Tech Roundup: Ubuntu 26.10 Lands, GhostAction Hits GitHub, and a Spy Bug in OpenAI's Conference Room
Title:
## Cybersecurity
**Windows Server zero-day crashes servers with one packet.** Microsoft patched CVE-2026-70111, a flaw that lets a network-adjacent attacker crash affected Windows Servers in seconds using a crafted DFS referral response. If you're running exposed DFS services, patch now. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792065386862829" index="1" channel="C0B802PCF0W" message_ts="1792065386.862829" text="[1]">
**GhostAction supply-chain campaign balloons.** The GhostAction attack has now compromised roughly 1,900 GitHub accounts and targeted more than 30,000 repositories, attempting to steal CI/CD, cloud, and API secrets. Worth an audit of your org's GitHub Action secrets and recent commits. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792065386829169" index="2" channel="C0B802PCF0W" message_ts="1792065386.829169" text="[2]">
**UK NCSC refreshes TLS/post-quantum guidance.** The National Cyber Security Centre published updated configuration guidance pushing admins toward TLS 1.3, disabling legacy protocols, and starting migration planning for post-quantum cryptography. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792065386683509" index="3" channel="C0B802PCF0W" message_ts="1792065386.683509" text="[3]">
**Infostealer malware now goes after AI coding assistant credentials.** The "Aoki" infostealer has expanded to harvest `.claude.json`, Codex `config.toml`, `.env` files, and tokens for Gemini, Cursor, and GitHub Copilot — a reminder not to leave API keys sitting in local config files. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792062994245889" index="4" channel="C0B802PCF0W" message_ts="1792062994.245889" text="[4]">
**170 million identity documents surface on the dark web.** A dataset allegedly exfiltrated from identity-verification vendor IDScan is circulating via a custom .onion marketplace called "Nexus," illustrating how fast stolen identity data gets resold and repackaged by threat actors. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792062994311819" index="5" channel="C0B802PCF0W" message_ts="1792062994.311819" text="[5]">
**Alleged corporate espionage at OpenAI.** The FBI arrested an OpenAI engineer accused of planting a recording device — hidden in a toilet paper roll — in a top-secret conference room, with foreign-espionage charges attached. The engineer faces up to 5 years and a $250K fine. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792062994328469" index="6" channel="C0B802PCF0W" message_ts="1792062994.328469" text="[6]">
**Ad-tech weaponized for spyware delivery.** Citizen Lab reports that a company called Discover-Tech used targeted advertising to profile and deliver Candiru spyware to devices belonging to Al Jazeera staff — a zero-click pipeline hidden inside normal ad infrastructure. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792061789603829" index="7" channel="C0B802PCF0W" message_ts="1792061789.603829" text="[7]">
## Linux & Open Source
**Ubuntu 26.10 "Stonking Stingray" is out.** The newest six-month Ubuntu release ships with Linux kernel 7.3 and GNOME 51, and completes the migration to Rust-based coreutils. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792065272415589" index="8" channel="C0B802PCF0W" message_ts="1792065272.415589" text="[8]">
**Linux kernel 7.3 will be the biggest release ever.** It's set to land with more than 20,000 changes — about 1,600 commits ahead of the previous record-holder (v6.7) and 2,200 more than the current mainline release. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792062871775329" index="9" channel="C0B802PCF0W" message_ts="1792062871.775329" text="[9]">
**Kernel team may drop its AI-code labeling rule.** The Linux kernel maintainers appear set to remove the requirement that contributions assisted by AI tools be explicitly flagged. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792062871858979" index="10" channel="C0B802PCF0W" message_ts="1792062871.858979" text="[10]">
**KDE turns 30 with Plasma 6.8 "Anniversary Edition."** The milestone release highlights updates to KRunner, Discover, and the KDE Frameworks. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792062871737709" index="11" channel="C0B802PCF0W" message_ts="1792062871.737709" text="[11]">
**New Rust-based file manager for Omarchy.** Strata 1.0 debuts as a GTK4 file manager built for the Omarchy distro, featuring Miller-column navigation and secure file previews. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792062871757829" index="12" channel="C0B802PCF0W" message_ts="1792062871.757829" text="[12]">
**openSUSE pitches a middle path for rolling releases.** openSUSE's "Slowroll" branch promises big updates roughly every other week with continuous security patches in between — splitting the difference between Tumbleweed's speed and Leap's stability. <!bk_citation citationType="message" url="https://litzseytech.slack.com/archives/C0B802PCF0W/p1792064072972959" index="13" channel="C0B802PCF0W" message_ts="1792064072.972959" text="[13]">
