The Linux kernel, distributions and the wider open-source ecosystem.
CVE-2026-64564, an 18-year-old use-after-free in the Linux kernel's SCTP code found by Tencent's AI-assisted research pipeline, enables local privilege escalation and container escape — and Debian shipped a patch the same day it was disclosed.
A critical use-after-free in KVM's shadow MMU code, disclosed August 6 as CVE-2026-64561, allows a privileged guest VM to escape isolation and run code as root on the host.
The Linux kernel 7.2-rc6 prepatch release contains 537 non-merge commits, the largest RC6 by volume in years according to Linus Torvalds.
Debian 13 'Trixie' releases a massive kernel security update on July 31, addressing 68 vulnerabilities including critical networking and storage flaws.
Linux gaming's Steam share rebounded to 4.01% in July 2026 after dipping to 3.69% in June, with SteamOS Holo leading all Linux distros at over 22% of the Linux breakdown.
Arch Linux ships kernel 7.1 by default for the first time in its August 2026 monthly ISO, bundling fresh system libraries, updated desktop profiles, and a refreshed installer to validate upstream changes before they hit the rolling channels.
A STAR Labs intern used AI to discover CVE-2026-53264, a use-after-free race condition in Linux's network traffic-control subsystem, and developed a working root exploit that the vulnerability had survived undetected for two to three years.
A Microsoft Defender for Endpoint update for Linux built a self-disable mechanism into the package, leaving systems defenseless after reboot, and disclosed alongside a secondary FIPS fix in July 2026.
Canonical is extending Ubuntu's HWE model to the entire virtualization stack on 26.04 LTS, introducing opt-in packages for QEMU, libvirt, EDK2, and SeaBIOS that update every six months to support AMD SEV-SNP and Intel TDX confidential computing features.
A fifth Linux Kernel 7.2 release candidate dropped July 26, 2026 with networking drivers absorbing over a third of the patches due to conference delays, though Linus Torvalds reported no alarming issues in the patch set.
Nebula Security disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw in futex priority-inheritance code that grants unprivileged users root access and container escape.
Linus Torvalds declared Linux is not an anti-AI project and told critics they can fork or leave, drawing a line under LLM code review tools like Sashiko amid a shift from his previous skepticism toward AI-driven kernel tooling.
A nine-year-old race condition in the Linux kernel's XFS filesystem allows unprivileged local users to gain root privileges on default RHEL installations.
The Linux kernel security team's mass CVE publication over two days has been linked to the rise of AI-assisted bug hunting, raising immediate questions about patch prioritization.
Collabora and Valve published the first preview of Holo Core — a from-scratch AArch64 port of Arch Linux for the upcoming Steam Frame VR headset, with sources, binaries, and CI infrastructure built specifically for the project.
After more than two decades of patent encumbrance, the final MPEG-4 Part 2 patent — held by Siemens AG in Brazil — expired on July 19, 2026, making the codec that powered DivX and Xvid free to use anywhere in the world.
Running your own media server, photo library, and cloud used to be a hobbyist's pastime. In 2026 it's starting to look like basic privacy hygiene.