Each episode of Open Channels News brings coverage and analysis of the biggest stories. Here’s a roundup of this week’s news:
- Drupal Commerce Access Bypass Under Active Exploitation
An access bypass vulnerability in Drupal Commerce is being actively exploited. Fixes are out in Commerce Core 3.3.13 and for earlier versions, and merchants are advised to audit orders and confirm payment details before fulfillment.
Resource: Drupal security advisory; Centarro (project maintainer) assessment of October 29 - Ivanti and Synology Systems Targeted
Ivanti acknowledged limited exploitation affecting certain Connect Secure versions, and Synology says ransomware operators are targeting outdated DSM systems through a flaw patched in December 2024. The lesson is to know which systems you own, which versions they run, and who maintains them.
Resource: Ivanti and Synology advisories - DeepSeek Publishes an Open Coding Agent Prototype
DeepSeek released Super-Agent, MIT-licensed research code that takes authorized requests from GitHub or the workplace chat app Feishu, runs them in separate sessions and returns results such as pull requests. The real measure is how much reliable progress a team gets after supervision, corrections and review.
Resource: DeepSeek’s dsh-superagent repository on GitHub - France Weighs a Traffic-Based Tax on Data Producers
France’s National Assembly adopted an amendment to the proposed 2027 finance bill that would tax digital data producers at 5.5 euro cents per gigabyte delivered to French subscribers, with revenue-based caps. VideoLAN, the nonprofit behind VLC, warned of more than €1 million in annual exposure before caps, raising concerns for free software distribution.
Resource: It’s FOSS - AI Bug Discoveries Delay Postgres 19
Postgres committer Robert Haas explained that AI tools are finding real bugs faster than maintainers can fix them, with commits to the upcoming stable branch rising more than 60% year over year. Three major features were pulled late in beta, and Postgres 19 is now likely to arrive in November or later.
Resource: Robert Haas’s post on the Postgres 19 release timing - Ubuntu Under Fire Over a Critical Kernel Patch
A post by Chalmovsky titled “WTF Ubuntu?” criticized Canonical’s response to CVE-2026-98432, a 9.8-severity Linux kernel TCP vulnerability, noting Debian shipped fixes first. Canonical says fixes for its LTS releases are in proposed testing pending qualification, and administrators need to install a fixed kernel and reboot, since disabling multipath TCP alone is not a complete fix.
Resource: “WTF Ubuntu?” blog post; Canonical security guidance - If You Love a Website, Back It Up
Web archivist Misty De Meo wrote about a long-running fan site that vanished and was replaced by gambling ads, urging individuals to preserve the sites that matter to them. Tools like archiveweb.page and Browsertrix let anyone capture pages in archival formats built for later replay.
Resource: “If You Love a Website, Back It Up”; archiveweb.page; Browsertrix - SUSE Cuts 10% of Its Workforce
SUSE is reducing its global workforce by 10%, with CEO Dirk-Peter van Leeuwen citing AI and automation, after voluntary separation packages fell short of the company’s target. The open question is whether support, security maintenance and upstream community work stay strong afterward.
Resource: Fosswire, summarizing reporting from Phoronix - E2E Raises €7 Million for Open Source Testing
Warsaw and San Francisco-based E2E raised €7 million in seed funding for an open source testing framework that the company says has passed 1 million downloads since its October 1 launch. As AI generates more code than people can review, verification is becoming the bottleneck.
Resource: The Recursive - Drupal Revisits Who Pays for Open Source
Drupal Association figures show that in 2024, 219 of 1,440 active organizations accounted for 96% of recorded contributions. Interim CEO Tiffany Farriss has outlined two proposals, a broader certification and recognition program and a dedicated maintainers fund, neither of which has been implemented.
Resource: The Drop Times; Drupal Association
Our sponsors keeps our network independent and actively publishing.
Since 2005, Automattic has built tools for the open web including WordPress.com, WooCommerce, and Jetpack that are used by millions of people to create, sell, and publish online. They believe in ownership, flexibility, and open source and we’re grateful for their support. Learn more at automattic.com.
In five days, Omnisend moves every flow, list, and template off your current platform, and you could be paying up to 35% less without lifting a finger. You just show up when it’s done. We’re glad to have them supporting the show and the community we’re building around it. Use the code OpenChannels and get 30% off your first 3 months of any paid plan.
Across the week, one idea kept coming back: the hard work happens after the easy part. AI can find bugs faster and write code faster, but someone still has to fix, review and verify it. A patch in testing is not a patch in production, and a site on the web is not guaranteed to be there tomorrow. Whether it is maintaining the systems we already trust, deciding how much authority to give an agent, or figuring out who pays for the maintenance that thousands of businesses depend on, open source has never meant software costs nothing. It means we have choices about how software is built, shared and sustained, and those choices are getting more important, not less.
