TFiR interviews John Mertic, director of program management at the Linux Foundation and the Open Mainframe Project, about a new infrastructure program that gives qualifying open source projects access to real IBM Z, z/OS and cloud-native mainframe environments for development, testing and education. The program addresses a long-standing gap in which mainframe hardware was too expensive and often air-gapped for most contributors to reach, leaving only a handful of specialist companies able to do porting and testing work; Mertic says the project has fielded questions about hardware access since its founding event at LinuxCon Toronto in 2015.
The Repository reports that Magistrate Judge Ajay Krishnan said at a hearing on WP Engine's spoliation motion that he is inclined to deny its bid to sanction Automattic and Matt Mullenweg over messages it alleges were destroyed, calling Mullenweg's September 2024 post inviting contact via Signal with disappearing messages "admittedly problematic" while saying the rest of the record did not support a finding of spoliation. WP Engine alleges Mullenweg's WhatsApp and Signal messages were not captured until 20 months after Automattic's duty to preserve evidence began and wants the jury instructed to presume the lost messages supported its claims, while Automattic argues WP Engine cannot identify a single missing message. The remarks mark a shift in tone from April, when Krishnan ordered Mullenweg to explain the missing messages under oath.
Phoronix reports that Sasha Levin of NVIDIA proposed adding AI agent resources to the upstream Linux kernel, starting with a skill that lets LLM coding assistants automatically add a "Fixes: " tag identifying the first problematic commit a patch fixes. The resources would live in a new agents/ directory at the root of the kernel source tree, or possibly under the existing documentation directory, and would collect skills, prompts and other material for coding assistants, referenced by the kernel's existing AI and generated-content documentation. Levin has worked on other kernel AI initiatives including proposing AGENTS.md, AI-powered merge conflict resolution and AI-assisted selection of patches for backporting.
Forrester principal analyst Dario Maisto argues that the message of Open Source Summit Europe 2026 was that organisations and governments which merely consume open source remain dependent on others to shape their future, while those that govern, maintain, secure and sustain the ecosystems gain influence, resilience, sovereignty and strategic leverage. He writes that open source has become critical infrastructure underpinning cloud platforms, AI systems, cybersecurity tools and digital public services while many projects still depend on small groups of maintainers facing growing security, vulnerability-management, compliance and community pressure, and that maintainer sustainability and documentation emerged as recurring concerns. Maisto cites the summit's four-stage sovereignty framework of integrity, resilience, continuity and interdependency, and the statistic that Europe contributes roughly 40 percent of open source activity while remaining underrepresented in governance and leadership, arguing that contribution without governance creates a gap because governance determines project direction, funding priorities, security investment and long-term roadmaps.
The Stack reports from the Linux Foundation's Open Source Summit in Prague, where BBC senior principal software engineer Tom Sadler described the broadcaster's fork of dash.js, the JavaScript implementation for playing DASH (Dynamic Adaptive Streaming over HTTP) content in browser-based environments, used by the BBC for streaming on its websites and connected-TV apps. Sadler said the BBC has used open source since it went online and has opened at least 85 projects built by its tech team, but that its particular requirements make it harder to contribute back, and he described the fork as one that is meant to be kept up to date with mainline rather than a divergence or a competitive or hostile fork. The talk covered the organisation's approach to maintaining the fork and the legal challenges of upstreaming its code.
The EDGE AI Foundation announced three new working groups and a strategic partnership with LF Edge, the Linux Foundation's vendor-neutral umbrella for distributed edge computing. The Physical AI / Robotics Working Group, led by NXP Semiconductors with representatives from AWS, Arduino, Analog Devices, DeepX and Johns Hopkins University, will define frameworks for autonomous systems to operate safely and effectively in human environments; a Security Working Group led by Exein and Dell will define best practices and architectures for protecting edge AI models, data pipelines and end-user privacy at the point of action; and an Interoperability & Standards Working Group led by STMicroelectronics and NXP will work on common protocols, benchmarks and standards across edge hardware and software ecosystems. Under the LF Edge partnership the two organisations will align LF Edge's open-source reference projects with the Foundation's working groups to produce repeatable reference architectures, with foundation CEO Pete Bernard and Linux Foundation general manager Arpit Joshipura framing the work as accelerating secure, scalable and interoperable edge AI deployments.
FOSS Force's Christine Hall reports that the Rocky Enterprise Software Foundation forked the discontinued OpenRadioss finite element solver as OpenCourant after Siemens pulled the project's code from GitHub in an apparent attempt to make it hard to fork, keeping the fork under the GNU AGPL v3. Brian Clemens announced the fork the same day Phoronix reported the shutdown, and the project recovered a proprietary input-reader library that was never kept in git after a community member came forward with an archived package that was verified against an independently recovered binary, restoring builds for Linux x86-64, Linux arm64 and Windows x86-64, though one reader function remains missing on every platform and the team is asking anyone with an August or September 2026 OpenRadioss package to check.
The Verge reports that SpaceXAI is joining the Omacom Foundation, which oversees David Heinemeier Hansson's Arch-based Omarchy Linux distribution, as a Founding Corporate Patron and donating $1.5 million worth of Grok tokens to the project. According to Hansson's blog post announcing the partnership, the tokens will primarily be used to accelerate development, review code and patch bugs. The Verge frames the move as aligning two controversial tech leaders and notes that 1Password and Cloudflare previously drew criticism for contributing to Omarchy over Hansson's political writing.
FOSS Force reports that IBM and Red Hat's AI-driven Lightwell platform identified and remediated more than 400 previously unknown vulnerabilities in popular Java libraries, a figure that rose from 300 in the embargoed draft to 400 by the final release. The announcement accompanied general availability of Clearinghouse, the part of the platform that lets users submit open source dependencies for review and remediation, previously restricted to financial services, while the other half, Network, offers Red Hat-rebuilt and signed secure package repositories. Lightwell VP and GM Gunnar Hellekson said AI agents shifted the threat landscape overnight and exploit old dependencies at machine speed, and Red Hat said applicable fixes are contributed back upstream under responsible disclosure protocols.
Anthropic launched the Anthropic Cyber Mission, a long-term commitment to help defenders secure software and systems, through which it says it will deploy engineering talent and provide tools and funding for those securing critical infrastructure and open-source software. It introduced the Critical Infrastructure Defense Program with founding partners including Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation, and for open source it launched OSS Scanner, an opt-in service inspired by Google's OSS-Fuzz that sends enrolled projects periodic free scans from Anthropic's most capable models with proof-of-concept exploits, explanations and suggested fixes, though the reports are model-generated without human review and expected to exceed 90 percent true positives. Anthropic said it funded the organizations behind widely used open-source code, including the Python Software Foundation, Alpha-Omega and OpenSSF through the Linux Foundation, and the Apache Software Foundation, plus Akrites and Gold Eagle, and launched the Defender Advantage Fund (0xDAF) in August to keep OSS Scanner free. Maintainers can also apply for free Claude Max subscriptions through Claude for Open Source and for expanded access via the Cyber Verification Program.
The OCUDU Ecosystem Foundation, hosted by the Linux Foundation, announced the OCUDU 26.10 release of its open source RAN CU/DU platform, adding 3GPP Release 17 non-terrestrial network support for 5G satellite connectivity, O-RAN Split 7.2b, 8T8R MIMO with enhanced beamforming and multi-beam operation, native 5G positioning, and security and latency improvements such as continuous fuzz testing, OSS-Fuzz participation and DTLS signaling encryption. The Linux Foundation says the foundation has welcomed 95 new members and doubled the technical project's active contributor count since launching, with participating organizations expanding tenfold, and it will co-host the OCUDU Ecosystem Developer Summit with Virginia Tech and the Commonwealth Cyber Initiative on October 20-22 in Alexandria, Virginia.
LWN reports on a Kangrejos 2026 talk by Tomáš Šedovič, a program manager at the Rust Foundation who co-leads the project's goals team, describing how the Rust project organizes, tracks, and amends its goals. The overview was aimed at helping Rust for Linux developers understand how goals are set and maintained and how contributors who take one on get the support they need, and notes that Rust for Linux has inspired several current project goals.
heise online reports on an opinion piece by Eric S. Raymond, co-founder of the Open Source Initiative, arguing that large language models spell the end of closed-source software. Raymond contends that AI-assisted decompilation and reimplementation remove the protection secrecy once provided, leaving only patents and software-as-a-service as viable moats, and predicts a hard collapse rather than gradual erosion, with at most niche survivors such as tax software whose value lies in continuously updated rules rather than code. He bases the claim on a personal experiment in which an AI assistant decompiled the DOS shareware game Firefighter and translated it into Rust for his Heritage Games Collection, saying the model inferred Borland Pascal from the data layout and produced readable code. On legality, he points to a US path modelled on Phoenix Technologies' clean-room IBM PC BIOS work, where someone converts a binary into a specification and generates new code without looking at the decompiled output, now achievable in about a day. The article notes that security researchers take a more nuanced view, that obfuscation is cheaper to defeat but not worthless and that code signing and secure boot prevent modified code from running but not from being read, and that Raymond expects reverse engineering to expose long-hidden intellectual-property disputes.
