<p><strong>TLDR:</strong> Ubuntu 26.04 LTS beta landed this week with Wayland-only sessions, GNOME 50, and Linux 7.0. A threat actor group called TeamPCP ran coordinated supply chain attacks against Trivy and LiteLLM, infecting over 1,000 cloud environments with credential-stealing malware. Linux 7.0-rc6 shipped with an unusually heavy fix load, and the AI-generated code debate got louder across multiple projects simultaneously.</p>
<hr>
<h2>Ubuntu 26.04 LTS beta ships without X11</h2>
<p>The beta is out ahead of the April 23 stable release. X11 is gone from the main flavor — Wayland is the only session now, with Xwayland handling legacy apps. The release bundles GNOME 50 with stable VRR support, Linux 7.0, Mesa 26.0.2 with Vulkan 1.4, and Rust-based replacements for coreutils and sudo. The App Center finally shows deb packages alongside Snaps, which should have been there from day one. Python 3.14, GCC 15.2, and OpenJDK 25 round out the toolchain updates. If you depend on X11 apps, now is the time to test how they behave under Xwayland before the stable release.</p>
<h2>TeamPCP supply chain attacks hit Trivy and LiteLLM</h2>
<p>This is the week’s most serious story. TeamPCP exploited a GitHub Actions misconfiguration to steal a privileged Aqua Security token, then force-pushed malicious versions to 75 of 76 trivy-action tags. Anyone running Trivy in CI inadvertently executed infostealer malware. The attack expanded from there — LiteLLM (downloaded up to 3.4 million times per day) was trojanized via a compromised dependency, and a self-propagating npm worm called CanisterWorm spread the compromise further. The group claims 300 GB of compressed credentials from projects downloaded over 100 million times monthly, and has since announced a partnership with ransomware group Vect. Rotate credentials, pin GitHub Actions to commit SHAs, and treat security tools as versioned dependencies with checksum verification.</p>
<h2>Linux 7.0-rc6 ships with heavier-than-normal fix volume</h2>
<p>Linus noted in the release announcement that the consistently high fix count throughout this cycle is unusual and somewhat concerning. rc6 includes a large batch of EXT4 and XFS patches, x86 fixes for Intel TDX and AMD SEV-SNP VMs, an unusually large set of audio quirks for laptops, and driver fixes across GPU, RDMA, and networking. Linus speculated that improved AI tooling may be contributing to the uptick in small fixes — more eyes finding more things, or more noise, depending on how you look at it. Stable 7.0 is still targeted for mid-April, with Ubuntu 26.04 expected to ship it.</p>
<h2>AI-generated code controversy hits multiple projects at once</h2>
<p>Several threads converged this week. OpenBSD rejected an LLM-generated ext4 implementation over unresolved copyright status — no human author can clearly claim copyright on machine-generated code, and the LLM was trained on GPL-licensed Linux code. The chardet Python library became a flashpoint after its maintainer used Claude to rewrite it and relicensed it from LGPL to MIT; Bruce Perens concluded current copyright law cannot stop AI-mediated relicensing. A Node.js petition gathered contributor signatures urging the TSC to ban LLM-generated PRs after a 19,000-line Claude Code pull request. Gedit banned AI contributions outright. The common thread: maintainers are spending real time on contributions that are cheap to generate and expensive to review.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Wine 11 NTSYNC support:</strong> The new kernel-level NT synchronization driver, merged in Linux 6.14, eliminates wineserver round-trips — Dirt 3 jumped from 110 FPS to 860 FPS in benchmarks; Valve already added NTSYNC to SteamOS 3.7.20 beta.</li>
<li><strong>Wayland session management:</strong> The xdg-session-management protocol was finally merged after a pull request open since February 2020, enabling apps to save and restore window states across restarts.</li>
<li><strong>Ubuntu MATE stepping back:</strong> Founder Martin Wimpress is leaving after 12 years, there will be no Ubuntu MATE 26.04 LTS, and the project’s future depends on finding volunteers.</li>
