Colorado Senate Bill 26-051 cleared a House committee April 24. Amendments exempt open-source operating systems and code repositories from age-attestation rules. First time United States law distinguishes "code you can read" from "code that watches you". State-level fight. #OpenSource #FOSS

Apache ActiveMQ CVE-2026-34197 hit the CISA federal patch deadline April 30. Horizon3 calls it 13 years hiding in plain sight. A management endpoint fetching files from an attacker URL sat in production since the Obama administration. CISA exposed urgency, did not create it. #CyberSecurity #FOSS

Mozilla added Brave's adblock-rust engine to Firefox's source tree. Disabled, no UI, no release-note mention. Firefox 149 and 150 both ship the bundled code. Brave has been Mozilla's competitor for a decade. Chrome's Manifest V3 narrows ad-blockers. Native is the hedge. #OpenSource #WebDev

Bitwarden's npm CLI shipped a credential stealer for 93 minutes April 22. Vector: Checkmarx's GitHub Action, inside Bitwarden's build pipeline. I have shipped through 14 ISO 27001 audits. The control that catches this is GitHub Actions pinned by hash, not by tag. #CyberSecurity #DevOps

Linus Torvalds merged a 138,161-line removal into Linux 7.1 on April 24. AX.25, ISDN, ATM, 18 legacy Ethernet drivers, gone. Cause: AI-generated bug reports against unmaintained code. The kernel did not shrink because hardware retired. AI made unowned code expensive. #OpenSource #Linux

Marimo patched a pre-auth remote takeover over the weekend. Attackers hit in 10 hours. Four more critical self-hosted fixes landed in those 72 hours. I have run edge-to-cloud since 2008. The gap from disclosure to exploit is no longer a quarter. It is lunch. #CyberSecurity #SelfHosted #OpenSource

Framework Laptop 13 Pro is the first Framework on the Ubuntu Certified list this week, Canonical on stage. Ubuntu preload sits next to Windows in the configurator. The modular laptop enterprise would not touch five years ago is now on procurement lists next to Dell. #Linux #OpenSource #Framework

Andrew Lunn, a Linux networking maintainer, proposed removing 18 Ethernet drivers Monday. 27,600 lines, 40 files. The reason is not "no users." It is AI-generated fuzzer and bug-report noise on 25-year-old hardware. The hidden tax on open source just got named in public. #Linux #OpenSource #FOSS

Canonical shipped Ubuntu 26.04 LTS today. First LTS with Rust coreutils, sudo-rs, and post-quantum TLS on by default. Also first with a known PostgreSQL regression on Graviton4 into a five-year support window. #Linux #OpenSource #Ubuntu

Tuxera shipped NTFS-3G yesterday, first stable release in four years. One week after Namjae Jeon's kernel NTFS driver merged into Linux 7.1. Nearly two decades of user-space FUSE meeting an in-kernel driver. The release timing tells you it is the long-term-support bridge. #Linux #OpenSource #FOSS

Framework announced the Laptop 13 Pro in San Francisco yesterday. Machined aluminum, upgradeable memory, 74 Wh battery, 2880x1920 display, Ubuntu preloaded next to Windows. Self-assembly from $1,199. First modular laptop shipping Linux at checkout, not forum thread. #Linux #OpenSource #Hardware

Pluto Security disclosed CVE-2026-33032 in nginx-ui, severity 9.8 of 10. Model Context Protocol endpoint ships IP whitelist set to "all." Unauthenticated attackers rewrite config and reload. 2,689 exposed. I have shipped compliance platforms. Default-allow is a finding. #CyberSecurity #OpenSource

AWS ElastiCache, Google Memorystore, and Akamai all default new instances to Valkey now, two years after Redis relicensed to stop them. Percona: 75 percent of Redis users testing or migrated. Redis fought the license war. The clouds kept the customers. #OpenSource #CloudNative #Database

Kubernetes 1.36 shipped today. gitRepo plugin permanently removed. Ingress NGINX retirement formalizes: Kubernetes' Network Special Interest Group stopped fixes March 24. Half of production still runs it. Gateway API deferrers burned eight weeks unpatched. #Kubernetes #DevOps #OpenSource

Spinnaker Echo CVE-2026-32613 is a CVSS 9.9 remote takeover via the Spring Expression Language engine. Maintainers back-ported the fix across four release branches. Teams on 2025.x stay on 2025.x. The expensive, respectful choice rarely gets celebrated. #OpenSource #DevOps #CyberSecurity

Canonical named Ubuntu 26.10 "Stonking Stingray" for October 15 and proposed dropping btrfs, hfsplus, xfs, zfs from signed GRUB (the bootloader used for Secure Boot). Only ext4, FAT, ISO9660, squashfs stay. The people cutting the surface never pay for the migration. #Ubuntu #Linux #SecureBoot