How-To Geek surveys the intensifying dispute inside KDE over what role, if any, AI should play, as a flood of generated contributions consumes maintainer time. It recounts KWin developer Vlad Zahorodnii's mailing-list post 'How to deal with fully LLM-generated merge requests', which complains about verbose replies that arrive impossibly quickly, compares the influx to a DDoS attack and suggests simply closing obviously LLM-generated requests. It details contributor Nate Graham's proposed policy, built on a human-in-the-loop principle that requires a person to make the decisions and the result to be functionally indistinguishable from unaided work, permitting LLMs for drafting and bug-finding so long as a human verifies and tests the output and allowing machine translation of one's own words, while prohibiting copy-pasted output the submitter does not understand. The article notes the practical difficulty of detecting LLM use, community objections that generated code may be plagiarised and incompatible with KDE's licences, KDE Eco's concerns about AI energy and water use, the strict no-AI 'KDE for the People' campaign, and an Akademy proposal for an AI-native KDE with a Kadai integration offering local AI, other models or none, concluding that the fight may split the project into pro- and anti-AI factions.
GamingOnLinux reports that Flathub has largely walked back the near-total ban on generative AI it introduced in May 2026, replacing it with a disclosure regime first amended on September 4. Submitters must disclose any AI-generated code, documentation, packaging or other material they know or reasonably believe is included in an application or its Flathub packaging, identifying the affected parts and approximate extent, while Flathub manifests must not contain AI-generated or AI-assisted content and disclosure does not exempt a submission from that rule. AI used only for research, discussion or debugging need not be disclosed when no generated material ships, other disclosed material is evaluated at reviewer discretion, and reviewers may reject a submission without further review over concerns about its review, quality or maintainability. AI tools or agents are barred from opening or automating Flathub submission pull requests or generating their commit messages, descriptions, review comments or replies, and submitters may not request AI-agent reviews; undisclosed or misrepresented material may be rejected. The article notes that leaving decisions to reviewers could produce inconsistent outcomes, with one app approved and another rejected.
The Register reports that ArtCraft has added WordCraft, plus Excel and PowerPoint counterparts, to its growing collection of Rust applications it describes as 'clean-room reimplementations' of proprietary software, built heavily with Claude and dual-licensed under MIT or Apache 2.0. WordCraft is at a pre-alpha stage the company estimates at 62 percent feature parity, with DOCX compatibility testing not yet begun and charts, SmartArt and embedded OLE objects dropped, and ArtCraft's repositories also model Photoshop, Illustrator and Premiere Pro. ArtCraft says the apps were built from public specifications and observation using original or openly licensed assets; the Document Foundation behind LibreOffice declined to comment and Microsoft and Adobe gave no substantive response, while lawyer Neil Brown told the paper the legal position would depend on jurisdiction and that an independent reimplementation may be non-infringing, though a deep-pocketed aggrieved party with a lot to lose could make litigation likely.
Dan Cohen marks the twentieth anniversary of Zotero's launch with an account of how the open source research tool took five years of collaboration among historians at George Mason University's Center for History and New Media before its first beta appeared, arguing that the slow, communal way it was conceived produced durable software rather than the ephemeral output AI can now generate instantly. He traces the project's origins in earlier tools like Scribe and Web Scrapbook and a naming process that ended with an Albanian dictionary and a lawyer's warning against 'Firefox Scholar', and notes the launch drew 60,000 users within a month, with additional funding from the Mellon and Alfred P. Sloan foundations later paying for syncing and for independence from the Firefox browser. Zotero is now maintained by the non-profit Corporation for Digital Scholarship.
Open Source Initiative executive director Duane O'Brien represented the OSI at the 81st UN General Assembly, speaking on a UN Digital Cooperation Day panel about defining Open Source AI and joining a Creative Commons symposium on openness and digital sovereignty, where he summed up the organization's position as 'Open by itself does very little but enables a lot'. He described the Open Source AI Definition as the product of two years of workshops in 18 countries and said the OSI will soon reopen conversations about it, and noted that the G7's Vision on AI Openness, which the OSI helped draft, now calls for releasing the training data developers can share and accurately describing what they cannot. The OSI also attended the inaugural 50-in-5 Awards for digital public infrastructure, stressing that software qualifies as a digital public good only if it carries an OSI-approved license, and O'Brien argued that open alternatives need decades of sustained investment to flourish.
Phoronix reports on Google engineer Roman Gushchin's status update at the Linux Plumbers Conference on Sashiko, the Google-built agentic code review system for the Linux kernel. In less than a year the open source tool, which works with Google's Gemini and other LLMs, has completed more than 191,000 patch reviews across 99 mailing lists, performed over 19 million autonomous git lookups, and drawn more than 7,600 replies from over 1,100 kernel developers. More than 1,277 upstream kernel commits this year cite Sashiko, along with 1,567 in linux-next, and 463 CVEs so far this year reference it. Google engineers are now working on a local terminal review mode, a persistent bug database, and self-review for Sashiko.
Its FOSS reports that several long-standing sponsors of Gentoo's infrastructure have stopped contributing, leaving the source-based Linux distribution asking for replacements because it runs largely on donated hardware and hosting and keeps only a few machines of its own. Gentoo's wiki lists five ways to help: donated machines for its US hosting sites, colocation with rack space, power and connectivity, virtual machines with at least 2 vCPUs, 4GB of RAM and 25GB of storage, fully hosted physical servers, or money to cover colocation and hosting; capacity outside the US is described as the most urgent need. The article notes the sponsors page still lists Oregon State University's Open Source Lab, CDN77, HP and Hetzner, and contrasts Gentoo's shortfall with LVFS, whose firmware update service now draws Premier-tier support of $100,000 a year each from Lenovo and Dell alongside backing from Framework, the Open Source Firmware Foundation, the Linux Foundation, Red Hat, HP and NVIDIA.
Diginomica reports from the opening day of Open Source Summit Europe in Prague, where Linux Foundation Europe GM Thierry Carrez noted that European contributors account for 38% of the code across the Linux Foundation's 620 projects (44% of the Linux kernel, 35% of Kubernetes, over 50% of Zephyr) but supply only 15% of foundation funding and take part in governance at just 37% of the rate they contribute code. Carrez drew a line between "public source", where code is merely visible, and genuine open source control that requires the familiarity to understand, operate and if necessary fork a project, warning that US and Asian firms already treat openly governed open source as a strategic investment. CNCF executive director Jonathan Bryce added that who operates the code matters as much as who writes it, citing OVH's push for "open operations" alongside open source.
EdTech Innovation Hub reports that Renaissance Philanthropy and XTX Markets have added $17.1 million to the AI for Math Fund, taking total commitments to $35.1 million. The 2026 Core Grants round was expected to hand out $10.5 million but was expanded after more than 470 applications, and will fund 22 proposals across 30 organizations with grants of $100,000 to $1 million over 12 to 24 months. Funded work includes AI-assisted theorem proving, research infrastructure and datasets, and open-source tooling such as TorchLean, which connects machine learning to the Lean proof checker, plus a browser-based visual proof environment for inspecting and editing long formal proofs.
Data Drop at sheets.works visualises who actually maintains 23 pieces of software that phones, browsers and servers depend on, counting everyone who made ten or more changes to each project between October 2025 and October 2026 and then checking which of those libraries ship on an Android phone, an iPhone and a Windows PC. It finds that 11 of the 23 projects had only one or two people doing the regular work, and sets that against what they are paid: Lasse Collin wrote 97 percent of xz changes in 2025 after years of unpaid hobby work that preceded the Jia Tan backdoor, core-js author Denis Pushkarev raised $57 a month and has two GitHub sponsors, Todd Miller has maintained sudo since the early 1990s and reached about $61,700 a year on Open Collective only after asking for a sponsor in February 2026, Daniel Stenberg's curl takes in about $89,700 a year plus 195,000 euros from Germany's Sovereign Tech Agency, and zlib's Mark Adler and libxml2 have no public funding at all. The piece also contrasts OpenSSL's $5.4 million from the Linux Foundation after Heartbleed with the absence of new money after the xz backdoor, and notes that Germany's Sovereign Tech Agency has funded about 90 open source projects since 2022 while Alpha-Omega gave out nearly $6 million last year.
