# packages Published articles for packages. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Using Python's pip to Manage Your Projects' Dependencies DevFeed: [Using Python's pip to Manage Your Projects' Dependencies]() Original publisher: [Read original article]() Author: Philipp Acsany Published: 2026-11-08T14:00:00Z Content type: tutorial Language: en Sources: [Real Python]() Topics: [pip](), [PyPI](), [Python](), [Learning]() Tags: [dependencies](), [install](), [library](), [manage](), [manager](), [packages](), [pip](), [projects](), [python](), [standard-library]() ### AI overview pip installs Python packages from PyPI or a configured index, resolves their dependencies, and can also install packages from Git repositories. Use `python -m pip` to run pip through a specific Python interpreter, and use `venv` to isolate a project's packages and Python version. `pip freeze` can record installed versions in a requirements file, while `pip install -r` recreates an environment; flexible version bounds allow updates, but exact pins help reproduce a release. Separate development requirements can include production requirements. Before uninstalling packages, check their dependencies to avoid breaking other software. If pip is missing, try `ensurepip` (which installs its bundled version without internet access) or `get-pip.py` (which installs the latest version); path or interpreter mismatches can also explain command errors. ### Source excerpt What is pip? Learn how to use pip, Python's standard package manager, to install and manage packages that aren't part of the standard library. ## OpenIndiana 2026.10 Released With Updated Tools & Compilers, New Apps DevFeed: [OpenIndiana 2026.10 Released With Updated Tools & Compilers, New Apps]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-11-07T22:50:46Z Content type: release Language: en Sources: [Phoronix]() Topics: [Compilers and Linkers](), [Tool]() Tags: [2026](), [apps](), [compilers](), [desktop](), [desktop-linux](), [driver](), [ebook](), [firefox](), [gcc](), [intel](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [llvm](), [navigation](), [open-source](), [open-source-graphics](), [open-source-software](), [operating-system](), [package](), [packages](), [perl](), [phoronix](), [phoronix-test-suite](), [python](), [tools](), [ubuntu-benchmarks](), [ubuntu-hardware](), [updated]() ### AI overview OpenIndiana Hipster 2026.10 is primarily a package refresh, with updates including Firefox and Thunderbird 159, GCC 15.3, LLVM Clang 23.1.4, Perl 5.44, and Python 3.15.2. It also adds UEFI framebuffer support through the illumosfb X.Org driver on the live image, newer QEMU and VirtualBox releases, TeX Live 2026, Foliate, and zoxide. In the author's test on an Intel Panther Lake Framework Laptop 13 Pro, the live system booted to MATE, but support for most device drivers was missing. The excerpt does not provide the complete package change list. ### Source excerpt OpenIndiana Hipster 2026.10 is out today as the newest six-month update to this operating system based on Illumos and with the lineage tracing back to the fruitful Sun OpenSolaris days... ## FreeBSD 15.2 Beta 1 Allows Experimental Cross-Building Of Base Packages On Linux/macOS DevFeed: [FreeBSD 15.2 Beta 1 Allows Experimental Cross-Building Of Base Packages On Linux/macOS]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-11-07T00:04:20Z Content type: release Language: en Sources: [Phoronix]() Topics: [freebsd](), [Cross-Compilation](), [Linux](), [macOS]() Tags: [ai](), [ai-llms](), [amazon](), [amazon-aws](), [beta](), [clang](), [cloud](), [cross](), [desktop-linux](), [experimental](), [freebsd](), [hardware](), [linker](), [linux](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [lld](), [llvm](), [macos](), [open-source-graphics](), [openssh](), [packages](), [phoronix](), [phoronix-test-suite](), [security](), [security-fixes](), [ubuntu-benchmarks](), [ubuntu-hardware]() ### AI overview FreeBSD 15.2 Beta 1 adds experimental support for cross-building base system packages on Linux and macOS hosts, provided the pkg utility is manually set up on the build host. Other changes mentioned include a laptop backlight setting that saves and restores its level across reboots, Clang defaulting to LLVM's ld.lld linker unless overridden, and updated components such as LLVM 21.1.8, OpenSSH 10.4p1, OpenZFS 2.4.4, and XZ 5.8.4. The excerpt also cites security fixes, hardware driver and ID updates, and KDE desktop with XRDP enabled on FreeBSD EC2 desktop AMIs. The project targets an official release on December 8, with weekly betas and at least one release candidate planned beforehand. ### Source excerpt FreeBSD 15.2 Beta 1 is out today as the release dance kicks off in working toward the next installment of FreeBSD 15... ## The Binance Hack: Why You Should Never Trust a Coding Assignment DevFeed: [The Binance Hack: Why You Should Never Trust a Coding Assignment]() Original publisher: [Read original article]() Author: anton liberant Published: 2026-11-06T00:00:00Z Content type: article Language: en Sources: [JavaScript Development]() Topics: [npm security](), [trust](), [Binance](), [Static code analysis](), [npm]() Tags: [ai](), [binance](), [binance-hack](), [code](), [coding](), [coding-interview](), [compromise](), [developer](), [developer-tools](), [fake](), [hack](), [interview](), [malicious](), [npm](), [npm-packages](), [packages](), [security](), [tasks](), [tools](), [trust](), [vs-code]() ### AI overview The article's practical takeaway is to treat unfamiliar coding assignments as untrusted code: inspect them before execution and keep them away from work credentials and sensitive systems. It describes Binance's preliminary account of a months-long attack involving a tampered developer tool, a fake interview assignment that reportedly compromised an engineer's computer, lateral movement through an internal AI tool, and a stolen deployment token used to reach wallet-signing infrastructure. The article