A criticalvulnerability has been discovered in WordPress's get_page_template()function for page-template resolution that could allow remote-code execution(RCE) by an unauthenticated attacker, in some limited circumstances. The projecthas provided an update for the most recent branch of WordPress, as well asbackports of the fix for branches back to 4.7. See thevulnerability report for the conditions required for an RCE attack to be successful.The vulnerability alsoaffects the ClassicPress fork ofWordPress, though a security update has not been provided for that projectyet. LWN covered ClassicPress in2024. Users of either content-management system should update soon.
Pierre-Emmanuel Patry and Arthur Cohen gave a talk atRustConf2026 on thestatus of the Rust frontend for GCC (gccrs), with a particular eye toward thegoal ofcompiling the Linux kernel. Patry gave a follow-up talk for a morekernel-focused audience atKangrejos the next week, which Cohen could not attend. Thegccrs project ismaking good progress overall, but it will still be some time until the compileris usable.
The open-source consulting firm Igalia has put out anannouncement celebrating 25 years of working on upstream FOSS projectsfor its clients. The list of projects the company has worked on is rathereye-opening: WebKit, mobile-browser rendering (on Maemo, Moblin, MeeGo, andTizen), the Linux kernel (CPU and GPU scheduling), 3D graphics drivers, theOrca screen reader, GStreamer, and lots more. Beyond that, the company, which is aworker-owned cooperative, does its work in ways that benefit the communityas well as its clients:
Greg Kroah-Hartman has released the 7.2.7,6.18.53, and 6.12.111 stable kernels. As is usual these days, they arequite large; also no surprise is that they provide many important fixesthroughout the kernel tree. Users of those kernels are advised to update.
NetBSD has long had support forrunning Linux binaries via its kernel-level compat_linuxfeature, but test coverage for it was less complete than some mighthope. In order to provide better testing for compat_linux,Google Summer of Code (GSoC) participant Henrique Brito opted to workon enabling the Linux TestProject (LTP) test suite to compile and run on NetBSD. At EuroBSDCon2026, Brito'smentor, Stephen Borrill, provided a report on the project, and thestatus of LTP on NetBSD. The work has already resulted in some minorfixes, and a good list of additional problems to solve.
Linus Torvalds has released the 7.3-rc4kernel prepatch. It is, unsurprisingly at this point, large: "We all know the drill by now: 'it's big, yadda yadda'".
The Git source-code management system isat the core of development processes worldwide, so changes, especiallyincompatible changes, are of great interest to the developers involved.The Git 2.56 release, which can be expected around the end of September, iscurrently available in release-candidate form. Itis not the most earth-shaking of releases, but the one that follows, whichmight be the long-awaited Git 3.0, may well be.
The io_uringsubsystem is all about asynchronous execution; applications count on itto not block - unless explicitly requested to. Within io_uring, maintainingthe "never blocks" guarantee has sometimes been a challenge, given thatmany paths in the kernel were never designed for asynchronous execution.This problem has been worked around, but at a significant cost toperformance. Now, io_uring maintainer Jens Axboe has posted an RFC patch setwith a somewhat radical (and potentially scary) solution to the problem.
Version 51 of the GNOME desktopenvironment has been released. The list of changes includes a number ofperformance improvements, offline data and better transit information inthe Maps application, a new interface for the file previewer, and more.
At the 2026 edition of FOSSY, RomeoSolano gave a fast-paced, humorous presentation on what could have been arather boring topic: server encryption. There are a number of threats thatwe face in today's world, from criminals, government overreach, espionage,and more, that can be thwarted with encryption. But encrypting data on asystem that may live elsewhere, without any access to its keyboard at boottime, is rather more difficult than encrypting the disk of a laptop.Solano described the problems and gave a tour of some of the solutions inthe talk.
The scheduling of block I/O requests has longbeen a challenge for operating-system kernels. For many years, theperformance characteristics of rotating drives meant that puttingconsiderable resources into request ordering was worthwhile. In a worldwith fast, solid-state drives, scheduling is more concerned with enforcingfairness between competing users while being fast enough to keep up withdrives that can perform millions of I/Ooperations per second. The blk-iocost I/Ocontroller was designed for the solid-state world and generally performswell, but there is always a desire to do better. This patchseries from Tao Cui aims to make blk-iocost more flexible by enablingthe loading of a BPF program to make cost decisions.
Padraig Brady has announcedGNU Core Utilities (coreutils) version 9.12. "There have been 288 commits by16 people in the 21 weeks since 9.11". New features include an -Aoption for unamewhich labels all output, as well as adding awareness of the failfs and nullfs filesystem types to statand tail.There are many bug fixes in this release as well, including one for a bug "presentin 'the beginning'" that caused some utilities to fail when traversinghierarchies if files are being removed in parallel.
What is it like to be a Debian Project Leader (DPL), or a former one?According to Andreas Tille, who stepped down this year after two consecutiveterms as DPL, you'd have to be one to know. At the recent MiniDebConf in Winterthur,Switzerland, Tille spoke about what he learned while serving as DPL, some ofthe initiatives he led, mistakes that he made, and his thoughts on the general resolution (GR) on largelanguage model (LLM) usage in Debian.
Sean Whitton has announcedthat the original fix for an arbitrary code execution flaw in Emacs (CVE-2024-53920) wasincomplete. Bas Alberts discovered that viewing or editing untrusted files inmodes other than Emacs's Lisp mode can also result in arbitrary codeexecution.
