AlmaLinux OS Foundation released AlmaLinux OS 10.2, which includes an additional x86-64-v2 build for older hardware alongside the default x86-64-v3 baseline, and restores support for the 32-bit i686 architecture that Red Hat Enterprise Linux 10 removed entirely. The release reflects AlmaLinux's shift since 2023 from pursuing exact 1:1 compatibility with RHEL to ABI compatibility, after Red Hat restricted source code access that year. AlmaLinux OS 10 carries active support through 2030 and security support through 2035.
linux.slashdot.org
· 2026-11-07
Asahi Linux released its 7.3 progress update, reporting that its macaudio driver—requiring substantial ALSA core changes—is now ready for upstream kernel review after roughly 3,100 lines of driver and Devicetree code. The project also submitted its AVD video decode driver, about 13,000 lines, just three months after it appeared in the downstream tree, alongside initial Devicetrees for M4 Pro, Max and M5 chips.
asahilinux.org
· 2026-11-07
Security researchers disclosed CVE-2026-123158, a vulnerability in Alpine Linux's default OpenSSH setup that allows attackers to log into password-disabled or key-only accounts simply by sending an oversized password string. The bug stems from musl libc, the lightweight C library used by Alpine and other distros including Void Linux, OpenWrt, and Yocto-based embedded systems, meaning the exposure extends beyond Alpine itself. Alpine Linux and OpenSSH maintainers have issued patches, and users are urged to update and restart affected services immediately.
zdnet.com
· 2026-11-07
A vulnerability was found stemming from musl libc's crypt function returning the sentinel string "*" when a password is too long to hash, which collides with the Unix convention that "*" denotes a locked account. Because sshd hashes login attempts for locked accounts to prevent timing attacks, this collision allows an unauthenticated user to obtain a shell—potentially as root—on musl-based systems lacking PAM, such as the official Alpine AWS image.
sunshowers.io
· 2026-11-06
OpenAI has disclosed a new cybersecurity-focused AI model, reportedly called Aardvark, that identified potential exploitation methods for close to 1,000 known flaws in Linux systems. The model is designed to analyze code and systems to surface vulnerabilities that could be exploited by attackers.
it.slashdot.org
· 2026-11-06
A developer has published a multi-part series explaining how to write bare-metal applications for UEFI-based PCs using a Linux workstation. The series, aimed at experienced Linux developers with no prior UEFI knowledge, walks through compiling and linking code, creating bootable disk images, and handling files via the Simple File Protocol. The author notes the five parts are designed to be read sequentially, as each builds on the previous one.
kevinboone.me
· 2026-11-06
OpenAI announced GPT-6 Cyber, an AI model built for vulnerability research, which uncovered 81 unknown high-severity Firefox flaws and helped patch many of them. In Linux kernel testing, the model flagged 2,308 potential issues, reproduced 1,724 of them, and built privilege-escalation exploits for 948 distinct bugs. OpenAI rated the model's cybersecurity capability as 'Critical,' up from 'High' for its predecessor, and restricted access to select customers in its Daybreak Red program.
bleepingcomputer.com
· 2026-11-06
A Hacker News poster flagged that Ubuntu has not yet shipped a fix for CVE-2026-98432, a vulnerability rated 9.8 in severity, nearly a week after disclosure. Ubuntu's security tracker still lists the issue as 'work in progress,' though it now includes a suggested mitigation. The poster says they have been relying on manual mitigations in the meantime.
news.ycombinator.com
· 2026-11-06
OpenAI reportedly used an AI-based analysis tool to scan the Linux kernel and identified 948 possible local privilege escalation vulnerabilities, according to Phoronix founder Michael Larabel. The findings point to weaknesses that could let a local user gain elevated system access if left unaddressed.
phoronix.com
· 2026-11-06
Researchers disclosed a vulnerability stemming from how OpenSSH interacts with musl, the lightweight C library used by Alpine Linux, when PAM authentication is not used. On systems meeting specific conditions—including passwordless accounts marked with an asterisk in /etc/shadow and at least one SHA256/SHA512-hashed account—an attacker can log in via SSH without any password, succeeding on the first attempt with no retries needed.
arstechnica.com
· 2026-11-05
Enterprise Linux provider SUSE plans to lay off about one in ten of its roughly 2,000 employees, according to reporting from The Register. CEO Dirk-Peter van Leeuwen told staff in an email that AI's rapid advancement means the company's current organizational structure and cost base can no longer sustain its future growth.
zdnet.com
· 2026-11-03
Gregory Kurtzer, co-founder of CentOS and Rocky Linux, says he built a new operating system kernel called Ginux in 11 days, with an AI coding agent writing nearly all the code. Though written from scratch in Rust rather than forked from Linux, Ginux shares Linux's application binary interface and can already boot Rocky Linux 10. The kernel currently fully supports only 82 of Linux's 375 x86-64 system calls, with 245 partially working and 48 intentionally blocked.
techspot.com
· 2026-11-03
GoKawiil