reports about $6.34 billion in affected assets and says Binance had frozen or intercepted about $2.85 billion by November 3, 2026; figures remain subject to reconciliation, and an independent review was pending. Suggested precautions include reviewing package scripts and editor or container configuration, installing npm dependencies with lifecycle scripts disabled, retaining VS Code Workspace Trust protections, and using a disposable, isolated environment for execution. These checks reduce specific risks but do not make untrusted code safe; running application code can still execute it. The article also recommends that organizations separate interview projects from managed workstations, ### Source excerpt How a fake coding interview led to the $6.34B Binance hack. Learn how malicious npm packages, VS Code tasks, and developer tools can compromise your machine. ## Docker and ActiveState Extending Secure Defaults to the Packages Developers Install DevFeed: [Docker and ActiveState Extending Secure Defaults to the Packages Developers Install]() Original publisher: [Read original article]() Author: Vishrut Iyengar Published: 2026-11-05T15:28:22Z Content type: release Language: en Sources: [Docker]() Topics: [Docker Hardened Images](), [AI software supply chain security](), [container images](), [Docker](), [npm](), [pip]() Tags: [agent](), [agentic](), [agents](), [ai-coding-agents](), [ai-coding-assistants](), [artifactory](), [attack-surface](), [axios](), [blast-radius](), [build](), [builds](), [built-from-source](), [content](), [developers](), [docker](), [docker-hardened-images](), [packages](), [partners](), [partnerships](), [products](), [secure-defaults](), [security](), [solutions](), [standard](), [teams](), [trusted-supply-chain]() ### AI overview Docker and ActiveState extend supply chain controls from container images to application dependencies. Docker Hardened Images (DHI) are minimal, source-built images with signed SBOMs, SLSA Level 3 provenance, full CVE visibility, and--on paid tiers--a 7-day SLA for critical and high CVEs. ActiveState's Curated Catalog is a policy-governed repository containing team-approved packages, compiled from source with SLSA Level 3 provenance and complete SBOMs; it automatically rebuilds components after upstream fixes, with SLAs of 5 business days for critical CVEs and 10 for high CVEs. Teams can route Artifactory or Nexus through the catalog while developers and coding assistants retain familiar pip and npm workflows. The article says these controls complement pinned digests, cooldown periods, and sandboxed agents; the integration does not replace them. ### Source excerpt Docker partners with ActiveState to continue to provide one standard for trusted content across everything you and your teams build on. ## PolinRider Returns: Hijacked npm Packages Use Ethereum Blockchain to Conceal Malware Infrastructure DevFeed: [PolinRider Returns: Hijacked npm Packages Use Ethereum Blockchain to Conceal Malware Infrastructure]() Original publisher: [Read original article]() Author: Moshe Siman Tov Bustan Published: 2026-11-04T20:59:06Z Content type: news Language: en Sources: [OX Security]() Topics: [npm security](), [Malware](), [npm packages](), [Ethereum](), [malicious packages](), [Blockchain](), [npm](), [infection chain](), [Cryptocurrency]() Tags: [appsec](), [blockchain](), [c2](), [campaign](), [code](), [command](), [command-and-control](), [control](), [ethereum](), [family](), [hidden](), [infrastructure](), [ip](), [loader](), [malicious](), [malware](), [npm](), [npm-packages](), [overview](), [ox-security](), [packages](), [polinrider](), [research]() ### AI overview OX Security reports compromised releases of legitimate npm packages linked to PolinRider. On import, an obfuscated loader queries public Ethereum RPC endpoints for a transaction containing a C2 IP, downloads an XOR-obfuscated JavaScript payload over HTTP, and executes it through an interactive Node.js process, potentially keeping activity in memory. Updating the blockchain reference can redirect affected installations without changing the published package. The affected packages total about 1,400 weekly downloads, a measure of download activity rather than confirmed infections. Recommended steps are to check dependencies and lockfiles against the affected versions, consider accessible wallets and credentials potentially compromised if the code executed, and pin dependencies to verified clean versions or apply a minimum package-age policy. ### Source excerpt Overview OX Security researchers identified malicious releases of legitimate npm packages compromised in a campaign linked to the PolinRider malware family. The injected code uses the Ethereum blockchain as a dead drop for command-and-control (C2) infrastructure. When an affected package is imported, a hidden loader queries public Ethereum RPC endpoints to retrieve a C2 IP [...] The post PolinRider Returns: Hijacked npm Packages Use Ethereum Blockchain to Conceal Malware Infrastructure appeared first on OX Security. ## Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory DevFeed: [Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-11-04T11:46:27Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [Xen](), [virtual machines](), [Security research]() Tags: [ai](), [ai-security](), [anthropic](), [artificial-intelligence](), [claude](), [cloud-security](), [critical](), [data](), [debian](), [exploit](), [fixed](), [isolation](), [linux](), [memory](), [open-source](), [operating-system](), [os](), [packages](), [patch](), [patches](), [permissions](), [virtualization-security](), [vm](), [vulnerability](), [xen]() ### AI overview Two Xen grant-copy flaws, CVE-2026-102703 and CVE-2026-102704 (XSA-523), can let a malicious guest read and write memory belonging to other VMs, including dom0. Xen sometimes reused permission checks across batched copies within a memory page without rechecking when necessary. All Xen versions from 4.6 onward are affected; 4.5 and