Tor Project blog

Keeping the doors open

A user in China once said this about our work:

LinuxGizmos.com

M5Stack PaperColor is an ESP32-S3 dev kit with Spectra 6 e-paper panel

M5Stack has introduced the PaperColor, a compact development board built around the ESP32-S3R8 processor and a 4-inch Spectra 6 full-color e-paper display. The platform combines wireless connectivity, onboard sensors, audio hardware, battery operation, and expansion interfaces for low-power IoT and embedded display applications.

Wireless-Tag previews IDO Claw ARM platform with OpenClaw pre-installed

Kickstarter recently featured the IDO Claw campaign, a compact ARM-based system from Wireless-Tag designed for local OpenClaw deployment. The fanless platform combines the Rockchip RK3576 processor with LPDDR5 memory, onboard storage, dual Gigabit Ethernet, and hardware video acceleration for always-on AI and edge workloads.

9to5Linux

Debian 13.5 “Trixie” Released with 144 Bug Fixes and 103 Security Updates

Debian 13.5 comes two months after Debian 13.4 to provide the community with an up-to-date installation media for those who want to deploy the latest Debian 13 “Trixie” operating system series on new hardware without downloading lots of updates after the installation or those who had issues with the previous ISO releases.

Shelly 2.3 GUI Package Manager for Arch Linux Brings Performance Improvements

Shelly 2.3 introduces performance improvements to both the graphical user interface and the command line interface by switching from JSON to MemoryPack, the ability to remove locally installed packages, support for language translations (contributions are welcome), and improved support for Flatpak apps.

Six-Year-Old Linux Kernel Flaw Lets Unprivileged Users Read Root-Owned Files

A proof-of-concept is available as ssh-keysign-pwn, taking advantage of the __ptrace_may_access() function in the Linux kernel, skipping the dumpable check when task->mm == NULL. As such, do_exit() runs exit_mm() before exit_files() (no mm, fds still there) and pidfd_getfd(2) succeeds in that window when the caller’s uid matches the target’s.

Ubuntu 25.10 Users Can Now Upgrade to Ubuntu 26.04 LTS, Here’s How

Ubuntu 26.04 LTS was released on April 23rd, 2026, but the upgrade path wasn’t open until now, not for Ubuntu 25.10 users and not for Ubuntu 24.04 LTS users. Of course, you can always force the upgrade with the update-manager -d command, but I wouldn’t recommend doing so as you might end up with a broken system.

KDE Plasma 6.7 Desktop Environment Is Now Available for Public Beta Testing

Some of the highlights of KDE Plasma 6.7 include per-screen virtual desktops, Wayland session restore, a global push-to-talk feature, a dedicated setup UI for configuring shared printers, a “multi-GPU swapchain” feature for Vulkan support, and a full-featured print queue viewer app.

Fragnesia Is Yet Another Local Privilege Escalation Flaw in Linux Kernel

Fragnesia (CVE-2026-46300) is a bug in the IPsec XFRM ESP-in-TCP subsystem, part of the Dirty Frag vulnerability class. It’s called Fragnesia because the skb “forgets” that a frag is shared during coalescing. The good news this time is that the mitigations for Dirty Frag also apply to Fragnesia.

PipeWire 1.6.5 Brings Extra Security Checks and Hardening Fixes to Pulse Server

Coming three weeks after PipeWire 1.6.4, the PipeWire 1.6.5 release is here to add a whole bunch of extra security checks and hardening fixes to the pipewire-pulse server, improve renegotiation in audioconvert when the graph rate changes and the resampler is disabled, and fix a crash in ALSA when logging.