Hardware-encrypted SSDs sold under the TCG Opal2 standard cannot be assumed safe just because they ship with encryption features turned on. Researchers tested 38 drives from multiple vendors and found broken or weak behavior, including predictable random numbers, flawed PSID reset tokens, and, on some Lenovo OEM drives, a tweak value reused across the whole disk. One drive firmware issue was fixed by Micron, but many other reports were already known, unpatched, unsupported, or ignored.

Source

Red Hat has developed a two-node configuration for high-availability OpenShift deployments at the edge to cut hardware costs that customers find prohibitive when powering and maintaining a third node across many sites. OpenShift is Red Hat's enterprise Kubernetes platform for running containers and related workloads. Previously a lightweight arbiter device was required to maintain quorum and prevent split-brain scenarios in which both nodes act as primary after a connectivity loss.

Source

A regression in the open-source AMDGPU driver is causing significant performance degradation across several major Linux distributions, including Ubuntu, Fedora, and Arch. The issue stems from a bug in the Linux 7.0 kernel series that mismanages GPU power profiles and clock settings. This flaw can allow GPU core frequencies to exceed manufacturer limits, triggering the kernel to throttle the device to prevent damage.

Source

Linus Torvalds has officially declared that the Linux kernel project is not "anti-AI," positioning artificial intelligence as a practical utility for developers. He emphasized that the usefulness of large language models is no longer in question for those who have actively engaged with the technology. While acknowledging that AI can sometimes increase maintainer workloads or surface embarrassing bugs, Torvalds insists that the project will prioritize technical merit over ideological opposition.

Source

Microsoft has revoked 11 legacy, Microsoft-signed UEFI shim bootloaders that allowed attackers to bypass Secure Boot protections. These outdated binaries, primarily version 0.9 and earlier, remained trusted by the "Microsoft Corporation UEFI CA 2011" certificate despite containing long-known vulnerabilities. By utilizing a "Bring Your Own Vulnerable Bootloader" (BYOVB) attack, threat actors could execute unauthorized code during the early boot phase before the operating system initializes.

Source

Red Hat OpenShift 4.22 introduces a hardened foundation by migrating core components to a minimal Universal Base Image to reduce the attack surface. The platform now utilizes a zero-trust workload identity manager and SPIRE to replace static credentials with dynamic, cryptographic tokens. These architectural changes aim to automate compliance and minimize the manual effort required for risk mitigation across hybrid cloud environments.

Source

The release of Debian 12.15 marks the final point update for the "Bookworm" series as it transitions to long-term support. This milestone signifies the end of mainstream support for the native 32-bit x86 (i386) architecture within the Debian ecosystem. While Debian 12 will receive security maintenance until mid-2028, no further point releases are planned for this version.

Source

ESET researchers have identified 11 vulnerable UEFI shim bootloaders that allow attackers to bypass Secure Boot on nearly any UEFI-based system. These shims, some dating back to 2013, remained signed by Microsoft despite containing critical flaws or authorizing vulnerable secondary components. Because these binaries were never revoked, attackers can use them to execute untrusted code and deploy persistent bootkits like BlackLotus or BootKitty.

Source

Microsoft has overhauled the resource management architecture for Windows Subsystem for Linux to prevent demanding workloads from crashing the entire environment. Previously, resource-heavy operations like software compilation could trigger out-of-memory events that left the subsystem unresponsive even after usage subsided. The new design ensures that essential background services always have the necessary overhead to maintain communication with the host Windows OS.

Source

Researchers have identified at least eleven vulnerable UEFI shim bootloaders that allow attackers to bypass Secure Boot on any system trusting the Microsoft third-party certificate authority. These shims, primarily version 0.9 or older, act as a bridge between firmware and the operating system but contain decade-old flaws that can be exploited to execute unsigned code. Because attackers can simply bring their own copy of a trusted but vulnerable binary to a target machine, the protection is undermined regardless of the installed operating system.

Source

The sixth point release of Debian 13, known as "trixie," primarily addresses the expiration of a decade-old UEFI Secure Boot certificate authority. To prevent future boot failures, the update includes a new version of fwupd capable of refreshing the Key Exchange Key and revocation database. The shim bootloader has also been rebuilt to ensure compatibility with the 2023 Microsoft UEFI certificate while implementing updated revocation levels.

Source