For many years, I didn’t think that Tor could be useful for me. However, I’ve recently found a Gist on GitHub that describes how you can use it to harden your central syslog-ng server. And while I have yet to try it, at least now I have a reason to actually test Tor.

The Tor website describes the project as follows: “Protect yourself against tracking, surveillance, and censorship.” I live in a country where thankfully I do not need these, nor do I perform any activities for which Tor would be useful. However, sometimes I hear from syslog-ng users that they want to hide their logging infrastructure with something more than what mutual TLS authentication makes possible. This is where this short how-to might be useful for you:

https://gist.github.com/hashgh0st/19bcfa4bfc96fbf0bbd2897b66c77db7/

The Gist is about how to install / configure syslog-ng and Tor on a FreeBSD client and server. I have a couple of FreeBSD boxes lying around, so I will test the instructions there. However, with minimal changes, the procedure should work on any Linux distribution as well.

Originally published at https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-hardening-using-tor

Back when I was working at Canonical on the Ubuntu phone project, test-driven development was the default and natural way to work. One thing I noticed and genuinely liked was how Ubuntu and Debian ship functional tests alongside many of their packages. Not only build-time unit tests hidden in the CI pipeline, but installable test binaries that you can run against the actual packages on an actual system. They are named *-tests or *-test, and they live in the archive next to the production packages.

Dear Tumbleweed users and hackers,

This week was quite busy and successful, with 6 snapshots (0716, 0717, 0718, 0720, 0721, and 0722) published to our users.

From last week’s outlook, we successfully checked off three major updates: KDE Plasma 6.7.3, systemd 261.1, and Perl 5.44.0 are now in your hands.

We also had a brief “yo-yo” moment with multipath-tools. In snapshot 0720, we upgraded it to version 0.15~1, which enabled asynchronous path checkers by default and deprecated some options. This quickly turned out to cause some integration ripples, so in snapshot 0721 we chose safety first and reverted back to version 0.14.3.

These six snapshots delivered the following updates:

• KDE Plasma 6.7.3
• systemd 261.1
• Perl 5.44.0
• Linux Kernel 7.1.4
• Wayland 1.26.0
• firewalld 2.3.2
• Mozilla Firefox 152.0.6
• Python 3.13.14
• Ruby 4.0.6
• Mesa 26.1.5
• libzypp 17.38.14
• libupnp 22.0.4
• ipxe 2.0.0
• libtool 2.6.2
• google-noto-fonts 20260701

As we close out this week’s chapter, here is a sneak peek at what is brewing in the staging projects for the coming days.

• linux-glibc-devel 7.1: Last holdup at this time is llvm (15 – 21).
• Podman 6.0.0: Undergoing integration and sync testing with buildah and skopeo.
• GCC 16 as the default system compiler: This major upgrade has now been moved to Staging:N, where openQA will soon be triggered to verify integration.
• rpmlint: The upcoming update will enforce whitelisting for capabilities in SUIDPermissionsCheck

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org.

The community blog feed aggregator lists the featured highlights below from July 17 to 23. This week opened Call for Proposals for two 2027 Open Developers Summits (Barcelona and Dallas), and KDE published its Akademy 2026 schedule for Graz. A blog also confirms Akademy-es will be in Madrid. On the technical side, a PortProtonQt Polkit flaw (CVE-2026-59678) was fixed in 1.3.1, and Tumbleweed shipped five snapshots.

Here is a summary and links for each post:

Slimbook OS 26 Released, Slimbook’s Own Operating System

The KDE Blog covers the launch of Slimbook OS 26, which jumps from the previous release to a base of Ubuntu 26.04 LTS and GNOME 50. Although tuned for Slimbook hardware, it works on any machine and bundles the Slimbook Control Panel and Service alongside Alpaca for optional, private local AI chat.

Thunderbird 153 Released, the New Extended Support Version of the Free Software Mail Client

Victorhck reports that Thunderbird 153 becomes the new ESR release replacing Thunderbird 140. It gathers up everything that has landed month by month in the monthly release channel, including a new design, new features and bugfixes.

Flying Cursors for Your PC

The KDE Blog introduces Volantes, a clean and minimal cursor theme for Linux desktops created by x-varlesh-x. Available in light and dark variants with sizes from 24 to 64 pixels, the cursors can be installed directly through KDE Plasma’s cursor theme settings via the “Get New Themes” option.

Syslog-ng Journald Source: How to Avoid Log Bombs on Errors

Peter Czanik’s Blog explains a behavior change in syslog-ng regarding error handling when jumping to a saved systemd journal position. Up until version 4.12, syslog-ng would read the journal from the beginning upon encountering an error, but the latest version allows users to configure what happens in such cases.

Open Developers Summits Head to Barcelona and Dallas in 2027

openSUSE News announces two Open Developers Summits planned for 2027, with calls for proposals now open. The first summit takes place Feb. 18 in Barcelona alongside SUSECON, while the second is scheduled for April 14 in Dallas, Texas.