<li><strong>PineTime Pro announced:</strong> Pine64 introduced a dual-core Cortex-M33 smartwatch with AMOLED display, GPS, heart rate and blood oxygen sensors, and Bluetooth 5.2; hardware revision 3 expected in April.</li>
<li><strong>Fedora moves to Forgejo:</strong> The Fedora Forge platform powered by Forgejo is ready and will replace <a href="http://pagure.io" target="_blank" rel="noopener nofollow">pagure.io</a>, with final cutover at Flock to Fedora 2026 and <a href="http://src.fedoraproject.org" target="_blank" rel="noopener nofollow">src.fedoraproject.org</a> retiring by Fedora 46.</li>
<li><strong>RISE RISC-V CI runners:</strong> The RISE Project launched free native RISC-V GitHub Actions runners on real Scaleway bare-metal hardware, no emulation required, available to any open source project.</li>
<li><strong>Krita 6.0 released:</strong> The Qt6 port ships with full Wayland color management protocol support for HDR on Linux, plus a new text engine with full OpenType support.</li>
<li><strong>wlroots 0.20 and Sway 1.12-rc1:</strong> wlroots adds color-representation-v1 and full Vulkan renderer coverage; Sway 1.12-rc1 builds on it with HDR10 support and individual window capture.</li>
<li><strong>KDE Plasma 6.6 vs GNOME 50 benchmarks:</strong> Testing on Ubuntu 26.04 with an AMD RX 9070 XT showed Plasma 6.6 with a roughly 47% performance advantage over GNOME 50 across gaming workloads.</li>
<li><strong>Canonical joins Rust Foundation:</strong> Gold membership at $150K/year puts Canonical on the board; Ubuntu 26.04 ships sudo-rs and uutils as defaults.</li>
<li><strong>GNOME Fellowship program:</strong> Fellowships paying $70K–$100K/year for experienced contributors will begin in May, targeting build systems, CI/CD, accessibility, and technical debt.</li>
<li><strong>Fivetran donates SQLMesh to Linux Foundation:</strong> The move comes after Fivetran merged with dbt Labs and amid controversy over dbt’s Elastic License adoption for its Fusion engine.</li>
<li><strong>NVIDIA DRA driver donated to CNCF:</strong> The Dynamic Resource Allocation driver moves to community governance, enabling attribute-based GPU allocation (MIG profiles, NVLink topology) rather than simple integer counts.</li>
<li><strong>Kyverno graduates from CNCF:</strong> Now used across 230+ LinkedIn clusters handling 20K+ admission requests per minute; latest release fully adopts CEL.</li>
<li><strong>Firefox 149:</strong> Ships a Rust-based JPEG-XL decoder and defaults to the XDG portal file picker on Linux.</li>
<li><strong>Godot 4.7 dev 3:</strong> 297 fixes from 113 contributors, including transform offset properties for Control nodes and HDR output on Linux via Wayland.</li>
<li><strong>systemd birthDate controversy:</strong> A developer added an optional birthDate field for age verification compliance; the backlash included death threats and doxxing, and a protest fork called Liberated systemd has already appeared.</li>
<li><strong>LiteLLM malware and Delve irony:</strong> The credential-harvesting malware entered via a compromised dependency; LiteLLM prominently displays SOC2 and ISO 27001 certifications obtained through Delve, a compliance startup already under scrutiny for allegedly generating fake audit data.</li>
</ul>


Linux distro releases, open source project news, and FOSS community updates.

Open Source Digest

Ubuntu 26.04 LTS beta drops X11 entirely in favor of Wayland-only sessions, bundling GNOME 50, Linux 7.0, and Rust-based coreutils replacements. The week's most critical story is a coordinated supply chain attack by TeamPCP: they exploited a GitHub Actions misconfiguration to compromise Trivy's CI pipeline and trojanize LiteLLM, claiming 300 GB of stolen credentials from widely-used projects. Linux 7.0-rc6 shipped with an unusually high fix volume, with Linus speculating AI tooling may be contributing. AI-generated code controversy erupted simultaneously across OpenBSD, the chardet Python library, Node.js, and Gedit — all grappling with copyright ambiguity and review burden. Notable items include Wine 11 NTSYNC delivering massive FPS gains, Canonical joining the Rust Foundation, Fedora migrating to Forgejo, and the systemd birthDate field sparking a protest fork.

Ubuntu 26.04 drops X11, TeamPCP supply chain attacks hit Trivy and LiteLLM