Greg Kroah-Hartman has announced the 7.2.6,6.18.52, 6.12.110, 6.6.157, 6.1.188,5.15.221, 5.10.270 stable kernels.According toKroah-Hartman, this batch may set a record for the number of patches withmore than 9,000 in total between them. There are more than 1,800patches in 7.2.6 alone. Users of these kernels are, of course, advised toupgrade.
Just a reminder that prices for LWN subscriptions will increase afterSeptember15. Until then, the older rate still applies. See this article for details on this change.Thanks, yet again, to all of our subscribers for your support - that iswhat keeps LWN going.
The 7.3-rc3 kernel prepatch is out fortesting. Linus said: "Another fairly large rc release, and again onewith a bigger filesystem footprint that we usually see."
All of the videos from the EuroPython2026 conference, heldin Krakow, Poland from July13 through July19, are nowonline along with a recap ofthe event from conference organizers.
Kernel developers do a lot of kernel builds. Since the kernel is not asmall program, those builds can take a fair amount of time, even on a fastmachine. The kernel also has a complex build system; it is probably fairto say that few developers truly understand it, and fewer still are willingto try to improve it. Lorenzo Stoakes, armed with LLM-based assistance,decided to give it a try, though, and has managed to reduce the time ittakes to build a kernel - and not by a small amount.
Greg Kroah-Hartman has announced the release of the 7.2.5 and 6.18.51stable kernels. There are more than 550 patches in each with fixes throughoutthe tree; users are advised to upgrade.
The Forgejo software-forge project has announced therelease of versions 16.0.4and 15.0.8,which fixes two security vulnerabilities. One is a critical flaw that wouldallow remote-code execution (RCE):
PostgreSQL 19 was expected to be released in September, in keeping with the databaseproject's longstanding tradition of a major release every year. However,some late-breaking concerns about several of the features slated for inclusionhas some developers worried about the quality of the release. On August 25, PostgreSQLcontributor Robert Haas sentan email with the subject "scary patch contest" about several patchesthat have required an unusually large number of bug fixes leading up to therelease, which has raised questions about their readiness for a stablerelease. One of the patches has been reverted, but several are still under heavyrevision, and an extra beta release has been slotted in to allow for additionaltesting.
Version1.13 of the Julia programming languagehas been released. Highlights include faster precompilation of packages,improvements to Julia's REPL, and Juliaup,a graphical interface for the Julia version manager. A full list of changes canbe found in the releasenotes. LWN covered Julia1.12 in November 2025.
Joe Birr-Pixton has written a blog postreflecting on a decade of the Rustls TLS-library project and looking ahead tothe upcoming0.24 release and an eventual1.0 release.
Heiko Tietze has publisheda blog post summarizing the results of a recentsurvey about the use of LibreOffice's database application, Base. 455 peopleparticipated in the survey, including more than 330 who use Base on Linux, withuse cases ranging from maintaining records of personal media such as CDs or DVDsto use enterprise-resource planning (ERP) and finance. Of course, users had manyideas how to improve the application:
Typst is a system for typesetting documentsinto various formats: PDF, SVG, PNG, and, in progress, HTML. It is adept athandling technical material, and is often considered to be an eventual LaTeX replacement. We last lookedin on Typst a year ago, when it had reached version 0.13. A new version,0.15, was released inJune with lots of new features, including support for variable fonts,MathML, multiple bibliographies, and more. Typst is free, Apache-2.0-licensed software, programmed in Rust.
A function's return type is supposed to indicate the kind of data that itproduces. Rust's "never" type, which isdenoted by an exclamation mark ("!"), is the type the language uses to marka function that never returns and other places where a value can never occur. Fora long time, the never type was used internally by the compiler, but wasconsidered an unstable feature. OnAugust24, after more than two years of work,Rust-compiler-contributor "waffle" finally managed to stabilize the type. Ittook so long, in part, because it involved a small breakingchange to previous Rust editions, which the compiler maintainers needed toensure did not impact much real code.
Version 12 ofthe Jellyfin media-management system hasbeen released. Notable changes include databaseperformance improvements, anupgrade to FFmpeg8.1 for media transcoding, as well as betterhandling of book and comic media. See the release notes for the webclient and server for afull list of changes.
The European Laboratory for Particle Physics, usually just called CERN, is not only the birthplace ofthe World Wide Web, it is home to the Large HadronCollider (LHC), the world's largest and highest-energy particleaccelerator. As such, its computing environment is both truly unique and ofgreat interest to people outside of CERN who hope to find lessons applicable totheir own computing needs. The upcoming migration of some of CERN's systems fromCentOSLinux to Debian, which was the topic of a talk at the recent MiniDebConfWinterthur2026,is of particular interest.
Greg Kroah-Hartman has announced the release of the 7.2.4, 6.18.50,and 6.12.109 stable kernels. Each containsimportant fixes throughout the tree. Users are advised to upgrade.
The restartable sequences feature is one ofthe stranger corners of the kernel's user-space interface; it provides away for user space to carry out simple lockless operations and be informedif it is preempted over the course of an operation (and must, thus,restart). Work merged in the 6.19 release to improve the performance of restartablesequences broke the TCMalloc allocator,which was relying on an undocumented (and unintended) kernel behavior.Now, Olivier Dion is proposing anaddition to the restartable-sequences API that will bring TCMalloc backinto the fold; it does not make the restartable-sequences API any lessstrange, though.
Version2026.08 of the Buildroot embedded Linuxsystem builder has been released. Buildroot 2026.08 includes nearly 1,000changes from 100 contributors; some of the notable changes include support forLinux7.1.x, Binutils 2.46.1, GCC 16.2.0, glibc 2.44, as well as adding theM68K and IBM Power 10/11 architectures.
LWN.net