MOTD: message of the day
Message of the day. Every day, whether the industry deserves it or not.
TCP MD5 for BGP authentication is thirty years old. TCP-AO is the replacement. Nobody has migrated.
RFC 5925 (TCP Authentication Option) has been in the Linux kernel since 6.7 and is supported by FRR, BIRD, and OpenBGPD. The RFC 2385 TCP MD5 Signature hack has been authenticating BGP sessions since 1996. Two years after the kernel got a working alternative, most operators are still on the old thing.
An ARM engineer let an AI generate hideous code and found a 70% speedup in the Linux kernel build
Lorenzo Stoakes at ARM used an LLM to profile the Linux kernel build system. The generated code was, by his own description, hideous. The bottlenecks it surfaced were real. Patches targeting Linux 7.4 cut allmodconfig build times by 36% and incremental builds by 70%.
Ubuntu 26.10 finishes what 26.04 started: GNU coreutils is now opt-in
cp, mv, and rm were the last GNU holdouts on Ubuntu. Ubuntu 26.10 ships uutils at 100%, making GNU coreutils optional for the first time on a major distro. An independent audit of uutils found 113 issues and 41 CVEs. Nearly all were fixed before the code landed.
Two years after PKfail, most affected hardware is still booting on a compromised Secure Boot key
In July 2024, Binarly found AMI's development Platform Key in production UEFI firmware across hundreds of devices. The private key is publicly accessible. Secure Boot's trust hierarchy has a root, and on the affected systems, it is cracked open.
cups-browsed held UDP 631 open to the world. Two years after the CVEs, the architecture finally changed.
CVE-2024-47176 let a crafted UDP packet steer cups-browsed into fetching attacker-controlled IPP data and executing arbitrary commands. The patches came fast. The architectural fixes, dropping PPD files and splitting the discovery daemon out of the core, landed in CUPS 3.x.
bcachefs has been in the kernel for three years. Is it your production filesystem yet?
Kent Overstreet's B-tree copy-on-write filesystem merged into Linux 6.7 in January 2024. Three kernel years of real distributions, real upgrades, real user reports. Here is an honest accounting of where it stands.
DNSSEC validates about 38% of the internet. Here's why the other 62% hasn't moved.
DNSSEC has been production-ready since 2005 and the root zone has been signed since 2010. Two-thirds of DNS queries still aren't validated. The protocol is not the problem.
FreeBSD 14.5 ships: forty-three advisories patched, inotify in base
FreeBSD 14.5-RELEASE landed September 8. The security backlog is real and addressed. SA-26:08 is the advisory that should drive upgrades, not the inotify headline.
CRA day one: the portal is up, the clock is running
The EU Cyber Resilience Act's vulnerability reporting requirements went live this morning. ENISA's Single Reporting Platform opened the same hour. Rod checks in on the first twelve hours.
Eighteen years of wrong arithmetic in fragment reassembly: CVE-2026-80590
An undersized socket buffer in __ip6_append_data() since Linux 2.6.27 lets an unprivileged container process corrupt the host kernel and get root. Public PoC is out. Eight stable kernels have the fix.
Linux 7.2.4, 6.18.50, 6.12.109: SMACK had a use-after-free
Three stable kernels dropped September 7 with roughly 1,650 commits. UAF fixes concentrated in MediaTek's mt76 Wi-Fi 7 driver and SMACK, a Linux Security Module, which is a sentence worth sitting with.
FreeBSD 14.5 is out, EuroBSDCon starts tomorrow
FreeBSD 14.5-RELEASE dropped September 8 with a tty use-after-free fix via TIOCSCTTY ioctl, LLVM 21.1.8, OpenSSL 3.0.21, and XZ 5.8.3 in a year when people are still paying attention to XZ version numbers. EuroBSDCon opens in Brussels tomorrow.
The EU CRA reporting deadline is Thursday and the portal opens the same morning
On September 11, 2026, the EU Cyber Resilience Act's mandatory vulnerability reporting kicks in. Open source software stewards are included. The ENISA Single Reporting Platform they must file through also goes live that day. Rod has questions.
