<p><strong>TLDR:</strong> Three local privilege escalation vulnerabilities — CopyFail, DirtyFrag, and Fragnesia — landed in quick succession, forcing emergency patches across every major distro. The Linux kernel added new documentation in 7.1-rc4 to manage the flood of AI-generated bug reports overwhelming the security mailing list. Meanwhile, a coordinated supply chain attack hit over 170 npm packages including TanStack and Mistral AI, and Bun quietly rewrote itself from Zig to Rust using Claude Code.</p>
<hr>
<h2>Three kernel privilege escalation bugs in a month</h2>
<p>CopyFail, DirtyFrag, and Fragnesia all dropped within weeks of each other, each allowing unprivileged local users to escalate to root. Fragnesia (CVE-2026-46300) targets the XFRM ESP-in-TCP subsystem and has a public proof-of-concept already circulating. The ssh-keysign-pwn bug — a separate ptrace race condition — lets unprivileged users read root-owned files including <code>/etc/shadow</code> and SSH host keys, and Linus Torvalds authored the fix personally. Patches are available across Linux 5.10 through 7.0; if you haven’t updated your kernel this week, do it now.</p>
<h2>Linux 7.1-rc4 adds guidance on AI-generated bug reports</h2>
<p>The kernel security mailing list is, in Linus’s words, “almost entirely unmanageable” — multiple researchers running the same AI tools are independently finding the same bugs and filing separate private reports. New documentation by Willy Tarreau in 7.1-rc4 addresses this directly: AI-assisted findings should go through public channels by default, since there’s no meaningful secrecy when dozens of people are running identical scanners. The irony is real — Greg Kroah-Hartman is himself using AI fuzzing tools he calls gkh_clanker_t1000 and gkh_clanker_2000, and they’ve produced two dozen fixes backported to stable releases.</p>
<h2>TanStack, Mistral AI, and 170+ npm packages hit by supply chain attack</h2>
<p>A coordinated attack on May 11 (tracked as “mini-shai-hulud”) compromised the entire TanStack router ecosystem (42 packages), all Mistral AI SDK packages on npm and PyPI, 65 UiPath packages, and OpenSearch. The payload harvests AWS IAM keys, GitHub tokens, HashiCorp Vault tokens, and npm publish tokens, then exfiltrates via the Session messenger network. A self-spreading mechanism commits poisoned IDE config files into victim repositories targeting Claude Code and VS Code users. Check your lockfiles for affected versions and rotate any credentials that were present in exposed environments.</p>
<h2>Bun rewrites itself in Rust, mostly via Claude Code</h2>
<p>Bun 1.3.14 is the last Zig-based release. The rewrite — 6,755 commits, over a million lines of new code — was done almost entirely by Claude Code after Anthropic acquired the project in late 2025. The binary shrinks 3-8 MB, benchmarks are neutral to slightly faster, and the borrow checker eliminates a class of use-after-free bugs that had cost the team significant debugging time. The legitimate concern: no human has read most of this codebase. Tests pass, but global invariants and subtle concurrency assumptions are the kind of thing that only surfaces when something breaks in production. Bun is now one of the larger real-world tests of whether AI-generated, minimally-reviewed code holds up over years.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>KDE gets €1.28M from Germany’s Sovereign Tech Fund</strong> to improve Plasma QA infrastructure, security architecture, and the KDE PIM suite across 2026 and 2027.</li>
<li><strong>GitHub Actions cache poisoning</strong> has compromised Angular, tj-actions, Cline, and TanStack over two years; the attack lets less-trusted PR workflows poison cache keys that privileged release workflows later restore. Replace <code>pull_request_target</code> with <code>pull_request</code> and disable caching in release workflows.</li>
<li><strong>Cemu Linux builds were compromised</strong> between May 6-12, with nearly 20,000 downloads of infected Ubuntu and AppImage binaries; Flatpak users were unaffected, and affected users should do a clean OS reinstall and rotate all credentials.</li>
<li><strong>node-ipc npm package was backdoored</strong> after attackers registered an expired domain to hijack a dormant maintainer’s email account; the malware collects credentials from 100+ sources and exfiltrates via DNS TXT queries.</li>
<li><strong>Canonical’s Redhound AI security agent</strong> found three CVSS 9.1 vulnerabilities in LXD in under a day, all of which had survived years of manual review.</li>
<li><strong>Bun’s Zig-to-Rust PR</strong> was automatically flagged by GitHub as “AI slop” and closed — a footnote that will age interestingly.</li>
<li><strong>Rocky Linux launched an optional security repository</strong> to ship critical patches faster than waiting for upstream RHEL, motivated directly by DirtyFrag and Fragnesia.</li>
<li><strong>A kernel kill switch proposal</strong> from Sasha Levin would let admins disable specific kernel functions by name at runtime without a reboot; Red Hat supports it, security researchers are worried admins will treat it as a substitute for patching.</li>
<li><strong>Marek Olšák</strong>, one of the most prolific AMD Linux GPU driver developers, left AMD to join Valve after 15+ years of Mesa contributions.</li>
<li><strong>Discord announced hardware-accelerated video encoding</strong> for Linux across Nvidia, AMD, and Intel GPUs, driven by the growing Steam Deck and Steam Machine audience.</li>
<li><strong>Fisker Ocean owners</strong> reverse-engineered their cars’ firmware after the company went bankrupt, publishing CAN bus DBC files and Home Assistant integrations to keep their vehicles functional.</li>
<li><strong>Zulip is becoming a nonprofit foundation</strong> after founder Tim Abbott joins Anthropic; the Zulip Foundation mirrors governance models used by Mozilla and Signal.</li>
<li><strong>OpenZFS 2.4.2</strong> adds Linux 7.0 kernel support with data integrity fixes.</li>
<li><strong>Debian 13.5 and 12.14</strong> both released this week with kernel security fixes and patches for privilege escalation issues in Bubblewrap and Cockpit.</li>
<li><strong>Turso shut down its $1,000 bug bounty program</strong> after being overwhelmed by AI-generated spam submissions; the asymmetry of seconds to generate versus hours to review made it unsustainable.</li>
<li><strong>CERN open-sourced its internal KiCad component libraries</strong>, covering parts used in particle accelerator projects, compatible with KiCad 9.x.</li>
<li><strong>Twilight Princess fan port Dusk</strong> brings the game natively to Windows, Linux, macOS, Steam Deck, iOS, and Android with uncapped frame rates and 4K texture pack support.</li>
</ul>


Linux distro releases, open source project news, and FOSS community updates.

Open Source Digest

Three Linux kernel local privilege escalation vulnerabilities (CopyFail, DirtyFrag, Fragnesia) dropped within weeks, requiring emergency patches across all major distros. Linux 7.1-rc4 added new documentation to handle AI-generated bug reports flooding the security mailing list. A coordinated supply chain attack compromised 170+ npm packages including TanStack and Mistral AI SDKs, harvesting cloud credentials and spreading via poisoned IDE configs. Bun rewrote itself from Zig to Rust using Claude Code in 6,755 commits, raising questions about AI-generated code at scale. Additional notable items include GitHub Actions cache poisoning, Cemu Linux binary compromise, KDE receiving €1.28M in funding, and Debian 13.5/12.14 security releases.

Linux kernel gets an AI-noise policy, three privilege escalation bugs hit in a month