Stable software is widely preferred because it is tested and avoids unwanted changes, yet security fixes often reach only the newest release. Backporting those fixes to older branches requires adapting code, checking dependencies, and testing for regressions - laborious work that overburdened volunteer maintainers may not have time to do. The result is a choice between keeping familiar software with known vulnerabilities and upgrading to a version that may disrupt existing systems. The scale is substantial: the cited Linux kernel data lists between 337 and 2,006 unfixed CVEs across supported branches, while Debian 13 and Ubuntu 26.04 report thousands more in packages. These figures are indicators, not exact counts of confirmed exploitable flaws; they are based partly on vulnerability metadata and do not establish exploitability.
Trail of Bits describes using Codex and GPT-5.6 to identify missing fixes, adapt patches for stable versions, run tests, gather validation evidence, and prepare submissions. Engineers still review and submit the work, and regression testing and maintainer approval remain necessary. For straightforward backports, human preparation and review take about 30 minutes; difficult cases take roughly three hours, compared with tasks that could consume a week or more. By October 29, the effort had helped land fixes for 149 distinct CVEs in stable Linux kernels, with additional patches prepared for Fedora and Ubuntu packages. The approach begins with fixes that apply cleanly and moves toward more complex changes, aiming to make neglected security maintenance practical at scale.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Attackers stole enterprise cloud and AI credentials to run up fraudulent model-usage charges, with some companies facing bills near $1 million. Criminal groups resell stolen access through illicit gateways, prompting Google to urge stronger credential security and monitoring. (cloud.google.com)
Milner Mayor Craig Timmons secretly GPS-tracked Police Chief Bunn over timesheet concerns, bypassing city council approval. The chief, five officers, and city manager resigned, leaving the Georgia town without full-time police officers. (gadgetreview.com)
A Google Android partner allegedly infected 1.3 million set-top boxes with malware and turned them into a botnet. Google says the manufacturer intentionally hijacked the devices. (theverge.com)
WorkOS detected unauthorized access to an internal API, exposing data from Salesforce and Snowflake, including customer contact details, business information, and support tickets. WorkOS says it has found no evidence that customer application data or production services were accessed or affected. (news.ycombinator.com)
![I discovered a sound that leaks your exact location (and it's everywhere) [video]](https://hntoday.pixelshot.io/screenshots/20261103/3cae09e1cadc4410_tn.jpeg)
A sound signal found in everyday environments can reveal someone’s exact location. The discovery raises concerns about location privacy. (youtube.com)
The New York Times and several other publishers sued Brave, alleging it scraped and distributed copyrighted content to AI companies without permission. The lawsuits also challenge Brave’s paywall-bypassing feature and ad blocking, and seek damages and an injunction. (techcrunch.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.