LiteLLMis a gateway library providing access to a number of large language models(LLMs); it is popular and widely used. On March24, the word went outthat the version of LiteLLM found in the PythonPackage Index (PyPI) repository had beencompromised with information-stealing malware and downloaded thousands oftimes, sparking concern across the net. This may look like just anothersupply-chain attack - and it is - but the way it came about reveals justhow many weak links there are in the software supply chains that we alldepend on.
Greg Kroah-Hartman has announced the release of the 6.12.79 stable kernel. This releaseonly reverts a patchthat caused a regression on the LoongArch platform; users whocould not build 6.12.78 on LoongArch need to upgrade.
Toma Hrka has announcedthat the Forgejo-based Fedora Forge is now afully operational collaborative-development platform; it is ready foruse by the larger Fedora community, which means the homegrown Pagure platform's days are numbered:
A number of projects have been struggling with the question of whichsubmissions created by large language models (LLMs), if any, should beaccepted into their code base. This discussion has been further muddied byefforts to use LLM-driven reimplemention as a way to remove copyleftrestrictions from a body of existing code, as recently happened with the Python chardet module. Inthis context, an attempt to introduce an LLM-generated implementation ofthe Linux ext4 filesystem into OpenBSD was always going to create somefireworks, but that project has its own, clearly defined reasons forlooking askance at such submissions.
The keynote for Sun Security Con2026 (SunSecCon) was given by Farzan Karimi on how incident handlingcan go awry because of a lack of collaboration between the "goodguys"-which stands in contrast to how attackers collaboratively operate.He provided some "war stories" where security incident handling hadbenefited from collaboration and others where it was hampered by its lack.SunSecCon was held in conjunction with SCALE 23x in Pasadenain early March.
The Tor Blog has an interesting articleabout the non-technical side of setting up a Tor Relay. It documents how acomputer science student at National Taiwan Normal University worked with theuniversity system to set up a relay and provides a template for futureattempts:
The kernel's direct map provides code running in kernel mode with directaccess to all physical memory installed in the system - on 64-bit systems,at least. It obviously makes life easier for kernel developers, but thedirect map also brings some problems of its own, most of which aresecurity-related. Interest in removing at least some pages from the directmap has been simmering for years; a couple of patch sets under discussion show some use cases for memory that has been removed from thedirect map, and how such memory might be efficiently managed.
Greg Kroah-Hartman has announced the release of the 6.19.10, 6.18.20, 6.12.78, 6.6.130, and6.1.167 stable kernels. Each contains importantfixes throughout the tree. Users are advised to upgrade.
Version149.0 of the Firefox web browser has been released. Notablefeatures in this release include a new split-view feature for viewingtwo web pages side-by-side, a built-inVPN for browser traffic only, and more.
PHP's licensing has been a source of confusion for some time. The project is,currently, using two licenses that cover different parts of the code base: PHP v3.01 for thebulk of the code and Zend v2.0 for codein the Zend directory. Much has changedsince the project settled on those licenses in 2006, and the need for customlicensing seems to have passed. An effort to simplify PHP's licensing, led byBen Ramsey, is underway; if successful, the existing licenses will be deprecatedand replaced by the BSDthree-clause license. The PHP community is now voting on the licenseupdate RFC through April4, 2026.
This issuereport describes a credential-stealing attack buried within LiteLLM1.82.8 in the PyPI repository. It collects and exfiltrates a wide varietyof information, including SSH keys, credentials for a number of cloudservices, crypto wallets, and so on. Anybody who has installed thispackage has likely been compromised and needs to respond accordingly.Update: see thisfuturesearch article for some more information. "The releasecontains a malicious .pth file (litellm_init.pth) that executesautomatically on every Python process startup when litellm is installed inthe environment."
BPF programs can run in both sleepable and non-sleepable (atomic) contexts.Currently, sleepable BPF programs are not allowed to enter an atomic context.Puranjay Mohan has anew patch set that changes that. The patch set would let BPF programs calledin sleepable contexts temporarily acquire locks that cause the programs totransition to an atomic context. BPF maintainer AlexeiStarovoitov objected to parts of the implementation, however, so acceptance ofthe patch depends on whether Mohan is willing and able to straighten it out.
Linus has released 7.0-rc5 for testing."It looks like things are starting to calm down - rc5 is smaller thanthe previous rc's this merge window, although it still tracks a bit largerthan rc5s historically do."
Version 0.15.0 of the b4 patch-management tool is out. Highlights in thisrelease include the b4 review workflow manager for maintainers(covered briefly in this article), b4dig, which can find the original mailing-list submission behind acommit, three-way-merge support in b4 shazam, and more. See the releasenotes for details.
Version19 of the Agama installer for openSUSE and SUSE has beenreleased. This release includes major changes in Agama's architecturaldesign, organization of the web interface, and more.
Members of the Manjaro Linux distribution's community have publisheda "Manjaro2.0Manifesto"that contains a list of complaints and a demand to restructure the project to providea clear separation between the community and Manjaro as a company. The manifestoasserts that the project's leadership is not acting in the best interests of thecommunity, which has caused developers to leave and innovation to stagnate. Italso demands a handover of the Manjaro trademark and other assets to ato-be-formed nonprofit association. The responses on the Manjaro forum showed widespread supportfor the manifesto; Philip Muller, project lead and CEO of the Manjarocompany, largely stayed out of the discussion. However, he surfacedon March19 to say he was "open to serious discussions", but onlyafter a nonprofit had actually been set up.
