This week in open source, the commons took hits from every direction at once.

A third wave of malware quietly took over more than nineteen hundred packages in the Arch User Repository before the project slammed the brakes and froze package adoption entirely. A man in Atlanta is staring at five years in federal prison — not for anything he did with his phone, but for using a privacy feature on it. The biggest desktop environments are fighting off a flood of sloppy AI-generated code while the industry's newest marketing trick is to advertise how much of the product was "written by AI" instead of by people. And meanwhile, in the middle of all that noise, the people who actually build this stuff kept building: a new COSMIC desktop, a Rust-native X server crossing the finish line, GOG officially coming to Linux, open firmware for modern AMD boards, and NetBSD turning eleven with RISC-V support.

This is the open source news digest, and I want to read it the way I read everything: by asking who benefits when the thing you use every day gets a little less safe, a little more owned, and a little less yours.

Let me start with the story that should make every single person using Arch — and honestly, every person using any free software — sit up. On July thirtieth, Arch Linux disabled package adoption on the Arch User Repository after a third sustained wave of malicious takeovers. The campaign has a nickname now: Atomic Arch. Attackers have compromised well over nineteen hundred packages across three waves since late May. First wave, around June ninth: they adopted orphaned packages — abandoned projects that nobody maintains anymore — and slipped npm install commands into the build scripts. Those lifecycle scripts silently pulled down a Rust-based credential stealer that could optionally drop an eBPF rootkit to hide its own traces in the kernel. The Arch team purged more than nineteen hundred affected packages in mid-June and declared the repository clean. Within hours, the second wave rolled out, this time with heavily obfuscated JavaScript downloaders. And now the third wave flips the detection playbook entirely: attackers embedding compiled ELF binaries directly into build scripts, static payloads that execute during the makepkg build phase, bypassing the JavaScript-based detection that caught the earlier waves.

Let me translate what that actually means, because the technical details hide the real story. The Arch User Repository is a community repository. It runs on trust — thousands of volunteers packaging software for other people to use, no corporate security team, no paid gatekeepers, no bug bounty that pays a living wage. When you install from the AUR, you are trusting that the person who wrote the package is not the person who wants to steal your passwords. That trust is the attack surface. The attackers did not break into Arch's servers. They did not exploit some clever kernel bug. They adopted orphaned packages — the digital equivalent of moving into an abandoned house — and put their malware in the build instructions. Nineteen hundred packages. Three waves. Months of volunteer time spent cleaning up a mess that no one was paid to clean up.

And here's the systemic part that nobody in the headlines will say out loud: this is what an open commons looks like under siege. The official repositories stayed untouched. The core infrastructure held. But the community layer — the part built and maintained by volunteers, the part that exists precisely because no one owns it — that's the part that got attacked, because that's the part where trust is the only security, and trust is free to exploit. When the tech giants talk about "open source supply chain security," what they usually mean is: your unpaid labor is our free quality assurance, and if it fails, we'll sell you a product to fix it. The AUR crisis is the purest demonstration of that logic: the commons gets attacked, and the people who actually own the infrastructure — the volunteers — absorb the cost, while the companies that depend on that infrastructure sell "solutions" to the problem they didn't have to solve.

Now the second story, and this one should make you genuinely angry. A GrapheneOS privacy feature just became the basis for a federal indictment. Samuel Tunick, an Atlanta resident, faces up to five years in prison. The charge: destruction of property to prevent government seizure, under a federal statute about blocking evidence seizure. The "destruction" was his phone wiping itself after he gave border agents a passcode — a duress password, a feature designed exactly for this scenario. Let me tell you what happened. In January, Customs and Border Protection put Tunick into secondary inspection at Atlanta's airport as he returned from the Dominican Republic. Agents searched him, demanded the passcode to his phone, all under the pretext of looking for CSAM. He asked for a lawyer multiple times. They ignored him. They never read him his Miranda rights. When he pushed back, they told him it was "a whole different ballgame" at the border, and they didn't need a warrant. He eventually handed over a passcode. The moment it was entered, the screen flickered, the phone rebooted, and its contents erased in front of the same agents who'd demanded access. That's the duress password working exactly as designed — a panic feature that lets you surrender something plausible while the real data stays safe.

