Ladybird is an open-source project aimed at building an independent web browser, rather than yet another browser based on Chrome. It is written in C++ and licensed under a two-clause BSD license. The effort began as part of the SerenityOS project, but developer Andreas Kling announced on June 3 that he was "forking" Ladybird as a separate project and stepping away from SerenityOS to focus his attention on the browser completely. Ladybird is not ready to replace Firefox or Chrome for regular use, but it is showing great promise.

According to CrowdStrike, a vulnerability in the Linux kernel's nftables code that was discovered earlier this year is being actively exploited in the wild. The vulnerability allows for local privilege escalation. Most distributions have already released a fix.

As noted by the exploit developer, leveraging this POC is dependent on the kernel's unprivileged user namespaces feature accessing nf_tables. This access is enabled by default on Debian, Ubuntu and kernel capture-the-flag (CTF) distributions. An attacker can then trigger the double-free vulnerability, scan the physical memory for the kernel base address, bypass kernel address-space layout randomization (KASLR) and access the modprobe_path kernel variable with read/write privileges. After overwriting the modprobe_path, the exploit drops a root shell.

BPF was first generalized beyond packet filtering more than a decade ago. In that time, it has changed a lot, becoming much more capable. Alexei Starovoitov kicked off the second day of the BPF track at the 2024 Linux Storage, Filesystem, Memory Management, and BPF Summit by leading a session discussing which changes to BPF are going to come in the next ten years as it continues evolving. He proposed several ideas, including expanding the number of registers available to BPF programs, dynamic deadlock detection, and relaxing some existing limits of the verifier.

Version 2024.2 of the Kali Linux penetration testing distribution has been released. This release includes an update to GNOME 46, a high-resolution (HiDPI) mode for Xfce, as well as a number of new packages such as the AutoRecon network reconnaissance tool, pspy command-line utility for snooping on Linux processes, and SploitScan tool for fetching and displaying CVE information. Kali Linux is based on Debian testing, and 2024.2 incorporates Debian's work to transition to 64-bit time_t to avoid year 2038 problems. Users with existing Kali systems should be sure to follow the documentation when upgrading.

Version 14.1 of FreeBSD has been released. This is the second release of the 14.x stable branch. Highlights of this release include upgrades to OpenZFS 2.2.4, Clang/LLVM 18.1.5, and OpenSSH 9.7p1. FreeBSD 14.1 also features cloud-init support, sound subsystem improvements, and more. See the what's new blog post from the FreeBSD Foundation, release notes, and errata for more information.

Many years ago, the PostgreSQL project started holding regular CommitFests to help tackle the work of reviewing and committing patches in a more organized fashion. That has served the project well, but some in the project are concerned that CommitFests are no longer meeting the needs of PostgreSQL or its contributors. A lengthy discussion on the pgsql-hackers mailing list turned up a number of complaints, a few suggestions for improvement, but little consensus or momentum toward a solution.

Drew DeVault has published an update about the state of the SourceHut software development platform and its plans for the coming months. This is the first update since the January post-mortem following a distributed denial-of-service (DDoS) attack that resulted in a prolonged outage:

As you can imagine, it has been a stressful time for us. However, I wish to stress that everything we've been dealing with is planned for in our models, both technical and financial. There is no existential threat to SourceHut. Nevertheless, we are grateful for your patience and support.

[...] We have been focusing on two things this year: provisioning and managing our infrastructure and getting as much rest as possible. Our situation has calmed down, and while we still have a lot of loose ends to attend to I'm happy to say that we're resuming a sense of normalcy here and preparing to resume our work on the features you need.

Alan Jowett returned for a second remote presentation at the 2024 Linux Storage, Filesystem, Memory Management, and BPF Summit to compare the performance of different BPF runtimes. He showed the results of the MIT-licensed BPF microbenchmark suite he has been working on. The benchmark suite does not yet provide a good direct comparison between all platforms, so the results should be taken with a grain of salt. They do seem to indicate that there is some significant variation between implementations, especially for different types of BPF maps.