Arriving about a month after DietPi 10.4, the headline change is that KMS (Kernel Mode Setting) and DRM (Direct Rendering Manager) are now enabled by default on Raspberry Pi boards whenever you install a graphical app or desktop environment through DietPi-Software. The behavior can still be toggled from a new entry under DietPi-Config’s Display Options.
Raspberry Pi users also get an updated Camera setting in DietPi-Config that can switch on the modern camera stack via the libcamera API. For the NanoPi K2, the release fixes a bug that prevented setting a static Ethernet MAC address through the ethaddr variable — though on existing installs you’ll need to flash U-Boot via DietPi-Config’s Advanced Options for it to take effect.
On the software side, DietPi-Software now enables the RustDesk client on ARMv7 and fixes an ownCloud Infinite Scale regression that broke password logins on fresh installs. DietPi-Config, meanwhile, gains a revamped display menu, options to configure the GRUB terminal and early-boot console resolution, and a fix for the RTC mode option not showing up.
This release also drops several older, device-specific options — the per-device resolution menus for Raspberry Pi and Odroid, plus Raspberry Pi headless mode, HDMI rotation, and PSU noise reduction. Full details are in the release notes on GitHub.
DietPi 10.5 is available now from the official website; existing users only need to update their installations.
Source: 9to5Linux
]]>Despite a busy cycle that saw a growing number of AI/LLM-reported bugs across the kernel, 7.1 landed on time. It brings a long list of new features: a new NTFS driver, Intel FRED for better performance on Panther Lake and future CPUs, faster Intel Arc Battlemage graphics, improvements for older AMD Radeon GPUs, and plenty more. The full feature overview covers everything in this now-stable release.
The kernel can already be pulled from Git. In his release note, Torvalds explained the early timing — he is simply in a different timezone while traveling — and warned that the upcoming merge window may be “a bit irregular” as he works through part of it offline. As for the final week of changes, he described it as “nothing particularly interesting or scary,” mostly smaller driver updates across GPU, networking, and sound.
Attention now turns to Linux 7.2 and the next kernel cycle.
Source: Phoronix
]]>The role leans heavily on low-level security work. Among the responsibilities, Epic lists applying deep operating-system knowledge to detect and prevent the latest cheating techniques, reverse-engineering cheats and other malicious software, and working closely with game developers and anti-cheat data analysts. On the requirements side, it asks for expert C/C++ in a security context, deep knowledge of both Linux and Windows internals, and experience debugging and reverse-engineering x86-64 binaries.
It’s worth keeping expectations in check, though: a listing like this doesn’t mean Fortnite is suddenly headed to Linux. But it could be groundwork toward eventually allowing it. Back in 2023, Epic CEO Tim Sweeney said that Linux and SteamOS would need “tens of millions of users” before that would happen.
The job is listed on Epic Games’ careers site.
Source: GamingOnLinux
]]>COSMIC is built in Rust and licensed under GPLv3 for apps and MPL-2.0 for libraries. It follows Freedesktop specifications, is not tied to any single distribution, and uses the Iced toolkit for a clean, type-safe, and reactive interface.
--no-xwayland launch option.The result feels fast and responsive, with the work on animations, panel hiding, and touchpad scrolling making everyday use noticeably smoother. Decoupling the systemd components is also a sensible step toward running COSMIC on a wider range of setups.
COSMIC 1.1.0 ships now in Pop!_OS 24.04. You can grab the latest ISO from the official Pop!_OS download page, and existing Pop!_OS 24.04 users can simply update their system. Packages are also expected soon in Fedora, NixOS, Arch Linux, openSUSE, Redox, and CachyOS, among others.
Source code and build instructions are available in the cosmic-epoch repository.
Source: DebugPoint
]]>Another key update is the addition of usb-signaller, a new Rust-based tool now integrated into postmarketOS edge, partially replacing the previous role of usb-moded.
Moreover, usb-signaller now offers a simpler solution. It enables USB gadget initialization without initramfs scripts, supports transactional mode and gadget switching for improved reliability, provides clearer logging, handles missing kernel drivers, and includes OpenRC support. The latest version also implements USB role switching between host and device modes.
Duranium, the systemd-based image for postmarketOS, also received several updates. Waydroid can now be enabled with Duranium via sysext by running updatectl enable waydroid, simplifying Android app compatibility.
