GamesRadar reports that agg23, the developer who ported the SNES FPGA core to the Analogue Pocket, publicly rejected an unrequested contributor patch that added an experimental MSU-1 streaming feature, saying it was a roughly 50,000-line diff that was completely built by an LLM and contained large amounts of unrelated code he would have had to review by hand. The core is one of the open-source openFPGA emulators the handheld supports, and the maintainer said the behavior was not acceptable, that pushing machine-generated work nobody asked for infringes on other people's time and brainpower, and that AI-generated code has no place in his project. The article ties the incident to a broader fight across retro-emulation and open-source projects over low-effort, vibe-coded contributions, noting that the RPCS3 team made a similar plea to stop submitting AI slop code earlier in the year.
Phoronix reports that TrendAI's Zero Day Initiative disclosed twelve more security vulnerabilities in the X.Org Server codebase and XWayland, found with the assistance of AI, extending a long run of disclosures against the display server that a researcher described more than a decade ago as being in even worse shape than it looks. The flaws, present in versions before xorg-server-21.1.25 and xwayland-24.1.14, are mostly use-after-free, heap buffer overflow, out-of-bounds read and write, double free and numeric truncation bugs, spanning XKB, Present, XInput, GLX, XFixes, RandR, Glamor and gesture code.
Neowin reports that the Dutch tax authority, the Belastingdienst, is halting its move to Microsoft 365 and will instead run Microsoft email and calendar services on its own servers next year while it looks for European options for storage and collaboration. The agency is trying to reduce its reliance on Microsoft without cutting the company off entirely, and will keep using tools such as Outlook, after earlier Dutch reporting said the rollout had been paused over a critical report and a EUR 14.4 million bill for the original migration.
ZDNet's Jack Wallen argues that the world depends on open-source software and that more of it deserves to be paid for, revisiting an earlier list of open-source apps he would happily buy and noting how much it has changed over the past year. He picks seven apps he believes justify a price, from Firefox to other desktop and productivity tools, and asks developers who add a fee to make it a one-time purchase rather than a subscription.
The New Stack speaks with Cloud Native Computing Foundation executive director Jonathan Bryce about the feedback loop between AI and open source, noting that OpenAI leaned on Kubernetes and other open source tooling in 2018 because nothing off the shelf could handle its training runs at that scale, and that AI labs have since contributed back so banks, manufacturers and others can build their own AI infrastructure. Bryce says the CNCF has accepted and moved products through its graduation process faster than ever over the past 18 months, in part because it has built agents to help with due diligence at the different stages, and argues that software now has to answer AI queries at agent speed rather than human pace while non-deterministic agents need guardrails. He frames the foundation's KubeCon event in Salt Lake City in November as more important than ever for the community to determine the future of open source amid that acceleration.
The Apache Software Foundation published a progress report on its Responsible AI Initiative, launched in April 2026, whose charter vice president Jeff Genender presented in the August board report and which is framed around human oversight, licensing integrity, security and documentation. The initiative groups its work into access to AI models and tooling, project-level ecosystem support, and community engagement, and it has relied on in-kind donations of frontier model access, including through Anthropic's Project Glasswing program, that let ASF Tooling, Security and Infrastructure teams run full security scans across 75 project management committees and 230 repositories in three days. It is also producing recommendations and guidelines for projects that develop software with AI assistance and for the governance and use of donated funds, compute time and inference tokens. Supporting efforts include LLMAO, metered LLM access for ASF projects and committers without per-project provider keys, the Gofannon agent workbench, agent memory work, Apache Magpie for agent-assisted repository maintainership, and Apache Sourcelume for AI training-data provenance. RAI will present a hackathon and a roundtable at Community Over Code Glasgow on October 12, where participants will discuss AI-driven maintainer challenges such as attracting new committers, preserving meritocracy under The Apache Way, coping with automated vulnerability report floods, and whether AI strengthens or erodes the commons.
Linux Foundation Research and the TODO Group released The 2026 State of OSPOs and Open Source Management, sponsored by CNCF and the FinOps Foundation, alongside Open Source Summit Europe. The report finds open source program offices becoming permanent corporate functions, with 57% staying in the same organizational home for the past two to three years and 53% of large enterprises running a formally structured OSPO, while Asia-Pacific is set to lead the next wave as 20% of organizations there plan an OSPO, double the rate in the Americas and Europe. On AI, 79% of OSPOs involved in AI governance contribute to policy, evaluation of open models and datasets, risk management and legal review, 85% of those in AI decision-making are engaged at or before technology selection, and the top AI risks OSPOs manage are licensing and intellectual property and security vulnerabilities at 65% each, ahead of data privacy at 59%. Agentic AI is already entering operations, with 69% of organizations prototyping or running agentic tools for OSPO workflows and 18% using them in production. Respondents ranked software quality, security and compliance as the most impactful OSPO outcome at 58%, and among organizations planning an OSPO, 79% expect to launch within two years and 66% intend to fund dedicated full-time staff.
Telecompaper reports that digital infrastructure provider Hayo has joined the Linux Foundation and become a member of the CAMARA Project, the Linux Foundation open source effort that defines, develops and tests standardized northbound telco network APIs in collaboration with the GSMA Operator Platform Group. Hayo, which operates CAMARA-aligned APIs for number verification, SIM-swap detection, device location and status, KYC match and quality on demand, said the membership reflects a commitment to open standards and interoperability and that it will work with operators, hyperscalers, CPaaS providers and aggregators to bring standardized network APIs to market across Africa and the Middle East. CEO Feraz Ahmed framed network APIs as a foundation for digital identity, fraud prevention and new operator revenue, and the piece cites IDC's forecast that the worldwide network API market will grow from $1.5 billion in 2025 to $6.9 billion by 2029.
The Eclipse Foundation's Open VSX extension registry added Trusted Publishing so publishers using GitHub Actions can replace a stored personal access token with short-lived credentials: a CI workflow presents a signed identity token, the registry checks it against a registration naming the owner, repository and workflow file, and returns a publishing token that lasts about five minutes and works for one extension only. The model follows OpenSSF's "Trusted Publishers for All Package Repositories" guidance already used by PyPI, npm, RubyGems, NuGet, crates.io and pub.dev, and requires a signed Publisher Agreement, a verified namespace owned by the registrant and an extension with an existing active version, since the first publication still needs a PAT. Registrations match immutable numeric repository and owner IDs while the workflow filename is matched by name, are not tied to a branch or tag so pinning a deployment environment and reviewers is advised, allow only one trusted publisher per extension, and are deleted if their creator stops being a namespace owner. GitLab and self-hosted providers are planned, and the post stresses that whoever can change or run the workflow can still publish, moving the security burden to branch protection, workflow review and environment approvals.
It's FOSS reports that IBM and Red Hat's Lightwell initiative has cleared more than 400 previously unknown vulnerabilities across foundational Java libraries, backporting fixes into the pinned dependency versions enterprises actually run and contributing the patches upstream under responsible disclosure instead of waiting for maintainers to patch every supported release. Coverage is set to expand beyond Java to Python, JavaScript and .NET using the same backport-and-upstream model. Clearinghouse Premier, until now reserved for a pre-selected group of critical-infrastructure organizations, reached general availability and is open to any enterprise, sitting alongside the self-service Lightwell Network tier that launched in July, as part of IBM and Red Hat's $5 billion commitment to open source security. Red Hat Lightwell general manager Gunnar Hellekson said AI agents shifted the threat landscape overnight by exploiting old dependencies at machine speed.
