New research shows that squid lived all around the globe even before the
Cretaceous-Paleogene mass extinction event.
As usual, you can also use this squid post to talk about the security stories in
the news that I haven’t covered.
Blog moderation policy.
The GNOME Project has provided GNOME OS for some time; until now, the project
only provided a "Nightly" edition that was built from the latest commits and was
aimed solely at GNOME developers. Adrian Vovk has now announced the release of
GNOME OS Preview, which is intended for a non-developer audience:
> GNOME OS Preview is the current GNOME OS Nightly, but without the "nightly"
> aspect. Instead, it's built from the latest stable GNOME release (GNOME 51.1,
> at the time of writing). GNOME OS Preview lives in the same branches on GitLab
> as the stable org.gnome.Platform Flatpak runtimes.
>
> GNOME OS Preview is only a few weeks old, so it has only seen limited
> real-life testing so far. We therefore expect people will uncover some issues
> initially. That said, Preview is significantly more stable than Nightly, which
> dozens of people have been daily driving without major issues for over a year.
> Thus, we're feeling confident that Preview is going to be reliable enough for
> daily use by non-developer enthusiasts.
While Preview is meant for non-developers, it is not considered complete or
stable for the broader public. There are a number of features, listed in Vovk's
post, that need to be implemented before the project is ready to declare
GNOME OS "ready for prime time". Adventurous users, who might not mind having to
reinstall the OS once a stable version is declared, can download and start using
GNOME OS Preview today.
Self-referential structures that can be used without unsafe code have posed a
problem for Rust for years. There are many cases where a self-referential data
structure is the elegant algorithmic choice, but implementing it in accordance
with Rust's lifetime rules is all but impossible. At Kangrejos 2026, Gary Guo
presented a clever solution to the problem in the context of the kernel's
pin_init crate, which helps with the creation of immovable data structures,
typically for interoperability with C. Guo's changes could help remove most of
the unsafe code related to lifetimes in the Nova driver and, eventually, other
Rust components.
The NFS network filesystem protocol has a long history on Unix-like operating
systems (and beyond). NFS is still evolving, though, and implementations need to
keep up. At the 2026 Linux Plumbers Conference, NFS developer Jeff Layton gave
an overview of recent enhancements to the Linux implementation, along with some
hints for what will be coming in the near future.
The results from the 2026 election for members of the Linux Foundation Technical
Advisory Board (TAB) have been announced. Kees Cook, Dave Hansen, Miguel Ojeda,
and Shuah Khan have all been re-elected, and Laurent Pinchart will be joining
the board.
Security updates have been issued by AlmaLinux (ghostscript, grafana, hplip,
libsoup3, lrzsz, rpcbind, and wireshark), Debian (chromium, cifs-utils, expat,
gst-plugins-bad1.0, gst-plugins-good1.0, jpeg-xl, mutt, and spip), Mageia (gpsd,
libx11, and roundcubemail), Oracle (389-ds-base, compat-libtiff3,
environment-modules, ghostscript, grafana, gstreamer1-plugins-bad-free,
gstreamer1-plugins-base, gstreamer1-plugins-good, hplip, idm:DL1, kernel,
kernel-uek, libsoup, libsoup3, lrzsz, rpcbind, and wireshark), Red Hat (gd),
SUSE (alloy, amazon-ecs-init, bind, busybox, chromium, distribution,
govulncheck-vulndb, iperf, jackson-annotations, jackson-core, jackson-databind,
kernel, libXtst, mutt, openssh, php8, python313-python-multipart,
python313-python-rapidjson, python313-python3-saml, python313-pywbem,
python313-redis, python313-reportlab, python313-requests, python313-rope,
python313-rpyc, python313-rsa, qemu, swtpm, the Java stack, and wpa_supplicant),
and Ubuntu (golang-1.23, linux-azure, and rabbitmq-server).
This is a problem:
> Any open model whose weights have been edited can carry a backdoor, whether
> it’s a task-specific fine-tune, a merged adapter or an abliterated build. We
> have abliterated models in the title because it’s the most popular reason
> people download modified weights without verifying what’s inside. Abliteration
> is a cheap fine-tune that takes away a model’s ability to refuse. You find the
> direction in the weights that carries “no” and subtract it. The model then
> answers things a safety-tuned version would turn down. It began as a research
> trick and it’s now routine before people upload a model to Hugging Face, where
> you’ll find abliterated builds of most of the popular open weights: Qwen,
> Llama, even OpenAI’s gpt-oss...
