Sistema operacional Linux integra Intel oneAPI, Level Zero, OpenVINO, Intel Arc e NPU para reduzir a complexidade da computação heterogênea e acelerar o desenvolvimento de aplicações de IA

A Inteligência Artificial está chegando cada vez mais perto do usuário. O que durante muitos anos esteve concentrado em grandes datacenters equipados com aceleradores especializados começa agora a fazer parte dos notebooks, desktops, estações de trabalho e dispositivos de borda. As novas gerações de hardware Intel são um exemplo claro dessa transformação.

Em uma mesma máquina podemos encontrar CPU, GPU Intel Arc e NPU, três arquiteturas com características diferentes e que podem ser exploradas conjuntamente em aplicações de Inteligência Artificial. O desafio, porém, não está apenas em possuir esse hardware.

É necessário fazer
tudo funcionar.

Drivers, firmware, runtimes, bibliotecas, compiladores, frameworks e diferentes camadas de acesso ao hardware precisam estar corretamente instalados, configurados e compatíveis. Foi justamente para atacar esse problema que nasceu o MultiCortex AI Intel Accelerated.

A proposta é simples: entregar um ambiente Linux no qual a infraestrutura necessária para explorar a computação heterogênea Intel já esteja disponível desde o primeiro boot. A própria plataforma apresenta CPU, Intel Arc GPU e Intel NPU como recursos complementares para processamento geral, inferência e IA eficiente.

O problema não é apenas instalar um framework

Uma das etapas mais complexas e custosas na adoção de Inteligência Artificial é a instalação, configuração e integração dos aceleradores com os frameworks utilizados pelos desenvolvedores.

Mesmo em ecossistemas extremamente populares, como NVIDIA e CUDA, preparar corretamente uma máquina para desenvolvimento de IA pode exigir conhecimento especializado. No ecossistema Intel existe um desafio adicional.

Tecnologias como Intel NPU, Intel Arc, oneAPI, Level Zero e OpenVINO ainda são menos conhecidas por uma parcela significativa dos desenvolvedores quando comparadas às stacks tradicionais de GPU.

E possuir uma NPU dentro do processador não significa automaticamente conseguir utilizá-la. Entre a aplicação e o silício existem várias camadas. De forma simplificada:

Uma falha em qualquer uma dessas camadas pode fazer com que um acelerador fisicamente presente na máquina simplesmente desapareça para a aplicação.

Foi exatamente um problema desse tipo que encontrei durante o trabalho realizado com a Intel NPU.

Quando o hardware existe, mas a aplicação não consegue utilizá-lo

Durante os testes do linux-npu-driver 1.35.0, percebi uma situação particularmente preocupante. O hardware estava presente. O firmware estava carregado. O driver de kernel estava funcionando.

Mesmo assim, o OpenVINO não conseguia disponibilizar a NPU.

Em determinados cenários, o problema era ainda mais grave: processos que dependiam da inicialização da NPU terminavam completamente com um SIGABRT.

Ou seja, não era simplesmente uma redução de desempenho ou a execução automática da carga na CPU. O processo poderia literalmente sofrer um crash durante a inicialização do Level Zero. A investigação levou a uma thread interna do driver chamada ResourceCleaner.

O código utilizava:

std::chrono::steady_clock::time_point::max()

como deadline para:

std::condition_variable::wait_until()

A intenção era representar uma espera infinita.

O problema é que determinadas implementações da libstdc++ realizam internamente conversões entre relógios ao processar o deadline recebido por wait_until(). Como time_point::max() já está próximo do maior valor suportado pelo inteiro utilizado internamente para representar o tempo, a operação de conversão poderia provocar um signed integer overflow. Em ambientes onde esse overflow era detectado pelo runtime do GCC, a execução chegava ao helper __addvdi3, que executava um abort().

O resultado final era um: SIGABRT

e o encerramento completo do processo.

Corrigindo o driver da NPU

A solução foi mudar a lógica utilizada pelo ResourceCleaner. Uma espera realmente infinita não precisa ser representada artificialmente por uma data extremamente distante. Quando nenhum timeout está configurado, a solução adequada é utilizar simplesmente:

cv.wait(lock);

Quando existe efetivamente um prazo para a operação de limpeza, permanece:

cv.wait_until(lock, timeout);

A correção também passou a proteger as atualizações da variável idleTimeout utilizando o mutex já existente no mecanismo de limpeza, evitando acesso concorrente entre setIdleTimeout() e a thread executada em background.

A alteração foi desenvolvida e submetida como contribuição upstream diretamente ao repositório oficial intel/linux-npu-driver, no Pull Request #142.

Essa contribuição representa algo importante para o projeto MultiCortex. Não estamos simplesmente instalando pacotes desenvolvidos por terceiros dentro de uma imagem Linux.

Estamos trabalhando, testando e entendendo a stack em profundidade suficiente para chegar até a camada que controla o acelerador e contribuir com sua correção.

É também mais uma contribuição Open Source brasileira chegando à infraestrutura utilizada para Inteligência Artificial.

De cinco falhas para seis testes concluídos

O problema foi reproduzido utilizando o linux-npu-driver 1.35.0 em uma Intel NPU40xx.

O teste utilizado foi:

npu-umd-test --ze-init-test -c none

Antes da alteração, apenas 1 dos 6 testes era concluído corretamente. Os outros cinco processos falhavam com:

status: 134

correspondente ao SIGABRT.

Após a aplicação da correção:

[ PASSED ] 6 tests.

Todos os seis testes foram concluídos.

Mais importante do que o teste isolado foi verificar o comportamento da stack completa.

Com Python e OpenVINO:

import openvino as ov
core = ov.Core()
print(core.available_devices)

o resultado passou a ser:

['CPU', 'NPU']

confirmando que a NPU estava novamente disponível para aplicações de Inteligência Artificial.

Esse caso ilustra exatamente por que simplesmente entregar uma lista de pacotes instalados não é suficiente para construir uma plataforma de IA.

A stack precisa ser testada do hardware até a aplicação.

É nesse ponto que entra o MultiCortex AI Intel Accelerated

O MultiCortex AI Intel Accelerated foi desenvolvido para reduzir justamente essa distância entre possuir um computador com aceleradores Intel e efetivamente conseguir utilizá-los para desenvolver Inteligência Artificial.

A imagem Linux reúne uma stack previamente preparada com componentes como:

• Intel oneAPI, como ecossistema de desenvolvimento;
• Level Zero, fornecendo acesso de baixo nível aos dispositivos;
• OpenVINO, para inferência e otimização de modelos;
• drivers e runtime para Intel Arc GPU;
• driver e runtime para Intel NPU;
• suporte à utilização da CPU como parte da mesma arquitetura heterogênea.

Esses componentes já fazem parte da proposta apresentada pela plataforma MultiCortex, reduzindo as etapas necessárias antes que um desenvolvedor consiga efetivamente executar seu primeiro workload.

Em vez de começar o projeto procurando documentação, adicionando repositórios, resolvendo dependências, compilando componentes e diagnosticando incompatibilidades entre drivers e runtimes, o desenvolvedor pode começar pelo que realmente importa:

a aplicação de Inteligência Artificial.

CPU + GPU + NPU

Um dos conceitos centrais do MultiCortex AI Intel Accelerated é a computação heterogênea.

Nem toda carga deve necessariamente ser executada no acelerador mais poderoso.

Cada dispositivo possui características diferentes.

A CPU continua sendo extremamente importante para controle da aplicação, pré e pós-processamento, modelos e operações gerais.

A GPU Intel Arc oferece grande paralelismo e capacidade computacional para cargas intensivas.

A NPU adiciona um acelerador especializado para redes neurais, criado principalmente para executar cargas de IA com grande eficiência energética.

Com ferramentas como o OpenVINO, uma aplicação pode selecionar dispositivos diferentes ou construir pipelines capazes de aproveitar essa diversidade de recursos.

Isso transforma o computador moderno em algo diferente do modelo tradicional em que praticamente todo o processamento era concentrado na CPU.

Passamos a ter diversos motores computacionais disponíveis dentro de uma mesma máquina.

CPU + GPU + NPU.

E o MultiCortex AI Intel Accelerated foi construído justamente para tornar essa computação heterogênea visível, utilizável e mensurável. A demonstração pública da plataforma mostra CPU, NPU e Intel Arc GPU sendo utilizadas simultaneamente.

OpenVINO como ponto de integração

Uma das tecnologias centrais dessa estratégia é o OpenVINO.

O OpenVINO permite desenvolver e executar aplicações de inferência em diferentes dispositivos, criando uma camada de abstração entre os modelos de Inteligência Artificial e os aceleradores disponíveis.

A geração OpenVINO 2026 ampliou ainda mais essa estratégia.

A documentação oficial da versão 2026.3 apresenta suporte a novos modelos executando em CPU, GPU e NPU, além da expansão de modelos como YOLO26 para GPU e NPU e novas integrações para aplicações de IA generativa.