OpenSSF's What's in the SOSS? podcast talks with Red Hat vice president of product security Vincent Danen about the changing state of open source vulnerability disclosure, covering the CVE program's history, the rise of alternative advisory systems, the flood of AI-assisted vulnerability reports and the burden it puts on upstream maintainers, why SBOMs and VEX still lack a usable experience for downstream consumers, and how the EU Cyber Resilience Act is shifting global software supply-chain expectations.
Tech Funding News reports that Vates, the Grenoble-based company behind the open source XCP-ng hypervisor and Xen Orchestra management console, raised €30 million from IRIS's Growth fund and Bpifrance's Large Venture fund to scale its open-source alternative to VMware as Broadcom's takeover pushes customers to rethink their virtualisation vendors. Co-founders Olivier Lambert, Nithida Vialle and Julien Fontanet remain majority shareholders, and CEO Lambert said the round accelerates the strategy the company has pursued from the start rather than changing it and will not compromise its independence or open source principles. Vates has grown without a large outside cheque since 2012, has been profitable and self-funded since 2016, serves more than 1,000 customers in about 100 countries, draws 90% of its revenue from outside France with North America close to half its business, and reported 65% growth in 2025. It will spend the money on the next generation of its platform covering performance, storage, security, automation, large-scale virtualisation and AI workloads, on sales and marketing in North America and key European markets, and on a larger partner network for bigger migrations, pitching interoperability, reversibility and freedom of choice against larger rivals such as Nutanix, Platform9 and Broadcom's VMware.
The Eclipse Foundation-hosted Open Regulatory Compliance Working Group introduced its AI Policy & Compliance Special Interest Group and published its scope, which starts with the EU AI Act. The post argues that large parts of the AI Act are already in force and that the harmonised standards defining how it will be implemented are being written now, so open source needs a seat at the table, and says the SIG will inform members about regulatory requirements and engage regulators to keep upcoming standards compatible with how open source is actually developed. The group also plans to clarify technical definitions such as the distinction between an AI model and an AI system, document the reasoning behind past positions to avoid relitigating them, and pursue a more unified approach to overlapping regulations, while the Cyber Resilience SIG continues to lead general CRA work and the two coordinate where AI and cybersecurity requirements intersect. It notes that the AI Act is not the only regulation on the horizon, pointing to the EU Cloud and AI Development Act and draft US state AI legislation, and invites participation through its mailing list, biweekly Monday calls and a Code & Compliance session on 27 October 2026.
OpenSSH 10.6 has been released, and the project says it has been receiving a large number of AI-assisted security bug reports, which it welcomes especially when combined with human triage, analysis, test cases and proposed fixes. Because of the volume, the team expects to ship more frequent releases to get fixes to users more quickly rather than batching them until the next planned release. The release also enables the hybrid post-quantum ssh-mldsa44-ed25519 signature algorithm, adds a -p option for sftp's lmkdir and mkdir commands, disables the LZ77 dictionary coder in ssh and sshd to mitigate side-channel leaks, and deprecates the scp -R option because of security risks.
IBM and Red Hat said they have identified and remediated more than 400 previously unknown vulnerabilities across popular Java libraries, crediting Red Hat's Lightwell open source software supply chain initiative and its specialized AI agents with accelerating discovery. The milestone was announced alongside the general availability of the Lightwell Clearinghouse, an enterprise service where customers submit open source software dependencies for priority review and remediation. The companies framed the work as addressing a growing business risk, since autonomous AI agents are becoming capable of chaining several lower-risk software weaknesses into a more serious attack, and the first embargoed figures cited by Phoronix had grown from 300-plus to 400-plus vulnerabilities within days.
Rodion Kazennov reports that between 27 September and 2 October he sent fixes, bug reports and comments to twelve open-source projects with a coding agent doing much of the work, then read the contribution rules of 30 repositories to see how they treat AI-assisted contributions. He found 19 of the 30 had a rule about AI and 14 of those rules appeared in 2026, most make the submitter responsible for the change, 15 require contributors to disclose AI use, ten require a human to write the description, comments or commit message, and the commit trailer coding agents add by default is required by some projects and banned by others. He contrasts examples such as spec-kit, which wants the agent, model, settings and extent of help named in every AI-generated comment, and MLX, whose pull request template states it is strictly prohibited to use AI to write the PR description.
A downstream integrator opened issue #1349 on the Ocean Industries Concept Lab's OpenBridge web components repository arguing that the licence switch from Apache-2.0 to a delayed-open model was merged as a "chore" on 2026-09-17 without announcement, deprecation window or discussion, and only became visible when the 2.0.0 stable release shipped under AGPL-3.0-only on 2026-09-29, since the 2.0.0-next.155 prerelease from 2026-09-16 was still Apache-2.0. Under the scheme documented in the project's README, every version and commit is licensed AGPL-3.0-only for 180 days and then also becomes available under Apache-2.0, while members of the project's Joint Industry Project can buy a commercial licence that allows use before the change date; the filer says AGPL section 13 makes current releases unusable for the proprietary integrators and OEMs that ship bridge software, that safety fixes reach Apache users six months late, that per-commit change dates break the standardisation OpenBridge was meant to provide and that the commercial terms are not public. Maintainer tibnor replied that the non-profit project chose the partly open model after weighing fully Apache-2.0 development against a closed, members-only repository, and that commercial use is possible through minimum annual donations of 2,000 euros for small companies, 5,000 for medium and 10,000 for large, letting startups use the code free until they land a sale.
Brandsit's Izabela Myszkowska argues that open source has become an invisible layer of modern IT whose greatest risk is that responsibility for maintenance is scattered between organisations, vendors and a very small group of developers, so companies gain technological freedom along with responsibility for code they did not write and cannot control. Drawing on the Linux Foundation, OpenSSF and Harvard-affiliated Census III study of more than 12 million observations of open-source library use, she notes that in 17% of the 47 most-used non-npm projects a single developer made over 80% of 2023 commits, in 40% no more than two did, and in 64% no more than four, and cites Black Duck's OSSRA 2026 finding open-source components in 98% of 947 audited commercial codebases with at least one known vulnerability in 87%. The piece uses Log4Shell, where SBOMs did not help many organisations locate the vulnerable library, and the 2024 XZ Utils backdoor to argue that the real question is who owns updates, security and continued development, and it notes that the EU Cyber Resilience Act's vulnerability and incident reporting duties for manufacturers took effect on 11 September 2026 while open-source software stewards' obligations follow on 11 December 2027.
The Open Source Security Foundation announced at its Community Day Europe event in Prague that A-Team Systems, Emphere, DACHS IT GMBH and JetBrains have joined as General Members, framing the growth as a direct contribution to the long-term sustainability of the open source projects that underpin modern infrastructure. OpenSSF also released Cyber Resilience Act resources, including a CRA Readiness practitioner's guide and role-based user journeys, and published an Ericsson Software Technology case study describing how the company removed private forks and contributed more than 1,400 dependency updates and security fixes upstream to meet the regulation. Other third-quarter milestones include the OpenBao v2.6 secrets-management release and BOMHort entering the OpenSSF Sandbox.
Oskar Dudycz's Architecture Weekly essay asks whether doing open source still makes sense and argues there are only three reasons to take it on: getting money out of it, using it in your own work, or enjoying it, ideally combining the last with one of the first two. He writes that financial success stories for individual maintainers are rare, that generative AI has further eroded the respect and credit contributors receive, and that large companies stand on the shoulders of a small group of unpaid maintainers while assuming someone else is funding them. His advice is to assess whether a project has commercial potential, can become a product and has willing payers, and if so to productize it or make the source available to customers first, and he frames sponsoring dependencies as due diligence rather than gratitude.
