open-source

JFrog researchers turned a 16-year-old FFmpeg decoder bug, CVE-2026-8461, into working remote-code-execution exploits against Jellyfin and Nextcloud using one 50 KB video file.

Debian has opened a General Resolution with four competing proposals on AI-assisted contributions, from an outright ban to conditional acceptance, with no vote date set yet.

The React team merged a work-in-progress Rust rewrite of the React Compiler, and Vercel says early Turbopack tests found 20-50% faster compilation.

Codeberg e.V. members voted 358-144 to prohibit AI-generated 'vibe-coded' projects and to commit that Codeberg will never train AI on hosted code, citing soaring hardware costs and community trust.

Jellyfin's project leader, a nearly-eight-year core team member, and a co-founder all departed within days in July 2026, citing burnout and a dispute over AI-assisted development tools.

GitHub is halving public bug bounty payouts starting July 27, reserving its largest rewards for a new invite-only VIP tier as it fights a flood of low-quality, AI-generated reports.

The Linux Foundation and roughly 20 companies including AWS, Anthropic, Google, IBM and major banks launched Akrites, a coordinated incident-response alliance for open source software, after finding fewer than 5% of recently surfaced vulnerabilities have been patched.

Blender 5.2 arrived July 14 as the project's newest long-term support release, adding experimental node-based physics for cloth and hair, remotely hosted asset libraries, a Cycles texture cache, and EEVEE performance improvements.

Rust shipped an emergency point release fixing an LLVM miscompilation that quietly existed since Rust 1.87 and turned crash-prone after 1.97.0.

IBM and Red Hat launched commercial Lightwell offerings on July 8, building on their $5 billion pledge to secure open source software supply chains.

Rust 1.97.0, released July 9, made the v0 symbol-mangling scheme the stable default, stabilized a Cargo build.warnings setting, and enabled linker warning output by default.

The German state has moved 5,000 employees off Microsoft SharePoint onto a self-hosted Nextcloud platform, with a long-term goal of 50,000 users as part of a digital sovereignty push.