O MultiCortex AI Intel Accelerated utiliza essa capacidade como uma das bases para permitir que desenvolvedores experimentem inferência, visão computacional, processamento de linguagem natural, modelos generativos e outros workloads aproveitando o hardware disponível localmente.

IA na borda

Existe ainda uma consequência importante dessa evolução.

Quanto mais capacidade computacional existe localmente, menos determinadas aplicações precisam depender exclusivamente do datacenter.

Processamento de imagens, reconhecimento de voz, biometria, análise de dados, modelos de linguagem e diferentes mecanismos de predição podem começar a ser executados diretamente no equipamento do usuário.

Isso traz vantagens importantes para aplicações que exigem:

baixa latência, privacidade, funcionamento offline, eficiência energética e soberania sobre os dados.

A NPU tem um papel particularmente interessante nesse cenário.

Ela é um recurso que já está fisicamente presente em uma nova geração de computadores, mas que ainda permanece subutilizado por muitas aplicações.

O desafio agora é permitir que mais desenvolvedores aprendam a utilizá-la.

Reduzindo a barreira de entrada

É exatamente aí que considero estar a principal contribuição do MultiCortex AI Intel Accelerated.

O objetivo não é simplesmente criar mais uma distribuição Linux.

É criar uma plataforma de experimentação e desenvolvimento capaz de reduzir uma das maiores barreiras da computação heterogênea:

a preparação do ambiente.

Um desenvolvedor que deseja estudar Intel NPU não deveria precisar passar dias tentando entender por que o dispositivo não aparece no framework.

Uma empresa que deseja validar um caso de uso com Intel Arc não deveria começar seu projeto de IA diagnosticando versões incompatíveis de drivers.

Uma equipe de inovação interessada em CPU + GPU + NPU deveria poder começar experimentando sua arquitetura, e não montando toda a infraestrutura necessária para chegar até ela.

Por isso, o conceito do MultiCortex AI Intel Accelerated pode ser resumido em uma frase:

Do hardware Intel à aplicação de IA, sem perder tempo preparando o ambiente.

Mais do que consumir tecnologia

Minha experiência trabalhando com OpenVINO e com o driver Intel NPU também reforçou uma convicção que tenho há muitos anos dentro do Open Source.

Não devemos ser apenas consumidores de tecnologia.

Precisamos aprender como ela funciona.

Precisamos empacotar.

Testar.

Encontrar problemas.

Investigar.

Corrigir.

E, sempre que possível, devolver essas melhorias para o projeto original.

A correção desenvolvida para o ResourceCleaner do Intel Linux NPU Driver é um exemplo concreto dessa filosofia.

E o conhecimento adquirido nesse processo retorna diretamente para o desenvolvimento do MultiCortex AI Intel Accelerated.

Isso significa que a plataforma não nasce apenas da integração de componentes.

Ela nasce da experiência prática de fazer CPU, GPU, NPU, Level Zero, oneAPI, drivers e OpenVINO funcionarem juntos em um ambiente Linux real.

O computador já possui um acelerador de IA. Precisamos começar a utilizá-lo.

Estamos entrando em uma nova fase da computação pessoal.

A Inteligência Artificial não estará apenas na nuvem.

Ela estará no próprio equipamento.

CPU, GPU e NPU formarão uma plataforma heterogênea capaz de executar uma parte cada vez maior dos workloads de Inteligência Artificial localmente.

O hardware está chegando.

Agora precisamos entregar aos desenvolvedores as ferramentas para utilizá-lo.

Esse é o propósito do MultiCortex AI Intel Accelerated:

transformar o hardware Intel disponível no computador em uma plataforma Linux completa, integrada e pronta para desenvolvimento e execução de Inteligência Artificial desde o primeiro boot.

Hello, openSUSE community!

My name is Geetansh Goyal, and I was a Google Summer of Code (GSoC) 2026 mentee with Uyuni and the openSUSE project. This is my first year contributing to a project of this size, and this post is my account of the summer working on “Event-Driven Automation for Uyuni via MQTT and Node-RED,” mentored by Ondrej Holecek and Abid Mehmood, both from the openSUSE community.

The problem

Uyuni already knows the moment something interesting happens: a system registers, a Salt job returns, a state applies, a software channel finishes building. None of that left the server. If you wanted to react to it, your only option was polling the XML-RPC API on a timer, which means either hammering the API for low latency or accepting a delay you didn’t choose. The goal of the project was to let events push out instead, so external tools can react as they happen.

What I built

The project has two halves. On the Uyuni side, I added an MQTT publisher to the Java core that publishes nine event types, five from the Salt reactor (system registration, job returns, state application, image deployment and batch starts) and four from domain code (org creation, user creation, and content lifecycle management builds starting and completing). Everything is off by default behind a set of configuration properties, so an existing installation notices nothing until an administrator explicitly turns it on.

On the consumer side, I built node-red-contrib-uyuni, a package of custom Node-RED nodes: one to subscribe to Uyuni events, one to call back into the API to apply a state or schedule a reboot, one to query system data, and two config nodes to hold credentials. The idea is that someone who has never touched Uyuni’s API can still wire together “a minion registers, then apply this state, then post to Slack” entirely by dragging nodes onto a canvas.

To make the whole thing easy to try, I also put together container images for a preconfigured Mosquitto broker and for Node-RED with the Uyuni nodes pre-installed, and a small library of example flows: a Slack alert on patch application, automatic Jira ticket creation, email notifications, and a couple more.

What I learned

I came into this as a first-year student who had never worked in a codebase anywhere near this size, and for the first few weeks I mostly felt like I was guessing. Uyuni’s Java core has years of history in it, and just finding where an event should be published, let alone where it safely could be, took longer than I want to admit.

The moment that actually changed how I think about code happened in review. Abid pointed out that my events were sometimes going out before the database transaction that produced them had even committed, meaning a subscriber could hear about something that, a moment later, technically hadn’t happened. I patched it the way I imagine a lot of people patch their first real bug: I found the closest thing that looked like “after commit” and hooked into that. It didn’t work, because I was deferring to the wrong transaction entirely, one that was never doing the actual write. Getting the real fix, which turned out to be as simple as changing the order a handler gets registered in, meant sitting with ActionExecutor until I actually understood what “each handler runs in its own transaction” meant for the code I’d written, instead of poking at it until the symptom went away. That’s the lesson I’ll carry past this project: a fix you don’t understand is just a different bug wearing the first one’s clothes.

The rest of what I learned came from being embarrassingly wrong in front of a real server. I’d copy a file into a running container, restart it to test, and watch my change vanish, because I didn’t yet know that a jar in there was a symlink and ant deploy was quietly doing nothing. I’d get a working config, restart the service to confirm it, and lose everything, because a line I hadn’t noticed in the systemd unit was wiping the container clean on every restart. I found a password sitting in a log file in plain text and realized I’d put it there myself, as a JVM argument, which is exactly why every credential in this project now also accepts an environment variable. None of that was in a diff anywhere. I only found it by breaking my own deployment enough times that I stopped trusting anything I hadn’t watched work end to end, which is how I ended up actually measuring it: about 0.112 seconds from a Salt job finishing to a subscriber hearing about it, checked with my own eyes on a real machine, not assumed.

Where the project stands

The implementation PR and the RFC are both open and under review as I write this, and the Administration Guide documentation is up for review too. Of the stretch goals, the example flow library is done, MQTT over TLS and a Grafana annotation node are still open for whoever picks this up next, including possibly me.

Thanks

Thank you to Ondrej and Abid for the review that actually made me fix the ordering bug properly instead of papering over it, and to openSUSE and GSoC for the chance to spend a summer inside a codebase this size as a first-year student. It was the first time I had to reason about transaction boundaries in someone else’s production system, and I’d do it again.

Hoy os traigo otro resumen del progreso en KDE Linux, un informe detallado de la última entrada de Nate Graham esta vez aparecido directamente en el Planet KDE, donde nos pone al día sobre los avances de KDE Linux, el sistema operativo «del futuro» de la comunidad KDE. Es decir, que bienvenidos a el progreso de este mes de agosto en KDE Linux, otro paso que nos acerca a un sueño para los simpatizantes de este entorno de trabajo.

Este mes de julio en KDE Linux

El bueno de Nate no solo se encarga de informarnos del progreso de Plasma en sus artículos de «This week in Plasma, sino que en ocasiones nos obsequia con una mirada a otros proyectos de la Comunidad.

Hace unos meses se publicaron artículos como «Busy months in KDE Linux«, «This month in KDE Linux«, «This month in KDE Linux: March 2026», «This month in KDE Linux: May 2026«, «This month in KDE Linux: June 2026» y «This month in KDE Linux: Juy 2026″ en los que Nate nos muestra que el proyecto está vivo y que si no pasa nada en unos meses tendremos entre nosotros la primera versión estable de esta distribución. Por cierto, el título parece haberse estabilizado.

Y el mes de agosto nos volvió a obsequiar con una revisión del proyecto de nuevo con la colaboración de John Veness, que evidentemente os animo a leer completo, que ha titulado «This month in KDE Linux: august 2026» y del cual os ofrezco un resumen del mismo para los que no tenemos un dominio exhaustivo del inglés.

