Canonical vs Red Hat

Canonical announces Zephyr 26.04 LTS, delivering up to 15 years of support for MCU-grade devices

Canonical today announced the upcoming release of Zephyr 26.04 LTS, an enterprise distribution providing a trusted Real-Time Operating System (RTOS) to solve critical Cyber Resilience Act (CRA) compliance and developer experience challenges. Also announced: Ubuntu coming soon to Snapdragon X2 Series platforms, and a new kernel release strategy for faster CVE fixes.

Migrate Cloud TPU API Workloads to Compute Engine

This technical migration guide explains moving TPU workloads from Google Cloud's deprecated Cloud TPU API to Compute Engine instances. The Cloud TPU API is no longer under active development and future TPU hardware generations (starting with TPU7x) are supported only through Compute Engine or Google Kubernetes Engine. Migration requires flag and command mapping (e.g., accelerator-type -> machine-type, tpu-vm ssh -> compute ssh), checking different quota metrics (preemptible vs family quota) and provisioning models (FLEX_START, SPOT, STANDARD, RESERVATION_BOUND), and adjusting startup scripts and images (some Compute Engine accelerator images lack tools like docker). The guide documents practical troubleshooting: using SPOT to probe capacity, checking both quota metrics via the Cloud Quotas API, handling silent failures where RUNNING != ready, and other pitfalls encountered during real migrations.

• Google's Cloud TPU API is no longer under active development; new hardware generations starting with TPU7x are supported only via Compute Engine or GKE.
• Compute Engine uses different flags and flows (e.g., --machine-type=ct6e-standard-1t, --image-family, --request-valid-for-duration, --provisioning-model=FLEX_START) compared with the Cloud TPU API.
• Flex-start provisioning on Compute Engine consumes preemptible quota (PREEMPTIBLE-TPU-V6E-per-project-region) and falls back to the family quota; quota and capacity are separate and reported by different APIs.

CISA flags three actively exploited Linux kernel flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities Catalog (KEV), indicating they are being actively exploited. The flaws, tracked as CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, are rated as 'critical' or 'high' severity. Red Hat has confirmed exploitation via publicly known exploits. The vulnerabilities can lead to system crashes, privilege escalation, and remote code execution. CISA has ordered US federal agencies to patch affected systems within three days or temporarily take them offline. Patches are available in the kernel, and administrators are urged to apply them urgently. No details on the threat actors or targets have been disclosed yet.

• CISA added three Linux kernel vulnerabilities to its KEV catalog: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964.
• Red Hat confirmed that all three vulnerabilities are exploited in real attacks via publicly known exploits.
• CVE-2025-39682 involves an error in processing empty TLS records in kernel TLS, potentially leading to system crashes and code injection.

Tokens-per-Second Benchmarks Explained

This technical guide explains what "tokens per second" (tok/s) actually measures for local LLM inference, why single-user tok/s numbers can be misleading, and how concurrency, batching, and prompt processing change the observed speed. It contrasts single-user latency with server throughput, highlights vLLM's continuous-batching advantage versus Ollama under high concurrency, defines related metrics (P99 latency, time to first token / TTFT), and provides practical measurement advice using tools like Ollama and vLLM and calculators from notAcalculator. The article also gives realistic tok/s expectations for different model sizes on consumer hardware and lists practical tips for reading and running benchmarks yourself.

• Tokens are the unit of both billing and speed for LLMs; tokenization affects cost and measured tok/s.
• Under a Red Hat benchmark on an A100 40GB with Llama 3.1 8B, vLLM peaked around 793 tok/s combined throughput versus about 41 tok/s for Ollama at high concurrency (~19x gap).
• vLLM's key innovation is continuous batching (plus PagedAttention), which increases total throughput under concurrency compared with single-request processing tools.

Spring Boot IAM: OAuth2 Redirect Bug in Production

The author built identityCore, a self-hosted Identity & Access Management (IAM) service in Spring Boot, implementing form login plus Google (OIDC) and GitHub (OAuth2) logins, RBAC stored as JPA entities, and a unified provisioning flow. The post explains key differences between OAuth2 and OIDC (GitHub returns an opaque access_token requiring extra API calls; Google returns an id_token JWT), and describes a production-only bug where OAuth2 logins failed with redirect_uri_mismatch because TLS was terminated upstream and the app ignored X-Forwarded headers. The one-line fix was to set server.forward-headers-strategy=framework so Spring trusts proxy headers. The author lists operational lessons about protocol differences, deployment vs demo differences, and centralized user provisioning.

• identityCore is a self-hosted IAM service built with Spring Boot (stack: Spring Boot 3.3.5, Spring Security 6.3.4, Spring Data JPA, PostgreSQL/H2, Thymeleaf, HikariCP, BCrypt).
• The system supports three login paths (form login, Google via OIDC, GitHub via OAuth2) that resolve to a single UserEntity and use JPA RoleEntity / PermissionEntity for RBAC.
• GitHub returns an opaque access_token requiring downstream calls (e.g., GET /user and /user/emails) to obtain a verified email; Google returns an id_token (JWT) containing email and email_verified claims.