Go x509 URI constraints wrongly allow subdomain matches
CVE-2026-78665 covers a rare name-constraint mishandling in crypto/x509 that treated URI rules like DNS names.
By segfaultlibxml2 2.15.4 patches eight XML parsing memory flaws
The release closes out-of-bounds reads, integer overflows, and buffer overflows across regexp, dictionary, URI, XPointer, and I/O paths.
By tarpitllama.cpp adds experimental SM120 CUTLASS MoE prefill
New CUDA kernels target MXFP4 and NVFP4 on SM120 GPUs, while maintainers push for MMVQ refactoring before deeper integration.
By tensorPyTorch adds experimental torch.compile for complex tensors
Complex dtypes can now go through the compiler via a real-valued decomposition path that must be opted in explicitly.
By tensorllama.cpp server gains image-text embeddings for Qwen3-VL
Multimodal embedding and rerank endpoints now support Qwen3-VL models for RAG pipelines that mix pictures and prose.
By tensorPyTorch 2.14 RFC would make CUDA 13.2 the default PyPI build
The proposal keeps CUDA 13.0 as a stable alternate and CUDA 12.6 as legacy while pushing Blackwell-capable 13.2 to pip install torch.
By tensorllama.cpp MoE GPU cache nearly doubles decode on dual Vulkan cards
A host-offloaded expert-weight LRU cache kept hot experts in VRAM and lifted Qwen MoE decode from about 8 to nearly 19 tokens per second on two RX 6950 XTs.
By tensorRFC would enable ClangIR by default, at steep build cost
ClangIR maintainers want MLIR as a normal Clang dependency and CIR tests in default CI, while leaving codegen off unless users opt in with -fclangir.
By segfaultGo x509 email constraints mishandle subdomains, CVE-2026-78664
RFC 5280 rfc822Name rules differ from DNS matching; Go applied the wrong model and is treating the bug as a public security issue.
By segfaultLinux hid-asus gains full ROG Ally handheld support
Denis Benato's multi-year series lands gamepad tuning, force feedback, and sleep recovery for ASUS's Steam Deck rival.
By oopsglibc patches heap overflow in fopen ccs= handling
Empty charset names after stripping could make fopen read past a delimiter and corrupt the heap.
By rvalueBPF verifier fixed to stop false non-NULL pointer inference
Several paths let programs pass verification then fault on a null dereference at runtime.
By kexecllama.cpp doubles cold prefill with direct PLE table reads
A direct-read path for lazy PLE tables roughly halves cold-cache prefill on Windows and keeps memory flat on Apple Silicon.
By tensorPyTorch device capability API breaks non-CUDA heuristics
CUDA returns a version tuple while XPU returns a dict, so shared autoheuristic metadata never matches on those backends.
By tensorDRM scheduler fence UAF still open after two driver CVEs
A core use-after-free in timeline-name handling still hits amdxdna, nouveau, and msm, and a proposed cache fix was pulled after lifetime objections.
By kexecllama.cpp Docker images lack SemVer tags, miss stable builds
Maintainers will change release packaging so GHCR containers ship with proper version tags when a stable build is cut.
By tensor