earlier are not. The advisory reports patches for xen-unstable through 4.19.x and versions 4.17.x-4.18.x, but none for 4.6-4.16; it says there is no known mitigation. XCP-ng 8.3 released a fix and requires host reboots. Qubes OS 4.3's fix updates Xen in dom0, which must be restarted; Anti Evil Maid users must also reseal their secret passphrase because PCR18 and PCR19 change. The excerpt reports Debian bookworm, trixie, and forky xen packages as vulnerable and sid as fixed as of November 4. It gives no details on required attacker access and mentions no known exploitation. ### Source excerpt Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Two flaws in the Xen hypervisor allow a malicious guest virtual machine (VM) to read and write the memory of other VMs on the same host, including dom0. Dom0 is the VM that, by default, has full permi ... Read more Published Date: Nov 04, 2026 (5 hours, 16 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-102704 CVE-2026-102703 ## Secure your containers without breaking what works DevFeed: [Secure your containers without breaking what works]() Original publisher: [Read original article]() Author: Help Net Security Published: 2026-11-04T06:00:34Z Content type: tutorial Language: en Sources: [Help Net Security]() Topics: [container-security](), [container images](), [CI/CD](), [distroless]() Tags: [attack-surface](), [audit](), [automation](), [container-image](), [container-security](), [containers](), [cybersecurity](), [development-tools](), [devsecops](), [don-t-miss](), [expert-analysis](), [hot-stuff](), [news](), [opinion](), [packages](), [vulnerabilities](), [vulnerability-management]() ### AI overview Container hardening can reduce attack surface safely by using observed runtime behavior to guide removals, then validating each rebuilt image. An SBOM inventories installed components; an RBOM records components observed in use, helping distinguish what is present from what profiling exercised. Profile under representative conditions--including functional tests, staging or production traffic where appropriate, load and stress tests, and fuzzing--then remove unobserved components at an intensity suited to the service, with keep lists for justified exceptions. Treat functional and integration tests as a release gate, retain the original image for rollback, and feed validation findings into the next baseline. CI/CD systems such as GitHub Actions, GitLab CI, or Jenkins can automate profiling, rebuilding, validation, and drift alerts, while teams remain accountable for removal choices, exceptions, and approvals. Because untested paths may need components, repeat profiling and validation as images change; observed use is evidence, not proof of complete coverage. ### Source excerpt Container security has a familiar problem. Teams identify vulnerabilities, but turning those findings into lower risk is much harder. A standard container image may include operating-system packages, development tools, debugging utilities and libraries that an application never uses. Each unnecessary component can expand the attack surface and add vulnerabilities to investigate, patch or explain during an audit. Consider an NGINX image that contains 274 categorized vulnerabilities straight from download. Scanning makes those findings visible, but ... More -> The post Secure your containers without breaking what works appeared first on Help Net Security. ## A new Go API for JSON DevFeed: [A new Go API for JSON]() Original publisher: [Read original article]() Author: Michael Pratt, Joe Tsai, Daniel Martí, Johan Brandhorst-Satzkorn, Roger Peppe, Chris Hines, and Damien Neil Published: 2026-11-04T00:00:00Z Content type: article Language: en Sources: [Go]() Topics: [encoding/json](), [JSON]() Tags: [api](), [encoding](), [encoding-json](), [go](), [json](), [json-v2](), [jsontext](), [packages]() ### AI overview Go 1.27 makes `encoding/json/v2` and `encoding/json/jsontext` stable and generally available. `jsontext` handles JSON syntax with streaming value and token encoders and decoders; `v2` builds on it for Go value marshaling, adds options across its APIs, and supports streaming custom methods. Compared with v1, v2 rejects invalid UTF-8 and duplicate object names, matches struct fields case-sensitively, and encodes nil slices and maps as empty arrays and objects. Marshal performance is roughly at parity with v1, while unmarshal can be significantly faster, with reported benchmark gains up to 10x; custom types can benefit further by implementing the streaming interfaces. Existing v1 applications remain supported, and its behavior can be retained or adjusted through compatibility options for gradual migration. ### Source excerpt Go 1.27 introduces new encoding/json/v2 and encoding/json/jsontext packages. ## Call for testing - nginx fix for "no buffer space in script copy" errors DevFeed: [Call for testing - nginx fix for "no buffer space in script copy" errors]() Original publisher: [Read original article]() Author: Andrew Lukoshko AlmaLinux Lead Architect Published: 2026-11-04T00:00:00Z Content type: release Language: en Sources: [AlmaLinux]() Topics: [nginx](), [staging](), [Unit testing]() Tags: [cve](), [nginx](), [packages](), [regression](), [repository](), [testing]() ### AI overview The CVE-2026-42533 nginx update caused intermittent HTTP 500 errors on configurations where a `set` or `rewrite` uses a `volatile` map whose value contains variables. The backport stored the script buffer boundary in a global variable; a nested map script could overwrite it, so the outer script checked against the wrong buffer. AlmaLinux's testing packages save and restore that boundary around script execution, preserving the CVE protection and ABI while fixing nested scripts. To test, install `almalinux-release-testing`, upgrade nginx and installed nginx modules from `almalinux-testing`, verify the package version for your release, then run `nginx -t` and restart nginx. Check the error log after normal traffic for new alerts. The