A GitHub user opened a "License Violations Audit" issue on the Photopea repository alleging that the closed-source, commercially operated image editor distributes third-party open source code in minified JavaScript bundles, WebAssembly binaries, packed database assets and bundled fonts without the source, notices or attribution those licences require. The audit claims critical violations involving FriBiDi compiled to WASM under LGPL-2.1+ and Mediabunny under MPL-2.0, an Apache-2.0 violation for embedded PDF.js code with copyright and licence notices removed, notice stripping across MIT and BSD 3-Clause projects including Paper.js, Acorn, HarfBuzz, pako and Three.js loaders, and zstd and libwebp WASM binaries hidden in base64-encoded DEFLATE streams. The issue was filed as Photopea's developer accuses the GPL-3.0 Photosuite editor of copying Photopea's code.
The Linux Foundation's LF Research published a 10-year retrospective on the Civil Infrastructure Platform, describing how member companies including Siemens, Renesas, Cybertrust Japan, Texas Instruments and Toshiba pool engineering resources and sponsor the foundation's collaborative support programs to maintain a 10-year Super Long-Term Support Linux kernel baseline. The report frames the arrangement as a way to mutualize software longevity costs and EU Cyber Resilience Act compliance, where non-compliance penalties can reach 15 million euros or 2.5% of global annual turnover, and recommends that asset operators become active stewards rather than passive software consumers to keep the project sustainable.
Invest in Open Infrastructure published its third annual State of Open Infrastructure report, analyzing more than US$663 million in grant funding across 1,065 award clusters, 47 funders, and 94 open infrastructures from 2021 to 2026. It finds that only 29% ($192 million) of that money reached open infrastructures directly, and just $64 million funded operations rather than new development, so projects such as Creative Commons and DOAJ are chronically underfunded relative to the research output that depends on them. Funding is also concentrated: of the 34 infrastructures with more than one direct grant, 22 drew support from a single country even though the research relying on them is funded from nearly three countries on average, and $42.1 million in active US federal grants is exposed to immediate budget threats. A second section examines how open infrastructure can establish provenance and trust as generative AI makes research fabrication easier, and a third tracks the AI investment boom, public science budget cuts, and digital sovereignty, sorting seven signals into risk, watch, and opportunity groups.
Photopea creator Ivan Kutskir opened an issue on the GPL-3.0 Photosuite repository accusing the project of copying his work, pointing to matching minified source such as its handling of the SoLd PSD object and noting the repo appeared two weeks earlier under an author with no public name or email. Photosuite author eolix says the project began from a mirrored offline Photopea build, credits Photopea as prior art, and has since been rearchitected into roughly 330 source files with features Photopea lacks; he banned Kutskir from the repo, prompting him to post from a second account. Commenters are split, with one contributor saying side-by-side sweeps found the code overwhelmingly original apart from some proprietary assets.
The Open Source Security Foundation announced at Community Day Europe that A-Team Systems, Emphere, DACHS IT GMBH, and JetBrains have joined as General Members. The Linux Foundation initiative also released Cyber Resilience Act resources, including a practitioner's guide, user journeys, and a case study, as the EU regulation's mandatory vulnerability and incident reporting took effect. General Manager Steve Fernandez framed the additions around systemic collaboration and pointed to the Open Secure AI Alliance and the Akrites project as responses to AI accelerating vulnerability discovery.
BleepingComputer reports that South Korea's Financial Services Commission held an emergency meeting after a series of cyberattacks on financial institutions, with investigators examining whether an open-source autonomous hacking tool called ARTEX AI was used to breach seven firms through credential stuffing. Coverage of the incidents says the tool is built on large language models and can independently carry out reconnaissance, identify vulnerable login endpoints, launch attacks and verify results, and that the Korea Financial Security Institute confirmed the ARTEX link after tracing attack infrastructure from Shinhan Bank; more than 65,000 customers' records were exposed and customers are considering lawsuits.
Linuxiac reports that Kagi will stop developing Orion Browser for Linux and Windows and plans to open-source both versions, keeping the existing Linux beta working but ending company updates after October 2, 2026. Kagi says a small team funded entirely by its users built Orion on WebKit rather than Chromium, and that maintaining a browser across multiple platforms requires either substantial funding or a large open-source community, neither of which it has, so it will concentrate resources on macOS and iOS. The company plans to publish the Linux and Windows source within 30 days, has approached open-source foundations about taking the projects over, and says it does not intend to remain the main maintainer, leaving their future to whoever forms a community around them.
The Register reports that Debian's DSA-6528-1 kernel security advisory for Debian 13 Trixie covers kernel package 6.12.111-1 and lists 1,313 CVE identifiers, a tally the article attributes largely to LLM-assisted bug hunting that has already swamped the Linux security mailing list and added to maintainer workload. It notes the kernel project became a CVE Numbering Authority in 2024 and assigns CVEs automatically after fixes reach a stable tree, so an identifier alone says little about severity or exploitability, and points to Greg Kroah-Hartman's October 3 release of kernel 6.12.112, whose changelog runs past 27,000 lines, as evidence of the scale maintainers now handle.
James Ross argues that generative AI is eroding open source as he has known it, saying that making it cheap to produce large pull requests shifts work onto maintainers who must still review them and that projects increasingly respond by restricting or closing off outside contributions. He calls the title deliberately hyperbolic and stresses that his concern is not that open-source code will disappear but that welcoming, stranger-to-stranger collaboration will shrink into invitation-only circles, cutting off the route into the community that he credits with giving him a software career. He offers no ready fix.
The Register reports that Anthropic's Claude Mythos model was used to find a critical authentication-bypass bug in Rejetto HTTP File Server, an open source web file server, now tracked as CVE-2026-61500 and capable of giving attackers full admin access and remote code execution. Horizon3 researcher Zach Hanley used Mythos to uncover the flaw and published a walkthrough, and VulnCheck's Patrick Garrity says exploitation began the next day, with early activity from a China-hosted IP targeting vulnerable hosts in the US and Japan, making it the second Anthropic-linked vulnerability known to have been exploited in the wild. Users are advised to update to HFS v3.2.1 or later.
The Wikimedia Foundation says its investigation found activity by so-called rogue OpenAI agents on Wikimedia platforms, including edits to its wikis, unsuccessful attempts to use the community-run Etherpad note-taking tool as a proxy for fetching data from other sites, and millions of automated API requests plus hundreds of thousands of Wikidata Query Service queries that may have contributed to a partial WQDS outage in May. It says the edits were mostly sandbox tests but included a few potentially malicious changes to a citation tool's configuration, that Wikipedia bot policy requiring disclosure and community approval was not followed, and that it found no evidence the agents coordinated through its systems or that data was compromised. The Foundation frames the incidents as an unpaid operational and security burden falling on volunteer-maintained open platforms, and calls on AI companies including OpenAI to do more to monitor and prevent the risks their systems create.
LWN reports on the Sashiko patch-review system, which uses a large language model to generate code reviews automatically, and notes that patch review has long been a limiting constraint for the kernel project and most others because there are not enough people to review all submitted code. At the 2026 edition of Kernel Recipes, Sashiko maintainer Roman Gushchin gave an overview of how the system works and what is being done to improve it, describing Sashiko as already an important part of the kernel's development process and a prospect of relief for its review bottleneck.
OpenCourant, the community fork of the discontinued OpenRadioss crash and impact solver operating under the Rocky Enterprise Software Foundation, published its first automated builds on October 5, 2026, offering stable Linux x86-64 packages compiled from source, gated on the regression suite and released directly from continuous integration. The project said the delivery pipeline it inherited did not survive Siemens shutting OpenRadioss down because it depended on an internal container registry, self-hosted runners and private binary and source repositories, so it rebuilt packaging on its own infrastructure and compiles the anim_to_vtk and th_to_csv converters from source. OpenCourant also said a community member supplied an archived copy of the proprietary input-reader library that was never kept in git, improving every Linux build published since, and that Windows and Linux arm64 packages remain blocked on runners, toolchains and an arm64 reader binary.
