📬 Linux 7.0's PostgreSQL Crisis, OpenClaw's Triple CVE, TigerFS

Linux 7.0-rc7 ships days before stable with PostgreSQL throughput halved on AWS Graviton4 and no fix in sight. OpenClaw collects three critical CVEs in three months. TigerFS mounts PostgreSQL as a filesystem for AI agents.

📬 Open Source & Linux Weekly - W142026

European Commission loses 340 GB to supply chain attack, Linux doubles macOS on Steam at 5.33%, PHP ends 26 years of license confusion with a 51-0 BSD vote.

TeamPCP Trivy Compromise: European Commission AWS Breach Confirmed

CERT-EU confirms EC cloud breach via Trivy scanner. OpenClaw: 250K stars, 135K exposed. Sonatype: 454K malicious packages. 65% of CVEs have no severity score.

The Field Is Optional. The Death Threats Were Not.

Fraudulent takeout orders. Mormon missionaries at the door. A Social Security number posted on an imageboard.

North Korea Hit Axios npm While TeamPCP Burned 1,000 Environments

North Korea's UNC1069 hit Axios npm (183M downloads) while TeamPCP compromised 1,000+ SaaS environments and Lapsus$ claimed 4TB from Mercor AI.

12.5 Million Downloads a Month. She's Never Seen Her Code on a Screen.

A visually impaired developer in Copenhagen maintains pypandoc, a top 1% Python package with 12.5M monthly downloads used by Adobe, Google, and Microsoft

95 Million Downloads. Poisoned by Its Own Security Scanner.

You never installed LiteLLM. CrewAI did. For 5 hours on March 24, every Python process on your machine was stealing your AWS keys, SSH credentials, and Kubernetes tokens.

Open Source & Linux Weekly - W13_2026

X11 died without a funeral. Canonical bets on post-quantum crypto and Rust. TeamPCP hacks four supply chain targets in ten days. Weekly OSS & Linux roundup.

Mozilla. WordPress. Now Manjaro. Open Source Keeps Dying the Same Way.

He fired the only person watching the money. Made himself treasurer. 2 years later, his own 50/50 business partner signed a public manifesto against him.

Every Line Looked Clean. The Malware Was Hiding in Characters No Editor on Earth Can Render.

You could stare at the infected file for hours and see nothing. The attack hit 200 Python repos, 151 JS/TS repos, 72 VS Code extensions, and 10 npm packages. A researcher traced 50 blockchain transactions spanning three months. Nobody noticed.