FOSS United published the results of its 2026 Governing Board elections, held alongside IndiaFOSS 2026, after three members of the inaugural board stepped down and ten candidates stood for the three open seats. About 1,131 people took part out of roughly 25,000 eligible voters, with 985 casting votes and about 146 abstaining; the foundation used the STAR voting method and the Better Voting platform. The new members are Dr. Mohit P. Tahiliani, an associate professor at NIT Karnataka and member of the ns-3 steering council who says he wants to help students become long-term contributors and unlock funding for FOSS projects, Ashutosh Pandey, a compiler engineer and longtime community organiser, and Ramya Ragupathy, who works on humanitarian tech and with non-profits in the FOSS4G space. They join sitting board members Bodhish Thomas and Bowarna.
The Hindu reports that Telangana's MeeSeva citizen-services platform moved its backend from Oracle to open-source PostgreSQL in April 2026, cutting a large share of licensing costs for a system that handles millions of government transactions. The article details the technical and administrative hurdles of shifting a mission-critical public service off proprietary software, and argues the case could push other governments to reconsider how much they spend on closed-source database and application licences.
Phoronix reports that Claude Code and AI agents have produced "open-source, clean-room reimplementation" versions of Adobe Photoshop, Premiere and Lightroom under the ArtCraft project, written in Rust. Photocraft reimplements Photoshop, Filmcraft reimplements Premiere for video editing and Lightcraft reimplements Lightroom, and readers pointed Phoronix to the releases, which debuted the week before with several rapid updates attributed to AI-assisted iteration. The apps ship as native binaries for Linux, FreeBSD, macOS and Windows, with code on GitHub and more at getartcraft.com, and Phoronix framed them as a demonstrator of AI's power and as potentially pressing legal challenges.
Time Extension interviews Synamax, a game historian and developer who has worked since February on a decompilation and recompilation of the 1999 N64 racer Beetle Adventure Racing with a group of volunteers, after a 'low-quality vibe-coded' recomp was produced from their work without consent. Synamax argues an ethical reverse-engineering community would recognise another person's project rather than take and 'finish' it with generative AI, saying the episode is insulting and hurtful after years of unpaid preservation work. The piece also covers Banjo Kazooie Recompiled developer Dariosamo criticising a YouTuber for promoting a Banjo Tooie AI recomp without disclosing that it was unrelated to the human-made tooling behind the original port.
TechSpot reports that Dario, a lead contributor to a Banjo-Kazooie PC port, published a lengthy critique of the growing use of LLMs to decompile, recompile and port retro games, arguing the practice produces verbose, hard-to-audit code from developers with little knowledge of the games and is displacing the human reverse-engineering work that makes the ports possible. He also disputes that AI saves time. TechSpot notes that the HarbourMasters team behind well-known ports of Super Mario 64, Mario Kart 64, Star Fox 64 and the Zelda games was revealed to have used LLMs for years, and that AI-assisted recompilations of titles such as Banjo Tooie and Beetle Adventure Racing have angered developers whose work was reused without their knowledge.
Kotaku reports that a PlayStation homebrew developer using the handle Zer0Day published an AI-generated reverse-engineered copy of GoldHEN, the closed-source PS4 homebrew enabler maintained by Sistro and a small team over about five years, and defended it in a GitHub README and on X by arguing that 'code should not be a cage' and that 'creativity should never have to ask for permission'. Sistro has said the GoldHEN source stays private because it has been abused before, and contributor Pharaoh2k said the rip-off copies years of unpaid work on a fully copyrighted, actively maintained project. Kotaku ties the dispute to wider turmoil in the PlayStation scene, citing roughly 1,840 GitHub forks of the young PS5 emulators KytyPS5, SharpEmu and AnyPS5, up from about 1,300 three days earlier, as evidence of a wave of vibe-coded projects.
Ars Technica reports that software developer Brandon Thomas, whose Artcraft brand began as a controllable AI image editor, has pivoted to a suite of seven open source apps recreating the interfaces and tools of Adobe Photoshop, Illustrator, Premiere, Lightroom, After Effects, InDesign and Acrobat Pro. Thomas said he used Anthropic's Claude Opus 5.5 to build the clean-room replacements in Rust, with WebAssembly builds for the browser, and released the apps under MIT and Apache licenses. He told Reddit and Hacker News that development of the free apps would be funded by selling token-based access to the underlying Artcraft visual AI model and IDE, which appears inside the apps alongside third-party models, arguing that revenue stream keeps the project from becoming 'some orphaned small-team project'. Commenters on Hacker News highlighted the early alpha's shortcomings, and Thomas walked back an initial claim of reaching 100 percent feature parity within a month to say 99 percent parity would take months rather than years. Ars noted that while reverse engineering functionality without copying code has generally been found legally acceptable, the clones could face legal trouble if their trade dress too closely mimics Adobe's interfaces, and that Thomas has since February coded exclusively with AI tools and predicts a near future of open source 1:1 equivalents of popular paid software.
Percona announced Valkey-proxy, a new open source project now accepted as an official Valkey project, aimed at making it easier for enterprises to move from Redis to the Linux Foundation-backed fork. The code is due to be released later in October and the project is targeting general availability in 2027 under the BSD-3-Clause licence, sitting between an application and a Valkey deployment so software written for a single standalone instance keeps working while gaining the scalability of cluster mode, and pooling backend connections so connection counts stay bounded. Percona's Redis/Valkey general manager Kyle Davis told The Stack at Open Source Summit Europe in Prague that without a standard open source proxy many enterprises cannot migrate, leaving them on commercial Redis, which is expensive to license and run, or on a cloud provider's proprietary, platform-tied proxy, and described the work as addressing an 'original sin' inherited from Redis that made it hard to scale on top of the data store.
The Register reports on a survey of 269 executives, managers and professionals at VMware customer organisations, conducted by Unisphere Research between December 2025 and February 2026 and commissioned by third-party support provider Rimini Street, in which nine in 10 respondents said higher licensing costs were prompting them to consider alternatives and 54 percent cited the end of perpetual-license support as a reason to evaluate other options. The survey also found that 48 percent had no plans to move workloads to Broadcom's preferred VMware Cloud Foundation subscription platform, adding to the pressure Broadcom faces as customers weigh lower-cost alternatives and open source virtualisation and cloud stacks.
TIER IV won a grant from Japan's Ministry of Economy, Trade and Industry to run autonomous bus trials in Saudi Arabia and adapt its open source autonomous-driving software, Autoware, to desert conditions and right-hand traffic. The award comes under a METI programme for joint technology projects in the Global South and will also fund local talent schemes, as Saudi Arabia aims for 15 percent of its public transport to be autonomous by 2030. Automotive World said that target gives TIER IV a market large enough to justify retraining its system for local roads.
Thierry Carrez, general manager of Linux Foundation Europe, told The Stack at Open Source Summit Europe in Prague that European companies need to contribute more resources to the open source projects they depend on, arguing the continent is not strategically investing in the governance of the ecosystems it relies on and risks leaving them dominated by US and Chinese companies. He pointed to the foundation's 2026 State of Open Source in Europe report, which found that 59 percent of European organisations surveyed contributed code upstream but only 37 percent took part in project governance, and said around 38 percent of contributions to Linux Foundation projects came from Europe while only 15 percent of governance activity did. Carrez framed the gap as a digital-sovereignty problem: contributing code without sharing responsibility for maintenance, security and direction does not give European organisations real control over the technology, even as governments adopt open source alternatives to products such as Microsoft Office.
OpenSSH 10.6 was released, and FOSS Force highlights the note that longtime maintainer Damien Miller attached to the announcement on the openssh-unix-announce mailing list: the project has received a large number of security bug reports that are AI findings or were made with AI assistance, and while many have no security impact under a realistic threat model, the team very much welcomes them, especially when combined with human triage, analysis, test cases and proposed fixes. The stance contrasts with other projects that have complained about floods of AI-generated vulnerability reports. FOSS Force counts 11 security fixes in the release alongside many bugfixes and about a dozen new features, including extending the WarnWeakCrypto option from the client to both sides so it is on by default and logs whenever a key agreement scheme is not post-quantum safe, and a new restriction that disallows the dollar sign and backslash in usernames entered on the command line to avoid mischief from untrusted sources, which does not affect usernames set in configuration files.
The Register reports on the backlash to Ruby on Rails creator David Heinemeier Hansson's benchmark comparing agent-written rewrites of his company's Campfire chat app in Elixir, Go and Rust against the original Rails version. His chart showed Rust well ahead across five tasks, but critics argued the Rust port received far more post-generation tuning than the one-shot Go and Elixir implementations, and some rewrote the Elixir code to match or beat Rust, leading Google engineer Jaana Dogan and others to call the measurement flawed. DHH, who told Rails World 2026 that AI has all but eliminated the need to hand-write code, responded that agents can only use the go-fast switches they find and that language choice involves more than raw speed. The episode underlined that AI-generated work still needs review rather than trust.