Ars Technica describesthe ritual that will be required before a future Android device willdeign to install apps from somewhere other than the Play Store. It is notfor the impatient.
Greg Kroah-Hartman has announced the release of the 6.19.9 and 6.18.19 stable kernels. As usual, eachhas important fixes throughout the tree; users are advised toupgrade.
Version1.7.0 ("Daffodil") of the Radicle peer-to-peer, local-first codecollaboration stack has been released. Some of the changes in thisrelease include improved I/O usage, the ability to block nodes at theconnection level, and clearer errors for radidupdates. See the release notes for a full list of changes and bugfixes.
The kernel project has a unique approach to tooling that avoids manycommonly used development systems that do not fit the community's scale andways of working. Another way of looking at the situation is that the kernelproject has often under-invested in tooling, and sometimes seems bent ondoing things the hard way. In recent times, though, the amount of effortthat has gone into development tools for the kernel has increased, withsome interesting results. Recent developments in this area include theSashiko code-review system, a patch-review manager built into b4, and a newattempt at a framework for the specification and verification of kernelAPIs.
Cindy Cohn is the executive director of the Electronic Frontier Foundation (EFF) andshe gave the Saturday morning keynote at SCALE 23x in Pasadenaabout some of the work she and others have done to help protect onlinerights, especially digital privacy. The talk recounted some of the historyof the court cases that the organization has brought over the years to tryto dial back privacy invasions. One underlying theme was therole that attendees can play in protecting our rights, hearkening back toearlier efforts by the technical community.
Version 4.24.0 of the Samba SMB filesystem implementation has beenreleased. There are a number of significant changes, including auditsupport for authentication information, remote password management, anumber of Kerberos improvements, asynchronous-I/O rate limiting, and more.
GNOME50 has beenreleased. Notable changes in this release include enhancements to theOrca screen-reader application, interface and performance improvementsfor GNOME's file manager (Files), a "massive set of stability andperformance updates" for its display-handling technologies, andmuch more. See also the "What's newfor developers" article that covers changes of interest to GNOMEand GNOME application developers.
The kernel's asynchronousio_uring interface maintains two shared ring buffers:a submission queue for sending requests to the kernel, and a completion queuecontaining the results of those requests. Even with shared memory removing muchof the overhead of communicating with user space, there is still some overheadwhenever the kernel must switch to user space to give it the opportunity toprocess completion requests andqueue up any subsequent work items. Apatch set from Pavel Begunkov minimizes this overhead by lettingprogrammers extend the io_uring event loop with a BPF program that can enqueueadditional work in response to completion events. The patch set hasbeen in development for a long time, but hasfinally been accepted.
Roman Gushchin has announced theexistence of an LLM-driven patch-review system named Sashiko. It automatically creates reviewsfor all patches sent to the linux-kernel mailing list (and some others).
The Free Software Foundation Europe (FSFE) is reportingthat payment provider Nexi has terminated its contract without priornotice, which means that a number of FSFE supporters' recurringpayments have been halted:
Fedora Project Leader (FPL) Jef Spaleta has issueda "modest proposal" for a technology-innovation-lifecycle process that would provide more formal structure for adopting technologies inFedora. The idea is to spur innovation in the project without having an adverseimpact on stability or the release process. Spaleta's proposal issomewhat light on details, particularly as far as specific examples ofwhich projects would benefit; however, the reception so far is mostlypositive and some think that it could make Fedora more "competitive" by being theplace where open-source projects come to grow.
Version1.5 of Marknote, a Markdown-based note-management application, has been released. Notablefeatures in this release include Source Mode for working directly withMarkdown instead of the WYSIWYG interface, internal wiki-style linksfor notes, as well as simpler management of notes and notebooks.
Kurt Roeckx has announcedthat Debian has moved to the campaigning period for the 2026 DebianProject Leader (DPL) election. This year there is only one candidate,Sruthi Chandran, so Debian voters will have a choice between Chandranas DPL or "None of the above". The campaign period will run throughApril3, and the voting period will run from April4 toApril17. Chandran has not yet posted a platform for the 2026election, but her 2024platform is available on the Debian wiki.
After a year's worth of development since GIMP 3.0 was released,the team behind the open-source image editor has releasedGIMP 3.2. It comes as part of the planto release GIMP more frequently, rather than wait six or seven yearsbetween releases. The release comes with lots of new features (as canbe seen in more detail in the release notes),including 20 new brushes for the MyPaint Brush tool, an "overwrite" paintmode, new and upgraded file formats, UI improvements in a variety ofplaces, such as the on-canvas text editor, and new non-destructive layers:
A pull request that touches over 8,000 files, changing over 20,000 lines ofcode in the process, is (fortunately) not something that happens every day.It did happen at the end of the 7.0 merge window, though, when LinusTorvalds mergedan extensive set of changes by Kees Cook to the venerable kmalloc() API (andits users). As a result of that work, though, the kernel has a new set oftype-safe memory-allocation functions, with a last-minute bonus change tomake the API a little easier to use.
LWN.net