Matthew Green has a new site that tries to estimate the number of
cryptanalyst-hours that have been spent analyzing different public-key
algorithms:
> Abstract: We estimate how much public cryptanalysis each public-key assumption
> has received, using the literature itself as the instrument. From roughly
> sixteen thousand candidate papers we classify cryptanalytic work on ECDLP,
> structured and plain lattices, syndrome decoding and their comparators, then
> convert papers into estimated research-allocation years through a person-level
> author map. These publication-based estimates may substantially overstate
> actual time spent. Lattices have overtaken elliptic curves in this cumulative
> measure only recently; we express that history as inference budgets under
> stated productivity assumptions. The study was conducted by AI models: Claude
> Fable 5.1 and Claude Opus 5.5 built the pipeline, ran the analysis and wrote
> this page, with contributions from GPT-6 Astra. Matthew Green set the
> questions, made the key methodological decisions and oversaw the work...
Since Android's inception, the kernels it has used have diverged significantly
from the mainline. While many of those differences have been resolved over time,
and the move to the generic kernel image has helped to bring Android closer,
current devices still carry a lot of out-of-tree changes. The preferred form for
such changes is by way of vendor hooks. At the 2026 Linux Plumbers Conference,
Todd Kjos ran a fast-paced session in the Android track to discuss vendor hooks
and how they are used.
As part of KDE's 30th anniversary celebration, the project has released The KDE
Documentary — A Story of Free Software Underdogs (YouTube video):
> The story starts in 1996, when Matthias Ettrich, a student at the University
> of Tübingen, posted to a Usenet group asking for programmers to help build a
> desktop for Linux. What followed became KDE, one of the largest free software
> communities in the world. KDE made Linux usable as a desktop for people who
> weren't system administrators, giving it a complete, consistent graphical
> environment at a time when there was none.
>
> The film covers the highs and lows of three decades of KDE: the Qt licensing
> fight and the rivalry with GNOME; the success of KHTML, the browser engine
> that became the basis of Apple's WebKit and Google's Chrome; and the
> contentious release of KDE 4 and the rebuild that followed.
Canonical has announced the release of Ubuntu 26.10 ("Stonking Stingray"):
> Ubuntu 26.10 advances enterprise security features, completes the rollout of
> the Rust-based uutils coreutils, and strengthens integrations for user
> authentication using Microsoft Entra ID.
>
> [...] Ubuntu 26.10 also ships with GNOME 51, bringing a smoother, more
> responsive desktop, better display handling, improved accessibility, and
> refinements across core applications. In addition, the Ubuntu App Center now
> provides a more consistent experience for managing snaps and debs.
See the release notes for a list of new features as well as incompatible changes
between 26.10 and prior Ubuntu releases.
Security updates have been issued by AlmaLinux (environment-modules,
flatpak-builder, kernel, kernel-rt, librabbitmq, libreoffice, libsoup,
mod_auth_openidc:2.3, nodejs:22, nodejs:24, OpenEXR, opentelemetry-collector,
pki-core:10.6, postgresql:12, python-tornado, python36:3.6, ruby:3.3, tftp, and
xorg-x11-server), Debian (buildstream, firefox-esr, mariadb, and sogo), Fedora
(exim, freerdp, python3-docs, and python3.14), Mageia (drakx-installer-images,
kernel, kmod-nvidia-current-wopengpu, kmod-virtualbox), Oracle (curl, emacs,
environment-modules, flatpak, flatpak-builder, gd, hplip, kbd, kernel,
librabbitmq, libreoffice, libxml2, microcode_ctl, mod_auth_openidc:2.3,
nodejs:22, OpenEXR, pcre2, perl-DBI, python-tornado, rsyslog, tftp, thunderbird,
and xorg-x11-server), Red Hat (compat-libtiff3, firefox, ghostscript, idm:DL1,
ipa, kernel, kernel-rt, libtiff, lrzsz, and mariadb-connector-c), Slackware
(libarchive), SUSE (amazon-cloudwatch-agent, bind, container-suseconnect,
containerd, glibc, google-osconfig-agent, helm, kernel, python312,
python313-oletools, python313-openpyxl, python313-orjson, python313-paramiko,
python313-pipreqs, python313-py, python313-pycryptodome,
python313-pycryptodomex, python313-pydrive2, python313-python-engineio,
webkit2gtk3, and xorg-x11-server), and Ubuntu (apache2, bind9, bluez, curl,
openssh, python-urllib3, and u-boot).