-

29-year-old Squid proxy bug “Squidbleed” leaks HTTP requests
Debian 12 exits regular support, Bun moves to Rust, and a 29-year-old Squid bug finally gets a name.
-

29-Year-Old Squid Proxy Bug ‘Squidbleed’ Leaks HTTP Requests
Debian ships two point releases in one day, LLVM lands x86 sandboxing, and the Bun-to-Rust rewrite is the most honest migration post in a while.
-

AUR supply-chain attack: orphaned packages pushed malware for days
Quiet weekend, but systemd v261 and the AUR supply-chain saga both deserve your attention before Monday standup.
-

GitLab 19.1 ships; malware stuffs CBRN keywords to blind AI scanners
A 753B open-weights model dropped under MIT, GitLab shipped secret-scan GA, and malware authors are now stuffing CBRN keywords into comments specifically to blind the AI tools scanning for them.
-

AUR hit by second, more sophisticated malware wave — 1,500+ packages affected
Linux 7.1 ships while 7.2 is already bumping compiler minimums, the AUR got hit twice in a day with the second wave obfuscated well enough to slip past the initial response, and a DNS caching quirk means dead domains can still look alive in your monitoring.