<p><strong>TLDR:</strong> NixOS 26.05 landed with 20,442 new packages and systemd-based initrd now on by default. A critical RCE in Gogs remains unpatched with a public exploit module now available, putting self-hosted Git servers at real risk. IBM and Red Hat announced Project Lightwell, a $5 billion initiative to backport security fixes into enterprise open source supply chains. The week also brought a wave of AI policy decisions across FOSS projects, from Flathub banning LLM-generated code to QEMU allowing it in limited areas.</p>
<hr>
<h2>Gogs RCE unpatched after two months, public exploit now available</h2>
<p>Any authenticated user on a default Gogs instance can execute arbitrary code on the server by crafting a branch name that gets passed unsanitized to git rebase during a merge. Because Gogs ships with open registration enabled by default, an attacker needs no pre-existing account. Rapid7 disclosed the flaw publicly after the sole maintainer failed to respond since March 17. A Metasploit module is now available, meaning the bar for exploitation is low. There is still no patch and no timeline for one. If you’re running Gogs for anything sensitive, restrict network access and disable open registration — neither fixes the underlying bug, but they reduce the attack surface. This is a familiar story: widely adopted infrastructure maintained by a single volunteer with no security SLA. <a href="https://app.daily.dev/feed-by-ids?id=BXvy1HZH2&amp;id=l1JSdVuT4&amp;id=v3GxOYLqb" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>IBM and Red Hat launch Project Lightwell, a $5 billion open source security clearinghouse</h2>
<p>The initiative deploys over 20,000 engineers alongside AI-assisted triage tools to backport validated security patches directly into enterprise software supply chains — working from dependency manifests like pom.xml rather than requiring source code access. It launches with Java/Maven support and will expand to PyPI, npm, and Go. Fixes are contributed back upstream. Early adopters include Bank of America, Goldman Sachs, JPMorgan Chase, and Visa. The stated motivation is that frontier AI models are accelerating the pace at which attackers find and exploit vulnerabilities faster than the current patch cycle can keep up. Commercial subscription launches within 30 days. <a href="https://app.daily.dev/posts/HD6PN5yrW" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>NixOS 26.05 released with 20,442 new packages and systemd initrd by default</h2>
<p>NixOS 26.05 “Yarara” shipped with contributions from 2,842 developers across 59,703 commits. The headline architectural change is that stage-one initrd now uses systemd by default instead of the previous scripted implementation. GNOME 50 and GCC 15 are included. The release adds 85 new modules and 1,547 new configuration options, while removing 17,532 outdated packages. Security updates run through December 31, 2026; the previous 25.11 reaches end-of-life June 30. Separately, Garnix, a hosted CI service for Nix projects, is shutting down July 15 and open-sourcing its codebase. <a href="https://app.daily.dev/feed-by-ids?id=qCmIJRgGW&amp;id=EUvO1kuwH&amp;id=UOB1CZRhf" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Flathub bans LLM-generated code, QEMU allows it in limited areas, and the AI contribution debate sharpens</h2>
<p>Flathub banned LLM-generated code from new submissions after a surge of rude, entitled submitters pushing AI-generated apps with minimal effort — a decision the maintainer describes as driven more by behavior than technical concerns. GNOME Circle updated its policy similarly: AI use isn’t banned outright, but developers must be able to explain their submitted code, and signs of slop get rejected. QEMU went the other direction, allowing AI assistance for tests, documentation, mechanical changes, and small bug fixes, while keeping core code off-limits without prior maintainer agreement. Linus Torvalds, speaking at Open Source Summit, pushed back on “99% of code is AI” claims and flagged a roughly 20% increase in kernel submissions tied to AI use as a maintainer burden. SQLite went further still, adding an <a href="http://AGENTS.md" target="_blank" rel="noopener nofollow">AGENTS.md</a> explicitly rejecting agentic contributions. <a href="https://app.daily.dev/feed-by-ids?id=JI80hYH4U&amp;id=d0Vhmytfe&amp;id=jTKFUXHPh&amp;id=6sP4vnGnN&amp;id=fAioh3cWv&amp;id=Oupb9F5aS&amp;id=acGaTVW21" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Gitea CVE-2026-27771: private container images exposed to unauthenticated attackers for four years:</strong> All Gitea versions before 1.26.2 and the Forgejo fork allow unauthenticated Docker/OCI pulls of private container images; an estimated 31,750 internet-facing instances are affected and users should upgrade immediately or set REQUIRE_SIGNIN_VIEW=true as a temporary workaround. <a href="https://app.daily.dev/posts/lMl2KM7l0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CIFSwitch Linux LPE: 19-year-old CIFS kernel bug gives root on default configs:</strong> A local privilege escalation introduced in 2007 lets unprivileged users forge CIFS spnego key requests, abuse the root-privileged cifs.upcall helper, and load a malicious NSS module to achieve root; confirmed vulnerable distributions include Linux Mint 21.3/22.3, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali Linux, and SLES 15 SP7, with a public PoC already available. <a href="https://app.daily.dev/posts/nGg7P0Mqb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Valkey 9.1 hits 2.1M RPS, adds hybrid search and per-database ACLs:</strong> The Redis fork ships up to 10% per-key memory reduction, a hybrid search module combining full-text, numeric, tag, and vector similarity search, per-database ACL granularity, and Lua scripting moved to a loadable module to reduce attack surface. <a href="https://app.daily.dev/feed-by-ids?id=Km42Yss22&amp;id=V0xbGn1LP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Btrfs DIO write parallelism fix in Linux 7.2 yields ~59% throughput improvement:</strong> A one-line patch restores Direct I/O write parallelism accidentally broken in 2023 during the mount API migration, recovering throughput from 826 MB/s to roughly 1,311 MB/s on tested hardware. <a href="https://app.daily.dev/posts/QSFimmUkY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AMD Vivado paywalls Linux support starting with 2026.1 release:</strong> The free Basic tier becomes Windows-only; Linux access requires the Core tier at $1,200–$1,800 per year, with AMD suggesting free users stay on 2025.2 until it loses support after 2026.3 ships. <a href="https://app.daily.dev/posts/VFargC4Qo" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Linux distro releases, open source project news, and FOSS community updates.

Open Source Digest

NixOS 26.05 "Yarara" released with 20,442 new packages, systemd-based initrd now default, GNOME 50, GCC 15, and contributions from 2,842 developers. A critical RCE in Gogs remains unpatched two months after disclosure, with a public Metasploit module now available — authenticated users on default installs can execute arbitrary code via unsanitized branch names. IBM and Red Hat launched Project Lightwell, a $5 billion initiative deploying 20,000+ engineers and AI triage tools to backport security patches into enterprise supply chains, starting with Java/Maven. The FOSS community is divided on AI-generated code: Flathub banned it outright, GNOME Circle requires contributors to explain their code, QEMU allows it in limited areas, and SQLite added an AGENTS.md rejecting agentic contributions. Also notable: Gitea CVE exposing private container images to unauthenticated access, a 19-year-old CIFS kernel LPE with public PoC, Valkey 9.1 hitting 2.1M RPS with hybrid search, and AMD paywalling Linux support in Vivado.

NixOS 26.05 ships, Gogs RCE stays unpatched after two months