• Instantáneas automáticas de Btrfs: Las carpetas personales ahora son subvolúmenes Btrfs con snapshots automáticos activados.. Está claro que el futuro es ese sistema de archivos.
• kio-snapshot en Dolphin: Nuevo sistema integrado que permite ver y restaurar versiones anteriores de archivos directamente desde el gestor. [Esto mola mucho].

• Entrada de texto CJKV preinstalada (pero que el usuario tiene que activarlo para empezar a usarlo): Soporte nativo para escribir en chino, japonés, coreano y vietnamita sin configuración adicional.blogs.kde
• Correcciones de seguridad:
  • Eliminación del acceso predeterminado al socket de Docker para el grupo wheel.
  • Bloqueo de módulos de kernel no autorizados en las imágenes unificadas.
• Mejoras en actualizaciones: Corrección de fallos en actualizaciones publicadas o en equipos con CPUs lentas o conexiones deficientes.
• Documentación accesible: Enlaces rápidos a la documentación oficial en la sección “Ayuda” del menú, guía para liberar espacio y página de soporte en la web.
• Integración KeePassXC + Flatpak: Documentación sobre uso de KeePassXC con Firefox y Chromium instalados vía Flatpak.
• Barra de progreso del instalador: Mayor precisión para evitar incertidumbre durante la instalación.
• Menú de arranque simplificado: Eliminada la entrada inútil de la consola UEFI.

Como vemos, KDE Linux no es solo una «distro» más; es el campo de pruebas y la vitrina oficial de lo que KDE puede ofrecer cuando controla todo el ecosistema, un sueño que no viene de ahora (ya escuché esto en la Akademy de A Coruña de 2015 y cuyo primer se dio con KDE Neon).

Vemos que el desarrollo de esta Comunidad cuyos objetivos están claros se construye dando pasos pequeños pero seguros.

• 
  Este mes de agosto en KDE Linuxseptiembre 3, 2026
  Bienvenidos a el progreso de este mes de julio en KDE Linux, otro paso que nos acerca a un sueño para los simpatizantes de este entorno de trabajo.
• 
  Este mes de julio en KDE Linuxagosto 3, 2026
  Bienvenidos a el progreso de este mes de julio en KDE Linux, otro paso que nos acerca a un sueño para los simpatizantes de este entorno de trabajo.
• 
  Este mes de junio en KDE Linuxjulio 13, 2026
  Hoy os traigo el otro resumen del progreso en KDE Linux, un informe detallado de la última entrada de Nate Graham en su blog «Adventures in Linux and KDE», donde… Leer más: Este mes de junio en KDE Linux

La entrada Este mes de agosto en KDE Linux se publicó primero en KDE Blog.

El 26 de agosto de 2026, Estados Unidos designó como terroristas al colectivo italiano que da soporte e infraestructuras digitales (blogs, correo electrónico, etc) a colectivos de activistas desde 2001

El gobierno de EE.UU. una vez más sacándose de la manga una ley para acallar voces disidentes. Un estado terrorista como el de EE.UU. que ha sembrado el miedo y muerte en muchos países y da soporte a otros estados asesinos, retuerce las leyes y los significados en su «neolengua» para que solo se oiga su voz.

Esta vez el brazo ejecutor del nuevo fascismo y nazismo tecnocapitalista ha recaido sobre el colectivo italiano Autistici/Inventati (AI), por ofrecer infraestructura digital a colectivos de activistas.

A/I se presenta como una organización antifascista, antirracista, antisexista y antimilitarista, opuesta al capitalismo y al autoritarismo, y selecciona los proyectos que acoge en función de su compatibilidad con estos principios.

Vayamos a las fuentes de información para saber de qué va este «culebrón». He traducido partes de una carta abierta que ha pueblicado el colectivo, junto con otras fuentes intercalando comentarios propios para seguir el hilo.

El 26 de agosto de 2026, el Departamento del Tesoro de EE.UU., a través de OFAC (Oficina de Control de Activos Extranjeros – la autoridad responsable de gestionar y hacer cumplir sanciones económicas y financieras), sancionó a Autistici/Inventati (A/I), un colectivo italiano que ha estado proporcionando infraestructura digital – correo electrónico, hosting, listas de correo, chat, videoconferencia, streaming y servicios relacionados con la privacidad y el anonimato – a movimientos y activistas.

Washington lo designó como Terrorista Global Especialmente Designado (SDGT), alegando que ha proporcionado apoyo financiero, material o tecnológico al terrorismo y a organizaciones ya sometidas a sanciones. A/I rechaza las acusaciones y declara que sus actividades consisten en proporcionar herramientas para la autodefensa digital e infraestructura para la libertad de comunicación.

Autistici/Inventati (A/I) ha proporcionado servicio de correo electrónico no comerciales, sitios web, listas de correo, Noblogs y otros servicios de comunicación desde 2001. A/I surgió de hacklabs italianos, medios autónomos y movimientos sociales. Su infraestructura fue construida en respuesta a la censura, la vigilancia encubierta y la incautación de servidores. Minimiza los datos identificativos de los movimientos y personas que lo utilizan, utiliza sistemas distribuidos y trata la privacidad como una condición para la participación política más que como un producto.

La infraestructura se gestiona a través de una asociación formalmente reconocida. Esto significa que A/I no es un grupo informal: sus actividades son gestionadas por una asociación que cumple con todas las normativas legales vigentes, con responsabilidades legales, relaciones contractuales y las obligaciones y controles asociados.

Esto no significa que la asociación nunca haya tenido que tratar con el sistema judicial. A lo largo de los años ha habido procedimientos e intervenciones por parte de las autoridades, también a escala internacional.

Entre los episodios recordados por el colectivo se encuentran la intervención de 2004-2005 en los servidores alojados por Aruba, en el contexto de una investigación iniciada por la fiscalía de Bolonia, así como disputas posteriores relacionadas con contenidos o cuentas individuales. En otro caso, tras una demanda de Trenitalia sobre un sitio satírico, el tribunal de Milán falló en defensa de la sátira.

Los anuncios públicos de Estados Unidos apuntan a material y organizaciones que supuestamente usaron infraestructura de A/I.

No demuestran públicamente que A/I planificara las acciones citadas, seleccionara objetivos, dirigiera a los usuarios o redactara material alojado.

Por tanto, la designación plantea una cuestión que va mucho más allá de un colectivo: ¿puede ser tratado como terrorismo mantener una infraestructura de comunicaciones que preserve la privacidad para movimientos desfavorecidos?

Parece claro, que en este renacimiento del nazismo instaurado en los grandes tecnócratas que se codean con el egocéntrico y ególatra presidente de EE.UU. que todo le huele a «rojerío», la respuesta es sí.

Esa teoría amenaza a los hosts independientes, los servicios de comunicaciones cifrados, las bibliotecas, los archivos del movimiento, los editores y pequeños proyectos voluntarios en todas partes.

En este sistema sobre vigilado, querer estar fuera de esa red de seguimiento masivo, es tomado como sospechoso. No querer formar parte de esa red de vigilancia parece que implica que eres culpable.

A/I proporciona infraestructuras digitales, herramientas y servicios a «células Antifa violentas» y otros extremistas de izquierdas. El comunicado cita alojamiento, correo electrónico cifrado, chat y videoconferencia, streaming y la infraestructura asociada a Noblogs. Washington también afirma que la infraestructura estuvo disponible para organizaciones ya sometidas a sanciones, nombrando específicamente al PKK.

Autistici/Inventati no es políticamente neutral; la afinidad política, sin embargo, no es control operativo. Proporcionar una cuenta de correo electrónico, plataforma de publicación o servidor no significa compartir todo lo que un usuario pueda decir o hacer después.

La lógica detrás de esta acusación no es simplemente «A/I llevó a cabo un ataque terrorista». La cuestión es el llamado apoyo material: según Washington, la infraestructura tecnológica constituye un medio para apoyar a individuos o actividades calificadas como terroristas.

A/I rechaza rotundamente la calificación que les ha realizado el gobienro estadounidense. El colectivo se describe a sí mismo como compuesto por voluntarios y activistas digitales, afirmando que simplemente proporciona herramientas digitales de autodefensa para activistas, individuos, grupos y asociaciones.

La designación estadounidense no equivale automáticamente a una prohibición de A/I en Italia o en la Unión Europea. Estados Unidos, la UE y los estados individuales tienen sistemas legales y listas antiterroristas distintas. Sin embargo, la inclusión en la lista OFAC genera una presión significativa sobre los operadores que tratan con la entidad designada.

A nivel técnico cuando un usuario escribe la url autistici.org en su navegador, el ordenador necesita saber a qué dirección IP debe conectarse. El DNS (Sistema de Nombres de Dominio) realiza esta función: traduce un nombre legible por humanos, como autistici.org, a la dirección numérica del servidor.