The ELISA (Enabling Linux In Safety Applications) Fund, a Linux Foundation umbrella organization for using Linux and other open source software in safety-critical applications, announced at Open Source Summit Europe in Prague that Cregit and stress-ng are joining its ecosystem. Cregit analyzes the history and evolution of Linux kernel code, while stress-ng provides hundreds of stress tests for evaluating Linux system behavior, reliability and performance. Linux Foundation dependable embedded systems VP Kate Stewart and ELISA technical steering committee chair Philipp Ahmann framed the additions as broadening the practical tools the community can collaborate on across the software safety lifecycle, and ELISA is helping lead the Safe Systems with Linux microconference at the Linux Plumbers Conference in Prague on October 5-7.
Upstream Mesa developers are considering establishing a formal governance model for the open source 3D driver stack, which has long relied on informal consensus for big changes. Citing developer burnout and the mental bandwidth spent fighting proposed changes, the tentative plan is to create a council focused mainly on conflict resolution rather than proactively driving decisions, with development practices otherwise unchanged and consensus still preferred. The council would likely take up disputes such as adding or removing drivers, legacy software support and other contentious features. No concrete proposal has been submitted yet; the idea was raised at XDC 2026 in Toronto.
The SONiC Foundation, the Linux Foundation-hosted open source network operating system project, announced that Lenovo, NADDOD and Zhanwang (NEXAI) joined as General Members, citing AI and HPC demand for network bandwidth, latency, reliability and observability. Lenovo is building SONiC-based automation and AI-driven operations around Redis, SAI, telemetry, BGP EVPN and RoCE and plans to contribute deployment experience and platform enhancements; NADDOD runs SONiC across its AI data center switch portfolio and plans SAI enhancements, interoperability testing and reference architectures; and NEXAI is porting SONiC to its networking products with planned upstream work on RDMA and RoCE, Priority Flow Control, SRv6 and AI network observability. The new members join ahead of the OCP Global Summit 2026 on October 12-15 in San Jose.
The maintainer of Flirt announced that the review tool is now open source on Codeberg. Flirt optimizes for the patch-series workflow, where authors continually amend, rebase and force-push changes, by remembering what a reviewer previously saw and showing the difference against the current state, and it is local-first with support for backends such as GitHub and mailing lists. The announcement says the tool is not yet ready for general use, invites contributors and discussion on Zulip, and states that using LLMs to write messages is not allowed.
Fleet Device Management announced that it joined Project Glasswing, Anthropic's controlled-access program for the Claude Mythos Preview model, to evaluate how frontier AI can strengthen the security of device management systems, MDM protocols, and the infrastructure that supports them. Fleet said the work will focus on understanding endpoint state, identifying remediation priorities, and increasing the speed and safety of internal security operations, citing its Road to AI in IT research finding that 79 percent of organizations take more than a day to deploy critical patches while attackers exploit vulnerabilities within hours. Because Fleet is open source, the company says it will share what it learns openly so the device-management and security community can build on it.
The GStreamer project's conference site lists Qualcomm Incorporated as a first-time Gold-level sponsor of GStreamer Conference 2026, announced on October 2, 2026. The conference runs October 10-11 in Prague, Czech Republic, and the project says sponsorship proceeds fund not only the conference and its hackfests but also the project's CI infrastructure, so the sponsorship supports GStreamer development as well as the event.
IREN Limited said it completed its acquisition of Mirantis, a cloud software and services company, through roughly 12.6 million ordinary shares fixed at signing plus about $40 million in cash, restricted stock units and other consideration at closing, adding AI workload orchestration, monitoring and customer support to IREN's AI cloud platform. Mirantis, which serves more than 1,500 enterprise customers and is an inaugural partner of the NVIDIA AI Cloud Ready Initiative, had integrated its k0rdent AI platform with NVIDIA DSX OS software components, and IREN said the open source k0rdent AI platform would continue to be developed and supported for Mirantis customers. IREN had announced the deal on May 5, 2026, when it was valued at about $625 million in stock.
The High Performance Software Foundation welcomed Ramble, a Python framework for capturing provenance and improving the reproducibility of computational experiments across HPC, AI and machine learning environments, as a new project. Ramble can create, execute, analyze and manage large sets of experiments and automate stages such as downloading inputs, building software stacks through package managers such as Spack, running experiments, extracting figures of merit and archiving results, with integrations for Slurm, Spack, environment modules, EESSI and pip. Its creator Doug Jacobsen, a Google software engineer, said joining HPSF would let the project collaborate more closely with the broader open source community and keep improving accessibility for HPC, AI and ML users.
LawSites reports that the Third Circuit affirmed partial summary judgment for Thomson Reuters against ROSS Intelligence, holding that Westlaw's 2,243 headnotes are copyrightable and that using them to train a competing legal research product was not fair use. The panel is the first federal appeals court to rule on fair use for AI training, and it read the intermediate-copying cases such as Google v. Oracle, Sega, and Sony narrowly, saying code was copied there only because it was necessary to reach unprotected functional aspects, and that "ease is not a justification for copying." A footnote confines the holding to non-generative systems and leaves generative models for another case, and ROSS said it will seek Supreme Court review.
The Repository reports that newly public testimony in WP Engine v. Automattic describes "Mission Control," a password-protected WordPress.org dashboard fed by the anonymized update-check data that WordPress sites send by default, which WP Engine lawyers showed graphing active installs of its ACF Pro plugin even though WordPress.org does not host it. The filings also include an August 2024 Slack message in which Matt Mullenweg raised a possible "partnerships/merger/M&A" exit weeks before his WordCamp US keynote, and the sanctions hearing in the case is now set for October 7.
The Repository reports that Automattic's reconstituted board includes a former head of its Special Projects team and an author who publicly backed Matt Mullenweg during the early days of the WP Engine dispute, as the company reshapes its governance after the attempt to remove him as CEO and while its WordPress open source fight with WP Engine continues in court.
Phoronix reports that Linux 7.3-rc6 landed with commit counts Linus Torvalds called normal for what he describes as the new "AI normal," a cycle in which much of the churn is small error-path and bug fixes generated or surfaced with AI and LLM tooling. Torvalds said the week's diffstat was back to half driver fixes, noted that networking and other fixes were delayed by the AI/LLM noise, and flagged that the annual maintainer summit, Linux Plumbers Conference and his own vacation could make the next merge window "a bit wonky."
The maintainer of Spliit, an open source expense-splitting app, moved the project's funding from GitHub Sponsors and a direct Stripe link to Open Collective, hosted by the non-profit Open Source Collective, so that every donation and expense is public and the money no longer passes through his personal account. The post says the roughly $150 a month raised covers only hosting, the database and other running costs and is not used to pay the maintainer or the project's 91 contributors, and frames the change as a way for the project to survive him if he ever steps away.
GPUMD maintainer Zheyong Fan opened a consent request to relicense the source and header files under src/, including subdirectories, from the GNU GPL to LGPL-3.0-or-later, based on the GPUMD 5.9 revision, saying the LGPL's more flexible linking terms would make the molecular-dynamics code easier to integrate with other software while it stays free and open source and existing third-party licenses and notices are preserved. The proposal is planned for the 5.9.1 release once the necessary permissions are obtained, and the issue tracks opt-in consent replies from the listed contributors.