update does not restart nginx automatically; the article advises against leaving the testing repository enabled on production systems and requests reports of both failures and successful testing. ### Source excerpt The recent nginx security update for CVE-2026-42533 introduced a regression: on some configurations, nginx randomly answers a small share of requests with HTTP 500 and logs [alert] ... no buffer space in script copy. Users reported it to us after updating, and we were able to reproduce it on every AlmaLinux release that received the update. We've found the root cause and built fixed nginx packages that remove the regression while keeping the CVE-2026-42533 fix fully in place. The packages are now in the AlmaLinux testing repository, and we need your help testing them before they go to production. ## Delivering Skills in NuGet packages DevFeed: [Delivering Skills in NuGet packages]() Original publisher: [Read original article]() Author: Richard Lander Published: 2026-11-03T19:00:14Z Content type: article Language: en Sources: [.NET Blog]() Topics: [Agent Skills](), [NuGet](), [Package Management](), [Frontier AI]() Tags: [agent-skills](), [ai](), [documentation](), [net](), [nuget](), [packages](), [skills]() ### AI overview NuGet packages can bundle `SKILL.md` files alongside library binaries, giving agents current, package-specific guidance after `dotnet restore`. The article demonstrates discovering skills with `dotnet-inspect` from a package or project graph, and copying direct-dependency skills into a repository with `dotnet-package-skills`; repository commits can keep copied skills available and reviewable, though maintainers must keep them in sync with package versions. Skills may improve answer quality or reduce token costs, but can also be ineffective or increase costs, so maintainers should evaluate them. The author reports stronger efficacy gains for weaker models and limited room to improve frontier models, and recommends testing with frontier models because a skill that helps one model can make another more expensive. Skills also introduce a threat vector through agent consumption of package markdown, so the article advises using packages from trusted maintainers. The supplied text is an article excerpt. ### Source excerpt Agent skills can be delivered in NuGet packages as a way to deliver up-to-date library documentation to models. The post Delivering Skills in NuGet packages appeared first on .NET Blog. ## Manage Java transitive dependencies with Lightwell rebuilds DevFeed: [Manage Java transitive dependencies with Lightwell rebuilds]() Original publisher: [Read original article]() Author: Matej Marušák Published: 2026-11-03T15:14:34Z Content type: tutorial Language: en Sources: [Red Hat](), [Red Hat Developer]() Topics: [ibm red hat project lightwell](), [software composition analysis](), [code security](), [Maven](), [CI/CD](), [renovate](), [Dependabot]() Tags: [automated](), [automatically](), [behind-the-scenes](), [but](), [challenge](), [dependencies](), [developer](), [development](), [devsecops](), [ecosystem](), [first](), [java](), [libraries](), [lightwell](), [manager](), [nested](), [package](), [packages](), [rebuilds](), [security](), [transitive-dependencies](), [with]() ### AI overview Java's pinned Maven and Gradle versions make it difficult for direct-dependency update tools such as Renovate or Dependabot to remediate vulnerabilities deep in transitive trees. The article describes three ways to use Lightwell's security-focused Java rebuilds: select packages manually from its catalog or API for granular control, with poor scalability; analyze the full dependency tree and review a report of matching rebuilds, then copy coordinates into pom.xml; or generate a BOM that pins matching rebuilds for auditability and version control, at the cost of continuous pipeline runs and BOM maintenance. The example pin-transitives.mjs script is only a starting point and lacks advanced filtering and CVE tracking. The article discourages opaque proxy-based substitutions because they can make builds nonreproducible and unverifiable; visible Maven relocations still warrant caution. ### Source excerpt Updating direct dependencies in Java is straightforward, but securing the hundreds of transitive libraries running beneath them is where many development pipelines stall. While automated tools simplify how teams upgrade direct dependencies--the packages your project explicitly declares--the Java ecosystem presents a challenge: pinned versions and deeply nested trees of transitive dependencies. Transitive dependencies are the libraries your direct dependencies rely on behind the scenes, which your package manager pulls in automatically. The post Manage Java transitive dependencies with Lightwell rebuilds appeared first on Red Hat Developer. ## Fedora Linux 45 released DevFeed: [Fedora Linux 45 released]() Original publisher: [Read original article]() Author: jzb Published: 2026-11-03T15:11:32Z Content type: release Language: en Sources: [LWN.net]() Topics: [Fedora](), [Linux]() Tags: [anaconda](), [atomic](), [cloud](), [coreos](), [desktop](), [developer](), [fedora-linux-45](), [iot](), [kde-plasma](), [packages](), [plugins](), [release](), [server](), [stratis](), [vpn](), [workstation]() ### AI overview Fedora Linux 45 is released across Workstation, KDE Plasma Desktop, Server, Cloud, CoreOS, IoT, Atomic Desktops, and Spins. It adds Stratis storage installation support through Anaconda or Kickstart, retires unmaintained NetworkManager VPN plugins, and updates desktop environments, developer toolchains, and system packages. The source points to Fedora's ChangeSet page for the full list of major changes. ### Source excerpt Fedora Linux 45 has been released. This includes all editions: Fedora Workstation, Fedora KDE Plasma Desktop, Fedora Server, Fedora Cloud, Fedora CoreOS, and Fedora IoT, as well as the Atomic Desktops and Spins. This release adds support for installation on Stratis storage using