@POTUS
is officially wheels down in Beijing ahead of his historic Summit.
It's the first state visit of a sitting U.S. president to China since President Trump's last visit in 2017.
https://x.com/RapidResponse47/status/2054531743735017724
is officially wheels down in Beijing ahead of his historic Summit.
It's the first state visit of a sitting U.S. president to China since President Trump's last visit in 2017.
https://x.com/RapidResponse47/status/2054531743735017724
X (formerly Twitter)
Rapid Response 47 (@RapidResponse47) on X
.@POTUS is officially wheels down in Beijing ahead of his historic Summit.
It's the first state visit of a sitting U.S. president to China since President Trump's last visit in 2017.
It's the first state visit of a sitting U.S. president to China since President Trump's last visit in 2017.
From: Linus Torvalds <torvalds-AT-linuxfoundation.org>
To: Willy Tarreau <w-AT-1wt.eu>
Subject: Re: [PATCH v2 2/3] Documentation: security-bugs: explain what is and is not a security bug
Date: Wed, 06 May 2026 08:46:07 -0700
Message-ID: <CAHk-=wi6z5BGUUT2p+=qrJg+obom8VnCo3MqB=7xp3Gw+UMMkg@mail.gmail.com>
Cc: greg-AT-kroah.com, leon-AT-kernel.org, security-AT-kernel.org, Jonathan Corbet <corbet-AT-lwn.net>, skhan-AT-linuxfoundation.org, workflows-AT-vger.kernel.org, linux-doc-AT-vger.kernel.org, linux-kernel-AT-vger.kernel.org, Greg KH <gregkh-AT-linuxfoundation.org>
I actually think we may want to go further than this.
I think we should simply make it a rule that "a 'security' bug that is found by AI is public".
Now, I may be influenced by that "my inbox is a disaster during the merge window" thing, but I do think this is pretty fundamental: if somebody finds a bug with more or less standard AI tools (ie we're not talking magical special hardware and nation-state level efforts), then that bug pretty much by definition IS NOT SECRET.
So why should be consider it special and have it be on the security list?
Yes, yes, I know - some people think that "security bugs are special". And I've been on the record before calling that opinion special - in the short bus sense.
Bugs are bugs. And not having them in public only makes them harder to deal with.
Do we want to make bugs with potential security impact harder to deal with? No. No, we really don't.
So I claim that the only reason for a security list is the non-public nature of the bug and the whole "responsible disclosure" argument.
But that argument is complete and utter garbage in the face of some mostly automated AI discovery (now, that argument is mostly a fiction in the first place, but I am not going to argue with people who have vested interest in making their special patches "security bugs").
To recap - I think this "document the scope of security bugs" is good, but I think we should go even further, and just document the fact that anything found by regular AI tools should just always go to public lists and is simply not special.
Linus
To: Willy Tarreau <w-AT-1wt.eu>
Subject: Re: [PATCH v2 2/3] Documentation: security-bugs: explain what is and is not a security bug
Date: Wed, 06 May 2026 08:46:07 -0700
Message-ID: <CAHk-=wi6z5BGUUT2p+=qrJg+obom8VnCo3MqB=7xp3Gw+UMMkg@mail.gmail.com>
Cc: greg-AT-kroah.com, leon-AT-kernel.org, security-AT-kernel.org, Jonathan Corbet <corbet-AT-lwn.net>, skhan-AT-linuxfoundation.org, workflows-AT-vger.kernel.org, linux-doc-AT-vger.kernel.org, linux-kernel-AT-vger.kernel.org, Greg KH <gregkh-AT-linuxfoundation.org>
I actually think we may want to go further than this.
I think we should simply make it a rule that "a 'security' bug that is found by AI is public".
Now, I may be influenced by that "my inbox is a disaster during the merge window" thing, but I do think this is pretty fundamental: if somebody finds a bug with more or less standard AI tools (ie we're not talking magical special hardware and nation-state level efforts), then that bug pretty much by definition IS NOT SECRET.
So why should be consider it special and have it be on the security list?
Yes, yes, I know - some people think that "security bugs are special". And I've been on the record before calling that opinion special - in the short bus sense.