Si el DNS deja de devolver la coincidencia correcta, el servidor puede permanecer activo pero el sitio web se vuelve inaccesible para los usuarios de ese dominio. Por tanto, es importante no confundir el acto de «desconectar o suspender el dominio» con la decisión de «apagar el servidor». La primera acción afecta a un nivel diferente de la infraestructura de alojamiento.

Este incidente demuestra que la infraestructura digital puede ser dirigida a diferentes niveles. No es necesario incautar el servidor que contiene datos específicos: se pueden tomar medidas contra el nombre de dominio que permite encontrarlo.

En este sentido, el nombre de dominio se convierte en un punto de control. La cuestión central es, por tanto, es: ¿qué ocurre cuando un colectivo italiano, sus servidores y sus usuarios están formalmente ubicados fuera de la jurisdicción estadounidense pero utilizan un dominio.org gestionado por un registro estadounidense y servicios financieros o tecnológicos vinculados al mercado estadounidense?

Una vez más queda patente la débil soberanía tecnológica en esta y otras cuestiones. Los servidores están fuera de la legislación de EE.UU. pero no el dominio utilizado. ¿Quizás debiera ser .it? ignoro si esa sería una mejor solución.

Y una cuestión clave es, ahora ha sido A/I pero ¿cuando decidirá el próximo gobierno declarar terroristas a otra organización? ¿Dónde ponemos el límite? Apoyar a colectivos antifascistas es terrorismo, apoyar a gobiernos que están llevando a cabo un genocidio en Gaza no. Tampoco es terrorismo la escucha masiva de ciudadanos de tu propio país, ni la invasión de un país ni la intromisión en su sistema político para decantarlo hacia tus propios intereses.

El mismo principio podría, en teoría, aplicarse a los proveedores de correo electrónico, servicios en la nube, proveedores de alojamiento, plataformas de mensajería, sistemas de pago o registradores de dominios. La cuestión es establecer cuándo la prestación de un servicio de propósito general se convierte, según las leyes aplicables, en «apoyo material» a una organización terrorista.

---

Si has llegado a leer hasta est punto, muchas gracias. A continuación te dejo los enlaces a la información de primera mano de A/I.

Enlaces de interés

• https://www.inventati.org/campaign/defend
• https://www.inventati.org/campaign/
• https://www.inventati.org/services/

Inicio la serie con las nuevas funcionalidades que nos ofrece la Comunidad KDE después de lanzar su conjunto de aplicaciones revisadas y mejoradas. Para seguir continuamos con las novedades de Konsole de KDE Gear 26.08 edición «Enjoy Shiny Stuff» la terminal de KDE potente y flexible.

Las novedades de Konsole de KDE Gear 26.08, edición «Enjoy Shiny Stuff»

Konsole es el emulador de terminal de KDE y cuenta con multitud de funciones y utilidades, una aplicación cuyo uso aumenta a medida que controlas más tu sistema GNU/Linux y entiendes que muchas cosas que se hacen mediante aplicaciones gráficas se puede hacer mucho más rápido.

Para esta nueva versión de KDE Gear 26.08 viene cargado de novedades, ahora puedes mantener pulsada la tecla Alt, hacer clic sobre el nombre de un archivo subrayado y arrastrarlo a cualquier otro lugar. Asimismo, si arrastras una imagen sobre un editor de imágenes, se abrirá lista para ser editada; si la arrastras sobre un editor de texto, se copiará la ruta del archivo.

Pero eso no es todo, lo mismo se puede hacer ahora con enlaces, direcciones de correo electrónico y términos de color. Arrastra un enlace a una pestaña vacía del navegador y se abrirá la página a la que apunta. Si mueves el enlace a un editor de texto, se descargará el HTML de la página listo para editar. Arrastra un código de color sobre una imagen en Krita y se rellenará la capa con ese color. O bien, si arrastras ese mismo código de color a un editor de texto, se escribirá por ti el código hexadecimal del color.

Todo ello mientras se prepara el 30 aniversario de un proyecto que según más de uno es el I+D+I de un Software de todo el mundo para todo el mundo.

Y, recuerda, todo este software es gratuito y sin publicidad en todos los sentidos: no te cuesta ni un euro y no se cobra en en forma de datos personales. No obstante, si quieres ayudar a su desarrollo siempre puedes participar en su campaña de recaudación de fondos.

• 
  Las novedades de Konsole de KDE Gear 26.08, edición «Enjoy Shiny Stuff»septiembre 2, 2026
  Las novedades de Konsole de KDE Gear 26.08, edición «Enjoy Shiny Stuff»
• 
  Las novedades de Dolphin de KDE Gear 26.08, edición «Enjoy Shiny Stuff»agosto 30, 2026
  Las novedades de Dolphin de KDE Gear 26.08, edición «Enjoy Shiny Stuff»
• 
  Las novedades de Okular de KDE Gear 26.08, edición «Enjoy Shiny Stuff»agosto 24, 2026
  Las novedades de Okular de KDE Gear 26.08, edición «Enjoy Shiny Stuff»

La entrada Las novedades de Konsole de KDE Gear 26.08, edición «Enjoy Shiny Stuff» se publicó primero en KDE Blog.

Recently, I heard complaints within the syslog-ng community that using Elasticsearch is not that easy anymore. I installed Elasticsearch 9.5 with Kibana to verify these claims.

Read more at https://www.syslog-ng.com/community/b/blog/posts/using-syslog-ng-with-elasticsearch-9-5

There were several software package updates for openSUSE Tumbleweed during the month of August, which delivered 23 snapshots across 31 days.

August delivered a packed month of snapshots across the desktop, developer tooling, and security surface. KDE Plasma 6.7.4 landed with KWin GPU management fixes and a workaround for libepoxy issues when a GPU reset happens. KDE Frameworks 6.29.0 and KDE Gear 26.08.0 also arrived in the month. GNOME Shell 50.4 and mutter 50.4 arrived with HiDPI cursor fixes and HDR output improvements. Mesa settled into its 26.2 series, and the Linux kernel progressed from 7.1.5 to 7.2.0 with a long tail of CVE fixes.

As always, be sure to roll back using snapper if any issues arise.

For more details on the change logs for the month, visit the openSUSE Factory mailing list.

New Features and Enhancements

KDE Plasma 6.7.4: The fourth bugfix release of the Plasma 6.7 series brings targeted stability improvements across the desktop. KWin no longer removes GPUs that have no outputs, which prevents a regression where external monitors connected via docks could disappear. A workaround for libepoxy failing when a GPU resets helps stabilize gaming and GPU-accelerated workloads on systems with multiple graphics adapters. The digital clock applet now applies its font family to the time zone label, and dragging items on the taskbar onto grouped tasks no longer breaks when floating applets are enabled. Spectacle gained QR code scanning when editing existing screenshots, and KScreen added a keyboard shortcut to trigger the Configure button from the OSD.

KDE Frameworks 6.29.0: A new feature release of the KDE component libraries arrived with refinements across KIO, Kirigami and KRunner. Solid now returns the mount point as filePath() for the root filesystem through its udisks2 backend, bluez-qt resolves a race condition in Bluetooth object manager initialization, and KTextEditor gained a disabledPlugins property. A separate KWin patch improved behavior after unplugging outputs by increasing the Wayland global removal timer timeout.

KDE Gear 26.08.0: The August feature release of the KDE applications collection brought updates across Dolphin, Konsole, Kate, Okular, and the Akonadi personal information management stack. Konsole implements the Kitty keyboard protocol and gains direct Copy and Open actions for URLs shown as escape-sequence hotspots. Okular adds copy-and-paste support for annotations and no longer executes load-scripts on signed documents, while Kate fixes working-directory handling when invoking git and possible out-of-bounds reads.

Firefox 154.0: The browser’s monthly milestone rolled out with a heavy load of Common Vulnerabilities and Exposures (CVE) fixes addressing more than 40 issues. The release covers a sandbox escape in the Remote Settings client, same-origin policy bypasses in service workers and cookie handling, use-after-free issues across WebAssembly, image loading, and layout text handling, plus multiple privilege escalation and site isolation issues in the graphics stack. It also refreshed mozilla-nss to 3.126.1 and mozjs140 to 140.14.0. Tumbleweed users should update to stay protected.

GNOME Shell 50.4 & mutter 50.4: The GNOME desktop received quality-of-life fixes that clean up day-to-day use. Switching to a minimized window on another workspace no longer causes a visual glitch, and the magnified cursor is correctly scaled on HiDPI displays. A sound glitch caused by pushing redundant volume changes has been eliminated, and menu animations are smoother. On the compositor side, mutter fixes blurred rendering with non-pixel-aligned monitors, fills in mastering display metadata for HDR output, and corrects invalid redraw clips on rotated monitors. GNOME Control Center 50.4 arrived alongside with updated translations.