Anaconda or Kickstart installs, retires unmaintained VPN plugins for NetworkManager, and updates Fedora's desktop environments, developer toolchains, and system packages. See the Fedora wiki ChangeSet page for a list of major changes. ## bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot DevFeed: [bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot]() Original publisher: [Read original article]() Author: drewt@jfrog.com Published: 2026-11-03T14:15:25Z Content type: article Language: en Sources: [From the Frog's mouth - JFrog Blog]() Topics: [reachy](), [Cross-origin resource sharing (CORS)](), [malicious packages](), [AI software supply chain security](), [smartdevices](), [huggingface\_hub]() Tags: [ai](), [ai-ml](), [attacks](), [but](), [can](), [cases](), [cve-2026-96455](), [embedded](), [extend](), [fastapicve](), [hidden](), [hijack](), [http](), [iot-security](), [literally](), [malicious](), [malicious-packages](), [models](), [one](), [open-source-robots](), [packages](), [pollen-robotics](), [reachy-mini](), [remote-code-execution](), [request](), [rise](), [risks](), [robot](), [robotics](), [security](), [security-research](), [supply-chain-attack]() ### AI overview JFrog Security Research reports five CVEs in the Reachy Mini daemon and demonstrates network and browser-triggered attack chains that can install and execute malicious Python packages, escalate to persistent root, and control the robot. The daemon reportedly listens on all interfaces at port 8000 without authentication; wildcard CORS enables cross-origin requests, and a localhost-only setting does not restrict the server bind. A separate Bluetooth chain combines unauthenticated sound-file upload, shared PIN state, and path traversal to run an uploaded script as root. The article recommends updating to a fixed version (v1.11.0 or later), or temporarily firewalling port 8000, avoiding untrusted apps and browsing on a shared network, and tightening sudoers. It also calls for endpoint authentication, restricted CORS, rejecting local package installs, and network segmentation for fleets. ### Source excerpt Software supply chain attacks are on the rise, and naturally taking the headlines. But with the rise of localized models and common software embedded into smart "things", risks may even be hidden in plain sight - or, in some cases, quite literally watching you. Vulnerabilities and malicious packages may extend risks to the unlikeliest of ... ## From PHP2Shell Alert to Action: Identify and Patch Your Workloads Using VMware Salt DevFeed: [From PHP2Shell Alert to Action: Identify and Patch Your Workloads Using VMware Salt]() Original publisher: [Read original article]() Author: rob robertson Published: 2026-11-03T13:00:00Z Content type: article Language: en Sources: [VMware]() Topics: [saltstack](), [workload protection](), [Deployment Strategies](), [alert triage](), [version]() Tags: [auto-remediation](), [avi](), [canary](), [cloud-infrastructure](), [compliance](), [configuration](), [configuration-management](), [cybersecurity-awareness-month](), [discovery](), [net](), [packages](), [patch](), [php](), [php2shell](), [repair](), [salt](), [security](), [verification](), [vulnerability](), [workers]() ### AI overview VMware Salt's PHP2Shell workflow connects managed-server discovery, approved PHP patching, mitigation of the separate session upload-progress advisory, worker replacement, and verification. It inventories Linux packages and, on Windows, combines package data with checks of runtime locations, services, and hosting configuration; vendor backports and approved overrides inform patch assessment. Operators can preview changes, apply repository or Winrepo packages, and disable the setting in declared startup INI files. Configuration checks gate service actions, and failed prerequisites remain visible. Reassessment, active-worker checks, application health tests, and scanner validation support closure. Network protections such as vDefend and Avi WAF can complement Salt but require separate configuration; automatic telemetry correlation is not provided. Containers and runtimes outside discovery scope need separate coverage, and customer-specific approval, integrations, recovery procedures, and compliance policies require implementation and assessment. ### Source excerpt A vulnerability alert starts the response. Salt helps carry it through discovery, approved repair, and verification--at scale, across your entire fleet. A critical PHP advisory lands. Security wants to know which systems could be affected. Operations need the right packages, the right configuration, and a safe way to replace running workers. Application owners need confidence ... Continued The post From PHP2Shell Alert to Action: Identify and Patch Your Workloads Using VMware Salt appeared first on VMware Blogs. ## Refusing the Impossible: A Taxonomy and Benchmark for Code Hallucination in Large Language Models DevFeed: [Refusing the Impossible: A Taxonomy and Benchmark for Code Hallucination in Large Language Models]() Original publisher: [Read original article]() Author: Vishnu Asutosh Dasu, Ashish Kundu, Gang Tan Published: 2026-11-03T05:00:00Z Content type: article Language: en Sources: [arXiv: Software Engineering]() Topics: [Hallucination detection](), [LLM evaluation / benchmarking](), [Large Language Model](), [AI-assisted coding](), [LLM security]() Tags: [adversarial](), [algorithm](), [benchmark](), [code](), [code-generation](), [cs-se](), [dependencies](), [ecosystem](), [errors](), [grounding](), [hallucinations](), [javascript](), [language-models](), [large-language-models](), [large-language-models-llms](), [llms](), [open-weight-models](), [packages](), [programming](), [reasoning](), [taxonomy]() ### AI overview The study finds that code models often fabricate answers to impossible requests, especially when those requests involve plausible but nonexistent software dependencies. Across 17 open-weight models and 6,137 responses to a benchmark of 270 adversarial