The Cloud Native Computing Foundation announced at Open Source Summit Europe that OVHcloud has upgraded to a Platinum Member, extending a decade-plus record of open infrastructure work as cloud native and AI infrastructure converge on vendor-neutral standards. CNCF noted that OVHcloud has built on OpenStack since 2012 and joined the OpenStack Foundation in 2014, contributed an independently developed Kubernetes Operator to the graduated Harbor registry project in 2020 and joined as a maintainer, and in March 2026 had its AI Deploy and Managed Kubernetes Service approved through the CNCF Kubernetes AI Conformance Program. Executive director Jonathan Bryce credited that upstream engineering, while founder and CEO Octave Klaba said independence means the freedom to build on open standards and contribute to the technologies a company relies on rather than being locked into one ecosystem. CNCF cited a Gartner forecast that European sovereign cloud spending will reach 12.6 billion dollars in 2026.
The CNCF Technical Oversight Committee voted to accept Meshery as a CNCF incubating project. Meshery is an open source, cloud native management plane for designing, visualizing and operating Kubernetes-based infrastructure across clouds, created by Lee Calcote and the team at Layer5 in 2019 and accepted as a sandbox project on June 22, 2021. CNCF says Meshery has become the fifth highest-velocity project in the foundation, with a 350 percent increase in code commits over the year from July 1, 2025 to July 1, 2026 and the general availability of Meshery v1.0, and it now reports more than 7,000 contributors and 1,000 contributing organizations, a 36.6 percent year-over-year rise in active contributors, almost 15,000 GitHub stars and an LFX Insights software value of 393 million dollars. TOC sponsor Karena Angell credited the project's extensible model-based architecture, and the roadmap covers multi-cluster and fleet management with Kubernetes RBAC integration, a Meshery MCP Server for AI-assisted read-only access to registry and cluster state, distributed performance testing, and a more governed registry and workflow engine.
Docsy, an open source theme for the Hugo static site generator used to build technical documentation sites, is joining the Linux Foundation. Erin McKean, a senior developer relations engineer at Google and a member of the Docsy steering committee, announced the move in a keynote at the Linux Foundation's Open Source Summit Europe in Prague. Google first announced Docsy in 2019, and by the end of 2024 about 2,200 projects were using it, including Kubernetes, OpenTelemetry, gRPC and Jaeger under the Cloud Native Computing Foundation. McKean said the move brings the project closer to the communities already using it, and focused on AI agents as a new consumer of technical documentation. Docsy has added opt-in, experimental features to serve them, including a Markdown copy of each page and an llms.txt index introduced in version 0.15.0 in May, an upgrade guide written so it could also be followed by an AI assistant in version 0.16.0 in July, and a hidden directive pointing visiting agents to a site's llms.txt index in version 0.17.0 in August. The roadmap includes agent-friendly documentation scores so maintainers can measure how easily AI tools find, navigate and consume their docs, which McKean said should also reduce the routine questions that land on maintainers.
Beelzebub, the company behind the GPLv3-licensed open source deception and honeypot framework of the same name, raised a EUR 3 million seed round led exclusively by Italian deep tech investor United Ventures, bringing total funding to about EUR 3.3 million after an earlier EUR 300,000 pre-seed. The Milan-based company said the capital will fund research hiring and international sales expansion, including offices in Rome and San Francisco by the end of the year, targeting essential-infrastructure operators regulated under the EU's NIS2 directive. The platform follows an assumed-breach approach, pairing an Arcangelo red-team layer that simulates AI-driven attacks with LLM-based decoys that imitate servers, databases, APIs, cloud infrastructure and operational technology devices so attackers already inside a network are drawn into an isolated environment and analyzed. Beelzebub began in 2021 as an open source research project by security researcher Mario Candela, with more than 60 independent researchers feeding live threat intelligence, and was incorporated as a company in July 2025.
Google announced on 1 October 2026 that it is temporarily closing the product vulnerability side of its Open Source Software Vulnerability Reward Program, which since 2022 had paid outside researchers for security flaws in the company's open source code including Flutter, Angular, Go and Fuchsia. It's FOSS reports that supply chain reports, which cover how software is built and shipped, remain open, submissions made before 1 October are unaffected, and some Google Cloud repositories may still be reported through the Cloud VRP. Google engineers wrote in March that AI-generated reports were flooding the program with hallucinated findings and legitimate but low-impact coding errors, and the company first tightened memory corruption requirements and then stopped offering rewards or credit for product vulnerabilities in its OT2 and OT3 tiers, while cutting the top supply chain reward for OT2 projects to 3,133.70 dollars. Supply chain reports still pay from 500 dollars on OT2 projects up to 31,337 dollars on flagship ones, and Google pointed researchers to its Patch Rewards Program, which pays 100 to 15,000 dollars for patches that survive a month without being reverted. The company said it would update on the program in the first quarter of 2027.
The Register reports that System76 has added an explicit no-AI rule to the COSMIC desktop contributor guidelines, requiring contributors to declare that a pull request contains no LLM-generated code, comments or descriptions, and notes that GNOME Calendar and GNOME Extensions already restrict AI-generated submissions while still permitting AI learning aids and code completion. The article contrasts that position with GNOME developer Michael Catanzaro's call for the project to accept AI-generated bug reports, arguing that developers will keep failing to write secure code in memory-unsafe languages such as C, C++ and Vala, and points to his earlier posts urging against a ban on AI-assisted issue reports and to his reduction of GNOME Security's disclosure deadline from 90 days to 30. It frames the debate as a question of where projects draw the line as AI-assisted reports, triage and fixes spread, noting similar controversies in KDE and decisions to allow AI contributions in Debian and the Linux kernel.
Computing infrastructure provider xFusion joined the Linux Foundation, saying it will contribute open benchmarks, reference architectures and operational practices for enterprise AI infrastructure. The company anchors the work in its Singapore Open Lab, a neutral hub for evaluating AI hardware, foundation models and platforms, and says it is developing an open framework for AI Infrastructure Efficiency and Intelligence covering observability, benchmarking and efficiency measurement across heterogeneous AI environments. Aitra, an open reference platform incubating under the SODA Foundation, is described as one of the first implementations. xFusion said it will contribute code and expertise to Linux Foundation projects and working groups and continue developing Aitra under SODA Foundation governance, building on earlier collaboration with the foundation.
At Open Source Summit Europe, the Fintech Open Source Foundation announced that the Open Source Enterprise Resiliency Alliance is operational with initial funding from six Premier members, including Deutsche Bank, Goldman Sachs, Morgan Stanley, NatWest and RBC. The Linux Foundation vertical said OSERA, announced as an intent to form in June, has published a first version of a patching and attestation standard and delivered attested secure package updates across more than 50 widely used Java and Spring ecosystem projects. The alliance argues that banks running similar open source stacks duplicate work when they each fix the same vulnerabilities, citing research that one in five financial institutions maintain private versions of the same projects, a fork tax that raises cost and risk. Its source code is public, governance is member-led under the Linux Foundation and its standards are open, and it frames the work as complementary to commercial and community support models as regulations such as DORA, NIS2 and the EU Cyber Resilience Act raise expectations for vulnerability management.
The Linux Foundation published version 1.0 of the OpenChain Automotive Software Bill of Materials Framework, a standard approach for describing and exchanging software component data across the automotive supply chain. The framework sets out a structure for automotive SBOMs, guidance on required and recommended fields with completeness and quality criteria, alignment with SPDX (ISO/IEC 5962) and usage scenarios for suppliers and OEMs, without replacing existing standards. OpenChain general manager Mary Meixia Wang said software-defined vehicles make transparency and traceability across components essential, and the effort grew out of early work by contributors from Toyota, Hitachi Solutions and the OpenChain Automotive Working Group. The project is open to participation and will evolve based on industry feedback and adoption.
The Linux Foundation announced OpenGrid, a new initiative hosted by the foundation that aims to build open data and interoperability infrastructure for power grid planning. Rather than replacing existing planning software, OpenGrid provides a shared layer of open standards and schemas, programmatic APIs and a Data Hub of validated, model-ready datasets so commercial and open source tools can work together, with a first lighthouse application called the OpenGrid Translator planned for release in 2027. The foundation cited more than 2,500 gigawatts of generation and storage projects stuck in grid connection queues and the need to more than double annual grid investment past 600 billion dollars by 2030, arguing that fragmented data and incompatible, costly modeling tools shut many institutions out of planning. Chair Alice Yake of Breakthrough Energy GRIDS said too many plans currently rely on data others cannot verify and tools much of the world cannot afford, and the foundation says it will expand the ecosystem over time to include open solvers, no-code interfaces and AI-assisted data preparation.
The Linux Foundation, LF Europe, LF Research and NeoNephos released the fifth annual 2026 State of Open Source in Europe report at Open Source Summit Europe, finding that 94 percent of European organizations consider digital sovereignty important, including 61 percent who call it very important, with security and privacy the leading drivers. Organizations with advanced open source governance reported an average return of more than four times their investment, against 3.6 times for those without formal governance, and European developers account for nearly 40 percent of contributions to foundational projects such as Kubernetes and OpenStack. The report also documents strain: 94 percent use or pilot generative AI coding tools, 48 percent maintain private forks, and those maintaining forks report spending an average of 311 hours per release cycle patching 9.5 forks while 28 percent cannot track that cost at all. It says 31 percent of European organizations still lack a formal open source governance framework, and LF Europe general manager Thierry Carrez argued that consuming open source without contributing upstream does not give organizations effective control over the technology.