And the state's response to a privacy feature working as intended is to indict the man who used it. Five years. The motion filed by his lawyer stresses that his real crime, in the eyes of the agents, was his association with Defend the Atlanta Forest, an activist group fighting the construction of a police training facility. The FBI had been circling that movement. So let's be clear about what this case is: an activist, flagged for his organizing, returns from a trip abroad, is detained without a warrant at the border, is denied a lawyer, is denied his rights, is pressured into handing over a passcode, and when the privacy feature does what it was built to do, the state charges him with a federal crime.

This is the pattern. It's the same pattern we saw with the Epstein case, where there was actual proof, actual documentation, actual victims, and the powerful people in that orbit walked — until one of them had a problem with another powerful person. The elites can do anything they want. Average people are always the ones being targeted. The surveillance state doesn't go after the people who own the infrastructure; it goes after the people who might challenge them. A duress password is a tool built so a journalist, an activist, a regular person under coercion can hand over something that looks like everything while protecting what matters. And the moment that tool is used, the state calls it evidence destruction. Think about what that means for everyone else: if a panic feature that protects your data under coercion is now a crime, then privacy itself is the crime. Encryption becomes suspicious. A passcode that wipes your phone becomes evidence of guilt. The tools that let ordinary people protect themselves from the state are being redefined, one case at a time, as tools of the guilty.

And look at the ecosystem reacting in real time. Windscribe just released deGDID, a tool to remove and block Microsoft's Global Device ID — the tracking identifier Microsoft has been quietly embedding in Windows. A commercial VPN company is shipping a free tool to strip surveillance out of the operating system, because the operating system vendor won't stop. That's the state of things: the people who make the OS have turned it into a surveillance instrument, and the people who sell privacy have to clean up after them. Meanwhile GrapheneOS, the privacy-hardened Android, gets its flagship feature turned into a federal charge. When the tool that protects you becomes the evidence against you, you have to ask: whose side is the system on?

Third story thread, and this one has a darkly funny edge to it. The AI gold rush has reached the open source maintainers, and they are not impressed. Debian developers are voting on five proposals about LLM use — spanning everything from a total ban on AI-generated contributions to pragmatic acceptance. GNU GCC, one of the oldest and most important compilers in existence, just banned AI code contributions, but sensibly — not a blanket ban, but a rule that AI-generated code must be clearly labeled and reviewed like any other contribution, because the maintainers refuse to be the free QA layer for models that were trained on their own code. GNOME is working to establish an RFC process — a formal way to make decisions — specifically because they're battling sloppy AI-generated extensions flooding their ecosystem. And then there's Starling, a new Linux desktop built using AI in six months, being covered with the breathless excitement of a tech demo.

And the user's comment on that one is perfect: "seems like 'written by AI' is the next big trending feature after 'written in Rust' lmao." That's the whole industry in one sentence. First it was "written in Rust" — a quality signal, real engineering, memory safety, actually meaningful. Now it's "written by AI" — and it's being marketed the same way, as if being generated by a statistical model trained on everyone else's work is a feature instead of a red flag. Six months to build a desktop. Sure. And how many volunteer years will it take to fix the bugs, audit the generated code, and maintain what the model produced? That cost isn't counted in the demo. It never is.

Here's the extraction mechanism underneath all three of these stories — AUR, GCC, GNOME, Starling, Debian. The AI companies trained their models on open source code. All of it. The commons built by volunteers over thirty years became the free training data for a trillion-dollar industry. Now that industry's output is flooding back into the same repositories, and the maintainers — still volunteers, still unpaid — are expected to review it, fix it, and keep the ecosystem safe. The model extracted value from the commons, and the commons is now paying the cost of the model's output. That's the whole arc of the AI boom in one paragraph: extract the labor, sell it back, and leave the cleanup to the people who did the original work. Debian's five proposals, GCC's sensible ban, GNOME's RFC process — these are communities drawing a line and saying: we built this, we maintain this, and we will not be your free quality control.