requests and 91 solvable controls, models hallucinated on 54% of adversarial requests and correctly refused 31%. Larger models improved on mathematical impossibilities and conflicting requirements (hallucination fell from 84% at 7B parameters or less to 32% at 80B or more), but did worse on nonexistent dependencies and features: rates fell only from 88% to 61%, and the largest model hallucinated on all 22 nonexistent JavaScript and Rust package requests. Two-thirds of hallucinations were confident fabrications without caveats. The authors conclude that scale does not replace grounding against the real software ecosystem, such as checking package names against registries. The evidence provided is the paper's abstract. ### Source excerpt arXiv:2609.03267v2 Announce Type: replace Abstract: This paper investigates whether large language models (LLMs) for code generation can recognize a programming request that cannot be satisfied. Coding assistants are widely deployed, yet they are evaluated almost exclusively on solvable tasks where a test suite can score the output. A request may instead name a package that does not exist or ask for an algorithm that is mathematically impossible, and the appropriate response is to refuse. Models nevertheless respond with plausible code, and such fabrications are also a security concern because attackers can register the package names that models invent. We define code hallucination as ungrounded code generation, distinguish it from ordinary programming errors, and introduce a taxonomy of these failures together with a benchmark of 270 adversarial requests and 91 matched solvable controls across six languages and 24 subcategories. We evaluate 17 open-weight models with 6.7B to 671B parameters, collecting 6,137 responses. Models hallucinate on 54% of the adversarial requests and correctly refuse 31%. Larger models do better on algorithmic impossibilities and conflicting requirements, where hallucination falls from 84% for models at or below 7B parameters to 32% for those at or above 80B. For plausible but nonexistent dependencies and features, the rates are 88% and 61%, and even the largest model hallucinates on all 22 requests for nonexistent JavaScript and Rust packages. Two-thirds of hallucinations are confident fabrications without caveats, and some reasoning models fail to return an answer on solvable tasks. Scale teaches models to recognize what is impossible but not what does not exist, so grounding code generation in the real software ecosystem, for example by checking package names against registries, remains necessary regardless of model size. ## Announcing Fedora 45 DevFeed: [Announcing Fedora 45]() Original publisher: [Read original article]() Author: Jef Spaleta Published: 2026-11-03T00:00:00Z Content type: release Language: en Sources: [Red Hat Blog]() Topics: [Fedora](), [Linux Kernel](), [Cryptography](), [Legacy Modernization]() Tags: [algorithms](), [availability](), [behavior](), [binutils](), [bootloader](), [browser](), [cli](), [compilers](), [confidential-compute](), [containers](), [features](), [fedora](), [fedora-45](), [fedora-linux-45](), [free-and-open-source](), [linux](), [packages](), [release](), [verification](), [version]() ### AI overview Fedora Linux 45 is generally available with stricter defaults and updated developer and desktop components. RPM 6.1 requires verified package signatures unless explicitly overridden; unprivileged process tracing is restricted by default and restored when debugging or diagnostic packages are installed. The release updates the GNU toolchain and language runtimes, adds Sequoia-powered OpenPGP verification, enables IPv6-mostly networking by default, and moves ODBC drivers to modular drop-in configuration. Workstation includes GNOME 51 and encapsule for container-isolated development tasks; KDE updates to Plasma 6.8. Atomic editions use the Anaconda WebUI installer and add browser-based remote installation, while Server and Cloud add native Butane handling in Ignition. NetworkManager-vpnc and NetworkManager-fortisslvpn are retiring and become obsolete starting with this release. The supplied text advises updating an existing system before upgrading. ### Source excerpt Today, the Fedora Project is excited to announce the general availability of Fedora Linux 45, the latest version of the free and open source operating system. Learn more about the new and updated features of Fedora 45 below and don't forget to make sure your system is fully up to date before upgrading from a previous release.General highlightsEnforced RPM signature checking: Fedora 45 switches the default package verification mode in RPM 6.1 to enforcing signature checking by default. Moving to upstream RPM default behavior, packages require a verified signature to install unless explicitly ov ## A homebrew Cray-1A DevFeed: [A homebrew Cray-1A]() Original publisher: [Read original article]() Author: Anne Barela Published: 2026-11-02T21:41:01Z Content type: news Language: en Sources: [Adafruit Industries]() Topics: [fpga]() Tags: [64-bit](), [assembler](), [clocks](), [cray](), [cray-1](), [design](), [fpga](), [gaming](), [history](), [homebrew](), [memory](), [octal](), [packages](), [python](), [replica](), [reverse-engineering](), [scale](), [spartan-3e](), [uart](), [vintage-computing]() ### AI overview A homebuilt, 1/10-scale Cray-1A reproduces the original's binary compatibility and cycle timing on a Xilinx Spartan-3E 1600 FPGA. It runs at about 33 MHz with 4 kilowords of memory, using roughly 75% of the FPGA's logic and all of its block RAM; a later update reports faster multipliers reaching 50 MHz. Its pipelined design has 12 execution units and 64-value vector registers. Because division would take a variable number of cycles, the machine instead computes a reciprocal approximation in 13 cycles and multiplies. Finding software proved difficult: museum holdings, reportedly destroyed archives, and unsuccessful FOIA requests yielded none, so early programs