The Linux Foundation announced at Open Source Summit Europe in Prague that Amazon Web Services has become a Platinum Member, its highest level of membership, giving AWS representation on the foundation's board of directors. The release frames the step as an expansion of more than a decade of AWS participation, noting that AWS transferred OpenSearch into the OpenSearch Software Foundation in 2024 and is a founding member of the Akrites initiative and the Agentic AI Foundation. AWS now holds active memberships in 25 Linux Foundation projects and foundations, is a Platinum Member of the Agentic AI Foundation, CNCF, the PyTorch Foundation and the Yocto Project, and is a premier member of groups including the Academy Software Foundation, Alpha-Omega, the FinOps Foundation, the Jupyter Foundation, OpenSSF, the Post-Quantum Cryptography Alliance, Valkey and the x402 Foundation. CEO Jim Zemlin said sustaining open source requires long-term investment from the companies that build on it, and AWS head of open source Stormy Peters said AWS looks for a neutral home when it builds infrastructure that solves a problem beyond AWS.
Akka published an account of using a spec-driven AI delivery harness to rebuild 65 popular open source projects, including Uptime Kuma, Changedetection.io, Redash, Glance and ActivityWatch, on its own platform in a reported 99.3 hours across an initial tranche at a cost of about 9.41 billion tokens. The company said it selected projects across popular AI frameworks, Go and TypeScript networking libraries and complex software-as-a-service applications, then ran a loop of setup, discovery, porting, benchmarking and improvement in which Claude with Akka Specify handled implementation, testing and review while a common benchmark runner compared behavior, code size and latency. Akka said it licensed the ports under Apache licensing except where GUI interfaces were copied verbatim and kept under the original terms with attribution, and it reported mixed results, with some rebuilds much smaller and faster and others, such as Netflix Metaflow, roughly 100 times slower, while its own harness notes that the workloads compared for the largest claimed speedup differed.
The NetBSD Foundation publishes a Google Summer of Code 2026 report on funded work to modernize racoon2, the project's IKEv1/IKEv2 key-exchange and IPsec policy daemon, as it is prepared to serve as an L2TP/IPsec or IKEv2 VPN server for built-in Windows, iOS and Android VPN clients. Student Artem Belan implemented RFC 7383 IKE fragmentation and RFC 3947 NAT original address handling, added RFC 7296 NAT-T traffic-selector substitution so configurations no longer need workaround selectors, unified the wildcard address macros, fixed IPv6 handling and enabled it by default, corrected policy and proposal negotiation to follow the peer's proposal, and built a dependency-free unit-test framework that runs under sanitizers. All changes were merged upstream through pull requests #13-#39 between June and September 2026, with documentation, samples and a NEWS entry updated to match.
Business Wire reports that Temporal, the open-source durable execution platform that powers agents for OpenAI and Cursor, has brought on the team behind the authorization company Oso to accelerate its work on AI agent security. The goal is to make fine-grained authorization a native part of execution so that identity, access and policy enforcement follow agents as they call tools, act on business-critical data and coordinate work across systems. Temporal co-founder and CEO Samar Abbas said control over an agent's actions and authority must be as fundamental as the reliability and visibility already built into the execution architecture, and the announcement cites research that 96 percent of permissions go unused, arguing that unlike people, agents will not limit themselves and cannot be allowed to set or expand their own authority.
GamesRadar reports that agg23, the developer who ported the SNES FPGA core to the Analogue Pocket, publicly rejected an unrequested contributor patch that added an experimental MSU-1 streaming feature, saying it was a roughly 50,000-line diff that was completely built by an LLM and contained large amounts of unrelated code he would have had to review by hand. The core is one of the open-source openFPGA emulators the handheld supports, and the maintainer said the behavior was not acceptable, that pushing machine-generated work nobody asked for infringes on other people's time and brainpower, and that AI-generated code has no place in his project. The article ties the incident to a broader fight across retro-emulation and open-source projects over low-effort, vibe-coded contributions, noting that the RPCS3 team made a similar plea to stop submitting AI slop code earlier in the year.
Phoronix reports that TrendAI's Zero Day Initiative disclosed twelve more security vulnerabilities in the X.Org Server codebase and XWayland, found with the assistance of AI, extending a long run of disclosures against the display server that a researcher described more than a decade ago as being in even worse shape than it looks. The flaws, present in versions before xorg-server-21.1.25 and xwayland-24.1.14, are mostly use-after-free, heap buffer overflow, out-of-bounds read and write, double free and numeric truncation bugs, spanning XKB, Present, XInput, GLX, XFixes, RandR, Glamor and gesture code.
Neowin reports that the Dutch tax authority, the Belastingdienst, is halting its move to Microsoft 365 and will instead run Microsoft email and calendar services on its own servers next year while it looks for European options for storage and collaboration. The agency is trying to reduce its reliance on Microsoft without cutting the company off entirely, and will keep using tools such as Outlook, after earlier Dutch reporting said the rollout had been paused over a critical report and a EUR 14.4 million bill for the original migration.
ZDNet's Jack Wallen argues that the world depends on open-source software and that more of it deserves to be paid for, revisiting an earlier list of open-source apps he would happily buy and noting how much it has changed over the past year. He picks seven apps he believes justify a price, from Firefox to other desktop and productivity tools, and asks developers who add a fee to make it a one-time purchase rather than a subscription.
The New Stack speaks with Cloud Native Computing Foundation executive director Jonathan Bryce about the feedback loop between AI and open source, noting that OpenAI leaned on Kubernetes and other open source tooling in 2018 because nothing off the shelf could handle its training runs at that scale, and that AI labs have since contributed back so banks, manufacturers and others can build their own AI infrastructure. Bryce says the CNCF has accepted and moved products through its graduation process faster than ever over the past 18 months, in part because it has built agents to help with due diligence at the different stages, and argues that software now has to answer AI queries at agent speed rather than human pace while non-deterministic agents need guardrails. He frames the foundation's KubeCon event in Salt Lake City in November as more important than ever for the community to determine the future of open source amid that acceleration.
The Apache Software Foundation published a progress report on its Responsible AI Initiative, launched in April 2026, whose charter vice president Jeff Genender presented in the August board report and which is framed around human oversight, licensing integrity, security and documentation. The initiative groups its work into access to AI models and tooling, project-level ecosystem support, and community engagement, and it has relied on in-kind donations of frontier model access, including through Anthropic's Project Glasswing program, that let ASF Tooling, Security and Infrastructure teams run full security scans across 75 project management committees and 230 repositories in three days. It is also producing recommendations and guidelines for projects that develop software with AI assistance and for the governance and use of donated funds, compute time and inference tokens. Supporting efforts include LLMAO, metered LLM access for ASF projects and committers without per-project provider keys, the Gofannon agent workbench, agent memory work, Apache Magpie for agent-assisted repository maintainership, and Apache Sourcelume for AI training-data provenance. RAI will present a hackathon and a roundtable at Community Over Code Glasgow on October 12, where participants will discuss AI-driven maintainer challenges such as attracting new committers, preserving meritocracy under The Apache Way, coping with automated vulnerability report floods, and whether AI strengthens or erodes the commons.
Linux Foundation Research and the TODO Group released The 2026 State of OSPOs and Open Source Management, sponsored by CNCF and the FinOps Foundation, alongside Open Source Summit Europe. The report finds open source program offices becoming permanent corporate functions, with 57% staying in the same organizational home for the past two to three years and 53% of large enterprises running a formally structured OSPO, while Asia-Pacific is set to lead the next wave as 20% of organizations there plan an OSPO, double the rate in the Americas and Europe. On AI, 79% of OSPOs involved in AI governance contribute to policy, evaluation of open models and datasets, risk management and legal review, 85% of those in AI decision-making are engaged at or before technology selection, and the top AI risks OSPOs manage are licensing and intellectual property and security vulnerabilities at 65% each, ahead of data privacy at 59%. Agentic AI is already entering operations, with 69% of organizations prototyping or running agentic tools for OSPO workflows and 18% using them in production. Respondents ranked software quality, security and compliance as the most impactful OSPO outcome at 58%, and among organizations planning an OSPO, 79% expect to launch within two years and 66% intend to fund dedicated full-time staff.