Bugs are bugs. And not having them in public only makes them harder to deal with.
Do we want to make bugs with potential security impact harder to deal with? No. No, we really don't.
So I claim that the only reason for a security list is the non-public nature of the bug and the whole "responsible disclosure" argument.
But that argument is complete and utter garbage in the face of some mostly automated AI discovery (now, that argument is mostly a fiction in the first place, but I am not going to argue with people who have vested interest in making their special patches "security bugs").
To recap - I think this "document the scope of security bugs" is good, but I think we should go even further, and just document the fact that anything found by regular AI tools should just always go to public lists and is simply not special.
Linus
👍5
Forwarded from BlockBeats
⚡️习近平举行仪式欢迎美国总统特朗普访华
BlockBeats 消息，5 月 14 日，中国国家主席习近平在北京人民大会堂东门外广场举行仪式，欢迎美国总统特朗普访华。特朗普已乘车抵达欢迎仪式现场。
原文链接 https://m.theblockbeats.info/flash/345860
BlockBeats 消息，5 月 14 日，中国国家主席习近平在北京人民大会堂东门外广场举行仪式，欢迎美国总统特朗普访华。特朗普已乘车抵达欢迎仪式现场。
原文链接 https://m.theblockbeats.info/flash/345860
Forwarded from 层叠 - The Cascading
🔴 NGINX http_rewrite 模块漏洞；或会导致堆溢出甚至远程代码执行。
- 漏洞的起因是 nginx 尝试将 escape 过的 URL 写入未 escape 长度的内存。
- 在 ASLR 未被开启的情况下，可以导致远程代码执行。
- 修复已于 1.30.1/1.31.0 发布。
1. https://depthfirst.com/nginx-rift
2. my.f5.com/~
CVE: CVE-2026-42945
CVSS: 9.2 (F5 Networks)
Affect: [0.6.27, 1.30.0]
Fixed-At: 1.30.1, 1.31.0
#nginx
- 漏洞的起因是 nginx 尝试将 escape 过的 URL 写入未 escape 长度的内存。
- 在 ASLR 未被开启的情况下，可以导致远程代码执行。
- 修复已于 1.30.1/1.31.0 发布。
1. https://depthfirst.com/nginx-rift
2. my.f5.com/~
CVE: CVE-2026-42945
CVSS: 9.2 (F5 Networks)
Affect: [0.6.27, 1.30.0]
Fixed-At: 1.30.1, 1.31.0
#nginx
depthfirst
NGINX Rift
An 18 year old memory corruption flaw in NGINX Plus and NGINX Open Source lets an unauthenticated attacker crash worker processes or execute remote code with crafted HTTP requests.
Tor 0.4.9.7
Changes in version 0.4.9.7 - 2026-05-06
This is a security release fixing several major bugfixes that were reported
in the past weeks. Huge thanks to everyone that reported these issues! We
strongly recommend upgrading as soon as possible.
o Major bugfixes (cell handling):
- Fix out-of-bounds read (OOB) when END, TRUNCATE and TRUNCATED cell
have no reason in their payload. TROVE-2026-011. Found by Found by
Brian Carpenter (geeknik). Fixes bug 41254; bugfix
on 0.1.1.1-alpha.
o Major bugfixes (conflux):
- Do not attempt or accept BEGIN_DIR via conflux legs. TROVE-2026-
008. Credit to Anas Cherni from Calif.io in collaboration with
Claude and Anthropic Research. Fixes bug 41243; bugfix
on 0.4.8.1-alpha.
o Major bugfixes (conflux, relay):
- Adjust conflux out-of-order queue accounting when clearing a
queue. TROVE-2026-010. Found by aptupdate. Fixes bug 41251; bugfix
on 0.4.8.1-alpha.
o Major bugfixes (pathbias):
- Fix a client-side crash caused by double-close of a circuit while
under circuit queue memory pressure. TROVE-2026-009. Found by
cypherpunks. Fixes bug 41237; bugfix on 0.3.3.6-rc.
o Major bugfixes (relay):
- Fix null pointer dereference when receiving a CERT cell out of
order. TROVE-2026-006. Found by Fwame. Fixes bug 41240; bugfix
on 0.2.4.4-alpha.
o Major bugfixes (relay, onion service):
- Fix off-by-one out-of-bounds read if a malformed BEGIN cell is
received. TROVE-2026-007. Found by Flanagan. Fixes bug 41245;
bugfix on 0.2.4.7-alpha.
o Minor features (fallbackdir):
- Regenerate fallback directories generated on May 06, 2026.
o Minor features (geoip data):
- Update the geoip files to match the IPFire Location Database, as
retrieved on 2026/05/06.