In addition, Duranium now uses systemd/bootctl on systems with EFI variable support to keep a fallback bootloader available during updates. If an updated bootloader turns out to be broken, the system can automatically boot into the fallback option instead.
On the device support side, the linux-postmarketos-qcom-sdm845 kernel package has been updated to Linux 7.1. Among other improvements, the LG G7 ThinQ now has working touchscreen support, along with additional changes that were mainlined through the device tree.
The postmarketOS team has also continued to clean up its package base, with unmaintained packages moved to an archived category. There are stricter requirements for devices in the testing category as well. Their kernels must now be no older than the oldest currently supported LTS kernel listed on kernel.org, and those kernels must be built with LLVM.
Another cleanup measure is the removal of armhf, or armv6, support from postmarketOS edge. The architecture was never released or widely used, yet required ongoing maintenance.
For more details, see the official announcement.
Source: Linuxiac
]]>Yserver, a project written from scratch in Rust, has reached version 1.0, marking the first stable-tagged release of an effort that aims to provide a modern X11 server for current Linux systems.
According to the project, it does not seek to replicate X.Org Server feature by feature. Instead, its goal is to back modern desktop environments, window managers, and applications while removing legacy X11 components such as multiple screens, non-TrueColor visuals, indirect GLX, the DDX driver ABI, and endian-swapped clients.
So, looks like X11 is still not ready to fade away quietly. With XLibre already bringing fresh attention to the space, Yserver now adds another noteworthy development as X11’s long-term future is uncertain within the Linux desktop ecosystem.
And even though most major desktops now default to Wayland, X11 is still widely used, particularly by those relying on legacy workflows, specific window managers, or applications that perform better under X11.
Currently, Yserver’s main feature is its standalone DRM/KMS server, which can run full MATE, Xfce, and Cinnamon desktop sessions. The project has also tested window managers such as FVWM3, e16, and Window Maker.
On top of that, Yserver offers a wide range of X11 extensions, including BIG-REQUESTS, Composite, DAMAGE, DPMS, DRI3, GLX, MIT-SHM, Present, RANDR, RENDER, SHAPE, SYNC, XFIXES, XInputExtension, XKEYBOARD, and XTEST.
The project’s hardware testing includes AMD, Intel, NVIDIA with the proprietary driver, Snapdragon X1 with Adreno graphics, Apple M1 and M2 systems running Asahi Linux, and virtio-gpu in virtualized environments. Tested desktop sessions include MATE, Xfce, and Cinnamon.
However, some limitations remain. For example, GLX_EXT_texture_from_pixmap is implemented and tested on AMD, Intel, Asahi, and Qualcomm hardware, but does not work with NVIDIA’s proprietary driver. VT switching is also limited, depending on how the server is launched, particularly in LightDM sessions.
Yserver can be launched directly from a TTY or used with LightDM for graphical logins. It requires a recent stable Rust toolchain and system dependencies such as libseat, libxkbcommon, libinput, fontconfig, and related graphics components.
At this stage, keep in mind that Yserver is an experimental yet technically significant project and is not a drop-in replacement for X.Org Server. However, its ability to run full MATE, Xfce, and Cinnamon sessions makes its first stable release noteworthy.
For additional details, see the project’s GitHub repo.
Source: Linuxiac
]]>Sygnia, which tracks the group as Velvet Ant, says it backdoored the PAM and OpenSSH components that decide who is allowed to sign in, planting its access where ordinary cleanup could not reach it. The network it targeted had no direct internet access, so the group first staged through internet-facing systems to get there.
The earliest traces go back to 2016. Instead of dropping new malware that a scanner might catch, the attacker changed the trusted login programs themselves. Nothing obvious appeared, and no exploit was needed, so the activity looked like normal administration.
On many machines, the attacker replaced the main PAM login module with backdoored copies. Some let them in with a secret password; others quietly recorded real usernames and passwords as people logged in.
Researchers found nine separate versions. The OpenSSH programs were altered the same way, logging credentials and every command typed, with a hidden switch to turn that logging off when needed.
Reaching the isolated network at all took extra work. The attacker used other disguised tools and an internet-facing web server as a bridge, passing commands through it to open remote sessions deep inside the segment that had no direct internet access.
Because the login system itself was compromised, normal containment did little. Password resets and killed sessions do not help when the thing that checks those credentials is working for the attacker.