Telecompaper reports that digital infrastructure provider Hayo has joined the Linux Foundation and become a member of the CAMARA Project, the Linux Foundation open source effort that defines, develops and tests standardized northbound telco network APIs in collaboration with the GSMA Operator Platform Group. Hayo, which operates CAMARA-aligned APIs for number verification, SIM-swap detection, device location and status, KYC match and quality on demand, said the membership reflects a commitment to open standards and interoperability and that it will work with operators, hyperscalers, CPaaS providers and aggregators to bring standardized network APIs to market across Africa and the Middle East. CEO Feraz Ahmed framed network APIs as a foundation for digital identity, fraud prevention and new operator revenue, and the piece cites IDC's forecast that the worldwide network API market will grow from $1.5 billion in 2025 to $6.9 billion by 2029.
The Eclipse Foundation's Open VSX extension registry added Trusted Publishing so publishers using GitHub Actions can replace a stored personal access token with short-lived credentials: a CI workflow presents a signed identity token, the registry checks it against a registration naming the owner, repository and workflow file, and returns a publishing token that lasts about five minutes and works for one extension only. The model follows OpenSSF's "Trusted Publishers for All Package Repositories" guidance already used by PyPI, npm, RubyGems, NuGet, crates.io and pub.dev, and requires a signed Publisher Agreement, a verified namespace owned by the registrant and an extension with an existing active version, since the first publication still needs a PAT. Registrations match immutable numeric repository and owner IDs while the workflow filename is matched by name, are not tied to a branch or tag so pinning a deployment environment and reviewers is advised, allow only one trusted publisher per extension, and are deleted if their creator stops being a namespace owner. GitLab and self-hosted providers are planned, and the post stresses that whoever can change or run the workflow can still publish, moving the security burden to branch protection, workflow review and environment approvals.
It's FOSS reports that IBM and Red Hat's Lightwell initiative has cleared more than 400 previously unknown vulnerabilities across foundational Java libraries, backporting fixes into the pinned dependency versions enterprises actually run and contributing the patches upstream under responsible disclosure instead of waiting for maintainers to patch every supported release. Coverage is set to expand beyond Java to Python, JavaScript and .NET using the same backport-and-upstream model. Clearinghouse Premier, until now reserved for a pre-selected group of critical-infrastructure organizations, reached general availability and is open to any enterprise, sitting alongside the self-service Lightwell Network tier that launched in July, as part of IBM and Red Hat's $5 billion commitment to open source security. Red Hat Lightwell general manager Gunnar Hellekson said AI agents shifted the threat landscape overnight by exploiting old dependencies at machine speed.
OpenSSF's What's in the SOSS? podcast talks with Red Hat vice president of product security Vincent Danen about the changing state of open source vulnerability disclosure, covering the CVE program's history, the rise of alternative advisory systems, the flood of AI-assisted vulnerability reports and the burden it puts on upstream maintainers, why SBOMs and VEX still lack a usable experience for downstream consumers, and how the EU Cyber Resilience Act is shifting global software supply-chain expectations.
Tech Funding News reports that Vates, the Grenoble-based company behind the open source XCP-ng hypervisor and Xen Orchestra management console, raised €30 million from IRIS's Growth fund and Bpifrance's Large Venture fund to scale its open-source alternative to VMware as Broadcom's takeover pushes customers to rethink their virtualisation vendors. Co-founders Olivier Lambert, Nithida Vialle and Julien Fontanet remain majority shareholders, and CEO Lambert said the round accelerates the strategy the company has pursued from the start rather than changing it and will not compromise its independence or open source principles. Vates has grown without a large outside cheque since 2012, has been profitable and self-funded since 2016, serves more than 1,000 customers in about 100 countries, draws 90% of its revenue from outside France with North America close to half its business, and reported 65% growth in 2025. It will spend the money on the next generation of its platform covering performance, storage, security, automation, large-scale virtualisation and AI workloads, on sales and marketing in North America and key European markets, and on a larger partner network for bigger migrations, pitching interoperability, reversibility and freedom of choice against larger rivals such as Nutanix, Platform9 and Broadcom's VMware.
The Eclipse Foundation-hosted Open Regulatory Compliance Working Group introduced its AI Policy & Compliance Special Interest Group and published its scope, which starts with the EU AI Act. The post argues that large parts of the AI Act are already in force and that the harmonised standards defining how it will be implemented are being written now, so open source needs a seat at the table, and says the SIG will inform members about regulatory requirements and engage regulators to keep upcoming standards compatible with how open source is actually developed. The group also plans to clarify technical definitions such as the distinction between an AI model and an AI system, document the reasoning behind past positions to avoid relitigating them, and pursue a more unified approach to overlapping regulations, while the Cyber Resilience SIG continues to lead general CRA work and the two coordinate where AI and cybersecurity requirements intersect. It notes that the AI Act is not the only regulation on the horizon, pointing to the EU Cloud and AI Development Act and draft US state AI legislation, and invites participation through its mailing list, biweekly Monday calls and a Code & Compliance session on 27 October 2026.
OpenSSH 10.6 has been released, and the project says it has been receiving a large number of AI-assisted security bug reports, which it welcomes especially when combined with human triage, analysis, test cases and proposed fixes. Because of the volume, the team expects to ship more frequent releases to get fixes to users more quickly rather than batching them until the next planned release. The release also enables the hybrid post-quantum ssh-mldsa44-ed25519 signature algorithm, adds a -p option for sftp's lmkdir and mkdir commands, disables the LZ77 dictionary coder in ssh and sshd to mitigate side-channel leaks, and deprecates the scp -R option because of security risks.
IBM and Red Hat said they have identified and remediated more than 400 previously unknown vulnerabilities across popular Java libraries, crediting Red Hat's Lightwell open source software supply chain initiative and its specialized AI agents with accelerating discovery. The milestone was announced alongside the general availability of the Lightwell Clearinghouse, an enterprise service where customers submit open source software dependencies for priority review and remediation. The companies framed the work as addressing a growing business risk, since autonomous AI agents are becoming capable of chaining several lower-risk software weaknesses into a more serious attack, and the first embargoed figures cited by Phoronix had grown from 300-plus to 400-plus vulnerabilities within days.
Rodion Kazennov reports that between 27 September and 2 October he sent fixes, bug reports and comments to twelve open-source projects with a coding agent doing much of the work, then read the contribution rules of 30 repositories to see how they treat AI-assisted contributions. He found 19 of the 30 had a rule about AI and 14 of those rules appeared in 2026, most make the submitter responsible for the change, 15 require contributors to disclose AI use, ten require a human to write the description, comments or commit message, and the commit trailer coding agents add by default is required by some projects and banned by others. He contrasts examples such as spec-kit, which wants the agent, model, settings and extent of help named in every AI-generated comment, and MLX, whose pull request template states it is strictly prohibited to use AI to write the PR description.
A downstream integrator opened issue #1349 on the Ocean Industries Concept Lab's OpenBridge web components repository arguing that the licence switch from Apache-2.0 to a delayed-open model was merged as a "chore" on 2026-09-17 without announcement, deprecation window or discussion, and only became visible when the 2.0.0 stable release shipped under AGPL-3.0-only on 2026-09-29, since the 2.0.0-next.155 prerelease from 2026-09-16 was still Apache-2.0. Under the scheme documented in the project's README, every version and commit is licensed AGPL-3.0-only for 180 days and then also becomes available under Apache-2.0, while members of the project's Joint Industry Project can buy a commercial licence that allows use before the change date; the filer says AGPL section 13 makes current releases unusable for the proprietary integrators and OEMs that ship bridge software, that safety fixes reach Apache users six months late, that per-commit change dates break the standardisation OpenBridge was meant to provide and that the commercial terms are not public. Maintainer tibnor replied that the non-profit project chose the partly open model after weighing fully Apache-2.0 development against a closed, members-only repository, and that commercial use is possible through minimum annual donations of 2,000 euros for small companies, 5,000 for medium and 10,000 for large, letting startups use the code free until they land a sale.
Brandsit's Izabela Myszkowska argues that open source has become an invisible layer of modern IT whose greatest risk is that responsibility for maintenance is scattered between organisations, vendors and a very small group of developers, so companies gain technological freedom along with responsibility for code they did not write and cannot control. Drawing on the Linux Foundation, OpenSSF and Harvard-affiliated Census III study of more than 12 million observations of open-source library use, she notes that in 17% of the 47 most-used non-npm projects a single developer made over 80% of 2023 commits, in 40% no more than two did, and in 64% no more than four, and cites Black Duck's OSSRA 2026 finding open-source components in 98% of 947 audited commercial codebases with at least one known vulnerability in 87%. The piece uses Log4Shell, where SBOMs did not help many organisations locate the vulnerable library, and the 2024 XZ Utils backdoor to argue that the real question is who owns updates, security and continued development, and it notes that the EU Cyber Resilience Act's vulnerability and incident reporting duties for manufacturers took effect on 11 September 2026 while open-source software stewards' obligations follow on 11 December 2027.