GStreamer 1.28.6: A wide-ranging update across the core and plugin packages with both security and playback fixes. The playbin3 and playbin elements fix stalls that occurred after re-enabling previously disabled subtitles, and the h265parser resolves out-of-bounds writes in RPS parsing. RTP retransmission bitrate estimation is improved, and the Rust (f)mp4 muxers gain H.266/VVC muxing support. webrtcsink fixes H.264 level and profile negotiation and adds support for nvv4l2h265enc.

OpenSSH 10.5p1: A security-focused release addressing an important vulnerability in agent forwarding. The ssh-agent interaction between locking and the session-bind@openssh.com extension was broken, meaning operations intended to be limited to local use only could be performed remotely when the agent was locked. The restrict keyword in authorized_keys now correctly applies to tunnel forwarding. A potential realloc use-after-free in the client when a remote forwarding is added via the multiplexing socket is fixed, and ssh-keygen gains the ability to set or clear touch-required and verify-required flags on FIDO private keys during passphrase reset.

harfbuzz 14.3.0 & 14.3.1: The text shaping engine that underpins rendering in browsers, desktop environments, and document editors received important improvements. Mark positioning now respects lookup order in the cross-direction, improving compatibility with DirectWrite and Core Text. Mark attachment to ligatures formed from decomposed glyphs is fixed, and the calt feature in Hangul text is now disabled only for the Jamos rather than the entire buffer. The release also adds support for partially instancing of the avar table and the CFF2 table, relevant for variable font workflows. A follow-up 14.3.1 release arrived later in the month with fuzzing and subsetting fixes, a fix for AAT insertion at the end of the text, and rendering fixes in the experimental GPU library.

QEMU 11.1.0: The machine emulator advanced from 11.0.3 with a substantial feature release. Highlights include Universal Flash Storage (UFS) emulation support for Write Booster and Host-Initiated Defragmentation based on the UFS 4.1 specification, and vhost-host-user support for offloading real-time clock handling from the hypervisor when using virtio-rtc. The GUI subsystem gained improvements to virtual console handling and GTK/VNC. ARM support expanded with the new imx8mp-evk machine type and virt board cache topology specification.

Key Package Updates

Linux kernel 7.1.5 through 7.2.2: The kernel progressed through four point releases and a feature release during August with a sustained focus on security and stability. Version 7.1.6 carried fixes for KVM x86 module reload use-after-free, arm64 TLBI errata mitigation, and a virtiofs use-after-free on submount umount. Version 7.1.7 added CVE fixes for batman-adv, ntfs3, and several networking and driver subsystems. Version 7.1.8 addressed an extensive list of CVEs including Bluetooth btusb use-after-free, ksmbd deferred file use-after-free, rtl8723bs out-of-bounds reads and writes, and RDMA fixes across irdma, erdma, and mana_ib. The Btrfs filesystem received fixes for free space cache validation and root leaks during relocation. The 7.2.0 version refreshed the kernel configuration and carried updated AMD Display Core patches. The month closed with the 7.2.2 release, which resovled CVE-2026-80590.

Mesa 26.1.6, 26.2.0 & 26.2.1: The graphics stack made a major jump from 26.1.5 to the 26.2 series during the month. The 26.1.6 bugfix release addressed regressions from the previous stable series, while the 26.2.0 release brought a new batch of driver improvements for AMD, Intel, and Qualcomm hardware. The 26.2.1 bugfix release soon followed, and the VirtIO Vulkan driver is now enabled in openSUSE’s build, bringing Vulkan support to virtualized environments. Users on AMD and Intel GPUs who experienced rendering issues after earlier Mesa updates should find these releases more stable. The Vulkan drivers continue to see corrections for gaming workloads.

python-cryptography 50.0.0: A major version bump that deprecates Diffie-Hellman key exchange over finite fields and adds the Cobblestone recipe for streaming authenticated encryption. The most important change is a security fix for Bleichenbacher oracle in PKCS7 decryption; pkcs7_decrypt_der no longer exposes distinguishable errors or timing when unwrapping a RecipientInfo’s encryptedKey. X.509 verification APIs are now considered stable, and ML-DSA public keys and signatures are permitted by default.

libssh2: Received two rounds of critical security patches during August. The first batch addressed a heap buffer overflow and the second batch fixed arbitrary code execution via double-free in SFTP sessions, denial of service via integer underflow in AES-GCM cipher negotiation, a heap out-of-bounds read, and heap buffer overflow during SSH negotiation. These are essential updates for any system using libssh2 for SSH or SFTP operations.

vim 9.2.0901: A massive update carrying over 100 fixes including eight security patches. Security fixes address arbitrary code execution via keyword lookup, code injection in netrw via bookmarks, heap overflow when adding more than 65,535 text properties, stack buffer overflow in the socket server, and a use-after-free on JSON decode error. The update also fixes numerous memory leaks, a deeply nested regexp pattern stack overflow, and a GTK4 hardware rendering performance regression.

unbound 1.26.0: The DNS resolver received a major update with a large list of fixes and new features. New options include max-transfer-size and max-transfer-time for limiting auth-zone and RPZ transfers, and new local-zone types block_aaaa, block_a_wdata, and block_aaaa_wdata. A heap out-of-bounds write via size_t-to-int truncation is fixed, along with DNSSEC validation fixes for noncanonical RSA DNSKEYs and a race condition causing segfaults when starting threads.

Qt 6 6.11.2: The second bugfix release of the 6.11 series landed across the full module range from qt6-base through qt6-webengine. The update fixes a regression in icon loading and carries multiple stability corrections for the toolkit that Plasma and most KDE applications build on. qt6-webengine also merges an upstream fix for AMD VA-API flickering on Wayland.

wpa_supplicant 2.12: The Wi-Fi authentication daemon adds more complete EHT/IEEE 802.11be/Wi-Fi 7 support including fixes for message validation issues that could enable denial-of-service attacks, and group key rekeying is corrected. SAE group 20 is now enabled by default when SAE-EXT-KEY is available, and IEEE 802.11bi functionality is supported including changing SAE password identifiers, EPPKE, and association frame encryption. RSN overriding (WPA3-Personal Compatibility Mode) is supported, and Automated Frequency Coordination (AFC) on the 6 GHz band is now available. The build enables CONFIG_IEEE80211BE, CONFIG_SAE_PK, CONFIG_PMKSA_PRIVACY, and CONFIG_IEEE8021X_AUTH by default.

postgresql18 18.6: A major security release for PostgreSQL 18 that fixes more than two dozen CVEs covering remote code execution and denial of service issues. Notable fixes include heap buffer overflows in regular expression matching, to_char formatting, and pg_stat_statements that could execute arbitrary code, a psql issue where early failures in COPY FROM STDIN process data lines as command input, and a logical decoding flaw that could dlopen an arbitrary file. Database administrators on Tumbleweed should plan an update soon.

flatpak 1.18.1: A security-focused bugfix release addressing several sandbox escape and privilege escalation paths in the application framework. Fixes include a sandbox escape with full host filesystem read/write access via a symlink attack on app data directories, a local root privilege escalation via revokefs symlink path traversal and commit tampering, and arbitrary root writes through path traversal in extra-data extraction and flatpak build-init. The release also corrects an anti-downgrade bypass that allowed unprivileged users to downgrade system applications.

Security Updates

libssh2:

• CVE-2026-58050: Fixes a heap buffer overflow via attacker-controlled attribute count from a publickey-subsystem response.

• CVE-2026-58051: Addresses uninitialized pointer being freed when a malformed response is sent by an SSH server.

• CVE-2026-66032: Resolves arbitrary code execution via double-free in SFTP session.

• CVE-2026-66033: Fixes denial of service via integer underflow in AES-GCM cipher negotiation.

• CVE-2026-66034: Addresses heap out-of-bounds read leading to information disclosure and potential arbitrary code execution.

• CVE-2026-66035: Fixes heap buffer overflow during SSH negotiation.

Samba 4.24.5:

• CVE-2026-6949: Fixes TSIG packet with crafted name compression crashing the internal DNS server.

• CVE-2026-58224: Addresses CTDB heap out-of-bounds read via unchecked packet length fields.

• CVE-2026-58216: Resolves 6-byte heap out-of-bounds read in kpasswd service packet parser.

• CVE-2026-58218: Fixes DNS TKEY negotiation storing unauthenticated GSS contexts in a fixed FIFO before authentication completes.

• CVE-2026-58221: Addresses authenticated LDAP access to internal LDB special DNs permitting domain takeover.

• CVE-2026-58222: Resolves LDAP Compare filter injection and trusted-request confusion disclosing protected attributes.

vim 9.2.0901:

• CVE-2026-8339: Fixes arbitrary code execution via keyword lookup.

• CVE-2026-8340: Addresses code injection in netrw via bookmarks.

• CVE-2026-8341: Resolves heap overflow when adding more than 65,535 text properties.

• CVE-2026-8342: Fixes stack buffer overflow in the socket server.

• CVE-2026-8343: Addresses popup opacity mask indexed out of bounds.

• CVE-2026-8344: Resolves use-after-free on JSON decode error.

• CVE-2026-8345: Fixes arbitrary Ex command execution during C omni-completion.

