Setuid (and setgid) binaries have long been a source of headaches, and security vulnerabilities, on Linux systems. They are largely seen as something to be avoided; SUSE's security team, for example, forbids the inclusion of setuid or setgid binaries in packages unless they have been reviewed and explicitly allowed. Thorsten Kukuk wants to go a step further and disallow them entirely. At the 2026 All Systems Go! conference, he spoke about his work to disable setuid system-wide, as well as some of the hurdles that remain.

Mozilla has announced that it has received a report that private keys associated with eight eMudhra intermediate certificates have been compromised:

These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control. An attacker who could intercept a user's connection could use those certificates to impersonate websites and potentially read or modify traffic.

Mozilla has blocked the affected certificates using its OneCRL centralized list of revoked certificates, and has updated the trusted certificate list in Network Security Services (NSS) 3.131.1.

There is a single-page site about the compromise that goes into more detail. According to the site the certificates have also been blocked in Chrome since October 17, Apple devices since the 19th, and Microsoft blocked the certificates on the 20th. There is also a table that displays whether a browser or other client still trusts the compromised certificates.

The NetBSD foundation has issued instructions to block the certificates on NetBSD installations. Users of other browsers and operating systems may wish to check for updates or guidance to disable the compromised certificates.

OpenBSD 8.0 has been released. There are many new features, including the addition of hibernate support for arm64, an increase in the kernel virtual address space for amd64 to 512GB, quite a few improvements for the qwx driver that supports Qualcomm WiFi 6 devices, and much more. See the full changelog for details.

Mike Rapoport has announced the release of the video recordings from the 2026 Linux Plumbers Conference (LPC), which was held in Prague from October 5 through October 7. Find the complete set via the YouTube playlist or look for the video links in the schedule. See also LWN's coverage of talks from LPC.

The GNOME Project has provided GNOME OS for some time; until now, the project only provided a "Nightly" edition that was built from the latest commits and was aimed solely at GNOME developers. Adrian Vovk has now announced the release of GNOME OS Preview, which is intended for a non-developer audience:

GNOME OS Preview is the current GNOME OS Nightly, but without the "nightly" aspect. Instead, it's built from the latest stable GNOME release (GNOME 51.1, at the time of writing). GNOME OS Preview lives in the same branches on GitLab as the stable org.gnome.Platform Flatpak runtimes.

GNOME OS Preview is only a few weeks old, so it has only seen limited real-life testing so far. We therefore expect people will uncover some issues initially. That said, Preview is significantly more stable than Nightly, which dozens of people have been daily driving without major issues for over a year. Thus, we're feeling confident that Preview is going to be reliable enough for daily use by non-developer enthusiasts.

While Preview is meant for non-developers, it is not considered complete or stable for the broader public. There are a number of features, listed in Vovk's post, that need to be implemented before the project is ready to declare GNOME OS "ready for prime time". Adventurous users, who might not mind having to reinstall the OS once a stable version is declared, can download and start using GNOME OS Preview today.

As part of KDE's 30th anniversary celebration, the project has released The KDE Documentary — A Story of Free Software Underdogs (YouTube video):

The story starts in 1996, when Matthias Ettrich, a student at the University of Tübingen, posted to a Usenet group asking for programmers to help build a desktop for Linux. What followed became KDE, one of the largest free software communities in the world. KDE made Linux usable as a desktop for people who weren't system administrators, giving it a complete, consistent graphical environment at a time when there was none.

The film covers the highs and lows of three decades of KDE: the Qt licensing fight and the rivalry with GNOME; the success of KHTML, the browser engine that became the basis of Apple's WebKit and Google's Chrome; and the contentious release of KDE 4 and the rebuild that followed.

Canonical has announced the release of Ubuntu 26.10 ("Stonking Stingray"):

Ubuntu 26.10 advances enterprise security features, completes the rollout of the Rust-based uutils coreutils, and strengthens integrations for user authentication using Microsoft Entra ID.

