News

Open Source Daily Briefing

Linux 7.4-rc1 sets a merge-window record driven by AI-found work, Postgres 19 slips as LLM-discovered bugs pile up, a remote kernel TCP bug exposes Go servers by default, Mistral ships Large 4 weights under a not-quite-open license, and more.

One theme ran through the weekend. AI tools are finding bugs faster than humans can fix them, and maintainers of the biggest projects are now saying so in public. Linus Torvalds just merged a record kernel merge window. A senior PostgreSQL developer explained why version 19 is late. A remote kernel bug found by an AI research team put every Go server on Linux in scope. Also in this briefing: a GNU infrastructure near-miss, a frontier model that is “open” with an asterisk, and one small project that handled a maintainer handoff well. Here’s what matters.

Linux 7.4-rc1 closes a record merge window, and Linus credits AI-driven work

Linus Torvalds released 7.4-rc1 today. The merge window took in 18,591 non-merge changesets, a record that nearly matches the patch count of the entire 7.3 cycle, which was itself a record. So far 2,678 developers have contributed to 7.4, and 625 of them are first-time kernel contributors. Linus called it a “BIG” merge window and put the size down to AI-triggered work. He said he’s much happier to see that work arrive during the merge window than as a stream of fixes in the -rc phase, because it suggests AI-assisted changes are becoming part of normal development. The cost shows up downstream. Greg Kroah-Hartman ended the 7.2 stable series early with 7.2.15 on November 1, saying that with this many pending stable patches, keeping eight branches alive would have been too much. If you track stable kernels, move to 7.3.y now. Also expect the 7.4 -rc cycle to be bumpier than usual.

Robert Haas: “Postgres 19 is late, and it’s AI’s fault”

This is the same pressure seen from a project with far fewer maintainers than the kernel. PostgreSQL committer Robert Haas explains why PG19 will most likely ship in November instead of the usual September–October window. LLMs have made old bugs easy to find. Commits to the REL_19_STABLE branch since feature freeze are up more than 60% over the same period for REL_18_STABLE (1,169 vs. 724). The LLM-drafted fixes still need careful human review, and that review time came out of release preparation. Three big features were pulled late: UPDATE/DELETE FOR PORTION OF, SQL/PGQ property graph queries, and MERGE/SPLIT PARTITION. Haas isn’t panicking about this one release. What worries him is the long term: “forty years of bugs that humans were unable to find but LLMs are quite capable of discovering,” handled by the same number of maintainers. “Every feature that we write from now until the end of our careers will be scrutinized by AI,” he writes. Open source has mostly framed AI bug-finding as a security win. Haas is pointing out that it is also a big transfer of unpaid work onto a small group of maintainers. If your company depends on Postgres, paying for review time is probably the most useful contribution you can make right now.

Remote kernel TCP bug puts Go servers in the blast radius by default

This clears our high bar for security news because it is remote, unauthenticated, in the kernel, and reaches a lot of production services through a language default most teams don’t know about. CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP handshake path, where a reply to a retransmitted SYN races with connection setup. Anthropic’s research team demonstrated remote root code execution against a server with a Multipath TCP listener. Since Go 1.24, Go programs enable MPTCP on Linux listen sockets by default. The Go security team’s advisory gives stopgap mitigations: GODEBUG=multipathtcp=0 at runtime, or godebug multipathtcp=0 in go.mod. It also warns that disabling MPTCP program by program is fragile and that the underlying bug isn’t specific to MPTCP. Severity scores disagree: the CVE record says 9.8, while Red Hat says 5.9 because the race is hard to win (LWN has details). Don’t wait for the scoring argument to settle. Roll out your distribution’s patched kernel, and in the meantime set the GODEBUG flag on internet-facing Go services.

How researchers could have backdoored Bash through GNU Savannah

Harsh Jaiswal and Rahul Maini of Hacktron published a full write-up on October 30 of an attack chain against Savane, the forge software that runs GNU Savannah. A shell injection in the email field of a GPG-key test feature gave any registered user code execution. From there they made themselves superuser and could impersonate other users, including Bash’s maintainer. They confirmed they could have added an SSH key with push access to the upstream Bash repository, then stopped short of doing it. An unpatched OverlayFS kernel bug gave them root and access to a GNU backup server. The FSF deserves credit: it acknowledged the May report within a day, patched within days, and published an incident report and Savane patches in August, alongside 25 more audit findings. The incident itself is months old. What’s new is the full chain, and it shows how close a widely trusted forge came to an xz-style compromise of a core GNU tool. The software that hosts our most fundamental projects deserves the same security investment as the projects.

Mistral releases Large 4 weights: frontier-class, but “open” with an asterisk

Mistral published the weights for Large 4 on Hugging Face on October 29. It’s a mixture-of-experts model with roughly 1T total and about 52B active parameters, multimodal input, and hybrid instruct/reasoning modes. It runs on vLLM and SGLang, and downloading needs no approval. Mistral’s own benchmarks put it at the top of open-weight models on Terminal-Bench 4.0 (41%) and tied with GLM-5.3 on Artificial Analysis’s Coding Agent Index. Now the license. It’s the “Mistral Ecosystem Open-Weight License,” a modified MIT that requires a separate commercial license for anyone offering the model as a hosted service. That is a field-of-use restriction, so the license isn’t OSI-compatible. Under the G7 taxonomy, that puts it in “Weights Available” territory rather than true Open Weights, though it is far more permissive than most. Training data isn’t disclosed, the technical report is “forthcoming,” and a cybersecurity-tuned variant is limited to vetted partners. For teams self-hosting inside their own products, this is one of the most capable models you can run on your own hardware. If you’re a cloud or inference provider, read the license before you deploy.

Denmark’s open source office pilot quietly ends after a government reshuffle

Denmark was one of Europe’s most-cited digital sovereignty experiments: the Ministry of Digitization’s trial of Collabora Online inside cBrain’s F2 case-management platform. It’s over. Phase one succeeded technically, letting users switch between Collabora and Microsoft Office on the same platform. In phase two, about 38 ministry staff logged formatting and tracked-changes problems, but the evaluation workshop that should have triaged them never happened. Then, after the March 2026 election, the ministry was merged with Higher Education and Science, and the pilot was dropped. Christine Hall argues the pilot was ended by politics, not by product shortcomings. That matters, because “Danish government tried LibreOffice and gave up” is already circulating as a talking point. The broader lesson is that sovereignty projects without legislative backing or multi-year funding die at the first reorganization, no matter how the software performs.

OpenInspect’s maintainer hands off the project cleanly, with a deadline and a plan

Cole Murray, creator of the MIT-licensed OpenInspect background coding agent framework, pinned a “Maintainers wanted” issue in late October. He was starting a new full-time job and set a hard date: November 1. He asked for two or three co-maintainers and said plainly that he’d archive the repo otherwise. Volunteers came forward, including engineers from Bitly and Chattermill who use it in production and could each offer “a couple of hours a week.” On October 31, Murray transferred the project to a new organization, and onboarding started the next day. Most maintainer exits happen silently or in burnout. This one went well because of three things: an explicit deadline, an honest note that the hosted infrastructure ran on his personal accounts, and a request for a small team instead of one heir. If you maintain something that companies depend on, copy his issue template before you need it.

Quick hits