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.7/ReleaseNotes#L5
Changes in version 0.4.9.7 - 2026-05-06
This is a security release fixing several major bugfixes that were reported
in the past weeks. Huge thanks to everyone that reported these issues! We
strongly recommend upgrading as soon as possible.
o Major bugfixes (cell handling):
- Fix out-of-bounds read (OOB) when END, TRUNCATE and TRUNCATED cell
have no reason in their payload. TROVE-2026-011. Found by Found by
Brian Carpenter (geeknik). Fixes bug 41254; bugfix
on 0.1.1.1-alpha.
o Major bugfixes (conflux):
- Do not attempt or accept BEGIN_DIR via conflux legs. TROVE-2026-
008. Credit to Anas Cherni from Calif.io in collaboration with
Claude and Anthropic Research. Fixes bug 41243; bugfix
on 0.4.8.1-alpha.
o Major bugfixes (conflux, relay):
- Adjust conflux out-of-order queue accounting when clearing a
queue. TROVE-2026-010. Found by aptupdate. Fixes bug 41251; bugfix
on 0.4.8.1-alpha.
o Major bugfixes (pathbias):
- Fix a client-side crash caused by double-close of a circuit while
under circuit queue memory pressure. TROVE-2026-009. Found by
cypherpunks. Fixes bug 41237; bugfix on 0.3.3.6-rc.
o Major bugfixes (relay):
- Fix null pointer dereference when receiving a CERT cell out of
order. TROVE-2026-006. Found by Fwame. Fixes bug 41240; bugfix
on 0.2.4.4-alpha.
o Major bugfixes (relay, onion service):
- Fix off-by-one out-of-bounds read if a malformed BEGIN cell is
received. TROVE-2026-007. Found by Flanagan. Fixes bug 41245;
bugfix on 0.2.4.7-alpha.
o Minor features (fallbackdir):
- Regenerate fallback directories generated on May 06, 2026.
o Minor features (geoip data):
- Update the geoip files to match the IPFire Location Database, as
retrieved on 2026/05/06.
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.7/ReleaseNotes#L5
Forwarded from 每日消费电子观察 (septs)
英伟达 CEO 黄仁勋称五年前的 GPU 就像“老酒”：越陈越香，还会涨价
https://www.ithome.com/0/950/065.htm
值得注意的是，价格上涨不仅发生在新产品上，旧一代 GPU 同样受到影响。即使是 4 至 5 年前的产品，目前仍在持续升值。黄仁勋指出，旧 GPU 的涨价速度甚至超过好酒陈化速度，在市场中仍然具有强需求。
https://www.ithome.com/0/950/065.htm
值得注意的是，价格上涨不仅发生在新产品上，旧一代 GPU 同样受到影响。即使是 4 至 5 年前的产品，目前仍在持续升值。黄仁勋指出，旧 GPU 的涨价速度甚至超过好酒陈化速度，在市场中仍然具有强需求。
😁15👎1
Forwarded from BlockBeats
美国批准向10家中国公司出售H200芯片，英伟达美股夜盘拉升涨超2%
BlockBeats 消息，5 月 14 日，据路透社报道，三位知情人士透露，美国已允许阿里巴巴、字节跳动、腾讯和京东在内的 10 家中国企业购买英伟达 H200 芯片。联想与富士康等分销企业也能购买。
据 Bitget 数据显示，英伟达美股夜盘短线拉升，现涨超 2%。
原文链接 https://m.theblockbeats.info/flash/345900
BlockBeats 消息，5 月 14 日，据路透社报道，三位知情人士透露，美国已允许阿里巴巴、字节跳动、腾讯和京东在内的 10 家中国企业购买英伟达 H200 芯片。联想与富士康等分销企业也能购买。
据 Bitget 数据显示，英伟达美股夜盘短线拉升，现涨超 2%。
原文链接 https://m.theblockbeats.info/flash/345900
This is your reminder to set up a monthly donation for your favorite open-source software.
