Signal Key Verification, Gitea RCE Fix, ext4 iomap Patches
Signal adds automatic key verification, Gitea 1.27.2 closes a remote code execution hole, 32 patches move ext4 onto iomap, and GNOME 51 beta starts the freeze.
✍️ From Editor
Percona’s experimental DuckDB engine ran 22 TPC-H queries on MySQL in 186 seconds, against 28 hours for InnoDB’s 18. Apache HttpComponents silently skipped TLS hostname checks, and Wireshark blamed 28 advisories on AI reports, a flood Daniel Stenberg faced first:
10 Billion Devices Run His Code. He Maintains It Alone. Now AI is Attacking Him
☕ Support FossDaily on Ko-fi and keep it free, daily and independent.
🖥️ Apps & End User
Signal adds automatic key verification (20 minute read)
Signal announced automatic key verification on 11 August 2026, checking a contact’s keys against a public transparency log audited by Cloudflare and Trail of Bits. You can confirm a chat is not being intercepted without meeting in person.
🏠 Self-Hosting & Homelab
Gitea 1.27.2 closes seven security holes including remote code execution
Gitea, a self-hosted Git forge, shipped 1.27.2 on 13 August 2026 with seven security fixes, including remote code execution through external renderers and a two-factor bypass on OpenID logins.
Nextcloud patches all three supported Hub versions at once
Nextcloud, the self-hosted file platform, released maintenance updates 32.0.14, 33.0.8 and 34.0.3 on 14 August 2026, one for each supported Hub version. Older installs get the fixes without jumping to a new major version.
🐧 Linux Kernel
Thirty two patches would move ext4 buffered reads and writes onto iomap
Zhang Yi posted 32 unmerged patches on 14 August 2026 moving ext4 buffered reads and writes onto the kernel’s iomap layer. Large I/O writes would speed up, by the author’s own FIO measurements on a 4 core virtual machine.
New kernel CVE ids land for ksmbd, binder and f2fs, already fixed in stable
The kernel CVE team published new ids for ksmbd, binder and f2fs on 15 August 2026, with fixes already in the current point release of every affected stable branch. Taking the latest stable update on your branch covers them.
Four patches would fix an inverted comparison in sched_ext core scheduling
Tejun Heo posted four patches on 15 August 2026 fixing an inverted comparison in sched_ext, the kernel’s BPF scheduler, aimed at Linux 7.3. Custom schedulers would order tasks as their code specifies.
📦 Distros & Desktop
GNOME 51 beta starts the freeze
GNOME 51 beta arrived on 15 August 2026 and starts the interface, feature and API freeze, with Wayland background blur in Mutter and fingerprint management in Settings.
What Linux still lacks before NFC works on a Linux phone (7 minute read)
Volker Krause wrote on 15 August 2026 that Linux NFC support is thin, and showed a toggle for Plasma, the KDE desktop, plus a daemon that reads tags.
🧰 Languages & Dev Tools
Rails publishes its first coding agent benchmark (6 minute read)
The official Rails blog published a coding agent benchmark on 13 August 2026, testing eight AI models across 21 tasks in Rails, a web framework, three runs each. It puts named models and success rates behind claims about Rails agents.
uv 0.12.4 prefers post-quantum key exchange when fetching packages
uv, a Python package installer, released 0.12.4 on 13 August 2026 and now prefers post-quantum key exchange when connecting to package indexes. Your Python downloads get key exchange designed to resist future quantum attacks.
🐳 Cloud Native & Infra
A Kubernetes control plane took a new OS image in 11 minutes with zero humans (5 minute read)
A CNCF post on 14 August 2026 documented three control plane nodes rebooting onto new images of Kairos, an immutable Linux OS, in 11 minutes after one merge. Admins get a worked example of an unattended upgrade.
🗄️ Data & Databases
Percona’s experimental DuckDB engine ran 500 GB of TPC-H in 186 seconds (6 minute read)
Percona ran 500 GB of TPC-H on 7 August 2026 against its experimental DuckDB engine for MySQL: 22 queries in 186 seconds, versus 18 in over 28 hours on InnoDB.