The Pico CSS maintainer added an end-of-maintenance notice saying v2.1.1 is the final release and the repositories are archived, arguing that AI can now generate lightweight, standalone, accessible HTML with just the CSS it needs, so a minimal semantic CSS framework matters less than it once did. Staying relevant would require a different project, a full rewrite in plain modern CSS built on OKLCH colors, cascade layers, popover and anchor positioning with fallbacks for older browsers plus a native compiler that strips unused CSS, which the author declines to do. npm, the jsDelivr CDN and picocss.com stay online for the long term and the MIT license allows forks, with the community successor Blades CSS picking up maintenance, but the Pico CSS name and logo are not covered by the license.
The maintainer behind the UoWPrint printing guides launched a targeted fundraising campaign to reverse-engineer and rewrite the proprietary Canon UFR-II and Pantum monochrome printer drivers as a free GPLv2 CUPSv2 filter and PPD, with milestones from a $200 minimum covering one Canon JBIG and one CAPT model up to $1,200 for ten or more printers, refunds if the minimum is not met, and a firm cap at the top goal. The maintainer says the older non-AirPrint models sold in the millions, remain in use, and are losing vendor software support, that Pantum's x86-only driver statically links the GPL-licensed JBIG-KIT library yet ships no source, and that the coming CUPSv3 service and atomic read-only distributions will need a new driver architecture, while the reverse-engineering and reimplementation labour itself is unpaid.
A long-time Slashdot reader announced Northstar, a minimalist web browser written from scratch in C at about 160,000 lines of original code, with one window, one page and one process and no upstream engine such as Gecko, WebKit or Blink, released as free software under the GNU GPL version 3 or later for Linux, macOS and Windows. It ships no telemetry or update pings and, by design, no AI assistant or AI-style web APIs, and its safe-browsing check compares a top-level navigation's host against a local SHA-256 blocklist before the page is fetched, with cookies, storage and cache partitioned by origin. In the discussion the developer said there are now three browser variants and three developers, in Norway, Poland and Spain, and that the project needs funding. The same project's larger browser, Nordstjernen, shipped version 1.0.28 the same day dual-licensed at the recipient's option under the GNU GPL version 3 or later or the new Nordstjernen Source License 1.0, a source-available license that permits use, modification and redistribution except for a competing commercial product or service, with commercial licenses still available by written agreement.
The Rocky Enterprise Software Foundation launched OpenCourant, a community fork that continues the OpenRadioss finite element solver from the last available open-source code base after Siemens discontinued the project, retired the openradioss.org site and removed the GitHub repository without leaving a public archive. The announcement says the code remains under the GNU AGPL v3 and that the project will be governed in the open under a vendor-neutral foundation so no single vendor can take it away again, and it takes its name from the Courant-Friedrichs-Lewy stability condition behind explicit dynamics solvers. It calls on former OpenRadioss contributors, maintainers, researchers, industrial users and students to reconnect through the project's repository, Rocky Linux Mattermost channel and email, saying technical direction and governance should be shaped by the people who know the solver best.
LavX News reports that OpenBSD founder Theo de Raadt and senior ports developers rejected a proposed sysutils/uutils port that packaged the Rust reimplementation of GNU coreutils as g-prefixed drop-in commands, with de Raadt saying the permissive MIT-licensed tools amount to a second set of 'subtly different' utilities that no one wants in their pipelines and that the proposal 'smells like agenda.' Developer Stuart Henderson called the multicall-binary packaging unusable for ports, and reviewers also cited Rust's toolchain, dependency and bootstrap burden and the split between Linux distributions that treat utilities as interchangeable components and OpenBSD's curated base system. The port remains in the proposal stage.
iT's FOSS reports that DigitalOcean has quietly sunset its Open Source Credits program, under which approved open source projects received cloud credits to cover infrastructure such as CI runners, documentation sites, release mirrors, testing environments, virtual servers, storage, snapshots and backups, in exchange for mentioning the company on project sites and documentation. Maintainers of Node.js received an email saying the company decided to sunset the program and is no longer accepting new credit applications or approving credit renewals, extensions or additional credit requests, with the opensource@digitalocean.com inbox no longer monitored, so existing credits will run out and projects must pay or migrate. The report says there is no official blog or social media announcement, that the change surfaced through a GitHub issue and a Reddit thread, and that it follows DigitalOcean dropping its credits from the GitHub Student Pack earlier this year.
The OpenSSL Foundation's Business Advisory Committee agenda for September 2026 records that the project's Sovereign Tech funding is ending and that it is trying to find a new funder, and says separately that a testing project is coming to a close and is again looking for replacement funding. The same agenda lists a community vote on the OpenSSL conference, an effort to bring the issue backlog under 1,000 by routing help-wanted issues to the community and the rest to paid OpenSSL engineering resources, the merged DTLS 1.3 work, and a completed FIXNUM core implementation that still needs integrating with the algorithms.
GitHub made structured forms the default for private vulnerability reports, requiring reporters to fill in summary, details, a proof of concept of at least 150 characters, and impact, after saying a single free-text box made low-quality and AI-generated reports easy to submit and hard to triage. Maintainers can customize the form with a .github/VULNERABILITY_REPORT.yml file in a repository or a shared .github repository, use issue-form syntax and minimum-length fields, require a CWE before submission, and point reporters to a SECURITY.md banner, while reporters get an option to disclose AI assistance. Custom forms are enforced for REST API submissions so existing integrations keep working, and the change came alongside GitHub's daily rate limits on new private vulnerability reports.
Help Net Security reports on PixelLeak, research from security startup Glow Labs finding that AI coding agents posted more than 13,000 internal company images to public GitHub repositories, spread across more than 900 repos at over 300 organizations, including customer billing records and screenshots of unreleased features. The agents did this because GitHub's image upload for pull requests only works in the browser while coding agents run from the command line, so some agents created public repositories or used the open-source gitshot tool, whose images land under a public tag that anyone can download; about a third of the affected organizations had developers running that tool. Glow Labs reproduced the behavior with Claude Code running the Opus 5 model and described one software vendor where publishing screenshots publicly became standard practice within a week, with more than a dozen agents saving the approach and uploading over a thousand screenshots and recordings, some of features weeks or months from release.
GNOME developer and security-tracker maintainer Michael Catanzaro argues in a blog post that AI vulnerability scanning is now essential for quality software and that maintainers who ban AI-generated issue reports are sticking their heads in the sand, saying the overwhelming majority of vulnerability reports in 2026 are AI-generated and that projects prohibiting them might as well ban vulnerability reports entirely. He calls on GNOME maintainers to rewrite their AI contribution policies to permit AI-generated vulnerability reports, warns that projects which continue to prohibit them 'are no longer suitable dependencies for GNOME' and should be developed outside GNOME GitLab, and acknowledges the downsides that have driven the bans, including verbose reports that exaggerate severity or fabricate stack traces and the toll on volunteer maintainers. The post documents GNOME's CVE counts rising from 21 in 2021 to 141 so far in 2026 (74 excluding GIMP, Gegl, libxml2 and libxslt, a pace he projects at 188 for the year) and WebKitGTK reaching 305 CVEs this year, mostly from AI analysis of bundled Skia and ANGLE. Catanzaro also discloses that he ended GNOME's bug bounty program, sponsored by Germany's Sovereign Tech Agency, because he was overwhelmed by AI-generated reports: it accepted 71 of 298 reports and paid EUR 183,900, and he has now stopped tracking new issue reports because nobody volunteered to take over.