It doesn't really matter what. Could be the OS you're using right now, could be some application. If we all give a small donation to FreeCAD for example, they might turn into something like Blender today.
It doesn't have to be a lot too, but if you have some spare money, just do it!
It might feel useless but if you won't notice 10 dollars being gone from your bank account, just give it to them. you'll make a real difference
https://www.reddit.com/r/linux/s/99jY94JeMo
It doesn't really matter what. Could be the OS you're using right now, could be some application. If we all give a small donation to FreeCAD for example, they might turn into something like Blender today.
It doesn't have to be a lot too, but if you have some spare money, just do it!
It might feel useless but if you won't notice 10 dollars being gone from your bank account, just give it to them. you'll make a real difference
https://www.reddit.com/r/linux/s/99jY94JeMo
❤4
Unfixed non-public security issues libexpat/libexpat#1160
https://github.com/libexpat/libexpat/issues/1160
https://github.com/libexpat/libexpat/issues/1160
TIL
sysusers.d(5)
u! httpd 404 "HTTP User"
Type u may be suffixed with an "!" ("u!") to create a fully locked account. This is recommended, since logins should typically not be allowed for system users. With or without the exclamation mark an invalid password is set. For "u!", the account is also locked, which makes a difference for non-password forms of authentication, such as SSH or similar.
Added in version 257.
sysusers.d(5)
u! httpd 404 "HTTP User"
Type u may be suffixed with an "!" ("u!") to create a fully locked account. This is recommended, since logins should typically not be allowed for system users. With or without the exclamation mark an invalid password is set. For "u!", the account is also locked, which makes a difference for non-password forms of authentication, such as SSH or similar.
Added in version 257.
鸥 Billchan 鸥 🍟 大薯 | 去码头整点薯条
TIL sysusers.d(5) u! httpd 404 "HTTP User" Type u may be suffixed with an "!" ("u!") to create a fully locked account. This is recommended, since logins should typically not be allowed for system users. With or without the exclamation mark…
fully locked (instead of just with an invalid password).
.sp_expire = i->locked ? 1 : -1
.sp_expire = i->locked ? 1 : -1
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
2026-03-12
2026-03-12
🤯2
Forwarded from 蓝点网订阅频道
ssh-keysign-pwn: Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.
With ssh-keysign-pwn, unprivileged users are able to read root-owned files. That affects all Linux kernel releases up through today's latest Linux Git state as of earlier today.
__ptrace_may_access() skips the dumpable check when task->mm == NULL. do_exit() runs exit_mm() before exit_files() — no mm, fds still there. pidfd_getfd(2) succeeds in that window when the caller's uid matches the target's.
Reported by Qualys and fixed by the mainline Linux kernel earlier today. This patch to adjust the kernel's ptrace behavior is what fixes the issue.
Jann Horn flagged the FD-theft shape in October 2020.
More details on ssh-keysign-pwn can be found via this GitHub repository.
https://www.phoronix.com/news/Linux-ssh-keysign-pwn
With ssh-keysign-pwn, unprivileged users are able to read root-owned files. That affects all Linux kernel releases up through today's latest Linux Git state as of earlier today.
__ptrace_may_access() skips the dumpable check when task->mm == NULL. do_exit() runs exit_mm() before exit_files() — no mm, fds still there. pidfd_getfd(2) succeeds in that window when the caller's uid matches the target's.
Reported by Qualys and fixed by the mainline Linux kernel earlier today. This patch to adjust the kernel's ptrace behavior is what fixes the issue.
Jann Horn flagged the FD-theft shape in October 2020.
More details on ssh-keysign-pwn can be found via this GitHub repository.
https://www.phoronix.com/news/Linux-ssh-keysign-pwn
🤯7
鸥 Billchan 鸥 🍟 大薯 | 去码头整点薯条
ssh-keysign-pwn: Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. With ssh-keysign-pwn, unprivileged users are able to read root-owned files. That affects all Linux kernel releases…