You Run One Update. Your Whole Professional Life Is Stolen.
Abandoned Arch Linux package changed hands while you slept. You updated at breakfast. After your first coffee, it was already too late.
More issues
📬 Open Source & Linux Weekly - W24_2026
An npm worm and an Arch AUR attack open two supply-chain fronts, GitHub hardens npm v12, and Linux 7.1 ships this week
325 Million Monthly Downloads. One Unpaid Maintainer. They Came After Him.
One stray character broke the security of 400,000 dependent projects. The security industry and the press came after the man who fixed it. His response was blunt.
His Code Backs Up the World. Now the Internet Wants Him Flogged.
He returned from retirement to save the code under every backup on Earth. The people he protects turned on him for how he did it. He has no regrets.
📬 Open Source & Linux Weekly - W23_2026
HTTP/2 Bomb hits every web server, PostgreSQL 19 Beta 1 ships, Rust funds maintainers, CISA flags cgroups bug
40 Years of Craft. Antipathy Turned Into a Weapon in His Own Code.
A veteran maintainer hid a prompt injection in a test framework called jqwik, invisible to humans but a weapon for AI agents.
Billions of Computers Run His Editor. He Managed It for 32 Years.
A text editor on nearly every Unix-based computer on Earth helped fund an orphanage in Uganda. One man maintained it for 32 years, until the day he couldn't.
📬 Open Source & Linux Weekly
Linux and open source, May 23 to 30, 2026: TrapDoor poisons AI coding assistants, CrowdStrike kills Glassworm, a Gitea CVE, Linux 7.1-rc5, OpenTelemetry
A $4 Billion Empire Broke Open Source. They Threatened One Developer. It Backfired.
They took open-source code for free, then threatened the lone developer who actually followed the license. The internet had other plans.
Google Just Found a Cleaner Legal Way to Take Your Code for Free
Hundreds of developers shipped 6,000 free contributions in a year. The license is still open. They lose access anyway.