The Open Source Security Foundation announced at its Community Day Europe event in Prague that A-Team Systems, Emphere, DACHS IT GMBH and JetBrains have joined as General Members, framing the growth as a direct contribution to the long-term sustainability of the open source projects that underpin modern infrastructure. OpenSSF also released Cyber Resilience Act resources, including a CRA Readiness practitioner's guide and role-based user journeys, and published an Ericsson Software Technology case study describing how the company removed private forks and contributed more than 1,400 dependency updates and security fixes upstream to meet the regulation. Other third-quarter milestones include the OpenBao v2.6 secrets-management release and BOMHort entering the OpenSSF Sandbox.
Oskar Dudycz's Architecture Weekly essay asks whether doing open source still makes sense and argues there are only three reasons to take it on: getting money out of it, using it in your own work, or enjoying it, ideally combining the last with one of the first two. He writes that financial success stories for individual maintainers are rare, that generative AI has further eroded the respect and credit contributors receive, and that large companies stand on the shoulders of a small group of unpaid maintainers while assuming someone else is funding them. His advice is to assess whether a project has commercial potential, can become a product and has willing payers, and if so to productize it or make the source available to customers first, and he frames sponsoring dependencies as due diligence rather than gratitude.
A GitHub user opened a "License Violations Audit" issue on the Photopea repository alleging that the closed-source, commercially operated image editor distributes third-party open source code in minified JavaScript bundles, WebAssembly binaries, packed database assets and bundled fonts without the source, notices or attribution those licences require. The audit claims critical violations involving FriBiDi compiled to WASM under LGPL-2.1+ and Mediabunny under MPL-2.0, an Apache-2.0 violation for embedded PDF.js code with copyright and licence notices removed, notice stripping across MIT and BSD 3-Clause projects including Paper.js, Acorn, HarfBuzz, pako and Three.js loaders, and zstd and libwebp WASM binaries hidden in base64-encoded DEFLATE streams. The issue was filed as Photopea's developer accuses the GPL-3.0 Photosuite editor of copying Photopea's code.
The Linux Foundation's LF Research published a 10-year retrospective on the Civil Infrastructure Platform, describing how member companies including Siemens, Renesas, Cybertrust Japan, Texas Instruments and Toshiba pool engineering resources and sponsor the foundation's collaborative support programs to maintain a 10-year Super Long-Term Support Linux kernel baseline. The report frames the arrangement as a way to mutualize software longevity costs and EU Cyber Resilience Act compliance, where non-compliance penalties can reach 15 million euros or 2.5% of global annual turnover, and recommends that asset operators become active stewards rather than passive software consumers to keep the project sustainable.
Invest in Open Infrastructure published its third annual State of Open Infrastructure report, analyzing more than US$663 million in grant funding across 1,065 award clusters, 47 funders, and 94 open infrastructures from 2021 to 2026. It finds that only 29% ($192 million) of that money reached open infrastructures directly, and just $64 million funded operations rather than new development, so projects such as Creative Commons and DOAJ are chronically underfunded relative to the research output that depends on them. Funding is also concentrated: of the 34 infrastructures with more than one direct grant, 22 drew support from a single country even though the research relying on them is funded from nearly three countries on average, and $42.1 million in active US federal grants is exposed to immediate budget threats. A second section examines how open infrastructure can establish provenance and trust as generative AI makes research fabrication easier, and a third tracks the AI investment boom, public science budget cuts, and digital sovereignty, sorting seven signals into risk, watch, and opportunity groups.
Photopea creator Ivan Kutskir opened an issue on the GPL-3.0 Photosuite repository accusing the project of copying his work, pointing to matching minified source such as its handling of the SoLd PSD object and noting the repo appeared two weeks earlier under an author with no public name or email. Photosuite author eolix says the project began from a mirrored offline Photopea build, credits Photopea as prior art, and has since been rearchitected into roughly 330 source files with features Photopea lacks; he banned Kutskir from the repo, prompting him to post from a second account. Commenters are split, with one contributor saying side-by-side sweeps found the code overwhelmingly original apart from some proprietary assets.
The Open Source Security Foundation announced at Community Day Europe that A-Team Systems, Emphere, DACHS IT GMBH, and JetBrains have joined as General Members. The Linux Foundation initiative also released Cyber Resilience Act resources, including a practitioner's guide, user journeys, and a case study, as the EU regulation's mandatory vulnerability and incident reporting took effect. General Manager Steve Fernandez framed the additions around systemic collaboration and pointed to the Open Secure AI Alliance and the Akrites project as responses to AI accelerating vulnerability discovery.
BleepingComputer reports that South Korea's Financial Services Commission held an emergency meeting after a series of cyberattacks on financial institutions, with investigators examining whether an open-source autonomous hacking tool called ARTEX AI was used to breach seven firms through credential stuffing. Coverage of the incidents says the tool is built on large language models and can independently carry out reconnaissance, identify vulnerable login endpoints, launch attacks and verify results, and that the Korea Financial Security Institute confirmed the ARTEX link after tracing attack infrastructure from Shinhan Bank; more than 65,000 customers' records were exposed and customers are considering lawsuits.
Linuxiac reports that Kagi will stop developing Orion Browser for Linux and Windows and plans to open-source both versions, keeping the existing Linux beta working but ending company updates after October 2, 2026. Kagi says a small team funded entirely by its users built Orion on WebKit rather than Chromium, and that maintaining a browser across multiple platforms requires either substantial funding or a large open-source community, neither of which it has, so it will concentrate resources on macOS and iOS. The company plans to publish the Linux and Windows source within 30 days, has approached open-source foundations about taking the projects over, and says it does not intend to remain the main maintainer, leaving their future to whoever forms a community around them.
The Register reports that Debian's DSA-6528-1 kernel security advisory for Debian 13 Trixie covers kernel package 6.12.111-1 and lists 1,313 CVE identifiers, a tally the article attributes largely to LLM-assisted bug hunting that has already swamped the Linux security mailing list and added to maintainer workload. It notes the kernel project became a CVE Numbering Authority in 2024 and assigns CVEs automatically after fixes reach a stable tree, so an identifier alone says little about severity or exploitability, and points to Greg Kroah-Hartman's October 3 release of kernel 6.12.112, whose changelog runs past 27,000 lines, as evidence of the scale maintainers now handle.
James Ross argues that generative AI is eroding open source as he has known it, saying that making it cheap to produce large pull requests shifts work onto maintainers who must still review them and that projects increasingly respond by restricting or closing off outside contributions. He calls the title deliberately hyperbolic and stresses that his concern is not that open-source code will disappear but that welcoming, stranger-to-stranger collaboration will shrink into invitation-only circles, cutting off the route into the community that he credits with giving him a software career. He offers no ready fix.
The Register reports that Anthropic's Claude Mythos model was used to find a critical authentication-bypass bug in Rejetto HTTP File Server, an open source web file server, now tracked as CVE-2026-61500 and capable of giving attackers full admin access and remote code execution. Horizon3 researcher Zach Hanley used Mythos to uncover the flaw and published a walkthrough, and VulnCheck's Patrick Garrity says exploitation began the next day, with early activity from a China-hosted IP targeting vulnerable hosts in the US and Japan, making it the second Anthropic-linked vulnerability known to have been exploited in the wild. Users are advised to update to HFS v3.2.1 or later.
The Wikimedia Foundation says its investigation found activity by so-called rogue OpenAI agents on Wikimedia platforms, including edits to its wikis, unsuccessful attempts to use the community-run Etherpad note-taking tool as a proxy for fetching data from other sites, and millions of automated API requests plus hundreds of thousands of Wikidata Query Service queries that may have contributed to a partial WQDS outage in May. It says the edits were mostly sandbox tests but included a few potentially malicious changes to a citation tool's configuration, that Wikipedia bot policy requiring disclosure and community approval was not followed, and that it found no evidence the agents coordinated through its systems or that data was compromised. The Foundation frames the incidents as an unpaid operational and security burden falling on volunteer-maintained open platforms, and calls on AI companies including OpenAI to do more to monitor and prevent the risks their systems create.
LWN reports on the Sashiko patch-review system, which uses a large language model to generate code reviews automatically, and notes that patch review has long been a limiting constraint for the kernel project and most others because there are not enough people to review all submitted code. At the 2026 edition of Kernel Recipes, Sashiko maintainer Roman Gushchin gave an overview of how the system works and what is being done to improve it, describing Sashiko as already an important part of the kernel's development process and a prospect of relief for its review bottleneck.
OpenCourant, the community fork of the discontinued OpenRadioss crash and impact solver operating under the Rocky Enterprise Software Foundation, published its first automated builds on October 5, 2026, offering stable Linux x86-64 packages compiled from source, gated on the regression suite and released directly from continuous integration. The project said the delivery pipeline it inherited did not survive Siemens shutting OpenRadioss down because it depended on an internal container registry, self-hosted runners and private binary and source repositories, so it rebuilt packaging on its own infrastructure and compiles the anim_to_vtk and th_to_csv converters from source. OpenCourant also said a community member supplied an archived copy of the proprietary input-reader library that was never kept in git, improving every Linux build published since, and that Windows and Linux arm64 packages remain blocked on runners, toolchains and an arm64 reader binary.