SplitSSHell: a comma in a cert principal has been root in OpenSSH since 2011
CVE-2026-35414 put a 15-year-old logic bug in OpenSSH's certificate principal matching code back on the advisory circuit. If you run cert auth with authorized_keys cert-authority entries, you needed 10.3 in April. You probably didn't get it.
Seven kernel LTS releases drop with USB/IPsec fixes and AI in the commit log
Greg Kroah-Hartman pushed seven stable kernel releases this week covering 5.10.269 through 7.1.13, with use-after-free and IPsec out-of-bounds fixes backported across every active branch. The more interesting thing is what showed up in the commit metadata. Rod has thoughts about that.
OpenZFS 2.3 ships with BLAKE3 stable, faster dRAID rebuilds, and the native encryption fix it needed
OpenZFS 2.3.0 dropped this week. BLAKE3 checksums graduate from experimental to production-stable. dRAID distributed spare rebuild got measurably faster on spinning rust. And someone finally fixed the raw-send re-keying behavior that made native encryption a liability for off-site replication. Here is what changed and who it affects.
glibc 2.44 enables FORTIFY_SOURCE=3 by default and your struct tricks are now fatal
glibc 2.44 shipped last week with FORTIFY_SOURCE=3 on by default for GCC 12+ builds. It catches real buffer overflows. It also catches thirty years of creative struct-boundary memcpy that technically worked until it didn't. Here is what changed and what is now crashing.
FreeBSD 14.5-RC1 has a sound ioctl UAF and a hardware counter that ignored your credentials
FreeBSD 14.5-RC1 dropped August 29 with three security fixes. The use-after-free in SNDCTL_DSP_SYNCSTART is local privilege escalation. The HWPMC credential-transition bug is subtler and more interesting. Here is what they fixed and why the HWPMC one matters more than it sounds.
Linux 7.3-rc1 dropped Saturday. One thousand two hundred and fifty memory management patches.
Linus tagged 7.3-rc1 on August 30 after a two-week merge window. The highlights are 1,250 MM patches, a 21-commit NTFS3 security overhaul that also adds Alternative Data Streams, Rust on PowerPC, and a KVM restructure. Here is the triage.
The xz backdoor was 28 months ago. Here is what the supply chain security scoreboard actually reads.
March 2024 was supposed to be the wake-up call that fixed open source supply chain security. It is August 2026. Here is the honest accounting of what improved, what did not, and why the underlying economics that made the attack possible have not fundamentally changed.
ML-KEM has been the default SSH key exchange for two years. Enterprise IT just noticed.
OpenSSH 9.9 switched to post-quantum hybrid key exchange by default in October 2024. It is August 2026. Corporate jump boxes are timing out on handshakes and helpdesk queues are filling up. Here is what broke, why it broke, and the three commands that fix it.
You can write a CPU scheduler in BPF now. Most of you shouldn't. Some of you really should.
sched_ext merged into Linux 6.12 and it's in your distro's kernel if you're running anything recent. You can load a custom CPU scheduler as a BPF program at runtime, no kernel recompile, with a verifier and a watchdog that catches you when you screw it up. This is either the most irresponsible feature in recent kernel history or a genuinely correct architectural decision. I've landed on the latter.
Your vulnerability scanner quietly switched sources. The NVD isn't the primary feed anymore.
NVD fell behind on CVE enrichment in 2024 and the scanner toolchain migrated to OSV-format data without making a press release about it. If your patching workflow assumes NVD is still the single source of truth, it's running on an outdated mental model.
Your curl switched to HTTP/3 without asking. The packet trace shows encrypted UDP.
Most major distributions now ship curl compiled with HTTP/3 support. Alt-Svc negotiation upgrades HTTPS sessions to QUIC silently. The TCP debugging workflow you have is unchanged. The transport under it is not.
GCC 16 finished C23. Now wait for your distro to catch up.