This is not new for the group. Each time defenders find one foothold, Velvet Ant moves to gear they watch less and sets up there. In a 2024 case, Sygnia found the same actor turning internet-exposed F5 BIG-IP appliances into internal command servers.
Later that year, it reported the group exploiting a Cisco NX-OS flaw, CVE-2024-20399, to plant a backdoor on the switches. That bug needs admin access first, so it is a persistence tool, not a remote break-in. Cisco patched it in July 2024, and CISA flagged it as exploited the next day.
Operation Highland is the same idea, one level deeper. Load balancers, switches, and the login software itself are trusted by default and rarely checked, which is exactly why a patient attacker hides inside them.
Operation Highland is not a one-CVE problem. The attacker changed trusted programs after getting in, so the fix is verification, not patching, and cleanup is delicate: a wrong replacement can lock admins out of a live system.
Watch the login files. Monitor the PAM and OpenSSH programs and their key files for any change, and alert when they change.
Hunt by checking what changed, not by waiting for an alert. Compare these programs against known-good copies, because nothing will flag them for you.
Remove the backdoor before resetting passwords, or the new ones get stolen the same way. Test any replacement in a lab first.
The earlier F5 and Cisco cases have their own checks: patch CVE-2024-20399 on Cisco Nexus gear, and watch F5 boxes for unexpected outbound connections.
The wider lesson is plain: infrastructure that sits outside normal monitoring still needs integrity checks, and that now includes the login layer.
Source: The Hacker News
]]>A report from the open-source intelligence community Independent Federated Intelligence Network (IFIN) notes that a new maintainer is spoofing a trusted publisher on the AUR platform to push infected packages.
The Arch Linux distribution is popular among power users and developers, using the AUR catalog to provide the latest versions for installed software, drivers, and the kernel.
AUR is a community-maintained repository for the Arch distribution that contains package build scripts (PKGBUILDs) with instructions for downloading, compiling, and installing software not available in Arch’s official repositories.
AUR is considered essential for any Arch-based distribution because it contains proprietary applications, beta/nightly versions of open-source software, niche utilities, and older versions of packages that retain functionality which may have been removed in later releases.
However, it is not a vetted space, and threat actors can use it to push malware through packages that change ownership without anyone noticing.
According to IFIN member Michael Taggart, the compromised packages are modified with preinstall scripts that download and execute a malicious npm package called atomic-lockfile.
Independent security researcher Whanos notes that one sample of the atomic-lockfile included a Linux ELF payload named deps, which was a “credential stealer with optional root-only eBPF [extended Berkeley Packet Filter] rootkit capabilities.”
“It is designed for developer workstations and build environments. It targets browser and Electron application data, Slack, Microsoft Teams, Discord, GitHub, npm, Vault, Docker/Podman, SSH, VPN material, shell histories, and other local developer secrets,” Whanos says in the report.
With eBPF technology present, the malware can run inside the kernel with elevated privileges and hide local processes.
Supply-chain management company Sonatype also published a report on a campaign targeting the AUR repository and delivering the malicious atomic-lockfile npm package, but using a different method.
Sonatype researchers say that the threat actor hijacked at least 20 orphaned packages on AUR and pushed atomic-lockfile by modifying the PKGBUILD file – a Bash script with the build information needed by Arch Linux packages.
According to the report, the attacker added a post-install script to invoke npm and retrieve the malicious package.
“The modified packages add a post-install script that invokes npm and installs atomic-lockfile during package installation,” Sonatype says.
However, analysis showed that the npm package installed a Linux executable with references to an eBPF rootkit that could hide processes, files, and network interfaces.
Additionally, the Linux binary indicates that it has infostealer functionality, targeting the following types of sensitive information:
Sonatype determined that the binary can archive data, handle multi-part files, and perform HTTP uploads, so the functionality for a typical exfiltration mechanism is present.
AUR maintainers are working to identify and remove all malicious commits, and to ban the accounts pushing them.
In a message to the community, Arch Linux package maintainer Jonathan Grotelüschen urged users to report any malicious package they find.
As a general rule, it’s recommended to only trust projects with frequent updates and an active community around them.
Arch users are advised to review the list of affected packages and look for the indicators of compromise provided in the report from Whanos.
Michael Taggart also pointed to a script that checks for the atomic-lockfile malware on the system.
If compromised packages are found, users should rotate all credentials and consider reinstalling Arch from scratch, since a rootkit may survive normal cleaning efforts.
Source: BleepingComputer
]]>