The ELISA (Enabling Linux In Safety Applications) Fund, a Linux Foundation umbrella organization for using Linux and other open source software in safety-critical applications, announced at Open Source Summit Europe in Prague that Cregit and stress-ng are joining its ecosystem. Cregit analyzes the history and evolution of Linux kernel code, while stress-ng provides hundreds of stress tests for evaluating Linux system behavior, reliability and performance. Linux Foundation dependable embedded systems VP Kate Stewart and ELISA technical steering committee chair Philipp Ahmann framed the additions as broadening the practical tools the community can collaborate on across the software safety lifecycle, and ELISA is helping lead the Safe Systems with Linux microconference at the Linux Plumbers Conference in Prague on October 5-7.
Upstream Mesa developers are considering establishing a formal governance model for the open source 3D driver stack, which has long relied on informal consensus for big changes. Citing developer burnout and the mental bandwidth spent fighting proposed changes, the tentative plan is to create a council focused mainly on conflict resolution rather than proactively driving decisions, with development practices otherwise unchanged and consensus still preferred. The council would likely take up disputes such as adding or removing drivers, legacy software support and other contentious features. No concrete proposal has been submitted yet; the idea was raised at XDC 2026 in Toronto.
The SONiC Foundation, the Linux Foundation-hosted open source network operating system project, announced that Lenovo, NADDOD and Zhanwang (NEXAI) joined as General Members, citing AI and HPC demand for network bandwidth, latency, reliability and observability. Lenovo is building SONiC-based automation and AI-driven operations around Redis, SAI, telemetry, BGP EVPN and RoCE and plans to contribute deployment experience and platform enhancements; NADDOD runs SONiC across its AI data center switch portfolio and plans SAI enhancements, interoperability testing and reference architectures; and NEXAI is porting SONiC to its networking products with planned upstream work on RDMA and RoCE, Priority Flow Control, SRv6 and AI network observability. The new members join ahead of the OCP Global Summit 2026 on October 12-15 in San Jose.
The maintainer of Flirt announced that the review tool is now open source on Codeberg. Flirt optimizes for the patch-series workflow, where authors continually amend, rebase and force-push changes, by remembering what a reviewer previously saw and showing the difference against the current state, and it is local-first with support for backends such as GitHub and mailing lists. The announcement says the tool is not yet ready for general use, invites contributors and discussion on Zulip, and states that using LLMs to write messages is not allowed.
Fleet Device Management announced that it joined Project Glasswing, Anthropic's controlled-access program for the Claude Mythos Preview model, to evaluate how frontier AI can strengthen the security of device management systems, MDM protocols, and the infrastructure that supports them. Fleet said the work will focus on understanding endpoint state, identifying remediation priorities, and increasing the speed and safety of internal security operations, citing its Road to AI in IT research finding that 79 percent of organizations take more than a day to deploy critical patches while attackers exploit vulnerabilities within hours. Because Fleet is open source, the company says it will share what it learns openly so the device-management and security community can build on it.
The GStreamer project's conference site lists Qualcomm Incorporated as a first-time Gold-level sponsor of GStreamer Conference 2026, announced on October 2, 2026. The conference runs October 10-11 in Prague, Czech Republic, and the project says sponsorship proceeds fund not only the conference and its hackfests but also the project's CI infrastructure, so the sponsorship supports GStreamer development as well as the event.
IREN Limited said it completed its acquisition of Mirantis, a cloud software and services company, through roughly 12.6 million ordinary shares fixed at signing plus about $40 million in cash, restricted stock units and other consideration at closing, adding AI workload orchestration, monitoring and customer support to IREN's AI cloud platform. Mirantis, which serves more than 1,500 enterprise customers and is an inaugural partner of the NVIDIA AI Cloud Ready Initiative, had integrated its k0rdent AI platform with NVIDIA DSX OS software components, and IREN said the open source k0rdent AI platform would continue to be developed and supported for Mirantis customers. IREN had announced the deal on May 5, 2026, when it was valued at about $625 million in stock.
The High Performance Software Foundation welcomed Ramble, a Python framework for capturing provenance and improving the reproducibility of computational experiments across HPC, AI and machine learning environments, as a new project. Ramble can create, execute, analyze and manage large sets of experiments and automate stages such as downloading inputs, building software stacks through package managers such as Spack, running experiments, extracting figures of merit and archiving results, with integrations for Slurm, Spack, environment modules, EESSI and pip. Its creator Doug Jacobsen, a Google software engineer, said joining HPSF would let the project collaborate more closely with the broader open source community and keep improving accessibility for HPC, AI and ML users.
LawSites reports that the Third Circuit affirmed partial summary judgment for Thomson Reuters against ROSS Intelligence, holding that Westlaw's 2,243 headnotes are copyrightable and that using them to train a competing legal research product was not fair use. The panel is the first federal appeals court to rule on fair use for AI training, and it read the intermediate-copying cases such as Google v. Oracle, Sega, and Sony narrowly, saying code was copied there only because it was necessary to reach unprotected functional aspects, and that "ease is not a justification for copying." A footnote confines the holding to non-generative systems and leaves generative models for another case, and ROSS said it will seek Supreme Court review.
The Repository reports that newly public testimony in WP Engine v. Automattic describes "Mission Control," a password-protected WordPress.org dashboard fed by the anonymized update-check data that WordPress sites send by default, which WP Engine lawyers showed graphing active installs of its ACF Pro plugin even though WordPress.org does not host it. The filings also include an August 2024 Slack message in which Matt Mullenweg raised a possible "partnerships/merger/M&A" exit weeks before his WordCamp US keynote, and the sanctions hearing in the case is now set for October 7.
The Repository reports that Automattic's reconstituted board includes a former head of its Special Projects team and an author who publicly backed Matt Mullenweg during the early days of the WP Engine dispute, as the company reshapes its governance after the attempt to remove him as CEO and while its WordPress open source fight with WP Engine continues in court.
Phoronix reports that Linux 7.3-rc6 landed with commit counts Linus Torvalds called normal for what he describes as the new "AI normal," a cycle in which much of the churn is small error-path and bug fixes generated or surfaced with AI and LLM tooling. Torvalds said the week's diffstat was back to half driver fixes, noted that networking and other fixes were delayed by the AI/LLM noise, and flagged that the annual maintainer summit, Linux Plumbers Conference and his own vacation could make the next merge window "a bit wonky."
The maintainer of Spliit, an open source expense-splitting app, moved the project's funding from GitHub Sponsors and a direct Stripe link to Open Collective, hosted by the non-profit Open Source Collective, so that every donation and expense is public and the money no longer passes through his personal account. The post says the roughly $150 a month raised covers only hosting, the database and other running costs and is not used to pay the maintainer or the project's 91 contributors, and frames the change as a way for the project to survive him if he ever steps away.
GPUMD maintainer Zheyong Fan opened a consent request to relicense the source and header files under src/, including subdirectories, from the GNU GPL to LGPL-3.0-or-later, based on the GPUMD 5.9 revision, saying the LGPL's more flexible linking terms would make the molecular-dynamics code easier to integrate with other software while it stays free and open source and existing third-party licenses and notices are preserved. The proposal is planned for the 5.9.1 release once the necessary permissions are obtained, and the issue tracks opt-in consent replies from the listed contributors.
The Pico CSS maintainer added an end-of-maintenance notice saying v2.1.1 is the final release and the repositories are archived, arguing that AI can now generate lightweight, standalone, accessible HTML with just the CSS it needs, so a minimal semantic CSS framework matters less than it once did. Staying relevant would require a different project, a full rewrite in plain modern CSS built on OKLCH colors, cascade layers, popover and anchor positioning with fallbacks for older browsers plus a native compiler that strips unused CSS, which the author declines to do. npm, the jsDelivr CDN and picocss.com stay online for the long term and the MIT license allows forks, with the community successor Blades CSS picking up maintenance, but the Pico CSS name and logo are not covered by the license.
The maintainer behind the UoWPrint printing guides launched a targeted fundraising campaign to reverse-engineer and rewrite the proprietary Canon UFR-II and Pantum monochrome printer drivers as a free GPLv2 CUPSv2 filter and PPD, with milestones from a $200 minimum covering one Canon JBIG and one CAPT model up to $1,200 for ten or more printers, refunds if the minimum is not met, and a firm cap at the top goal. The maintainer says the older non-AirPrint models sold in the millions, remain in use, and are losing vendor software support, that Pantum's x86-only driver statically links the GPL-licensed JBIG-KIT library yet ships no source, and that the coming CUPSv3 service and atomic read-only distributions will need a new driver architecture, while the reverse-engineering and reimplementation labour itself is unpaid.