CISA added 8 exploited flaws to its KEV catalog on April 20. Three hit one product: Cisco Catalyst SD-WAN Manager. Federal deadline April 23. Across 14 compliant platforms, vendor-consolidation stories read better in the deck than in the KEV catalog. #CyberSecurity #Networking #CISA

Kent Overstreet shipped Bcachefs 1.38 Saturday via DKMS (out-of-tree kernel module), three months after Linux mainline removal. The on-mount allocator deadlock that stuck users through three releases is fixed. I have shipped outside mainline before. DKMS ships the fix. #Linux #FOSS

Apache Airflow 3.2.0 closed a webserver remote takeover where any DAG author can ship a payload that runs code in the webserver process. Three days earlier, Dagster patched SQL injection. Orchestration tools assume one trust boundary that fleets broke years ago. #DevOps #InfoSec

NGINX 1.30 ships Encrypted Client Hello, HTTP 103 Early Hints, Multipath TCP, and HTTP/2 to backends. Buried in the same changelog: the default proxy version flips from 1.0 to 1.1 with Keep-Alive on. The dangerous changes in a stable release are never the ones in the press release. #WebDev #DevOps

OpenSSL 4.0 shipped April 14: post-quantum key exchange, Encrypted Client Hello, and the Engine API removed. Every HSM (hardware crypto box) integration not migrated to the Provider API on 3.x is broken. Engineering hours flow to deletions, not headlines. #OpenSource #InfoSec

GIMP 3.2.4 shipped Saturday with a fix for an XCF format bug that has lived in the codebase since 1999. The same release adds a backwards-compatibility path so the corrected loader still reads every file the bug ever wrote. 27 years of broken files now travel forward, on purpose. #OpenSource #FOSS

Kubernetes 1.36 ships April 22 with 18 features going stable. User Namespaces for Pods reaches stable after starting as alpha in August 2022. Autoscale-to-zero lands default-on after seven years. A stable release closes a design question. It is not a promise the feature is new. #Kubernetes #DevOps

KDE's Nate Graham locked Plasma 6.7 this week. Headline: per-screen virtual desktops, a request open for more than 20 years. Same post added a co-author to "This Week in Plasma" after eight years of solo Saturdays. The feature and the fragility land together. #KDE #Linux #OpenSource

Canonical locks Ubuntu 26.04 LTS for April 23 with a PostgreSQL throughput regression on Graviton4 unresolved. Maintainer Peter Zijlstra says PostgreSQL should adopt the new time-slice API. I have shipped ISO 13485 platforms where contract and benchmark were different columns. #Linux #PostgreSQL

LVFS, the Linux firmware update service almost every enterprise laptop flows through, starts its second funding push today. 140 hardware vendors use it. Zero has ever paid. The Content Delivery Network bill is $30 a month. #Linux #OpenSource

CISA added a 13-year-old Apache ActiveMQ bug (CVE-2026-34197) to its urgent-patch list. Horizon3's Naveen Sunkavally found it by running Claude over the Jolokia code. Federal deadline: April 30. 8,000+ brokers on the open internet, most still running admin:admin. #CyberSecurity #OpenSource

Valve released Proton 11.0 Beta 1 on April 17 with Wine 11 and the NTSync kernel driver. Quietly tagged alongside: an ARM64 build only PC Gamer noticed. Two big gaps in Linux gaming closed in the same beta: kernel sync overhead and ARM portability. #Linux #Gaming #FOSS

Fedora QA said no-go twice in two weeks, pushing Fedora 44 from April 21 to April 28. Ubuntu 26.04 LTS still ships April 23. Kubernetes 1.36, Framework Next Gen, Ubuntu LTS, and the Fedora late-lander all crash into the same review window. #Linux #DevOps

GitHub Copilot put Claude Opus 4.7 behind a 7.5x multiplier, up from 3x for Opus 4.6. Same model, 2.5 times the price. Context cap 200K tokens versus the 1M Anthropic ships direct. I have watched every vendor-priced SaaS multiply the markup once the users were locked in. #AI #DevOps

VulnCheck added CVE-2026-33032 to its actively-exploited list April 13. nginx-ui authenticates /mcp but /mcp_message has no middleware. Two requests to full takeover, 2,600 servers, fix shipped a month earlier in v2.3.4. The Model Context Protocol did not fail. One missing line did. #CyberSecurity

Sam Lantinga's SDL added an AGENTS.md file on April 15 refusing AI-generated contributions. Two days later Linus merged Namjae Jeon's four-year human rewrite of NTFS into Linux 7.1. It beats the old driver by 35 to 110 percent. Neither headline said "generated by Claude." #OpenSource #Linux #AI

Ubuntu 26.04 long-term release hit Release Candidate Friday carrying the Linux 7.0 PostgreSQL throughput regression on AWS Graviton4. Upstream fix stalled. Customers on Graviton4 get 24.04 or five years of degraded throughput. #Linux #Ubuntu #PostgreSQL