And the enclosure attempt is already underway, dressed in patriotic clothing. OpenUK — the UK's open source advocacy body — wants Britain to stop "giving away" open source creations. Their report points out that the Model Context Protocol, the standard now behind how AI models connect to tools and data, was built by two engineers in London and ended up under US-based governance at the Linux Foundation. Their proposal: a British National Foundation that holds code, governance, and standards built with UK public money, instead of watching that work migrate to servers and boards elsewhere. On the surface, that sounds reasonable — national pride in open source, a sovereign tech fund. Underneath, it's the same move every enclosure makes: when something built with public money proves valuable, the response is not to keep it public — it's to build a vehicle to own it. The Linux Foundation, the Sovereign Tech Agency, Open Atom — every country wants its own foundation now, because open source is the infrastructure of the 21st century, and whoever holds the governance holds the power. The commons is valuable. That's why everyone wants to carve it up.

Now let me talk about the stuff that went right this week, because the builders kept building, and the pattern underneath their work is the answer to all of the above.

The kernel moved. The first Arch Linux ISO powered by Linux kernel 7.1 is out. Fedora 45 will enable shadow stack protection by default on 64-bit — a hardware-backed defense that makes a whole class of memory corruption attacks much harder to pull off. That's not a flashy headline, but it's the boring, essential work that keeps the whole thing standing: when the attacks get more sophisticated, the defense gets deeper. New Debian 13 Trixie kernel security updates fixed sixty-eight vulnerabilities — sixty-eight — in one release. Ubuntu 26.04's virtualization HWE stack ships newer QEMU and libvirt. Liquorix kernel 7.1-7 dropped irqbalance to preserve low-latency performance, because for some people a millisecond matters. Fwupd 2.1.7 keeps improving the firmware update layer. GNU Binutils 2.47 adds new RISC-V features, linker improvements, and reproducible builds — meaning you can verify that the binary you're running is really built from the source you're reading. That last one matters more than most people realize: reproducible builds are the defense against exactly the kind of supply chain attack that hit the AUR.

The desktops moved. COSMIC 1.5 is out — System76's Rust-based desktop, now with a wave of improvements, and it's showing up in Gentoo-based MocaccinoOS 26.08 alongside KDE Plasma 6.6.6. KDE Neon shipped a new build, rolling Plasma 6 on top of Ubuntu 24.04. GNOME 50.3 enables remote desktop hardware acceleration for AMD GPUs. Wayfire 0.11, the Wayland compositor, adds better fractional scaling and HDR rendering. Hyprland 0.56.1 came out one week after 0.56.0 with fourteen regression fixes — a project moving fast enough to ship, break, and fix within seven days. And in the "the old world is still alive" corner: YServer 1.4.0, a Rust-native X11 server, finally crossed the threshold into actually usable territory. An X server written in Rust, hitting a usable milestone, in 2026 — that's not nostalgia, that's the future of the past: new engineering capacity applied to the oldest infrastructure we still depend on, because that infrastructure is still everywhere.

The apps moved. Krita 5.3.3 dropped with the first stable Qt 6 port — the painting app that animators and artists rely on, now on modern foundations. Shotcut 26.7 added a graphics adapter for Linux and a shake video filter. Calibre 9.12, the e-book manager, added the option to convert GIF images to JPEG and WebP. Firefox 153.0.1 fixed a batch of issues and crashes. FireDragon swooped in with a new release. Proton Pass improved its autofill. Mission Center added battery, partition, and power draw info to its system monitor. GOverlay 1.8.10 shipped after a one-week sprint of automated testing and polish. Shelly 3.0 — the GUI package manager for Arch — landed as a major update, got a 3.0.1 with polished AUR browsing and tighter Flatpak integration, and then a v3.0.1+1 hotfix just two days after the major Zig rewrite stabilization. And Fooyin 0.12 added audio conversion, three visualization plugins, and native PulseAudio support — which prompted exactly the right comment from one reader: isn't PulseAudio support a bit late? Didn't everyone migrate to PipeWire? And the answer is: no, not everyone. A huge installed base still runs PulseAudio, and supporting them is what free software is for. Choice is the product. That's the whole point.