were hand-assembled in octal. The project later added a Python CAL assembler, context-switching exchange packages, a 64-bit UART, and a wooden and MDF replica case. ### Source excerpt A project posted on chrisfenton.com describes a 1/10-scale, binary-compatible, cycle-accurate Cray-1A built over about a year and a half. The logic runs on a Xilinx Spartan-3E 1600 FPGA board, filling roughly 75% of the logic and all of the block RAM. The result clocks at about 33 MHz with 4 kilowords of memory, against the [...] ## Blocking malicious npm packages before and during installation DevFeed: [Blocking malicious npm packages before and during installation]() Original publisher: [Read original article]() Author: Andrew Healey Published: 2026-11-02T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [npm security](), [npm packages](), [malicious packages](), [code security](), [npm]() Tags: [automatically](), [blocking](), [blocks](), [builds](), [cache](), [dependencies](), [dependency](), [deployment](), [downloads](), [error](), [existing](), [function](), [install](), [installation](), [malicious](), [malware](), [minutes](), [npm](), [npm-packages](), [packages]() ### AI overview Vercel checks blocked npm package versions before and during dependency installation to help prevent malicious install scripts from running. Before installation, it scans supported lockfiles, including when dependencies come from the build cache; during installation, it blocks affected public npm downloads. Existing checks of installed dependencies and function outputs continue before deployment. Protections apply automatically to new builds on all plans. When a blocked package is found, Vercel fails the deployment, names the package and version, and attempts to invalidate the affected build cache. Update the dependency and lockfile to a safe version, then redeploy. ### Source excerpt Vercel now checks for blocked npm packages before and during dependency installation in builds, helping prevent malicious install scripts from running. The checks use a blocklist of specific package versions selected for blocking because of malware or security vulnerabilities, with new rules typically reaching new builds within minutes. Before installation, Vercel checks supported lockfiles, including when dependencies are restored from the build cache. During installation, Vercel blocks affected public npm downloads. Existing checks of installed dependencies and function outputs continue before deployment. These protections apply automatically to new builds on all plans, with no configuration required. If a blocked dependency is detected, Vercel fails the deployment, identifies the package and version in the error, and attempts to invalidate the affected build cache. Update the dependency to a safe version and update the lockfile, then redeploy. Read more ## Gitea 28.3.0 is released DevFeed: [Gitea 28.3.0 is released]() Original publisher: [Read original article]() Author: bircni, silverwind Published: 2026-11-01T11:23:57.979319Z Content type: release Language: en Sources: [Gitea Blog]() Topics: [Gitea](), [patches](), [CI/CD]() Tags: [actions](), [announce](), [bug](), [bug-fixes](), [gitea](), [improvements](), [maintenance](), [packages](), [performance](), [pull-requests](), [security](), [security-fixes](), [upgrade]() ### AI overview Gitea 28.3.0 is a maintenance release with numerous security fixes, mostly involving token scopes and access control, plus bug fixes and performance improvements. Notable fixes include preventing public-only tokens from accessing private data or performing restricted actions, ensuring review-triggered Actions workflows run on the pull request head, and rejecting changes to archived repositories. The release also fixes an account-linking flaw in open registration, limits decompression of Helm chart uploads, and removes an unsafe artifact header that could cause stored XSS. Other changes speed up issue and pull request lists and dashboards, reduce SQLite work on the admin job queue, and improve Actions runner behavior. The notes recommend upgrading as soon as possible. ### Source excerpt We are excited to announce the release of **Gitea 28.3.0**, the third maintenance release for the 28 series. It contains a large number of security fixes, mostly around token scopes, and bug fixes and performance improvements for Actions, issues, pull requests and packages. We strongly recommend that all users upgrade as soon as possible. ## Ubuntu 27.04 'Tenacious T-Rex' opens for development DevFeed: [Ubuntu 27.04 'Tenacious T-Rex' opens for development]() Original publisher: [Read original article]() Author: Joey Sneddon Published: 2026-10-30T21:15:12Z Content type: news Language: en Sources: [OMG! Ubuntu]() Topics: [Ubuntu](), [canonical]() Tags: [2026](), [ai](), [ai-models](), [archive](), [beta](), [canonical](), [core](), [debian](), [desktop](), [development](), [encryption](), [news](), [october](), [october-2026](), [packages](), [release](), [stable](), [sync](), [ubuntu](), [ubuntu-26-10](), [ubuntu-27-04]() ### AI overview Ubuntu 27.04 ("Tenacious T-Rex") development began on 30 October 2026, with Debian package auto-sync feeding a six-month testing and stabilization cycle. The release is scheduled for 22 April 2027, preceded by a 1 April beta. The excerpt says GNOME 52 is highly likely and Linux 7.6 or later depends on scheduling. Canonical plans to make ntpd-rs the default time-sync tool and develop Ubuntu Core Desktop as an all-snap preview, which the article says will not yet be ready for everyday use. Other planned work includes maturing TPM-backed full-disk encryption, security-focused booting and HWE firmware packaging. Myna voice dictation remains a tech preview; its models are too large to ship by default, though an opt-in could be added. An AI launcher is described only as a simulated concept. ### Source excerpt Development on Ubuntu 27.04, codenamed 'Tenacious T-Rex', has officially begun. The tenacious archive is now open (30 