Work is underway to bring the Fwupd firmware update framework and the Linux Vendor Firmware Service (LVFS) to Android devices with near feature parity to existing Linux and FreeBSD support. Lead developer Richard Hughes has merged code enabling fwupdmgr refresh on Android to download LVFS metadata and confirmed fwupdmgr update already functions to deliver firmware updates to devices. Those changes move Android support beyond experimental tooling toward a workflow where Android devices can query LVFS and apply signed vendor firmware in the same way many desktop and Chromebook systems do today.
The effort is positioned as a push for “proper integration” into real Android deployments rather than isolated implementations, driven in part by recent Android-based hardware such as Googlebook and the long-standing LVFS mandate for Chromebooks. Bringing Fwupd/LVFS into mainstream Android would standardize firmware distribution and management for a large class of devices, simplify vendor update workflows, and extend an open-source, security-focused update pipeline already backed by Red Hat and other ecosystem players. This represents a pragmatic win for firmware reliability and cross-platform consistency.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.