PortProtonQt: Custom Polkit Rule Allows Escalation of NetworkManager and UDisks2 Privileges

The SUSE Security Team discloses CVE-2026-59678, a vulnerability in PortProtonQt where a custom Polkit rule allows arbitrary local users to modify NetworkManager connections or UDisks2 mounts. The issue, introduced in version 0.1.12, was fixed in version 1.3.1 by restricting elevated privileges to users in an active local session who are members of a dedicated portprotonqt group.

You Are the Asset: Carles Tamayo’s Documentary at GNU/Linux València Event

The KDE Blog announces an event organized by GNU/Linux València featuring a debate on the documentary “El Activo Eres Tú” by Carles Tamayo, preceded by an Install Party on July 31.

Evaluating TOON in a Real-World Scenario

Christian Goll presents real-world experiments testing Token-Oriented Notation (TOON) in the systemd-mcp server to reduce token usage in AI inference. The study found that TOON performs superiorly for complex multi-step tasks, keeping LLMs more focused by increasing information density and reducing distracting overhead.

Updating the Signing Key on Leap Micro

openSUSE News explains how to resolve repository signature errors on Leap Micro following the recent signing key expiration. Users can force a refresh of the repository metadata by running zypper ref -f within a transactional-update shell.

GSoC Update 2: Visual Redesign and Responsive SVGs

openSUSE News shares Mario Marín’s Google Summer of Code progress on the obs-status-service SVG generation, focusing on visual consistency with Gitea’s UI. The update introduces native Gitea colors, a responsive compact mode for large project matrices, and dynamic layout calculations to prevent text overflow.

The Case for Sponsoring openSUSE

openSUSE News makes the case for companies to sponsor the openSUSE Project, highlighting the infrastructure value of Open Build Service, openQA, Tumbleweed, Leap, and Uyuni. Sponsorship takes three forms—money, hardware, or services—and helps maintain the development ecosystem that hardware vendors and enterprises rely on for Linux compatibility.

Akademy 2026 Talk Schedule Published for Graz, Austria

The KDE Blog announces the published talk schedule for Akademy 2026 in Graz, Austria, taking place Sept. 19-24 as a special 30th anniversary edition. Talks will be held on Saturday and Sunday, covering topics such as KDE Linux, Dolphin, Plasma, QA, and community matters.

Real-Time Weather Information with Meteoclimatic Feeds – Plasmoids for Plasma 6 (36)

The KDE Blog presents Meteoclimatic Feeds, the 36th entry in its Plasma 6 plasmoid series, connecting to the Meteoclimatic network of amateur weather stations for real-time data. Created by Victorhck, this plasmoid is based on the RSS feeds plasmoide and can be installed by copying the folder to ~/.local/share/plasma/plasmoids.

Linux Saloon 211: Open Mic Night

Nathan’s Blog covers discussions about user experiences with Fedora, job openings at Epic Games focused on Linux security, and IBM’s new chip architecture advancements. The episode also touches on Dell surpassing HP in U.S. PC sales amid a shrinking market.

Linux Saloon 210: Early Edition July

Nathan’s Blog discusses AI and the possibility of the bubble bursting. The episode also has discussions involving the Open Build Service and some joking about Tumbleweed.

Shadows for Steam and Discord – This Week in Plasma

The KDE Blog translates Nate Graham’s weekly Plasma development update, highlighting KWin’s new automatic shadow, outline, and corner rounding effects for client-side decorated windows like Steam and Discord.

openSUSE Tumbleweed Review of Week 29 of 2026

Victorhck and Dominique review five Tumbleweed snapshots published during the week. Highlights including SELinux Toolchain 3.11, KDE Frameworks 6.28.0, QEMU 11.0.2, GStreamer 1.28.5, and Rust 1.97. The reversion of gvim’s GTK4 build back to GTK3 was notable due to clipboard deadlocks in the current GTK4 port.

Akademy-es 2026 Will Be Held in Madrid

The KDE Blog announces that Akademy-es 2026 will take place from Oct. 23-25 in Madrid. The event celebrates KDE’s 30th anniversary and Akademy-es’s 20th anniversary.

View more blogs or learn to publish your own on planet.opensuse.org.

Choose your poison: Up until version 4.12, when syslog-ng ran into an error jumping to a saved systemd journal position, it read the journal from the beginning. With the latest syslog-ng version, you can configure what happens in case of such an error.

Read more at https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-journald-source-how-to-avoid-log-bombs-on-errors

The openSUSE community is planning two Open Developers Summits in 2027, and organizers are calling for proposals for both events now.

The first summit is scheduled to take place on Feb. 18, 2027, in Barcelona, Spain, held alongside SUSECON. The second is scheduled to take place on April 14, 2027, in Dallas, Texas. Both are one-day summits that bring together SUSE partners, openSUSE contributors, open-source community projects and enthusiasts for a day of shared ideas and collaboration. Whether you’re deep in the code or just passionate about open source, there’s a place for you at each.