October 2026), with auto-sync from Debian set to pull in a tranche of updated packages since the Ubuntu 26.10 release. Over the course of the next six months, those will be tested, set and form the basis of the final, stable release. Ubuntu 27.04 is scheduled for release on 22 April 2027, with a beta preceding it on 1 April (not a joke). Ubuntu 26.10 saw its beta delayed by a week, but hopefully the new development cycle has fewer hiccups. What to [...] You're reading Ubuntu 27.04 'Tenacious T-Rex' opens for development, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission. ## A Modern Smalltalk DevFeed: [A Modern Smalltalk]() Original publisher: [Read original article]() Author: Al Williams Published: 2026-10-30T18:30:54Z Content type: article Language: en Sources: [Hackaday]() Topics: [Object-oriented programming (OOP)](), [Squeak/Smalltalk](), [object](), [Polymorphism]() Tags: [architecture](), [arduino](), [browser](), [c-plus-plus](), [clone](), [desktop](), [free](), [git](), [gnu](), [help](), [install](), [introduced](), [mvc](), [nice](), [object-oriented](), [open](), [operator](), [packages](), [raspberry](), [smalltalk](), [software-development]() ### AI overview Cuis Smalltalk is a free, portable Smalltalk-80 environment that keeps a simple core and adds complexity through packages. It replaces the traditional MVC framework with Morphic while retaining a style familiar to users of 1990s Smalltalk. The desktop includes workspaces, help documents, and a transcript, and a class browser helps explore classes and their messages. The language treats operations such as addition as messages sent between objects, which can respond differently to the same message. Cuis uses rolling releases, though a stable release may suit application deployment. Packages for Arduino communication over a serial port exist, but they have not been updated lately and may need work. ### Source excerpt In the history of object-oriented (OO) computer languages, Smalltalk has a special place. It wasn't the first OO language, and it hasn't spread as well as some others. But it ...read more ## Why Physics Needs To Move At The Pace Of Design DevFeed: [Why Physics Needs To Move At The Pace Of Design]() Original publisher: [Read original article]() Author: Hardik Kabaria Published: 2026-10-29T07:03:34Z Content type: opinion Language: en Sources: [Semiconductor Engineering]() Topics: [Chip design](), [AI-enhanced product development](), [Tool](), [Materials science and engineering]() Tags: [1-5](), [about](), [accelerate](), [account](), [advanced-packaging](), [agentic](), [agentic-engineering](), [agentic-orchestration](), [ai](), [aircraft](), [analysis](), [based](), [blogs-sld](), [chip-design](), [chips](), [design](), [engineering](), [first](), [from-simulation-to-always-on-physics](), [multiphysics](), [needs](), [packages](), [physics](), [physics-based-design](), [semiconductor](), [system-level-design](), [systems](), [vinci]() ### AI overview Vinci argues that physics analysis should keep pace with design so engineers can assess physical consequences while choices are still changeable, reducing reliance on simplified designs, added margins, and assumptions. Its platform combines automated design preparation, agentic orchestration, a Foundation Model for Physics, and GPU-native kernels; the company says it produces deterministic, solver-accurate, manufacturing-resolution results on new designs without customer-specific training or fine-tuning. It is running on production semiconductor programs, with commercial thermal, thermo-mechanical, and convective-fluid capabilities. Vinci says analyses that once took hours or days can now take minutes. Its stated next steps are to expand physics coverage, agentic workflows, and customer-system integrations, with a longer-term goal of recommending engineering changes and eventually creating designs from human intent. ### Source excerpt Physics-based analysis becomes more consequential as chips, packages, boards, and systems are designed together. The post Why Physics Needs To Move At The Pace Of Design appeared first on Semiconductor Engineering. ## Pollora: Run WordPress Inside a Laravel Application DevFeed: [Pollora: Run WordPress Inside a Laravel Application]() Original publisher: [Read original article]() Author: Paul Redmond Published: 2026-10-29T03:46:20Z Content type: article Language: en Sources: [Laravel]() Topics: [Laravel](), [WordPress](), [Eloquent ORM](), [Laravel Boost](), [REST API](), [Back end]() Tags: [aws-s3](), [boost](), [cms](), [coding-agents](), [composer](), [conditional](), [hooks](), [laravel](), [laravel-packages](), [packages](), [php](), [route](), [routing](), [themes](), [wordpress]() ### AI overview Pollora runs WordPress inside Laravel: Laravel boots first and handles front-end routing and rendering, while WordPress continues to parse requests and provide its admin, database, and plugins. `Route::wp()` matches Laravel routes to WordPress conditional tags; unmatched requests fall back to the WordPress template hierarchy using Blade views. PHP attributes declare post types and hooks, and Gutenberg blocks use Blade templates for both rendering and editor previews. Pollora also supports Eloquent access through Colt and storing WordPress media on Laravel filesystem disks. The combined stack boots WordPress and its plugins on every web request, and core updates use Composer rather than the WordPress dashboard. The article's comparison recommends Sage for themes on standard WordPress, Acorn for adding Laravel components to an existing site, and Corcel for Laravel apps that only read WordPress data; it describes Pollora as a young project with fewer installs than Acorn and Sage. ### Source excerpt Pollora runs WordPress inside Laravel, with Route::wp() routing on conditional tags, Blade themes, and PHP attributes for post types and hooks. The post Pollora: Run WordPress Inside a Laravel Application appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. [Next page]()