The open source stories enterprise IT leaders actually read.
Volume 343, Issue 1 · 6 articles from 2 issues
It's FOSS weekly: DigitalOcean ends open source credits, Google pauses its OSS bug bounty over AI spam, and Sequoia PGP lands in Ubuntu.
This week's It's FOSS newsletter reports that DigitalOcean quietly ended infrastructure credits for long-standing open source projects, Gentoo is seeking new sponsors, and IFPI put yt-dlp on the EU piracy watchlist, naming four maintainers.
AI-generated spam led Google to pause product submissions to its open source bug bounty, and Siemens deleted the OpenRadioss repository, which was forked as OpenCourant under its AGPL license.
Red Hat's Lightwell backports fixes to Java libraries, and Rust-based Sequoia PGP arrives in Ubuntu 26.10 alongside GnuPG.
OpenSSH 10.6 disables compression dictionary sharing and rejects some usernames, knowingly breaking existing setups.
OpenSSH 10.6 ships two changes its maintainers knew would break things, starting with disabling the LZ77 dictionary coder for SSH compression after researchers found that sharing compression state across channels could expose plaintext.
It also blocks $ and \ in command-line usernames so they can't be interpreted by the shell through directives such as ProxyCommand and Match exec.
With AI-assisted security research finding more exploitable flaws, the project plans to ship fixes more often, and admins should check compression settings and username handling in scripts before upgrading.
Strata, an MIT-licensed inference engine, runs a 125B-parameter model on gaming PCs by splitting work across GPU, RAM and CPU.
Open Source For You reports on Strata, an open source inference engine that runs the 125-billion-parameter Qwen3.8-Flash-Next model on consumer gaming PCs under Windows or Linux with NVIDIA or AMD GPUs, keeping data on the user's machine.
It needs 12GB+ of VRAM, 32GB+ of RAM with 64GB recommended, and about 80GB of storage, keeping frequently used mixture-of-experts weights on the GPU and the full set in system RAM alongside speculative decoding.
Strata reports up to 94 tokens per second on an RTX 5070 system and 60 on an RX 9070 XT.
Weighs the security risks of cheaper open-weight AI models, including hidden backdoors and data poisoning, and how to contain them.
Cost pressure is pushing organizations toward open-weight models whose training data and provenance cannot be inspected, creating risks such as embedded backdoors and data poisoning that traditional scanning cannot detect.
The author distinguishes true open-source models, which allow informed scrutiny, from downloadable open-weight artifacts, and notes that liability for failures lands on the CSO when there is no vendor contract.
Since weights may be unscannable, the recommended leverage is downstream - restricting what the model can do, requiring user approval for sensitive actions and allowing access only to vetted domains - and vendors should also be judged on how well they help map these emerging threats.
AI agents turn small public clues into exploits quickly, weakening embargoes and pushing open source toward faster patching.
InfoQ reports on an argument by OCaml maintainer Anil Madhavapeddy that AI agents can turn public clues, such as an open fix PR, into working exploits within minutes, undermining traditional disclosure embargoes, noting he saw probes matching his bug pattern minutes after opening a fix.
Rclone's maintainer reported over 40 security disclosures in a month, compared with about 20 in the project's first decade.
Suggested responses include private vulnerability discussions, faster continuous releases, and protocol-level mitigations such as short-lived credentials and revocable capabilities that can be activated without immediate client upgrades.
OpenSSL reports AI-driven vulnerability reports rising from about 9 to 70 a month, straining the experts needed to triage and fix them.
AI tools have sharply increased vulnerability reports to OpenSSL, from roughly nine a month in 2025 to as many as 70, yet each still requires an experienced engineer to assess validity and risk, build and test a fix, and coordinate disclosure.
Of just over 400 reports in the past year, about one in ten produced a CVE.
The author warns that the gap between AI-scale discovery and limited human remediation capacity is becoming a security problem for open source, and calls for more investment in people who can fix flaws.