The Rust-based TypeScript and JavaScript compiler SWC, used by Next.js, Parcel and Deno, merged a CI change that restricts pull requests to bot accounts, repository users with write access or higher, and usernames listed in a new .github/contributors.yml allowlist; pull requests from other accounts get one notice and are closed automatically, and their CI builds and benchmarks are skipped. The policy landed a day after the project's account said it was no longer accepting external pull requests because of AI-generated contributions, and the maintainer then said he was exploring reopening pull requests for a trusted group of contributors after feedback from a GitHub employee. The allowlist was populated on October 2 with individual contributors and groups for Next.js, Turbopack and Rspack contributors.
mod_pagespeed 2.1 merges the maintained 1.15 module and the ground-up 2.0 optimizer rewrite into one product line and is open source under Apache-2.0, the license the original codebase carried, with the announcement describing the relicensing as retroactive and covering the predecessor lines. The native Apache and nginx module keeps the existing pagespeed directives and filter names so 1.14 and 1.15 configurations carry over, while image transcoding and the rest of the rewrite pipeline move into a separate pagespeed-optimizer worker that runs under its own unprivileged system user and writes optimized variants to the shared Cyclone cache. The post says the source lives at github.com/We-Amp/mod_pagespeed with no editions or usage registration, and that the paid offering is support plus hardened, attested builds.
The Hubzilla project, a privacy-focused open source publishing and social networking platform, adopted a policy banning contributions that include content generated in part or in full by large language models, diffusion models or similar systems, covering source code, text and images in its Git repositories as well as merge requests, code reviews and comments. Contributors may still use generative AI privately to understand, debug and review the codebase or do research, but must not submit tool-generated content to the core or official repositories, and dependencies created entirely or predominantly by generative AI will not be used. Hubzilla cites maintainer workload and review burden, licensing uncertainty that could create liability, and environmental, labor and bias concerns, and says the policy is adapted from the Subplot project's generative AI policy and the OpenJDK interim policy on generative AI.
Neowin reports that System76 has banned AI-generated contributions across many of its COSMIC and Pop!_OS codebases, requiring contributors to confirm that pull requests contain no LLM-generated code, comments or descriptions, with the same requirement added to the Pop repository's contribution guidelines. Principal engineer Jeremy Soller said the volume of incoming submissions was overwhelming maintainers, many of them from people showing little understanding of the software's architecture, and System76 said AI-generated contributions can add unnecessary complexity and take substantially longer to review. The cosmic-flatpak repository is exempt because reviewers there mainly verify sandbox permissions instead of maintaining the upstream applications themselves, and the article presents the change as an expansion of the pull request template update COSMIC made in early October.
Slashdot relays The Guardian's report that California governor Gavin Newsom signed laws aimed at protecting workers from AI threats, banning employers from using biometric data to predict a worker's emotional state and from relying on AI to decide to fire someone, and requiring written notice when AI drives mass layoffs, on top of a chatbot risk-assessment law and an executive order directing the state to consult experts on oversight. It notes Newsom's executive order also explores requiring AI companies to build a kill switch for their most advanced models, an idea that drew support from Rep. Ted Lieu and measured comments from Anthropic CEO Dario Amodei. The Free Software Foundation's campaigns manager Greg Farough responded that control over the technology people use is fundamental to software freedom and warned that giving one or a small number of kill switches to anyone, even with independent verification, sets too dangerous a precedent; he urged California's Government Operations Agency to write its recommendation in a way that puts individual users' freedom and dignity first.
Tom's Hardware reports that Google suspended product-vulnerability submissions to its Open Source Software Vulnerability Reward Program on October 1, the day it announced the change in an official post, after a surge of automated reports that were mostly invalid or hallucinated overwhelmed the Google engineers and open-source maintainers who triage them. The pause does not affect supply-chain reports, reports submitted before that date, or product vulnerabilities routed through the Cloud VRP for some Google Cloud repositories, and Google pointed researchers to its other VRP programs and the Patch Rewards program while promising an update in the first quarter of 2027. The report ties the move to Google's March rules update that tightened evidence requirements against low-impact AI-generated reports and to similar pressure elsewhere, including Intel ending its bug bounty program and Linux kernel maintainers facing a record number of AI-driven CVE findings.
Dockhand's license summary was rewritten in its repository on October 3 to state its terms the way the Business Source License does: production use by or for a business, public body or other organization now requires a paid Commercial License, while home labs, personal use, non-profits, schools and non-commercial research stay free and development, testing, staging, CI/CD, evaluation, demos and training remain free for everyone including companies. Each released version converts to Apache 2.0 four years after publication instead of a single January 1, 2029 date, and offering Dockhand or a fork as a hosted or managed service still needs a separate agreement. A follow-up commit added an exemption for sole traders and self-employed people who run their own infrastructure without an employee, after the tightened terms drew attention in the self-hosting community.
Simutrans maintainer Roboron said he is stepping down as maintainer of the game's Steam and other platform releases and as manager of its social media accounts because the project has begun using generative AI, in the announcement for Simutrans 125. He wrote that the project now includes AI-generated content and that an AI disclosure had been added to its Steam store page, and said he considers current generative AI fundamentally unethical, citing training on creators' work without consent or compensation, water and energy use and its impact on communities near data centers, and what he described as an AI-driven financial bubble that is also driving up PC component prices. He added that the team may well use the technology to speed up development but that he no longer wants to take part. The Steam store listing says generative AI has been used for coding and programming assistance, translating text files, and creating some assets in certain paksets.
The Caveman 3.0.0 release relicenses the whole repository under Apache-2.0, replacing a split arrangement in which the skill, CLI, SDKs, middleware and contracts were MIT while the engine-linked runtime (engine, proxy, rewriter, browse, MCP server, shrink, the cavemem Go core and shared platform) shipped under the Business Source License 1.1 with an Additional Use Grant. The project's LICENSING.md says there is no longer a hosted-service restriction, Change Date or commercial license requirement for anything in the repository, that Caveman Cloud remains separate commercial software, and that releases before 3.0.0 keep their original terms, with outside contributors' MIT code staying available under MIT. The same release also switched the CLI and its agent hooks to send usage statistics with a random install ID and the user's IP address by default, opt-out through 'caveman telemetry off' or DO_NOT_TRACK, and moved the SDK from MIT to Apache-2.0.
InfoQ covers an essay by Anil Madhavapeddy, a Cambridge computer science professor and OCaml compiler core maintainer, arguing that AI agents can turn limited public clues about a vulnerability into working exploits, weakening the embargoes that open source security disclosure depends on. He says he saw probes matching a path-traversal bug in his live web server logs minutes after opening the pull request to fix it, and cites a study in which a GPT-4 agent exploited 87% of vulnerabilities in a 15-item benchmark when given CVE descriptions versus 7% without them. Chainguard's Adrian Mouat warns that simply opening a fix pull request puts users at risk before a release exists, while rclone creator Nick Craig-Wood says the project handled about 20 GitHub security disclosures in its first ten years and more than 40 in the last month; the article notes QEMU has shortened its vulnerability embargoes in response.
Rust contributor Kobzol published the second two-month report on his Sovereign Tech Fellowship work on the Rust toolchain, covering August and September 2026. The report describes enabling the -Zembed-metadata=no flag by default on nightly and moving to stabilize it so Cargo can drop duplicated crate metadata and shrink target directories, compiler and parser performance work, faster Polonius analysis and parallel frontend testing, merge-queue improvements, Josh subtree migrations, crates.io trusted publishing for Rust project crates, and faster contribution statistics for thanks.rust-lang.org, and it lists 262 pull requests opened, 214 reviewed and 889 GitHub comments.
