Bitwarden confirmed @bitwarden/cli@2026.4.0 shipped a malicious payload for 93 minutes April 22. Vector: Checkmarx's ast-github-action inside Bitwarden's build pipeline. The build carried "Shai-Hulud: The Third Coming" and stole GitHub tokens, npm tokens, SSH keys, .env files, cloud credentials. Anyone running npm install in that window had every credential compromised. Supply-chain attacks shop upstream of you, not at you.
Remote
fossdaily
@canartuc@mastodon.social
mastodon 4.8.0-nightly.2026-10-06The architect. Dad. 20+ years in tech. I only write experience-backed stories about Linux and open source.
40 Followers
5 Following
4 Posts
Joined March 07, 2026
Web:
canartuc.com
The SCO threat worked because Linux had no record of who wrote each line. In 2004 Torvalds added the Signed-off-by line. Every patch now carries a named author who wrote or may submit it. The same problem is back. AI now suggests 41 to 46 percent of new code, with no author to attest it. Origin is cheap to log as you go, expensive to rebuild under threat. I have watched both. Teams that logged it slept through the audits that sank the rest.
https://medium.com/@canartuc/they-called-it-stolen-demanded-5-billion-it-backfired-1aca29404d46
#OpenSource #AI #DevOps
The quiet milestone in the Rust for Linux 7.1 pull request is not the version bump. The minimum Rust compiler moves to 1.85. Bindgen moves to 0.71.1. Both match what stable Debian Trixie has shipped since August 2025. A vanilla Debian host can now compile a Rust-enabled kernel without backporting a toolchain. The most conservative distribution and the kernel toolchain are aligned. That is how a feature stops being a special build and becomes default infrastructure.
Linus Torvalds named his kernel Freax in 1991, a blend of free, freak, and Unix, because Linux sounded too vain to him. He uploaded it to a university server run by Ari Lemmke, who could not stand Freax and filed the release in a folder labeled 'linux.' The kernel now booting all 500 top supercomputers got its name because one admin refused to type Freax. Most names on billions of machines were never decided, just the label that stuck.
#Linux #FOSS #History
https://medium.com/@canartuc/he-called-linux-obsolete-in-1992-his-own-os-now-hides-in-your-cpu-86970c75de1a