• CVE-2026-8346: Addresses heap buffer overflow in set_sofo().

Linux kernel 7.1.6, 7.1.7 & 7.1.8:

• CVE-2026-64490: Fixes ALSA virtio control metadata validation.

• CVE-2026-64489: Addresses ALSA ymfpci snd_ctl_new1 return value check.

• CVE-2026-64486: Resolves ALSA cmipci snd_ctl_new1 return value check.

• CVE-2026-64481: Fixes ALSA hda-cs35l41 firmware load work teardown.

• CVE-2026-64480: Addresses ALSA ice1712 snd_ctl_new1 return value check.

• CVE-2026-64477: Resolves x86 fs/resctrl out-of-bounds access.

• CVE-2026-64476: Fixes VFIO PCI disable_idle_d3 per-device latch.

• CVE-2026-64475: Addresses VFIO PCI VGA arbiter client release on registration.

• CVE-2026-64474: Resolves VFIO infinite loop in vfio_mig_get_next.

• CVE-2026-64471: Fixes Bluetooth btusb use-after-free on registration.

• CVE-2026-64466: Addresses Rust binder freeze listener cleanup on node removal.

• CVE-2026-64437: Resolves ksmbd use-after-free of a deferred file location.

• CVE-2026-64436: Fixes net af_key uninitialized alg_key_len for IPComp.

• CVE-2026-64433: Addresses Bluetooth MGMT use-after-free of hci_conn_params.

• CVE-2026-64432: Resolves ntfs3 Dirty Page Table capacity validation.

• CVE-2026-64431: Fixes ntfs avoid calling post_write_mst_fixup for invalid ranges.

• CVE-2026-64430: Addresses NTB EPF avoid calling pci_irq_vector from hardirq.

• CVE-2026-64424: Resolves netpoll use-after-free on shutdown path.

• CVE-2026-64449: Fixes staging vme_user bound slave read/write to the buffer size.

• CVE-2026-64445: Addresses staging rtl8723bs WEP length underflow and buffer overflow.

• CVE-2026-64444: Resolves staging rtl8723bs out-of-bounds read in OnAssocRsp IE.

• CVE-2026-64441: Fixes staging rtl8723bs out-of-bounds reads in rtw_get_sec functions.

• CVE-2026-64440: Addresses staging rtl8723bs out-of-bounds write in HT_caps_hand.

• CVE-2026-64599: Resolves crypto amlogic double cleanup in meson_cr.

Firefox 154.0:

• CVE-2026-75874: Fixes a sandbox escape in the Remote Settings client component.

• CVE-2026-74934: Addresses a site isolation issue in the Graphics CanvasWebGL component.

• CVE-2026-74936: Resolves a use-after-free in the JavaScript WebAssembly component.

• CVE-2026-74937: Fixes a use-after-free in the JavaScript GC component.

• CVE-2026-74939: Addresses a privilege escalation in the DOM Navigation component.

• CVE-2026-74943: Resolves a use-after-free in the Graphics ImageLib component.

• CVE-2026-74944: Fixes a use-after-free in the DOM Core & HTML component. https://github.com/KDE/kscreen

• CVE-2026-74953: Addresses a privilege escalation in the Networking Cookies component.

• CVE-2026-74956: Resolves a same-origin policy bypass in the DOM Service Workers component.

• CVE-2026-74969: Fixes a use-after-free in the Layout Text and Fonts component.

• CVE-2026-74976: Addresses a JIT miscompilation in the JavaScript Engine JIT component.

WebKitGTK 2.52.6:

• CVE-2026-43804: Fixes a security vulnerability in the WebKit rendering engine.

• CVE-2026-64713: Addresses a memory corruption issue in the WebKit rendering engine.

• CVE-2026-64719: Resolves a security vulnerability in the WebKit rendering engine.

• CVE-2026-64728: Fixes a memory safety issue in the WebKit rendering engine.

• CVE-2026-64730: Addresses a security vulnerability in the JavaScriptCore engine.

• CVE-2026-64757: Resolves a memory corruption issue in the WebKit rendering engine.

• CVE-2026-64783: Fixes a security vulnerability in the WebKit rendering engine.

postgresql18 18.6:

• CVE-2026-6464: Fixes psql processing data lines as command input after an early failure in COPY FROM STDIN.

• CVE-2026-6471: Addresses logical decoding being able to dlopen an arbitrary file.

• CVE-2026-14662: Resolves undersize allocations for tsvector and tsquery via integer wraparound.

• CVE-2026-14664: Fixes a regexp heap buffer overflow that executes arbitrary code.

• CVE-2026-14669: Addresses a to_char heap buffer overflow that executes arbitrary code.

• CVE-2026-14676: Resolves a pg_stat_statements heap buffer overflow that executes arbitrary code.

• CVE-2026-14679: Fixes a stack buffer overflow in argument match that writes to server memory.

• CVE-2026-15741: Addresses SQL injection via an EXTRACT argument during expression deparse.

• CVE-2026-18408: Resolves psql \unrestrict letting a superuser execute arbitrary code in the psql client.

• CVE-2026-19385: Fixes a pg_dump heap buffer overflow that executes arbitrary code.

expat 2.8.2:

• CVE-2026-50219: Fixes memory corruption affecting Expat bindings by disallowing reentrant calls to functions such as XML_GetBuffer, XML_Parse, and XML_ParserFree.

• CVE-2026-56131: Addresses XML_ResumeParser being called from a handler, plugging a hole in the CVE-2026-50219 fix.

• CVE-2026-56132: Resolves an out-of-bounds scaffolding index store in doProlog.

• CVE-2026-56403: Fixes an integer overflow in storeAtts.

• CVE-2026-56404: Addresses an integer overflow in addBinding.

• CVE-2026-56405: Resolves an integer overflow in getAttributeId.

• CVE-2026-56406: Fixes an integer overflow in XML_ParseBuffer.

• CVE-2026-56407: Addresses an integer overflow in textLen handling.

• CVE-2026-56408: Resolves an integer overflow in copyString.

• CVE-2026-56409: Fixes an integer overflow in the xmlwf output path join.

• CVE-2026-56410: Addresses an integer overflow in the xmlwf resolveSystemId.

• CVE-2026-56411: Resolves an integer overflow in notation list allocation.

• CVE-2026-56412: Fixes XML_TOK_DATA_CHARS handler calls in doCdataSection, plugging a hole in the CVE-2026-50219 fix.

c-ares 1.34.8:

• CVE-2026-33630: Fixes a use-after-free and double-free in query-completion handling remotely triggerable via ares_getaddrinfo() over TCP.

• CVE-2026-69184: Addresses a CPU-exhaustion denial of service via unbounded DNS name compression pointer chains.

• CVE-2026-69186: Resolves a memory-amplification denial of service via unvalidated DNS header record counts.

busybox:

• CVE-2026-38755: Fixes stack exhaustion in the ash applet caused by unbounded shell function recursion.

• CVE-2026-38754: Addresses an out-of-bounds read in ifsbreakup().

• CVE-2026-38753: Resolves a use-after-free in the awk applet regexp processing code during text replacement operations.

• CVE-2026-38752: Fixes stack exhaustion in the awk applet caused by unbounded function call recursion.

• CVE-2023-42366: Addresses a heap buffer overflow in the awk applet when a regexp ends with a backslash.

OpenEXR 3.4.14:

• CVE-2026-68513: Fixes a PyOpenEXR prefixed literal RGB key collision heap buffer overflow.

• CVE-2026-68514: Addresses a PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow.

• CVE-2026-59183: Resolves a signed integer overflow leading to out-of-bounds memory access in deep tile decoding.

• CVE-2026-59186: Fixes an ILP32 TiledRgbaInputFile large tile Array2D heap out-of-bounds write.

• CVE-2026-59187: Addresses an exrmetrics deep pixelmode heap buffer overflow.

• CVE-2026-59981: Resolves an OpenEXRUtil SampleCountChannel row nonzero dataWindow heap out-of-bounds read.

• CVE-2026-59985: Fixes an ILP32 OpenEXRCore RLE decode heap out-of-bounds read denial of service.

• CVE-2026-61555: Addresses a crash on empty multiView viewFromChannelName files.

• CVE-2026-62986: Resolves a PyOpenEXR deep prefixed RGB stale lane disclosure.

python313:

• CVE-2026-0864: Fixes mixed line ending handling in configparser by normalizing all line endings.

• CVE-2026-11972: Addresses tarfile._Stream.seek not breaking at end of file.

• CVE-2026-4360: Resolves a missing filter_function pass-through to TarFile._extract_one() during .extract().

• CVE-2026-15308: Fixes quadratic complexity in incremental HTMLParser parsing enabling CPU exhaustion.

gzip:

• CVE-2026-41992: Fixes global buffer overflow in the LZH decompression logic.

libXfont2:

• CVE-2026-59679: Fixes fs_read_glyphs() heap out-of-bounds read/write via encoding array index mismatch.

