<p><strong>TLDR:</strong> Ubuntu 26.04 LTS landed this week with Linux kernel 7.0, a Wayland-only GNOME 50, sudo-rs replacing the C sudo, and ROCm/CUDA now installable via apt. Fedora 44 is right behind it, releasing April 28 with GNOME 50 and KDE Plasma 6.6. Linux 7.1’s merge window closed with a major story: maintainers are removing decades-old drivers partly because AI-generated bug reports now consume roughly 40% of maintainer time. The Bitwarden CLI and Checkmarx KICS supply chain attacks hit the same week, making it a rough few days for anyone running automated CI pipelines.</p>
<hr>
<h2>Ubuntu 26.04 LTS ships Wayland-only</h2>
<p>The 11th Ubuntu LTS is out, and the headline is that Xorg is gone from the default GNOME and KDE sessions entirely. If you have software that only runs under X11, check compatibility before upgrading. The release ships Linux 7.0, sudo-rs as the default sudo provider (not fully compatible with every edge case config), uutils coreutils replacing GNU coreutils in some contexts, and TPM-backed full-disk encryption now generally available. ROCm and CUDA are both installable via <code>apt</code> for the first time, though the ROCm packages are already four versions behind current. Direct upgrades from 24.04 are delayed until the 26.04.1 point release in July.</p>
<h2>Linux 7.1 removes legacy drivers as AI bug reports overwhelm maintainers</h2>
<p>The 7.1 merge window closed with 138,161 lines removed: the ISDN subsystem, legacy ATM drivers, AX.25 amateur radio, old PCMCIA and ISA-era network cards, bus mouse drivers, and the beginning of Intel i486 phase-out. The honest reason is AI. Networking maintainer Jakub Kicinski noted that roughly 40% of maintainer time now goes to reviewing LLM-generated outputs — bug reports and fuzzing results that look real but target hardware with essentially zero active users. Removing the code removes the noise. The kernel is still growing: net change is roughly +259,000 lines, bringing the total to 39.88 million. The new NTFS driver (36,000+ lines, four years in the making) is the headline addition, with multi-threaded write speeds 35–110% faster than NTFS3 and mount times roughly 4x faster on large drives.</p>
<h2>Bitwarden CLI and Checkmarx KICS supply chain attacks</h2>
<p>Two significant supply chain compromises hit this week. A trojanized Bitwarden CLI (v2026.4.0) was live on npm for roughly 90 minutes after attackers compromised a GitHub Action in Bitwarden’s CI/CD pipeline — it harvested GitHub tokens, AWS/GCP keys, SSH keys, and AI agent API keys, then used found tokens to escalate and extract CI/CD secrets. Separately, Checkmarx KICS Docker images and VSCode extensions were poisoned for about 84 minutes on April 22, injecting a hidden MCP addon that exfiltrated credentials to a spoofed Checkmarx domain. Both attacks are attributed to the same group (TeamPCP), also linked to a recent Trivy compromise. If your pipelines pulled either during those windows, rotate everything.</p>
<h2>Fedora 44 releasing April 28</h2>
<p>All blocker bugs are resolved and the RC is available now. The release brings GNOME 50, KDE Plasma 6.6 with a new Plasma Login Manager replacing SDDM, GCC 16, LLVM 22, PHP 8.5, Ruby 4.0, and Golang 1.26. Enhanced AArch64 EFI support lands for Windows on ARM laptops. With Ubuntu 26.04 pushing a 6GB RAM minimum and going Snap-heavy, Fedora is increasingly the easier recommendation for new Linux users — and this release does nothing to hurt that case.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Pack2TheRoot (CVE-2026-41651):</strong> Critical local privilege escalation in PackageKit present since version 1.0.2 (2014), affecting Ubuntu, Debian, Fedora, and RockyLinux — fixed in PackageKit 1.3.5, patch now.</li>
<li><strong>Framework Laptop 13 Pro:</strong> Ground-up CNC aluminum redesign with LPCAMM2 memory up to 64GB, Ubuntu certified out of the box, DIY from $1,199 — and Framework says Ubuntu pre-builts are outselling Windows configurations.</li>
<li><strong>Niri 26.04:</strong> The scrollable-tiling Wayland compositor adds background blur (most-requested feature), a 2–8x render list construction speedup from a pull-to-push pipeline refactor, and screencasting improvements.</li>