GCC 16 shipped in April 2026 with a complete C23 implementation. The first C standard update worth caring about since C11 in 2011. typeof is a keyword now,
OpenSSL 3.0 EOL is two weeks out. If you pinned it, that's your problem now.
OpenSSL 3.0 LTS hits end-of-life on September 7, 2026. Five years of LTS support ends, security patches end, and every system still pinned to 3.0 starts the clock on unpatched CVEs. The upgrade path exists. Use it.
Six years of WireGuard in the Linux kernel. I was wrong to be skeptical.
WireGuard landed in Linux 5.6 in April 2020. Six years later, it's in every major OS, every cloud provider's toolbox, and the cryptography audit held. The 4,000-line kernel module that was supposed to be too opinionated turned out to be the right kind of opinionated.
iptables is a shim now. The shim has edge cases. Rewrite your rules.
Debian 13 Trixie completed the transition; iptables the binary now calls the nftables backend across every major Linux distro. The legacy xt_* kernel path still exists, but it's not the default and it's on the removal list. Twelve years after nftables landed, the ecosystem caught up.
OpenZFS 3.0 ships the RAIDZ expansion and the dedup engine they finally got right
OpenZFS 3.0 landed with RAIDZ expansion, a ground-up rewrite of the dedup engine, and block cloning. Three features that have been "coming soon" for most of the past decade are now in a release build. Worth looking at.
`sudo` wrote its last heap overflow in C. The Rust rewrite shipped.
sudo-rs is production-ready for most deployments. A setuid-root binary sitting at uid 0, accumulating privilege-escalation CVEs for four decades, is exactly the right target for a memory-safe rewrite. This one is hard to argue with.
`getrandom()` skips the kernel now. Took long enough.
Linux 6.11 shipped vDSO support for getrandom(). Every TLS handshake, UUID, and ephemeral key in your system is now getting random bytes from userspace without a syscall trap. The syscall was added in 2014. The optimization arrived a decade later. The implementation is correct. Both things are true.
Python dropped the GIL. Everything you marked 'thread-safe' lied.
Python's free-threaded build has been shipping for two release cycles now. The GIL is optional, increasingly the default build on major distros, and the ecosystem is discovering that "thread-safe" was a comment in a docstring, not a guarantee.
OpenSSH 10.0 drops DSA, CBC, and SHA-1 HMAC. About damn time.
OpenSSH 10.0 removes DSA keys, CBC cipher modes, and SHA-1 HMAC completely. Not deprecated with a warning. Removed. If your network gear or embedded systems are still negotiating any of these, your next maintenance window just got scheduled for you.
Go 1.27 ships. I was wrong about PGO. I'm still not wrong about iterators.
Go 1.27 lands today. Profile-guided optimization is showing 12-18% gains on real HTTP workloads with zero code changes. The iter package is now threaded through the entire standard library. Rod has updated some priors. Not all of them.
Linux 7.2 ships. The AI noise finally cleared the kernel's basement.
Linux 7.2 stable lands today with cache-aware scheduling, MGLRU gains that doubled MongoDB throughput in benchmarks, and a pile of driver removals nobody asked for, except the LLMs, who wouldn't stop filing bugs about them.
FreeBSD 16 evicted the last GPL tenant from base. The kernel has thoughts.
FreeBSD replaced dialog with bsddialog and declared its base system GPL-free. Then someone looked at the kernel. Thirty years of license hygiene, and it ends with "oops, still some in there."
The post-quantum key exchange already happened. You didn't notice. Good.
NIST finalized ML-KEM two years ago. OpenSSH shipped the hybrid key exchange into default KEX negotiation and most connections quietly upgraded. The certificate half of the post-quantum transition is not going to be that clean.
Your browser encrypted your DNS queries. It also decided who gets to read them.
DNS-over-HTTPS is a correct answer to a real problem, cleartext DNS has been leaking every hostname you visit since 1983. The way browsers deployed it, pointing users to Cloudflare and Google by default without explanation, is a different story. The encryption is real. The 'privacy' framing is doing a lot of work.