Open Developers Summit — Barcelona

The Open Developers Summit in Barcelona is scheduled to take place Feb. 18, 2027, and align with SUSECON. The call for proposals is open until Nov. 20, 2026.

Talks can cover operating systems, new technologies, cloud, infrastructure, edge, IoT, AI, data, programming languages, toolchains, security, DevOps, automation and more. If you have insights to share or a project worth spotlighting, this is your invitation to take the stage.

Submit your talk and join us in Barcelona. Come to learn, connect and help shape where open development goes next.

Open Developers Summit — Dallas

The Open Developers Summit is scheduled to take place in Dallas, Texas, on April 14, 2027. The call for proposals is open until Jan. 20, 2027.

As in Barcelona, talks can cover operating systems, new technologies, cloud, infrastructure, edge, IoT, AI, data, programming languages, toolchains, security, DevOps, automation and beyond. If you have insight to share or a project worth spotlighting, this is your invitation to take the stage.

Submit your talk and join us in Texas. Come to learn, connect and help shape where open development goes next.

Sponsor a Summit

Both summits are free community events made possible thanks to the generous support of sponsors and community donors. Sponsorship keeps the events accessible to all and fosters collaboration and knowledge-sharing across open-source communities.

Companies interested in sponsoring can review the prospectus for each event and reach out to Douglas DeMaio at ddemaio@opensuse.org:

• Barcelona: ODSB Prospectus
• Dallas: ODSD Prospectus

Sponsorship levels for the events include a Diamond, Emerald and Jade sponsorship donation, each offering logo placement, event recognition and promotion. Individuals and small organizations can also contribute through community donations.

More details are available at events.opensuse.org.

Table of Contents

• 1) Introduction
• 2) Insecure Polkit Rule
• 3) Bugfix
• 4) CVE Assignment
• 5) Timeline
• 6) References

1) Introduction

PortProtonQt is a GUI application to simplify launching of Windows games on Linux. A review of a custom Polkit rule installed by PortProtonQt uncovered an attack vector which allows arbitrary local users to modify NetworkManager connections or UDisks2 mounts.

This report is based on version 1.3.0 of PortProtonQt. A bugfix is available in the newly released version 1.3.1.

2) Insecure Polkit Rule

PortProtonQt installs a Polkit rules file ru.linux_gaming.PortProtonQt.rules containing the following logic:

var cmd_line = polkit.spawn(["ps", "-o", "args=", "-p", String(subject.pid)]);
var ppid = polkit.spawn(["ps", "-o", "ppid=", "-p", String(subject.pid)]).trim();
var parent_cmd_line = "";
if (ppid) {
    parent_cmd_line = polkit.spawn(["ps", "-o", "args=", "-p", ppid]);
}
var is_ppqt_call = cmd_line.includes("ppqtos") || parent_cmd_line.includes("ppqtos");

if (( action.id === "org.freedesktop.NetworkManager.settings.modify.system" ||
        action.id == "org.freedesktop.udisks2.filesystem-mount-system" ||
        action.id == "org.freedesktop.udisks2.filesystem-mount-other-seat" ||
        action.id == "org.freedesktop.udisks2.filesystem-unmount-others" ) && is_ppqt_call) {
    return polkit.Result.YES;
}

The code inspects the requesting process’s command line as reported by the ps utility, aiming to grant additional privileges to the ppqtos program. This is on one hand subject to race conditions, because the PID used by the requestor can be recycled or replaced by other programs by the time the Polkit rule runs. On the other hand, the process command line can be influenced arbitrarily to fake a ppqtos process.

We developed a simple shell script reproducer which shows that the exploitation of this vulnerability is simple and always succeeds. The vulnerability allows arbitrary local users to meddle with the network settings via NetworkManager and mount/unmount file systems via udisks. We could not spot a full local root exploit in that, although it is getting close. The impact is mostly Denial-of-Service and system integrity:

• arbitrary block devices can be mounted (but not in arbitrary locations, only under /run/media).
• arbitrary block devices can be unmounted (unless in use, but independent of their mount location).
• arbitrary NetworkManager connections can be removed and created, violating network integrity.

3) Bugfix

Upstream fixed the issue in commit f0ab40a2d which is part of a 1.3.1 bugfix release. Upstream followed our suggestion to allow these extra Polkit actions only for users in an active local session which are members of a dedicated portprotonqt group. This way the authentication bypass is restricted to interactive users that opt-in to using this feature.

The issue was introduced in PortProtonQt version 0.1.12 via commit 71a8ebd89.

4) CVE Assignment

In agreement with upstream we assigned CVE-2026-59676 to track this issue.

5) Timeline

6) References

• PortProtonQt GitHub project
• PortProtonQt 1.3.1 bugfix release
• openSUSE review bug for PortProtonQT Polkit rule
• Reproducer for the issue