The self-hosters ate well this week. Immich 3.1 added new filtering options, a wakelock, map date range, and better OAuth integration. Ente Photos added memory reactions, desktop upgrades, and curated sharing controls. Linkwarden 2.16 brought a modernized design, link format re-preservation, and a new search modal. ownCloud Web 12.5.0 added Collabora save-as and a new HTML editor. RomM 5.0 launched with a revamped UI and shareable savestates for the retro game library manager. Every one of those is a brick in the wall of "you don't have to rent your data from a corporation" — photos, links, documents, games, all self-hosted, all owned by the person running the server. That's the quiet counter-revolution: while the platforms enclose, the self-hosters retreat to their own infrastructure and rebuild the commons in miniature.

The hardware moved, and this is genuinely big news disguised as a niche story. The first open-source firmware for a modern AMD Ryzen AM5 platform was released — for the MSI B850 P-WIFI board. Let me say that again slowly: open source firmware for a current-generation AMD motherboard. For years, the firmware layer of your computer — the code that runs before the OS, the code that owns everything — has been a black box, proprietary, untouchable. Coreboot and its successors have been fighting for decades to open that layer, and this is a modern platform with open firmware. That's not a hobbyist curiosity. That's the foundation of actual ownership: if you can't see and control the firmware, you don't own your computer — you're renting it from the vendor and the vendor's supply chain. Keychron also released open source firmware for gaming mice, and Linux users stand to gain the most, because open firmware means the hardware works with your OS instead of requiring vendor software to even function. And GOG — the good old games store — is officially coming to Linux. The store that built its brand on "you own your games" is bringing its catalog to the platform where ownership is the default. That's not charity. That's the market finally admitting what the numbers have shown for years: Linux users buy games, and they buy them more when the store respects them.

And NetBSD 11.0 shipped with RISC-V support and enhanced Linux system call compatibility. NetBSD is the project that runs on everything from toasters to servers, and its new release quietly extends the reach of the free world to a new architecture. RISC-V is the open instruction set — the hardware commons — and every project that supports it is building the alternative to the locked-down chip world. The ecosystem is laying the tracks for a future where the silicon itself doesn't require permission.

Now step back and look at the shape of this week, because the shape is the analysis. On one side: malware exploiting the trust of a volunteer repository. AI output flooding the commons and demanding free review. A surveillance case weaponizing a privacy feature. A national foundation proposing to enclose public code. On the other side: sixty-eight kernel vulnerabilities fixed, shadow stacks enabled by default, reproducible builds, open firmware for modern boards, a store coming to Linux because ownership sells, a desktop environment built in Rust because memory safety matters, a museum-piece X server resurrected in a memory-safe language, self-hosted alternatives getting better every week. The builders built, and the extractors extracted. Same week, same ecosystem, two completely different relationships to the people who use the software.

That's not a coincidence, and it's not a vibe. It's structure. The open source commons is the only corner of the digital world where ordinary people still hold something approximating ownership — where the code is yours to read, the data is yours to host, the firmware is yours to inspect, the community is yours to join. And because it's not owned, no one profits from keeping it safe the way they profit from keeping a subscription service sticky. The malware authors exploit it because trust is free. The AI companies extract from it because the labor was donated. The state weaponizes its tools because privacy threatens control. And when the commons produces something valuable — a protocol, a standard, a foundation — the corporate world moves to enclose it, to own the governance, to hold the keys. That's the pattern under every headline this week. It's not that the good people are winning and the bad people are losing. It's that the commons is the target, because the commons is the only thing left that nobody can bill you for.