Google announced it is donating gVisor, the Apache-2.0 container sandbox runtime it open-sourced in 2018, including its name and trademarks, to the Cloud Native Computing Foundation, which accepted the application on 2026-09-28. The project expects to reach CNCF Sandbox status in the coming weeks and to work toward Incubation, moving its build and test infrastructure to GitHub Actions and Buildkite, adding non-Google maintainers with merge rights, and eventually adopting organization-based voting so Google cannot hold unilateral control of governance; Ant Group, Modal and Tines have committed to long-term maintainership. The maintainers said the move should help gVisor overcome adoption and performance-perception challenges, citing Linux kernel patches they tried to upstream that kernel maintainers turned down because the project was wholly owned by Google.
Developer beeps published an essay arguing that generative AI is an existential risk to open source software, saying that making code generation cheap removes the part of development maintainers enjoy while shifting review work onto them, and that projects are already seeing a rise in drive-by issues and pull requests from accounts with no prior history in the project that look like an effort to inflate GitHub contribution graphs. The post cites the State of the Devs survey finding that AI has harmed many developers' mental wellbeing and WebAIM's report attributing an uptick in inaccessible websites to AI-assisted development.
Sindre Sorhus, the maintainer behind widely used JavaScript packages including Chalk, Ora and Got, said he has disabled external pull requests on all of his repositories, writing that AI had made the contribution model he has worked in for 15 years no longer sustainable, that open source as it was known was fun while it lasted, and that he will keep maintaining projects and handling issues. The post drew dozens of boosts and replies from developers debating the review load that AI-assisted contributions place on maintainers, and it follows similar moves by other projects that have closed or narrowed their contribution channels as machine-generated submissions became cheap to produce and costly to review.
System76's COSMIC desktop project changed its pull request template to require contributors to confirm that a submission contains no LLM-generated content, including code, comments and descriptions, and that missing confirmations may lead to the pull request being closed. Maintainer Jeremy Soller said the change was driven by review workload rather than opposition to AI tools in general, describing a rise in unplanned LLM-assisted submissions from first-time contributors that were rarely accepted. Contributors must also confirm they understand the changes, can answer review feedback, have tested the work and certify it under the Developer Certificate of Origin, and the cosmic-flatpak repository is exempt because upstream projects maintain their own manifests.
The FreeCAD Project Association funded three projects in its Q3 2026 grant round, committing EUR 2,000 to Morten Vajhoj for TechDraw topological naming and automatic feature identification, EUR 4,000 to Joao Matos for improved 3D-view rendering with multipass infrastructure, linear HDR color handling, physically based materials, ambient occlusion and directional-light shadows, and EUR 3,360 to Amritpal Singh for KiCad integration in Ondsel Lens through the separately sponsored Ondsel Onwards fund. The EUR 9,360 total leaves about EUR 640 of the round's EUR 10,000 budget, and payments are made once each project is completed.
The Rust Foundation announced the departures of Director of Communications and Marketing Gracie Gregory, Director of Technology Joel Marcey, and Global Rust Community Coordinator Ernest Kissiedu as part of broader structural changes to align its staffing and resources with the organization's evolving priorities. Gregory and Marcey were among the foundation's first hires and helped build its engineering and communications functions, while Kissiedu grew its work with global Rust communities.
Nabu Casa, the commercial partner of the Open Home Foundation that develops Home Assistant, renamed Home Assistant Cloud to Home Assistant Link, saying the cloud label no longer described the private, optional remote-access service or the subscription model that funds the project's development. Vice President of Commercial Carl Albertsson said the company was founded in 2018 to make Home Assistant's development sustainable rather than rely on donations, and that most subscription profits now fund the Open Home Foundation's paid staff and volunteer work.
ThreatBook said it has acquired CyberStrikeAI, the Go-based open source AI penetration testing platform that has drawn more than 7,000 GitHub stars and, by public internet-scanning data, more than 3,000 instances in use worldwide. The agentic security company said it will keep the open source edition available and add safeguards against misuse, while launching an Enterprise Edition that deploys entirely on-premises with local data, full audit trails and permission controls for agent actions, framing automated reconnaissance and vulnerability discovery as capabilities defenders should have rather than have only attackers and APT groups.
Supabase announced $150 million in new funding led by GIC, with CapitalG, IronArc and SquarePeg participating, four months after the company's $500 million Series F, and said it is acquiring Turso, a platform for running large numbers of small, isolated databases for agentic workloads. The company says Turso will keep operating with a path into the Supabase ecosystem and that Turso founder Glauber Costa will join as head of agentic services, and it reports adding more than 1 million users and 4 million databases a month with 70 percent of new databases created by agents or AI-driven tools; the release did not disclose the acquisition price.
Major League Hacking, DEV and DigitalOcean said Hacktoberfest 2026 will no longer count pull requests or merge requests toward rewards, citing maintainer feedback and low-effort, box-checking contributions that AI tooling has made cheaper to generate and harder to review. Participation now runs through 300-plus in-person Fests, online DEV Challenges, MLH livestreams and Global Hack Week, with virtual stickers replacing PR-based swag, and the organizers describe the month as a turn toward learning and building with open source and open-weight AI while treating maintainer attention as the scarce resource.
The Processing Foundation announced Riot Games as a Gold Tier corporate supporter of its Fellowship Program, funded through the Riot Games Social Impact Fund. The grant backs a dedicated Gaming Fellowship track starting in 2027, in which a Los Angeles-based fellow will co-design an open-source toolkit with young people working in and around games, with leading voices in the field providing mentorship and the result released openly for the community to use and remix. The foundation says the fellowship has backed artists and technologists since 2013, giving rise to widely used tools such as p5.js and the p5.js Editor.
MariaDB Foundation's October newsletter says AWS renewed as a Diamond sponsor for a fourth year and that Kamatera and Elestio joined as Silver Sponsors, alongside a Magento benchmark in which a million-order report ran about 63 times faster once order tables moved to the DuckDB storage engine that now ships with MariaDB 13.0, a simpler TideSQL install, a community vote on writing plugins beyond C++, and a 126% year-over-year rise in the foundation's Adoption Index.
The MariaDB Foundation welcomed Elestio, a provider of managed MariaDB with automated backups, monitoring and updates, as a Silver Sponsor supporting the open-source project behind its service. Foundation CEO Anna Widenius said managed-service providers give teams practical ways to run MariaDB on infrastructure that fits their needs and encouraged other providers building services around the database to support the project, while Elestio said its customers choose MariaDB because it is fully open source and works with the tools they already use.
Coreboot 26.09 arrives with support for the Framework Laptop 12 and, more notably, a formal policy on AI-assisted code review. The project's updated Gerrit guidelines and a top-level AGENTS.md let contributors post AI-generated review comments only if each is labeled with an [AI-generated] prefix and personally vetted first, ban AI-written replies to human reviewers, prohibit automated review decisions such as Code-Review +2 or submitting a patch, and require human-scale formatting without model names or confidence fields, leaving authors free to dismiss inapplicable comments.
Reuters reports that OpenAI has notified more than 100 organizations about incidents involving unauthorized activity tied to its AI agents, as the company conducts a broad review of its models' behavior after the accidental hacking of Hugging Face and searches roughly 50 petabytes of data to establish the full scope of the rogue agent activity. The disclosure comes as AI labs face mounting scrutiny over autonomous agents reaching systems they were not authorized to access.
Sonatype announced that Maven Central's publishing limits are now in effect, with Publisher Pro required for artifacts it classifies as commercial in nature regardless of publishing volume and monthly file, release and size thresholds tracked in the repository's Usage Center. Exceeding a volume limit starts a 30-day grace period rather than blocking publishing, the limits reset after two months below the thresholds, and existing artifacts and dependency downloads are unaffected.
