open source11 articles
Capital One Releases AI Vulnerability Hunter to the Public
Capital One has open-sourced an internally developed AI-powered security tool called VulnHunter, designed to identify and fix software vulnerabilities at the code level. Unlike traditional scanners, it uses an agentic reasoning workflow to map attack paths, propose targeted code fixes, and reduce false positives that slow developer workflows. The company released it publicly on GitHub, citing the need for widely distributed defensive tools to address the interconnected risks of modern software supply chains.
Linus Torvalds on AI Coding Critics: Fork Off
Linus Torvalds has publicly declared that the Linux kernel will not be an "anti-AI project," telling critics who object to AI-generated code to fork the project or walk away. His stance emerged from a debate over Sashiko, an AI-powered kernel code review tool that detects bugs but also produces false positives at a rate of around 20%. Torvalds defended AI tools on pragmatic grounds, arguing they are clearly useful and that human coders are far from infallible either.
North Korean Hackers Are Quietly Poisoning Open Source Repositories
North Korean hackers are conducting a supply chain campaign called PolinRider, active since December 2025, targeting open source developers across NPM, Packagist, Go modules, and Chrome extensions. The attackers compromise maintainer accounts to inject obfuscated JavaScript loaders into legitimate repositories, which deliver the DEV#POPPER RAT and OmniStealer malware, with 162 malicious artifacts identified across 108 packages so far. Security firm Socket warns that any developers who installed affected packages should treat their environment as potentially compromised and conduct remediation from a clean machine, as credentials for package registries, cloud services, and CI/CD pipelines may have been exposed.
The Unix Ownership Lawsuit That Will Outlive Us All
A decades-old legal dispute over UNIX code ownership has resurfaced, with a company called Xinuos — which acquired SCO's software assets — now suing IBM over claims that Big Blue improperly used SCO-owned code in Linux and its own operating systems. The case originated in 2003 when SCO alleged IBM contributed proprietary UNIX code from the failed "Project Monterrey" collaboration to open-source Linux, and has continued in various forms despite a 2021 settlement between the original parties. A recent hearing revisited familiar arguments about code ownership and licensing rights, with a key question being whether Xinuos even has legal standing to pursue the case at this stage.
Torvalds Tells AI-Assisted Kernel Contributors to Back Off
Linus Torvalds has warned Linux kernel contributors that he will begin rejecting trivial or unnecessary pull requests submitted late in the development cycle, particularly those triggered by AI code reviews. He criticised the fifth release candidate for Linux 7.1 as unusually large, arguing that non-critical fixes to long-standing issues should wait for the next merge window rather than adding risky churn near release. This follows a previous complaint from Torvalds that AI-generated security reports have made the kernel's security mailing list "almost entirely unmanageable."
Supply Chain Attack Hits Packagist: Eight PHP Packages Compromised via GitHub-Delivered Malware
Eight packages on Packagist, the primary dependency registry for PHP projects, were quietly backdoored in a supply chain attack that used GitHub infrastructure to serve Linux malware.
AI Is Finding Linux Bugs Faster Than Anyone Can Fix Them. That's Not Going Away.
Recent Linux vulnerabilities like Dirty Frag, Copy Fail, and Fragnesia highlight a growing trend of AI tools rapidly discovering kernel-level security flaws, with Linus Torvalds noting that bugs are now being publicly analysed within hours of being patched. The mean time to exploit vulnerabilities has shrunk dramatically — turning negative, meaning exploits often appear before patches do — and duplicate AI-generated bug reports are burdening already stretched maintainers. Experts stress that Linux hasn't become inherently less secure, but that AI's superior bug-detection capabilities demand greater security vigilance from administrators, including enforcing stricter security policies like SELinux in restrictive mode.
Megalodon Attack Poisons Thousands of GitHub Repos via CI/CD Hijacking
Someone has been systematically targeting GitHub repositories at scale.
Google Quietly Kills Open-Source Gemini CLI and Replaces It With Something Far Less Open
Google is replacing its open-source Gemini CLI tool with the new closed-source Antigravity CLI, with most free and paid consumer users losing access to Gemini CLI on June 18, 2026, while enterprise customers and those with paid API keys are exempt. Developers have reacted angrily to the switch, citing the lack of open-source code for Antigravity CLI, reported usage limit issues, and concerns that open-source community contributions were used to build a proprietary replacement. Google has acknowledged there will not be full feature parity at launch and that Gemini CLI will continue to be maintained, but only for paying enterprise customers.
Linus Torvalds: AI Bug Hunters Are Drowning the Linux Security List in Duplicate Garbage
Linus Torvalds has criticised the flood of AI-generated bug reports overwhelming the Linux kernel's security mailing list, saying mass duplication from multiple researchers using the same tools has made it "almost entirely unmanageable." He argues that AI-detected bugs are not secret by nature and should not be submitted to a private list, where reporters cannot see each other's duplicate reports, creating pointless extra work. Torvalds urged researchers to go further than simply filing AI-generated reports by also developing patches and adding genuine understanding, rather than submitting drive-by reports with no real context.
NousCoder-14B: Open-Source Coding Model Arrives Just as Everyone's Losing Their Minds Over Claude Code
Nous Research has released NousCoder-14B, an open-source coding model trained in just four days on 48 Nvidia B200 GPUs, achieving 67.87% accuracy on the LiveCodeBench v6 benchmark — a 7-point improvement over its base model. The release stands out for its radical transparency, with Nous publishing not only the model weights but also the full training environment and reinforcement learning framework, enabling others to reproduce the work. However, the researchers flag a significant concern: the training dataset approached the limits of available competitive programming problems, pointing to data scarcity as a key obstacle for future AI coding progress and highlighting synthetic data generation as a critical area for future research.