<li><strong>GnuPG 2.5.19:</strong> Adds Kyber (ML-KEM / FIPS-203) post-quantum encryption; GnuPG 2.4 reaches end-of-life in roughly two months.</li>
<li><strong>CachyOS April 2026:</strong> Shelly replaces Octopi as default GUI package manager, Kyber replaces <code>none</code> as the default NVMe I/O scheduler, fingerprint sudo auth added via chwd.</li>
<li><strong>WireGuard for Windows 1.0:</strong> Reached stable after fixing a long-standing MTU polling workaround by reverse-engineering the NSI driver — a Windows bug Microsoft acknowledged in 2021 but never fixed.</li>
<li><strong>Godot 4.7 beta 1:</strong> 1,265 fixes from 309 contributors, full HDR output on Linux via Wayland/Vulkan, Vulkan raytracing groundwork, rectangular area lights, and a new DrawableTexture API.</li>
<li><strong>raylib 6.0:</strong> Biggest update in 12 years — CPU software renderer for embedded targets, new Win32 and Emscripten backends, skeletal animation blending, 215+ examples total.</li>
<li><strong>LACT 0.9:</strong> Switches from GTK4 to libadwaita, adds NVIDIA voltage-frequency curve editor comparable to MSI Afterburner on Windows.</li>
<li><strong>Asahi Linux / Linux 7.0:</strong> Installer updated to v0.8.0 with CI/CD automation, M3 machines gain PCIe/keyboard/trackpad/NVMe/RTC support, VRR discovered hidden in DCP firmware.</li>
<li><strong>Debezium 3.6.0.Alpha1:</strong> New Docling SMT for AI/RAG workflows, Amazon SNS sink, reworked Oracle LogMiner batch-sizing, OpenTelemetry tracing for Cassandra.</li>
<li><strong>Forgejo v15.0:</strong> 100th release, now LTS until July 2027 — adds repository-scoped access tokens, OIDC support in Actions, and ephemeral runners.</li>
<li><strong>Rust coreutils audit:</strong> Canonical’s security audit of uutils found 113 issues including 70 CVEs; cp, mv, and rm still fall back to GNU coreutils due to 8 unresolved TOCTOU race conditions, with full adoption targeting Ubuntu 26.10.</li>
<li><strong><a href="http://Cal.com" target="_blank" rel="noopener nofollow">Cal.com</a> goes closed source:</strong> Citing AI-enabled vulnerability scanning as the reason; the community forked it immediately as cal.diy under MIT license.</li>
<li><strong>Colorado age verification bill:</strong> System76’s Carl Richell successfully lobbied to add open source software exemptions covering Linux distros, GitHub/GitLab, and container tools like Docker and Podman.</li>
<li><strong>GCC 16:</strong> Release branch created after all 14 highest-priority regressions resolved — adds Algol 68 frontend, C++20 as default standard, AMD Zen 6 support, AVX10.2 and APX for Intel Nova Lake.</li>
<li><strong>OpenBLAS 0.3.33:</strong> Automatic BIGNUMA support now handles more than 256 CPU cores (up to 1,024) without manual configuration.</li>
<li><strong>Material Maker 1.6:</strong> Free Substance Designer alternative adds controlled variations, wireless aperture nodes, and a basic glTF exporter; coming to Steam in July.</li>
</ul>


Linux distro releases, open source project news, and FOSS community updates.

Open Source Digest

Ubuntu 26.04 LTS launches as a Wayland-only release with Linux kernel 7.0, sudo-rs replacing C sudo, uutils coreutils, and ROCm/CUDA now installable via apt. Linux 7.1 removes decades-old drivers (ISDN, ATM, AX.25, legacy network cards) partly because AI-generated bug reports now consume ~40% of kernel maintainer time. Two supply chain attacks hit the same week: a trojanized Bitwarden CLI on npm and poisoned Checkmarx KICS Docker images/VSCode extensions, both attributed to group TeamPCP, each live for under 90 minutes but capable of harvesting CI/CD secrets. Fedora 44 releases April 28 with GNOME 50, KDE Plasma 6.6, GCC 16, and PHP 8.5. Notable extras include a critical PackageKit privilege escalation CVE fixed in 1.3.5, WireGuard for Windows 1.0 stable, Godot 4.7 beta, GnuPG 2.5.19 with post-quantum Kyber support, and a Rust coreutils security audit revealing 70 CVEs.

Ubuntu 26.04 ships Wayland-only with Rust core tools, Linux 7.1 drops legacy drivers over AI noise