• CVE-2026-44950: Addresses fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow.

glib2 2.88.3:

• CVE-2026-15588: Fixes GDBusServer pre-authentication denial of service via unbounded SASL line buffering.

dracut:

• CVE-2026-15816: Addresses root code execution via unescaped error message written to sourced emergency hook script in die().

python-cryptography 50.0.0:

• CVE-2026-69247: Fixes Bleichenbacher oracle in PKCS7 decryption where distinguishable errors or timing could leak information when unwrapping a RecipientInfo’s encryptedKey.

libostree 2026.3:

• CVE-2026-58055: Fixes unbounded LZMA decompression in static delta processing allowing denial of service.

• CVE-2026-58056: Addresses heap buffer overflow via integer truncation in static delta bspatch on 32-bit systems.

gdm 50.2:

• CVE-2026-58058: Fixes path traversal vulnerability where a compromised greeter could load arbitrary .desktop files via SelectSession.

• CVE-2026-58059: Addresses autologin bypass where a compromised greeter could request autologin for any local account.

• CVE-2026-58060: Resolves denial of service where an invalid session name from the greeter would cause the entire daemon to exit.

udisks2 2.11.2:

• CVE-2026-7867: Fixes an unprivileged D-Bus caller using the as-user Filesystem.Mount() option combined with fstab entries containing user or users mount options to mount on behalf of another user without polkit authorization.

php8 8.5.9:

• CVE-2026-17543: Fixes SQL injection via E'...' backslash breakout in PostgreSQL.

• CVE-2026-17544: Addresses out-of-bounds write in bccomp().

• CVE-2026-7260: Resolves crash via recursive symlinks in Phar.

• CVE-2026-9672: Fixes a vulnerability in the GD library upgrade.

libssh2:

• CVE-2026-58050: Fixes heap buffer overflow via attacker-controlled attribute count from a publickey-subsystem response.

• CVE-2026-58051: Addresses uninitialized pointer freed when a malformed response is sent by an SSH server.

python-pip 26.2:

• CVE-2026-13346: Fixes double decoding of the URL path while determining a link filename.

gimp:

• CVE-2026-66757: Fixes a security vulnerability in GIMP image processing.

• CVE-2026-66758: Addresses a security vulnerability in GIMP.

• CVE-2026-66759: Resolves a security vulnerability in GIMP.

• CVE-2026-59087: Fixes a security vulnerability in GIMP image processing.

• CVE-2026-59088: Addresses a security vulnerability in GIMP.

• CVE-2026-59090: Resolves a security vulnerability in GIMP.

• CVE-2026-59091: Fixes a security vulnerability in GIMP.

libheif 1.23.1:

• CVE-2026-62289: Fixes integer underflow in Fraction constructor via double clap transform application.

• CVE-2026-62291: Addresses heap out-of-bounds write in uncompressed encoder when writing images with mismatched auxiliary alpha dimensions.

• CVE-2026-62292: Resolves out-of-bounds read in uncompressed unci tile range slicing.

• CVE-2026-62377: Fixes reachable assertion in HeifContext::get_track() aborting on a valid-but-empty HEIF sequence file.

nghttp2 1.70.0:

• CVE-2026-58055: Fixes out-of-bounds read in the base64 decoder.

libgit2 1.9.7:

• CVE-2026-5917: Fixes improper escaping of remote repository paths in libssh2.

bzip2:

• CVE-2026-42250: Fixes an off-by-one error in the bzip2recover utility when processing a specially crafted file that can lead to a crash.

openssl-3 3.x:

• CVE-2026-75803: Fixes AEAD forgeries with empty ciphertext when using EVP_Cipher().

• CVE-2026-14456: Addresses unbounded memory growth in QUIC server incoming channel queue.

• CVE-2026-14457: Resolves RPK server signature algorithm selection dereferencing a missing certificate.

• CVE-2026-18798: Fixes QUIC server triggering a double free when processing an INITIAL packet.

• CVE-2026-34181: Addresses PKCS#12 files with PBMAC1 being accepted with short HMAC keys.

• CVE-2026-54874: Resolves excessive memory use buffering DTLS records for a future epoch.

• CVE-2026-63072: Fixes a heap buffer overflow in CMS key unwrapping.

• CVE-2026-63073: Addresses untrusted sender DN used as format string in CMP response validation.

• CVE-2026-63074: Resolves CMP indefinite cache growth of ExtraCerts.

• CVE-2026-63075: Fixes QUIC ACK-only packet retention causing memory exhaustion.

• CVE-2026-63076: Addresses invalid pointer dereference in CMP server via crafted protectionAlg.

java-25-openjdk 25.0.4.1:

• CVE-2026-60589: Fixes resource resolving vulnerability.

• CVE-2026-61308: Addresses HTTP connection enhancement security issue.

• CVE-2026-70907: Resolves TLS server security vulnerability.

• CVE-2026-70906: Fixes font loading security vulnerability.

cpio:

• CVE-2026-66484: Fixes path traversal allowing creation of hard links outside the intended directory via malicious tar archives.

• CVE-2026-66485: Addresses denial of service via uncontrolled memory allocation from crafted archives.

• CVE-2026-66486: Resolves terminal control sequence injection via crafted archive member names.

libvirt:

• CVE-2026-77159: Fixes QEMU TPM following symlinks when chown’ing log files.

• CVE-2026-18917: Addresses integer overflow in RPC handler for virNodeGetFreePages.

multipath-tools:

• GHSA-hmcm-9cq4-r2xm: Fixes denial of service on multipathd socket by blocking IPC send operations.

• GHSA-pvp6-c9p3-25fp: Addresses denial of service on multipathd socket by exhausting connections.

• GHSA-g5mh-253r-jjw5: Resolves heap out-of-bounds read in custom format string parser via trailing %.

• GHSA-pxwh-g75c-95pc: Fixes heap out-of-bounds read in device-mapper-multipath ALUA RTPG parsing.

• GHSA-p6rh-9x9j-3hvx: Addresses kpartx heap out-of-bounds read in GPT header validation.

• GHSA-gr7q-prfc-q636: Resolves path traversal in device-mapper-multipath failed_wwids management.

• GHSA-hj7j-qr9h-5fv6: Fixes libmpathpersist PRIN READ FULL STATUS parser unbounded descriptor rewrite causing root heap overflow.

Users are advised to update to the latest versions to mitigate these vulnerabilities.

Conclusion

August was a busy month for openSUSE Tumbleweed with 23 snapshots delivering a steady cadence of desktop, developer, and security improvements. KDE Plasma 6.7.4 delivered targeted desktop fixes while KDE Gear 26.08.0 and KDE Frameworks 6.29.0 advanced the KDE application and library stacks, and GNOME Shell 50.4 polished the GNOME desktop. Mesa settled into its 26.2 series, the Linux kernel progressed through point releases to 7.2.0 with extensive CVE coverage, Firefox 154.0 shipped more than 40 security fixes, and GStreamer 1.28.6 brought playback and security fixes across the multimedia stack. Developer tools saw significant updates: Emacs jumped to 31.1, QEMU advanced to 11.1.0 with UFS emulation and RISC-V extensions, GCC reached 16.2, Qt 6 advanced to 6.11.2, OpenSSH 10.5p1 fixed critical agent forwarding issues, and vim addressed eight security vulnerabilities. FreeRDP 3.31.0 patched more than 20 CVEs while improving YUV decoding performance, wpa_supplicant 2.12 brought Wi-Fi 7 support, and chrony 4.9 added NTP-over-PTP and new stratum-bounding directives. Security remained a dominant theme, with critical patches in libssh2, Samba, postgresql18, openssl, expat, webkitgtk, openexr, flatpak, python-cryptography, openvpn, gdm, udisks2, multipath-tools, and php8.

Slowroll Arrivals

Please note that these updates also apply to Slowroll and arrive between an average of 5 to 10 days after being released in Tumbleweed snapshot. This monthly approach has been consistent for many months, ensuring stability and timely enhancements for users. Updated packages for Slowroll are regularly published in emails on openSUSE Factory mailing list.

Contributing to openSUSE Tumbleweed

Stay updated with the latest snapshots by subscribing to the openSUSE Factory mailing list. For those Tumbleweed users who want to contribute or want to engage with detailed technological discussions, subscribe to the openSUSE Factory mailing list . The openSUSE team encourages users to continue participating through bug reports, feature suggestions and discussions.

Your contributions and feedback make openSUSE Tumbleweed better with every update. Whether reporting bugs, suggesting features, or participating in community discussions, your involvement is highly valued.

A few years ago I wrote a blog post about a small hackweek project called rdepends. The idea was simple: given a package, find out what other packages depend on it, recursively. It lived in my home project on the build service and it was a useful but rough tool.

Since then a few things happened that made me revisit it.

Zypper got the feature

Back when I started this project, zypper had no built-in way to ask “what depends on package X?”. You could ask the other direction easily with zypper info --requires, but not the reverse. I raised this with the zypper developers and Benjamin Zeller implemented the --requires-pkg flag in zypper 1.14.33. So now you can do:

On Friday, August 28th, the SUSE Prague office hosted Mobile Linux Hackday #8. This event marked two major milestones: we hit a new record attendance for Prague, and attendees got their first hands-on experience in our freshly renovated Karlín space.

