Red Hat vs Ubuntu

CISA flags three actively exploited Linux kernel flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities Catalog (KEV), indicating they are being actively exploited. The flaws, tracked as CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, are rated as 'critical' or 'high' severity. Red Hat has confirmed exploitation via publicly known exploits. The vulnerabilities can lead to system crashes, privilege escalation, and remote code execution. CISA has ordered US federal agencies to patch affected systems within three days or temporarily take them offline. Patches are available in the kernel, and administrators are urged to apply them urgently. No details on the threat actors or targets have been disclosed yet.

• CISA added three Linux kernel vulnerabilities to its KEV catalog: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964.
• Red Hat confirmed that all three vulnerabilities are exploited in real attacks via publicly known exploits.
• CVE-2025-39682 involves an error in processing empty TLS records in kernel TLS, potentially leading to system crashes and code injection.

Tokens-per-Second Benchmarks Explained

This technical guide explains what "tokens per second" (tok/s) actually measures for local LLM inference, why single-user tok/s numbers can be misleading, and how concurrency, batching, and prompt processing change the observed speed. It contrasts single-user latency with server throughput, highlights vLLM's continuous-batching advantage versus Ollama under high concurrency, defines related metrics (P99 latency, time to first token / TTFT), and provides practical measurement advice using tools like Ollama and vLLM and calculators from notAcalculator. The article also gives realistic tok/s expectations for different model sizes on consumer hardware and lists practical tips for reading and running benchmarks yourself.

• Tokens are the unit of both billing and speed for LLMs; tokenization affects cost and measured tok/s.
• Under a Red Hat benchmark on an A100 40GB with Llama 3.1 8B, vLLM peaked around 793 tok/s combined throughput versus about 41 tok/s for Ollama at high concurrency (~19x gap).
• vLLM's key innovation is continuous batching (plus PagedAttention), which increases total throughput under concurrency compared with single-request processing tools.

Spring Boot IAM: OAuth2 Redirect Bug in Production

The author built identityCore, a self-hosted Identity & Access Management (IAM) service in Spring Boot, implementing form login plus Google (OIDC) and GitHub (OAuth2) logins, RBAC stored as JPA entities, and a unified provisioning flow. The post explains key differences between OAuth2 and OIDC (GitHub returns an opaque access_token requiring extra API calls; Google returns an id_token JWT), and describes a production-only bug where OAuth2 logins failed with redirect_uri_mismatch because TLS was terminated upstream and the app ignored X-Forwarded headers. The one-line fix was to set server.forward-headers-strategy=framework so Spring trusts proxy headers. The author lists operational lessons about protocol differences, deployment vs demo differences, and centralized user provisioning.

• identityCore is a self-hosted IAM service built with Spring Boot (stack: Spring Boot 3.3.5, Spring Security 6.3.4, Spring Data JPA, PostgreSQL/H2, Thymeleaf, HikariCP, BCrypt).
• The system supports three login paths (form login, Google via OIDC, GitHub via OAuth2) that resolve to a single UserEntity and use JPA RoleEntity / PermissionEntity for RBAC.
• GitHub returns an opaque access_token requiring downstream calls (e.g., GET /user and /user/emails) to obtain a verified email; Google returns an id_token (JWT) containing email and email_verified claims.

Arduino® VENTUNO™ Q is available for pre-order with Ubuntu pre-installed

Canonical and Arduino (a subsidiary of Qualcomm Technologies) announce that the Arduino VENTUNO Q is available for pre-order with Ubuntu pre-installed, following their initial collaboration announcement in March 2026.

Install Apache Kafka 4.2 on Ubuntu WSL2 (KRaft)

This technical guide explains how to install and run Apache Kafka 4.2 in KRaft (Kafka Raft Metadata) mode on Ubuntu 24.04 running under WSL2. It covers prerequisites (Java 11+), downloading and extracting Kafka, configuring server.properties for a single-node broker+controller, initializing KRaft metadata (generating a Cluster ID and running kafka-storage.sh format), starting the broker, creating/listing/describing topics, producing and consuming messages, and common administrative commands and troubleshooting. The author highlights the removal of ZooKeeper in favor of KRaft, the importance of the controller.quorum.voters setting, and the two-listener port model (9092 for clients, 9093 for internal controller communication).

• The guide installs Apache Kafka 4.2 on Ubuntu 24.04.4 LTS running in WSL2 using KRaft mode (no ZooKeeper).
• KRaft mode uses an internal Raft-based Controller to manage metadata; a unique Cluster ID must be generated and kafka-storage.sh format must be run once before starting the broker.
• Example server.properties for a single-node KRaft deployment includes process.roles=broker,controller; node.id=1; controller.quorum.voters=1@localhost:9093; and listeners for PLAINTEXT on 9092 and CONTROLLER on 9093.