The shareholder-first model doesn't care about the commons — it can't. The incentive structure rewards extraction: take the free labor, sell it back, and charge for the cleanup. The volunteer maintainer who reviews your AI-generated pull request for free is doing work that a company would bill you eighty dollars an hour for, and the company gets the model trained on their code, and the cycle repeats. The border agent who treats a duress password as evidence destruction is enforcing the logic of a state that sees encrypted data as a threat by default. The foundation that wants to "rescue" open source from giving itself away is proposing the standard enclosure: public wealth, private governance. This isn't a few bad actors. The whole system is arranged so that the commons loses and the extractors win, and then the extractors sell you the solution to the problem they created.

So what do you actually do with a week like this? Let me give you concrete, practical moves, because the whole point of noticing the pattern is to act on it.

One: if you use Arch and you install from the AUR, learn to read a PKGBUILD. It's a text file. It's short. It's the build recipe for everything you install from the community repo, and it takes ten minutes to learn what each line does. The Atomic Arch attacks worked because people installed without looking. The single most effective security habit in the entire open source world is not a fancy tool — it's looking at what you're about to run before you run it. Check the source URLs, check the maintainer, check whether the package you're installing is a well-known project or an orphaned package that changed hands recently. If a package you've never heard of is suddenly "adopted" and updated aggressively, that's the exact shape of the attack. Free tools that flag this exist — use them, or just use the official repositories, which stayed clean through all three waves.

Two: if you use a smartphone, understand what a duress password is and why the Tunick case matters to you personally. A duress password is a panic feature — you give the agent a password, and what it unlocks is not your real data. The state's position, now endorsed by a federal indictment, is that using that feature is destroying evidence. That means your privacy decisions are now potentially criminal decisions, and you should make them with open eyes. Encrypt your phone. Use a strong passcode. Know that at the border, in the US, agents can and do demand access with no warrant. Decide in advance what you will and won't do under pressure, because the pressure is the point — they count on you not having a plan. And support the organizations and projects that push back on this: GrapheneOS, the EFF, the civil liberties groups that defend the right to encryption.

Three: be deliberate about what you run AI-generated code in. Debian, GCC, and GNOME are all drawing lines — that's the community saying review the output, label the output, don't let the output become unexamined infrastructure. You should do the same. If a project advertises that it was "built by AI in six months," that's not a selling point — that's a warning label telling you the code has had less human review. Treat AI-generated contributions the way you'd treat any code from an unknown contributor: review it, test it, and don't put it in your critical path until it's earned trust. The hype cycle will try to convince you that "written by AI" is the new "written in Rust." It is not. One is a quality signal. The other is a red flag wearing a quality signal's clothes.

Four: self-host something this month. Immich for photos, Ente for secure storage, Linkwarden for bookmarks, ownCloud for documents, RomM for retro games — every one of those projects got better this week, and every one of them puts your data back under your control. You don't need a server rack. A used mini PC or even a Raspberry Pi can run most of them. The point isn't the scale — it's the direction. Every piece of data you stop renting from a corporation is a small act of ownership, and ownership is the thing the extraction model can't stand.

Five: if you can spare a few dollars, give them to a builder. Krita, GNOME, KDE, NetBSD, System76's COSMIC, Servo, the firmware projects — these are the people who did the actual work this week. Sixty-eight vulnerabilities fixed. Shadow stacks enabled. Reproducible builds shipped. Open firmware released. None of that is funded by venture capital. It's funded by donations and the people who give them. A monthly donation to one project you actually use is worth more than any subscription you'll ever pay, because it buys you something the subscription never will: a tool that belongs to you and everyone else, that no one can take away or sell back to you.

Here's the closing thought. Your tools are under attack from every side this week: malware that exploits trust, AI that extracts and floods back, a state that treats your privacy as a crime, and foundations that want to own what you built together. But the same week, the builders shipped open firmware for modern hardware, a store decided to respect Linux users, a Rust X server crossed the finish line, and sixty-eight holes in the kernel got closed. The commons is under siege — but the siege only matters if the people inside the walls don't notice. The system is working exactly as designed. The question is who it's designed for — and whether the people who actually build and use the commons are willing to defend it like it's theirs. Because it is theirs. It's yours. And the only way the extractors win is if you forget that.