If you missed the event, here is a recap of the community highlights, kernel hacking sessions, and key takeaways from the day.

Renovated Prague Office: Great Coffee and Full Capacity

Returning attendees and newcomers were welcomed into our newly reconstructed Karlín office. The expanded social hub in the kitchen was an immediate favorite, providing comfortable sofas for breaks and technical discussions.

The highlight for many was the upgraded coffee station. Attendees put the manual lever espresso machine and external grinder through its paces, while a fully automatic machine served as a reliable backup.

Community Growth and Room Merging

With a peak crowd of 20 to 25 attendees, we set a new record for a Prague Mobile Linux Hackday and put our workspace flexibility to the test. The numbers were strong, especially when compared with earlier community gatherings such as the first Pilsen Mobile Hackday or the combined Budweis and SUSE Labs events, which had historically drawn larger crowds and set the benchmark for what a really “prime” event could look like. This turnout is a clear sign that our outreach and event marketing are gaining traction, and it is encouraging to see the community respond so strongly.

We originally booked the Mint meeting room, but as more people arrived, we pulled open the sliding partition panel and took over the adjoining Avocado room as well. Even after expanding into a double-sized room, we still had to borrow almost every chair from the surrounding area to seat everyone. Moving forward, we will definitely make sure we have plenty of extra seating ready for future gatherings.

Flexible Formats and the Kitchen Talk Dilemma

Unlike previous editions with rigid agendas, this Hackday was a bit more freestyle. Attendees naturally split into smaller working groups, alongside a remote session with David, who joined us from Switzerland and kindly made time for a deeper discussion on a more established topic.

This casual approach sparked fantastic side discussions, but it also highlighted a fun new challenge: the renovated kitchen space was so inviting that some attendees spent most of the day there, drifting into long hallway-track conversations. A big kudos to the facilities team for creating such a comfortable, social space that people simply did not want to leave!

While informal networking is a core part of community building, balancing casual chatter with structured technical sessions is something we plan to fine-tune for future events. We are actively looking into light-touch scheduling methods to help guide attendees smoothly between casual kitchen banter and hands-on coding.

Outreach Insights: Where the Czech Linux Community Gathers

During the event, we surveyed attendees on how they discovered the event to help refine our future community outreach.

• Root.cz: The primary source for most attendees.
• AbcLinuxu.cz: Brought in several key community members.
• Word of Mouth: Direct recommendations from friends and colleagues played a major role in bringing in fresh faces.
• LinuxExpres.cz: This was the first time we included it in our promotion mix. It did not produce a noticeable spike in attendance, but it was still a useful extra step in widening our reach beyond the usual community channels.
• Mastodon: The main communication channel for the community, and many attendees learned about the event through the Mobile Linux CZ/SK Mastodon account.

Every newcomer made sure to leave with plenty of openSUSE swag to mark their first event.

Technical Highlights: AI Tools, BengalOS, and Snapdragon Hacking

Led by Petr Hodina, Mesa 3D GPU driver developer and community maintainer, the technical tracks covered several cutting-edge topics across mobile ecosystem development.

Key Topics Covered:

• LLMs and Developer AI: Practical applications of Large Language Models to streamline daily developer workflows.
• BengalOS Architecture: An overview of BengalOS, including instructions on how to build and test the OS on hardware.
• Qualcomm Snapdragon 845 Kernel Hacking: Hands-on kernel debugging and testing focused on sdm845-based devices, including the OnePlus 6/6T, Xiaomi Poco F1, and Shift 6MQ.

Join the Next Mobile Linux Hackday

A huge thank you to Petr Hodina for driving the sessions, keeping the momentum high, and running an outstanding workshop. As a small token of our appreciation for his dedication to the community, Petr was awarded a giant plush openSUSE chameleon!

Photos from the event, along with broader shots of the refreshed SUSE Prague office, are available in our shared Google Photos album.

To stay updated on upcoming hackdays, follow the Mobile Linux CZ/SK community on Mastodon, or keep an eye out on local tech portals like Root.cz. See you at Hackday #9!

Hace un tiempo que os vine a recomendar el podcast «La era de las distros» un proyecto del gran Lorenzo Carbonell que junto a los protagonistas correspondientes repasa lo que fue la punta de lanza del desembarco de Software Libre en España: las distribuciones educativas autonómicas. Dado que quiero que este proyecto llegue al máximo número de pesonas posibles voy a ir promocionando episodio a episodio porque bien vale la pena escucharlos. Bienvenidos al Episodio 4 del Podcast «La era de las distros», que lleva por título «100.000 Ordenadores con Linux. El milagro que ninguna gran tecnológica pudo detener» donde nos relatan como funcionaba por dentro LinExde la mano de José Luis Redrejo, Jesús Rubio, Jesús González-Barahona y Lorenzo Carbonell.

100.000 Ordenadores con Linux. El milagro que ninguna gran tecnológica pudo detener – Episodio 4 del Podcast «La era de las distros»

Como sabréis los que me siguen, he sido docente de secundaria en la Comunidad Valenciana desde el 2000, así que viví los años de la irrupción informática en las aulas en primera persona: los primeros ordenadores en las salas de profesores, las primera aplicaciones para la gestión de los colegios, los tímidos intentos de acercar las TIC al alumnado, las primeras escaramuzas para controlar los móviles en las aulas, etc.

En ese panorama, algunas comunidades autónomas del estado español decidieron que era el momento de dar una oportunidad al Software Libre, tanto por razones económicas como por tener la soberanía digital que tanta importancia está adquiriendo ultimamente.

Contar la historia de estas iniciativas es el propósito del Podcast de «La era de las distros» que en este cuarto episodio vemos el lado más técnico de LinEx, pero mejor que nos lo describan los protagonistas:

La historia de la tecnología suele estar escrita en los garajes de Silicon Valley o en los rascacielos de Seattle. Sin embargo, a principios del siglo XXI, una de las páginas más brillantes y audaces de la informática moderna se escribió en un lugar inesperado: la dehesa extremeña. En la historia de la tecnología española, pocos proyectos han tenido la audacia y el impacto de GNU/LinEx. Si bien en episodios anteriores de este podcast analizamos la visión política y el marco institucional que permitió su nacimiento, hoy nos sumergimos en el corazón del sistema. Nos alejamos de los decretos para conocer la ingeniería, los problemas de hardware y la pasión docente que hizo que LinEx no fuera solo un deseo político, sino una realidad cotidiana para miles de estudiantes.

Para este viaje contamos con José Luis Redrejo, profesor de formación profesional y una de las figuras clave en el desarrollo y estabilidad de la distribución. Junto a él, desgranamos cómo un grupo de «aficionados» apasionados acabó gestionando una de las mayores redes de software libre del mundo. este tercer episodio de «La era de las distros», nos adentramos en el fenómeno LinEx, la distribución de Linux que no solo dotó de herramientas digitales a una región, sino que desafió el orden mundial del software.

Los participantes del podcast son:

• José Luis Redrejo. Desarrollador de gnuLinEx. Profesor de Secundaria.
• Jesús Rubio. Durante esos años fue Jefe de Servicio en la Dirección General de Sociedad de la Información de la Junta de Extremadura.
• Jesús González-Barahona. Catedrático del área de Ingeniería Telemática en la Universidad Rey Juan Carlos (Móstoles, Madrid).
• Lorenzo Carbonell

Os puedo asegurar que vale la pena escucharlo para que no caiga en el olvido el increíble trabajo que realizaron las personas involucradas en el proyecto y para aprender a gestionar el futuro, aprendiendo de las cosas que no se pudieron hacer bien en el pasado.

Puedes escuchar el podcast en cualquiera de las siguientes plataformas:

• 
  Cómo Extremadura cambió el Software Libre para siempre – Episodio 2 del Podcast «La era de las distros»
  Bienvenidos al Episodio 2 del Podcast «La era de las distros», que lleva por título «Cómo Extremadura cambió el Software Libre para siempre» donde nos relatan el nacimiento de Linex, la distribución extremeña que inició la revolución.
• 
  Lanzado LinEx Colegios 2010
  Y otro lanzamiento más. En esta ocasión otra distribución más para colegios por parte de una administración pública, concretamente de la comunidad autónoma de Extremadura y su Linex. LinEx Colegios… Leer más: Lanzado LinEx Colegios 2010
• 
  Anuncios sobre Linux (V): LinEx
  Esta vez le toca a LinEx, la distribución Linux de Extremadura, la cual también se decanta por Gnome ya que se basa en Debian (gracias env)(la moda de Ubuntu es… Leer más: Anuncios sobre Linux (V): LinEx

La entrada 100.000 Ordenadores con Linux. El milagro que ninguna gran tecnológica pudo detener – Episodio 4 del Podcast «La era de las distros» se publicó primero en KDE Blog.