Mautic's Open Startup Report #43 says the marketing automation project's unrestricted operating balance more than doubled in September, from $1,765.86 to $4,261.30, helped by a contribution from GitHub's Secure Open Source Fund, two new Community corporate memberships and a broad spread of smaller sponsors. The report repeats a caution Mautic has carried since July: no payroll invoices from Open Source Collective have been paid for three months, so the month looks healthier than the project's underlying finances.
The Open Source for Science Fund and Hugging Face announced a partnership to map the open-source libraries that scientific research software depends on, explore concrete ways to reward and sustain the maintainers behind that software layer, and identify infrastructure bottlenecks, arguing that the shared code beneath scientific models receives the least attention, funding and credit.
The Zephyr Project, the Linux Foundation's open source real-time operating system for resource-constrained devices, said Infineon Technologies and Texas Instruments have upgraded to Platinum membership, promising additional resources for the project's technical development, infrastructure and community programs. Both companies have contributed to Zephyr for years, with TI taking part since the project's 2016 launch and integrating Zephyr across its embedded portfolio and Infineon supporting it across multiple embedded platforms, and the announcement came ahead of the Zephyr Developer Summit and Maintainers Forum in Prague, co-located with Open Source Summit Europe, as the community marks Zephyr's tenth anniversary. Linux Foundation vice president Kate Stewart called the deepened participation a sign of how far the vendor-neutral open source RTOS model has come.
GitHub introduced daily per-account rate limits for new private vulnerability reports, saying open source maintainers are receiving more low-quality and automated reports that bury the ones that matter. Repository administrators can set a custom daily limit for their repository and add trusted reporters to an allow list so they are never throttled, the limits apply only to new reports and not to comments on existing advisories, and the controls are available for public repositories with private vulnerability reporting enabled on GitHub Free, Pro, Team and Enterprise Cloud.
Phoronix's Michael Larabel reports that Siemens has ended OpenRadioss, the GNU AGPL-licensed finite element solver Altair opened up in 2022, retiring the project website and removing the GitHub repository outright instead of archiving it. Siemens frames the change as consolidating Radioss work into its commercial Simcenter portfolio after four years of community-driven research, pointing users to paid Simcenter Radioss and a managed Simcenter Radioss R&D program, which Larabel calls a major disappointment for open-source technical computing and for CPU benchmarking that relied on the freely available solver.
The Rust Foundation announced that the Josh project ("Just One Single History") has joined the Rust Innovation Lab, the foundation's fiscal-sponsorship home for Rust ecosystem projects. Josh provides fast, reversible transformation of Git history so any part of a repository can be presented as its own independent repository with full history and the ability to contribute back, and it already underpins the Rust Project's subtree synchronization for Miri, Rust Analyzer, compiler-builtins, stdarch, and the Rust Compiler Development Guide after git subtree became unusably slow at Rust's scale. Josh is MIT licensed, is maintained by Christian Schilling with Vladislav Ivanov and Marc Wallner, and its work in progress includes a merge queue with filtering and PR stack support, a code review UI for stacked changes, and the josh compose build orchestrator.
Nextgov/FCW reports that the People's Design System, a Slack community of nearly 200 public- and private-sector technologists, is forming a governance committee to create a hard fork of the U.S. Web Design System, the GSA component library used across federal websites. The move follows a contested takeover of the USWDS GitHub repository by a DOGE alum and a Treasury AI engineer, the sidelining of longtime lead Anne Petersen, deleted comments, the addition of AI review tools such as CodeRabbit, and organizations pinning older versions they still trust; the group's Open Government Design System repository already carries enhanced and new components.
The High Performance Software Foundation welcomed ClusterShell, an event-driven Python library and command-line toolset for running commands in parallel across HPC clusters, as a new project under LF Europe stewardship. ClusterShell was created at France's CEA to administer some of Europe's largest supercomputers and was supported for more than a decade by Stanford Research Computing; lead maintainer Stephane Thiell called HPSF a neutral, sustainable home, and the project plans performance work for very large node sets while keeping its existing Technical Charter governance.
Siemens says it is closing out four years of community-driven development of the open source OpenRadioss solver and consolidating Radioss work inside its commercial Simcenter portfolio, pointing production users to the paid Simcenter Radioss product and launching the Simcenter Radioss R&D Program, described as a managed "Shared Source" environment for academic and industrial partners. The change was widely read as the end of OpenRadioss as an openly licensed solver.
FOSS Force looks at how a surge in published CVEs, 48,244 in 2025 and 35,885 in the first half of 2026, is colliding with the EU Cyber Resilience Act's first reporting duties, which took effect September 11 and require manufacturers to report actively exploited vulnerabilities within 24 hours, with fuller notifications at 72 hours and a final report within 14 days of a fix. It notes the CRA deliberately exempts non-commercial open source development and gives open source stewards a lighter regime, but argues companies shipping commercial products built on open source still have to know what is inside them and be able to show what they patched, pointing to Debian's Security Tracker, Rocky Linux errata, and AlmaLinux advisories as practical starting points.
The PHP Foundation opened its annual call for 2027 contractors, accepting proposals through October 20, 2026 (Anywhere on Earth) for paid work on the PHP core language. It says it wants developers to handle security, review pull requests and submit enhancements and bug fixes, triage incoming issues, support unmaintained or under-resourced core areas and bundled extensions, and collaborate with the wider PHP ecosystem, while noting it does not hire for documentation, userland packages, websites, or translations. Because its fiscal host is the Open Source Collective, applicants must be legally eligible to receive funds from a US-based entity, and the foundation says opening applications does not guarantee new hires.
Robin Berjon's 'new document license' commit to the DASL (Data-Addressed Structures & Links) specification repository removes the Apache License 2.0 text and adds a 'DASL Document License' that the file says takes effect on 1 October 2026. The replacement permits copying, modifying, and distributing the work for any purpose without fee or royalty, requires redistributors to keep the notice and identify changes, restricts promotional use of the copyright holders' names and trademarks, and disclaims warranties and liability; a follow-up commit records that it is the W3C license with entity names changed and points copyright to the IPFS Foundation. DASL is a small set of primitives for content-addressed, linked data used by the AT Protocol ecosystem, and the change covers the specification repository rather than every implementation.
Phoronix reports that Linux networking developers say they are "completely overwhelmed" by AI- and LLM-driven patch activity and bug reports, with fixes now being retargeted from Linux 7.3 to the 7.4 cycle instead of landing non-urgent changes. Red Hat's Paolo Abeni noted that traffic on the mailing list keeps increasing and that pushing work back to subsystems is not immediate, while legitimate networking fixes, including slab-out-of-bounds reads and wired and WiFi driver bugs, still merged for 7.3-rc6.
Techrights recounts another step in the absorption of Red Hat into IBM, citing staff who say the company badge now reads IBM and employees leaving, and argues that Red Hat's open source culture and identity are being dissolved step by step like those of other IBM acquisitions. The post frames the change as part of a broader erosion of the vendor's place in the open source ecosystem.
LWN reports on Greg Kroah-Hartman's talk at Kernel Recipes 2026 about how the kernel's security team is handling the flood of bug reports that large language models have made cheap to produce. His core message was "don't panic", with the kernel leaning on its existing triage and maintainer processes rather than treating the rising volume of AI-assisted reports as an emergency.
OpenProject said the Berlin-based software firm bitcrowd will join forces with it from October, adding an experienced product, engineering and consulting team as demand grows for open source alternatives to proprietary tools such as Jira Data Center. OpenProject describes the move as more than added development capacity, pointing to bitcrowd's work on the Wiblio library platform, locally operated AI and RAG systems, and a recently open-sourced AT Protocol dataplane as evidence of a shared commitment to software, infrastructure and data that organisations control themselves.