[...] Ubuntu 26.10 also ships with GNOME 51, bringing a smoother, more responsive desktop, better display handling, improved accessibility, and refinements across core applications. In addition, the Ubuntu App Center now provides a more consistent experience for managing snaps and debs.

See the release notes for a list of new features as well as incompatible changes between 26.10 and prior Ubuntu releases.

Greg Kroah-Hartman has announced the release of the 7.2.11, 6.18.57, 6.12.113, 6.6.159, 6.1.190, 5.15.223, and 5.10.272 stable kernels. This series includes, among other things, a fix for a critical vulnerability (CVE-2026-99999). The flaw in skb_checksum_help() would allow an IPv4 packet with bad checksum metadata to "corrupt the network header and cause a bunch of mischief" in the words of patch author Michael S. Tsirkin. As usual, all users are advised to upgrade.

Version 6.8 of the KDE Plasma desktop has been released. The The KDE project has timed the release to coincide with the 30th anniversary of Matthias Ettrich's email announcing the project:

Unix popularity grows thanks to the free variants, mostly Linux. But still a consistent, nice looking free desktop-environment is missing. There are several nice either free or low-priced applications available, so that Linux/X11 would almost fit everybody needs if we could offer a real GUI.

Notable changes include accessibility improvements, inclusion of the Kup backup tool as part of Plasma, as well as the ability to include system audio and microphone input in Spectacle screen recordings. Plasma 6.8 also drops support for Plasma X11 sessions, as was announced in November 2025. X11 applications are still supported via XWayland, and KDE applications will continue to support X11 "for the foreseeable future".

See the KDE wiki for a list of major user-facing changes, and the changelog for all changes since Plasma 6.7.5.

The Lix and Nix projects have jointly disclosed a set of vulnerabilities that can be used to escalate privileges to root on systems running the Lix or Nix daemons. "All systems that build untrusted derivations are affected." Releases with fixes from each project are available today. CVE IDs have not yet been requested. See the announcement for more details on the vulnerabilities.

PostgreSQL core team member Peter Eisentraut has written a blog post reflecting on the "unusually high number of features" that have been taken out of the upcoming PostgreSQL 19 release since the beta period began.

Some of the reverted features had significant architectural defects that would have been hard to fix quickly and during beta. But there was also a long tail of relatively harmless issues involving various edge cases. In past times, many of these would not have surfaced until much later and we would have fixed them bit by bit over the subsequent five years. But with LLM-assisted code review, these kinds of things can get found much faster, and then you're staring at a list of like forty defect reports. And even if each of them requires only a three-line fix on average, there is a fixed overhead to dealing with each of these, and then you run out of time. Most if not all of the affected reverted features were written a long time ago when LLM-assisted code review was not as useful as it is now, meaning that the effective quality bar has been raised after the time the feature was written and committed. Unless the capabilities of LLM-assisted code review keep improving at the current rate, this situation should sort itself out for future development cycles.

A corollary of that is that, at least for the most part, as far as I can tell, this situation is not due to "vibe coding". This code was written well before that was a possibility.

LWN covered the unusually large number of bug fixes required for PostgreSQL 19 features in September.

The LineageOS project, which produces an Android-based distribution for mobile devices, has announced the release of LineageOS 24.0.

We're a bit sentimental about this release, as it precedes a really fun upcoming milestone.

On December 24, 2026, LineageOS will celebrate 10 years. It's a remarkable milestone for a project built by a passionate community of developers, maintainers, contributors, and users who have kept so many devices alive along the way.

[...] We've been hard at work rebasing all of our changes and features since Android 17's release in June. Android 17's first release mainly contained iterative improvements and some UI/UX refinements, but due to our previous efforts adapting to Google's heavy refactoring over the last several versions, we were able to rebase onto Android 17's code-base faster than anticipated. Yes you read that right: We're early this year!

Version 3.15 of the Python programming language has been released. Notable changes in this release include the addition of the sentinel and frozendict built-in types, the use of UTF-8 encoding by default, package start-up configuration files, as well as improvements in the experimental JIT compiler. See the "What's new in Python 3.15" article for an in-depth look at new features in this release, and the changelog for a full list of changes.