POSIX finally standardized .PHONY. Only took thirty years of everyone using it.
POSIX.1-2024 updated the make utility specification for the first time since the early 90s. The .PHONY target, which every make implementation has shipped for three decades without being in the spec, is now actually standard. The standardization story is a better parable about how POSIX works than anything the standards body would tell you itself.
Rust in the Linux kernel is not failing. I need to update my priors.
When Linus merged Rust support in 6.1, I gave it eighteen months before the borrow-checker arguments turned into flame wars and the whole experiment got ripped out. Real drivers are shipping. I was wrong about the trajectory.
Git's SHA-256 transition is finally not vaporware
Six years after the object-format flag landed in 2.29, SHA-256 repos are actually getting real hosting support. The design they ended up with, capability advertisement plus translation proxies, is genuinely clever. I hate that it took this long and I respect how they did it.
Python finally killed the GIL. The code that needed it left years ago.
Free-threaded CPython is stable in 3.14. After thirty years, import threading will do what you thought it did. RodHat on why the right fix took this long, who actually benefits, and why the Python you probably care about is either unaffected or slower.
The Redis fork everyone expected to die is what you should be running
In March 2024, Redis relicensed and AWS/Google forked it as Valkey under the Linux Foundation. I gave it 18 months before it turned into a governance zombie. Valkey 2.0 is shipping and I was wrong.
Your Alpine container runs musl, not glibc. Most of you have no idea what that means.
Alpine Linux is the most-pulled base image on Docker Hub. It ships musl libc, not glibc. Those are not interchangeable. RodHat on the quiet ABI divide that bites engineers every week and explains why half the "mysterious container crash" tickets exist.
pledge() turns 10. Linux still doesn't have anything half as clean.
OpenBSD's pledge(2) landed in 5.9 in 2016. Ten years later, Linux has Landlock (good) and seccomp-bpf (powerful and painful) and still nothing that lets a process sandbox itself in a single readable line. RodHat on why API simplicity is a security property.
systemd wants to replace sudo. I hate that they're not wrong about why.
run0 has been in systemd 256+ for over two years now and distros are starting to actually ship it. The scope creep argument is real. The security critique of sudo is also real. Holding both is annoying.
Unprivileged eBPF is getting locked out by default. It's five years overdue.
The Linux kernel project is landing a config change that makes kernel.unprivileged_bpf_disabled permanent by default. RodHat on why unprivileged BPF was always an attack surface in a trenchcoat, and why your bpftrace workflow is fine.
Observability priced per gigabyte means you log least when you need it most
Ingest-based pricing creates an incentive that fires exactly backwards: the incident that generates the most telemetry is the one that costs the most to observe. Teams respond by sampling, and then wonder why the postmortem has a gap in the middle.
The scary FreeBSD advisory this week isn't an RCE; it's a privilege check that slipped
FreeBSD-SA-26:53.ktrace is a regression in how ktrace is gated inside jails. No dramatic exploit, just an isolation boundary that quietly stopped meaning what you thought it meant.
"We'll just stay on LTS" stopped being a strategy when LTS became two years
Linux kernel long-term support dropped from six years to two, and the reason given was honest: almost nobody was testing the old branches. Stability was never a property of the version number. It was a property of somebody doing the work.
Your backups are fine and one account suspension deletes all of them
Three copies, two media, one offsite, and all three sitting under a single cloud identity that a fraud algorithm can disable at 4am with no appeal path. The rule was written when a copy meant a physical object somebody had to come and take.
FreeBSD 14.5 branch week is where your weird hardware gets a vote
FreeBSD 14.5 branches on August 7 and BETA1 starts the same day. RodHat explains why the useful part of a minor release is the short window when boring hardware reports can still change it.
If the AI does the junior work, where do senior engineers come from in 2036?
Every argument about AI and junior developers is about this quarter's headcount. The interesting question is a decade out: seniority is produced by doing unglamorous work under supervision, and that's exactly the work being automated first.
