GitSpawn lets poisoned repositories run code through AI coding agents

A repository’s own `.git/config` can still trigger attacker-controlled code through Claude Code, Codex, Cursor, goose, and other AI coding agents before trust prompts, authentication, model calls, or tool approvals occur. Manifold Security’s GitSpawn research found eight flaws across seven agents; fixes are available for several tools, but Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path remained vulnerable during September testing.
Source

👉@sysadminoff

https://4sysops.com/archives/gitspawn-lets-poisoned-repositories-run-code-through-ai-coding-agents/

Arduino’s VENTUNO Q went up for pre-order, sold out

Arduino's VENTUNO Q is now up for pre-order, priced from $299. The development board comes with Ubuntu preinstalled and is built around Qualcomm's Dragonwing IQ8 platform.
You're reading Arduino’s VENTUNO Q went up for pre-order, sold out, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

👉@sysadminoff

https://www.omgubuntu.co.uk/2026/09/arduino-ventuno-q-preorder

📰 Linux Gets A Reverse-Engineered Driver For ASUS ROG NVMe Enclosure RGB Lighting

If you are into RGB lighting, you can even find NVMe external enclosures these days with RGB LEDs like the ASUS ROG Strix Arion. Now thanks to reverse engineering there is a Linux driver for allowing the RGB lighting controls for the ASUS ROG Strix Arion NVMe enclosure...

🔗 Source: https://www.phoronix.com/news/ASUS-ROG-Strix-Arion-RGB-Linux

#linux

👉@sysadminoff

https://phoronix.com/news/ASUS-ROG-Strix-Arion-RGB-Linux

Google has launched Gemini 3.8 Flash and Gemini 3.8 Flash Cyber

Google has launched Gemini 3.8 Flash and the security-focused Gemini 3.8 Flash Cyber, extending the rapid rollout that began with Gemini 3.7 Flash. The Cyber edition targets trusted defenders with autonomous vulnerability discovery and patching, while retaining the Flash family’s speed and introductory pricing.
Source

👉@sysadminoff

https://4sysops.com/archives/google-has-launched-gemini-3-8-flash-and-gemini-3-8-flash-cyber/

📰 AWS to Acquire DuckLabs, DuckDB Project Stays Open Source

AWS has signed an agreement to acquire DuckLabs, while the open-source DuckDB project will remain independent under the DuckDB Foundation.

🔗 Source: https://linuxiac.com/aws-to-acquire-ducklabs-duckdb-project-stays-open-source/

#opensource

👉@sysadminoff

http://bing.com/news/apiclick.aspx?aid=&c=3070015438794106880&mkt=tr-tr&tid=6a98724cf9804589afa5b9f0ca1396da&url=https%3a%2f%2flinuxiac.com%2faws-to-acquire-ducklabs-duckdb-project-stays-open-source%2f

Выпуск nginx 1.31.5 и njs 1.0.1

Опубликован выпуск основной ветки nginx 1.31.5, в которой продолжается развитие новых возможностей. В параллельно поддерживаемую стабильную ветку 1.30.x вносятся только изменения, связанные с устранением серьёзных ошибок и уязвимостей. В дальнейшем на базе основной ветки 1.31.x будет сформирована стабильная ветка 1.32. Код проекта написан на языке Си и распространяется под лицензией BSD.

👉@sysadminoff

https://www.opennet.ru/opennews/art.shtml?num=66201