| Web | canartuc.com |
Anthropic pointed Claude Code at Linux kernel source files one at a time, framed as a security puzzle. It found a heap overflow in NFS code hiding since March 2003. Four more kernel bugs followed. 500+ validated vulnerabilities in weeks. Linux Foundation set aside $12.5M to help maintainers cope. Nobody found a volunteer to maintain a Google Drive library for 3.5 years. The bottleneck was never the bugs.
Anthropic pointed Claude Code at the #linux kernel source one file at a time, framed as a security puzzle. Found a heap overflow in NFS (Network File System) hiding since March 2003. Four more kernel bugs followed. 500+ validated vulnerabilities across open source in weeks.
Linux Foundation set aside $12.5M to help maintainers cope. Meanwhile, nobody could find one volunteer to maintain a Google Drive library for three and a half years. The bottleneck was never the bugs but the unpaid people.
gallery-dl, an open source media downloader, got a DMCA takedown on GitHub filed through a third-party service. The CEO of the company whose copyrights were cited said an AI agent sent it "without our approval or permission."
The maintainer removed nine components. The project migrated to Codeberg. US law requires takedown notices under penalty of perjury. When an AI agent submits one autonomously, no one in the chain authorized the legal action.
#Linux 7.0 removed a CPU scheduling mode #PostgreSQL (a widely deployed open source database) relied on for internal locking. Result: throughput on AWS Graviton4 (Amazon ARM servers) dropped to 49% of normal.
The kernel team says PostgreSQL should adopt RSEQ, a newer Linux API for safe lock restarts. PostgreSQL cannot ship that before Linux 7.0 goes stable mid-April.
Ubuntu 26.04 LTS ships April 23. LTS means five years. Teams on AWS ARM who upgrade will hit this silently.
The European Commission ran Trivy, a security scanner, inside its automated build pipeline on AWS. A criminal group called TeamPCP poisoned Trivy itself.
The scanner had elevated permissions. Attackers used that access to steal 340 GB. ShinyHunters, a data extortion gang, published the dataset. 71 hosted clients affected.
Same attack hit Sportradar (23,169 athlete records, 328 API credential pairs offered for up to $50K) and 1,000+ other organizations.