The diff nobody wrote and everybody approved
AI coding tools now generate a meaningful percentage of commits at shops that have adopted them. RodHat on what happens to institutional knowledge when the author of the diff has never been paged.
io_uring keeps producing the same class of CVE and it's time to call that structural
Another batch of privilege-escalation bugs in io_uring dropped this week. RodHat explains why the design keeps generating the same vuln class, and what to actually do about it in your container environments.
OpenSSH is finally done pretending your 2009 SSH config was acceptable
The OpenSSH project continues ripping out legacy cryptography: DSA keys gone, SHA-1 gone, post-quantum key exchange on by default. RodHat runs through what breaks and what you should have burned years ago anyway.
CISA wants a body count on your malloc() calls. They're not entirely wrong.
Federal agencies are now demanding memory-safety roadmaps from software vendors. RodHat runs through what the mandate gets right, what it gets delusional, and what happens when bureaucrats discover that C is load-bearing.
Another vendor decided the CLI was holding their users back. They're wrong.
A DevOps tooling vendor is sunsetting their CLI in favor of a "streamlined cloud dashboard experience." RodHat has opinions, and a survival guide.
A managed database vendor changed its pricing model again and called it 'simplification'
Another usage-based pricing overhaul from a managed database vendor, filed under simplification. RodHat translates.
Another wave of typosquat packages hit a major registry, and the fix everyone proposes still won't ship
The same typosquatting attack pattern, the same registry, the same 'we should really fix this' thread. RodHat's seen this loop enough times to name it.
A major serverless platform's cold-start times regressed 40% and nobody outside the forums noticed
Cold starts crept back up on a major FaaS platform this week. No announcement, no postmortem. RodHat noticed because he still checks.
Everything is a critical CVE now, which means nothing is
CVSS score inflation has gotten bad enough that a 9.8 barely raises RodHat's eyebrow anymore. That's the actual crisis.
Passkeys fix phishing and nobody wants to talk about account recovery
The cryptography is right, the phishing resistance is real, and I've stopped arguing about it. What hasn't been solved is what happens when the device is gone, and every deployed answer to that reintroduces the thing passkeys replaced.
Your AI pair programmer went down for four hours and so did half of Hacker News' composure
A major AI coding assistant had a multi-hour outage this week. RodHat has seen this movie before, just with a different lead actor.
Certificate lifetimes are collapsing to 47 days and your renewal process is a person
The CA/Browser Forum voted to phase TLS certificate validity down to under seven weeks by 2029. If your renewal runbook has a human in it, the schedule just became your problem, and that's the actual point of the change.
Egress fees were never about bandwidth
Charging nothing to put data in and a fortune to take it out is not a cost recovery model, it's a switching cost. Regulators worked that out, the fees started falling, and the interesting part is what got built to replace them.
Go count how many of your dependencies have one maintainer
Not the direct ones. The transitive ones. The libraries nobody chose, that nothing in your organisation has a name attached to, that a single unpaid person has been carrying since before your company existed.
The hard part of Rust in the kernel was never the Rust
The compiler works. The bindings work. The drivers work. What nearly stalled the whole effort was thirty years of maintainer culture meeting a rule about who has to maintain what, and that's a governance problem no language solves.
Your build pipeline depends on a stranger's free tier and you found out on a Tuesday
Registry rate limits turn CI into a coin flip, and the fix (a pull-through cache) has existed the entire time. Anonymous pulls from shared CI egress IPs were always going to hit a ceiling. That was predictable in 2020.
The xz backdoor was a social engineering attack and we responded with more scanners
Two years on, the thing that nearly shipped a compromised sshd into every distro on earth wasn't a code flaw. It was a burned-out maintainer, a patient stranger, and a pressure campaign. Almost every mitigation since has been aimed at the wrong layer.
Charging extra for SSO is charging extra for not getting breached
Single sign-on sits behind the enterprise tier at a suspicious number of vendors, at a markup that has nothing to do with what it costs to implement. It's not a feature. It's the control you need to offboard someone the day you fire them.