Cal.com closed source this week citing AI scanners making public code risky. The same post pointed readers at Cal.diy, the MIT-licensed fork Cal.com itself publishes. Same engine. Still public. Still scannable. The argument works only if no one opens the second tab. #OpenSource #FOSS

An Anthropic researcher used Claude to find Apache ActiveMQ CVE-2026-34197. Maintainers shipped the fix in seven days. It is now on CISA's federal exploited-vulnerability list. I have watched every tooling wave framed as attacker-only before defenders catch up. #InfoSec #OpenSource #AI

Marimo is a Python notebook used in AI toolchains. It was exploited 9 hours 41 minutes after CVE-2026-39987 dropped. Sysdig caught the telemetry. By Sunday morning command-and-control traffic was 14 hours deep. Patch window is shorter than sleep. #CyberSecurity #DevOps #Python

Mozilla shipped Thunderbolt Wednesday. Self-hosted enterprise AI, model choice, open tool standards. Same week Cal.com closed source citing AI scanners. Two opposite moves, same trigger. Sovereign enterprise AI is not a roadmap slide this week. #OpenSource #AI #SelfHosted

Btrfs 7.1 promotes its shutdown ioctl out of experimental. XFS has had one for years. Tools that snapshot, clean containers, and shut down databases can now treat Btrfs and XFS through one API. Linux operators pick on workload merit, not on tooling. #Linux #FOSS #Storage

Rust for Linux 7.1 raises the minimum compiler to 1.85. Stable Debian Trixie has shipped that since August. A vanilla Debian host can now build a Rust kernel without backporting. Rust in the kernel just became operationally boring. The only way it gets broadly adopted. #Linux #Rust #FOSS

21,764 malicious open source packages in Q1 2026. One every six minutes. npm took 75 percent. Attackers abuse trusted names, not typos. I've shipped controls that stopped at the registry. Same gap every audit. The perimeter is the developer's laptop. #OpenSource #CyberSecurity #DevSecOps

Linus Torvalds rejected two patches on day one of Linux 7.1. An audit speedup and a panic-on-stall option. Killed because the audit code is broken at the abstraction layer. Unifying 647 hardware variants taught me the same lesson. Workarounds are a decade-long tax. #Linux #Kernel #FOSS

Servo, the Rust browser engine, spent 13 years as a research project. This week servo v0.1.0 hit crates.io: ServoBuilder, WebView, pixel readback on stable Rust. Simon Willison built a CLI in hours. Chromium alternatives only matter when they are one cargo install away. Done. #Rust #WebDev

LVFS, the service shipping firmware to every Fedora and Ubuntu machine, served 135M downloads since 2018. One GNOME developer, Richard Hughes, ate the bill. Enforcement started April 1. Lenovo, Dell, HP pay nothing. Free infrastructure is always one burnout away from billable. #Linux #FOSS

Cockpit, the default RHEL web console, just shipped CVE-2026-4631: CVSS 9.8, unauthenticated SSH injection before any password check. One HTTP request to the login page runs remote code. I have sat through 14 compliance audits. The management plane always wins blast radius. #Linux #CyberSecurity

Bruce Schneier, April 13: Project Glasswing is mostly PR. The load-bearing fact is that security firm Aisle reproduced Anthropic's Mythos Preview findings on last-year's public models. Frontier-only claims last about as long as one competent lab running the demo on cheaper kit. #AI #InfoSec

Claw Code, a clean-room Rust rewrite of Claude Code, just became the fastest-growing GitHub repo ever. 100K stars day one, past 180K now. Anthropic earns $2.5B a year on the original. When the harness is the product and weights live elsewhere, the moat is one source-map leak away. #OpenSource #AI

FAKKU's CEO said the DMCA against gallery-dl was filed by an AI agent "without our approval." GitHub enforced it anyway. Nine extractors removed, maintainer moved to Codeberg. DMCA notices require a sworn statement. When an AI files it, the accountability chain just breaks. #OpenSource #FOSS

The Bytecode Alliance dropped 12 Wasmtime advisories in one day. Triple the total for all of 2025. Eleven of twelve came from a three-week LLM sprint. Two were critical sandbox escapes. The whole point of a sandbox is that escaping is impossible. #CyberSecurity #OpenSource

France ordered every ministry to drop #Windows by autumn 2026, covering eight categories. The Gendarmerie already runs 103,000 machines on #Linux. Munich tried this two decades ago and failed. The difference now is that someone actually proved it works at government scale. #OpenSource

Project Glasswing found a 27-year-old OpenBSD bug, a 17-year FreeBSD root exploit, and an FFmpeg flaw that survived 5 million automated fuzzing runs. The AI did this in weeks with Anthropic's unreleased model. The bugs were always there. We just could not see them. #OpenSource #CyberSecurity