🤖 AI, ML & LLM
Alibaba publishes Qwen3.8-27B open weights under Apache 2.0
Alibaba’s Qwen team published Qwen3.8-27B open weights on 14 August 2026, a 27 billion parameter model that reads text, images and video. The Apache 2.0 license carries no territory limit, so European teams can self-host it.
Hugging Face counts 2.96 million models and finds downloads concentrate hard (14 minute read)
Hugging Face published its summer 2026 report on 14 August 2026, counting 2.96 million models, of which 1.5 percent of repositories take 99.2 percent of downloads. You can see which open models people actually run.
📊 Observability & Networking
Wireshark 4.6.8 and 4.4.18 close 28 security issues at once
Wireshark, the network packet analyser, shipped 4.6.8 and 4.4.18 on 12 August 2026, closing 28 advisories between them, a volume the maintainers attribute to AI assisted vulnerability reports. Updating clears a batch of dissector and file parser crashes.
🔐 Security & CVEs
Apache HttpComponents Client 5.6.4 fixes a silent TLS hostname check bypass
Apache HttpComponents Client 5.6.4, announced on 13 August 2026, fixes a flaw where the async Java client silently skipped TLS hostname checks in versions 5.4-alpha through 5.6.3. Upgrading restores hostname verification, so Java apps notice a wrong certificate again.
What 50 open source projects taught GitHub about security in the AI era (11 minute read)
GitHub reported on 13 August 2026 that its Secure Open Source Fund has distributed 1.88 million dollars to 188 projects across all sessions, whose maintainers disclosed 533 new CVEs. Maintainers can see what the fund pays before applying.
⚖️ Licensing, Foundations & Policy
The Agentic AI Foundation adds 57 members and reaches 247 organisations
The Linux Foundation’s Agentic AI Foundation announced 57 new members on 13 August 2026, reaching 247, and governs MCP, goose, AGENTS.md and agentgateway. The specifications behind agent tooling sit under a neutral foundation instead of a single company.
🔌 Hardware, RISC-V & Embedded
What Zephyr’s safety certification work will and will not cover for car software (5 minute read)
A Zephyr project post from 6 August 2026 explains how Zephyr, an embedded operating system, maps to ISO 26262, with IEC 61508 certification of a kernel subset still in progress. Automotive teams know which safety work stays theirs.
🎮 Gaming & Graphics
OBS Studio 32.2.2 fixes Windows plugins failing to load after an update
OBS Studio, the streaming tool, released 32.2.2 on 14 August 2026, a hotfix for plugins failing to load after updating on Windows, and it will not run on macOS 12. Windows streamers get their plugins back without reinstalling.
💎 Gems & Repos
microsandbox runs untrusted code, agents and plugins inside microVMs on your own machine, with a command line tool and Rust, Python, TypeScript and Go libraries. Apache 2.0, last commit 15 August 2026, so risky workloads stay off your main system.
celld from Deno runs Cloudflare Workers and Durable Objects on your own servers, giving each object its own SQLite database and replicating through a bucket you own. Apache 2.0, last commit 14 August 2026, and it needs no control plane.
kandev is a kanban board that runs coding agents as tasks, supporting Claude Code, Copilot and Gemini across local, Docker, SSH and cloud runtimes. AGPL-3.0, last commit 15 August 2026, and it is self-hostable.
⚡ Quick Links
Linux 7.2-rc7 is still the current mainline: linux-next sits at next-20260814, and 7.2 final is the next milestone, which leaves time to test.
LocalSend 1.18.0 rewrites file transfer in Rust: shipped 10 August 2026, its first release since February 2025, adding a command line tool so devices swap files from a terminal.
Podman 5.8.6 fixes a quadlet install flaw: the 13 August 2026 patch closes CVE-2026-19730, after which installed unit files match what you wrote.
Perl’s DBI 1.652 fixes two heap write bugs: disclosed 15 August 2026, both affecting every version before 1.652, one only on 32-bit Perl, so code parsing untrusted SQL gets protected.
NLnet funds five more Nix and Taler projects: the 11 August 2026 round covers faster Nix evaluation and a cross platform Taler wallet, both now paid for.
☕ Support FossDaily on Ko-fi and keep it free, daily and independent.
Got an article worth included, a correction, a project we missed, or just say hi 👋 ? Write to c@fossdaily.org.