OpenBSD 8.0 and Tor Browser 16.0 Lead a Quiet Open-Source Release Week

Two open-source releases with very different jobs landed within 48 hours of each other this week. OpenBSD 8.0 shipped on 31 October, according to InfoQ. Tor Browser 16.0 followed on 2 November, per LWN. Neither is a consumer event. Both matter to the people who maintain the plumbing.

InfoQ's write-up lists the changes that matter most to operators. The AMD64 kernel's virtual address space grows from 4 GB to 512 GB. That lets OpenBSD map graphics cards with more than 4 GB of VRAM. The vmm/vmd stack now supports multiprocessor virtual machines, with up to 64 virtual CPUs per guest. RISC-V gains the V vector extension and the Advanced Interrupt Architecture. Arm64 machines get hibernation support, and swap encryption gets faster through AES instructions.

There is a hardware story buried in the release notes, too. OpenBSD 8.0 adds Intel Arc A-Series graphics support, built on the DG2/Alchemist architecture. NVIDIA cards remain unsupported. InfoQ attributes that partly to NVIDIA not shipping proprietary binary drivers for OpenBSD, unlike Linux and FreeBSD. Peripheral support expands to the SpacemiT K3 SoC and its PCIe controller, Intel E610, Panther Lake and Wildcat Lake Ethernet devices, and the Qualcomm WCN7850 wireless chip through the qwz driver. New drivers appear for Samsung's Advanced BIOS Interface and its laptop battery monitor.

What Tor Browser 16.0 changes

LWN reported on 2 November that Tor Browser 16.0 is the first stable version built on Firefox ESR 153. The release adds 64-bit Arm support on Linux, redesigned settings, and a "generic window titles" feature. That feature is meant to stop other applications from reading browser activity from window names. Android gets interface updates that follow Google's Material Design 3. The project also followed Firefox in dropping 32-bit x86 Linux, which LWN notes in the same post.

Those two items are the visible end of the week. Underneath, the kernel side has been unusually busy.

"Note, this is the LAST 7.2.y kernel release. After this one the 7.2.y kernel tree is end-of-life. Please move to 7.3.y at this time."

That is Greg Kroah-Hartman, quoted by LWN on 1 November in the announcement of Linux 7.2.15. He wrote that the branch went end-of-life sooner than normal. He cited the current release cycle and the number of pending cc: stable patches in the queue. Keeping eight branches alive at once, he said, would have been too taxing. The 7.2 series therefore closes with a handful of updates and a push toward 7.3.y.

Anyone tracking the open-source operating system release calendar gets a clear signal this week. Stable branches are being retired faster than the old rhythm implied. That also puts pressure on distributions that backport fixes, because the upstream tree they pull from is no longer maintained.

Security work keeps the week honest

OpenBSD's release notes, as summarised by InfoQ, keep the project's familiar claim in view: more than thirty years with only two remote holes in the default install. The 8.0 build bundles LibreSSL 4.4.0, with compatibility fixes for AIX, FreeBSD, macOS, MinGW, NetBSD and especially Windows, plus internal changes. OpenSSH 10.6 arrives with SSH compression using LZ77 disabled. It also rejects $ and \ characters in command-line usernames, a move against shell injection. The httpd daemon gains custom HTTP headers, header block and drop rules for request filtering, better default crypto methods for HTTPS, and cache control for static files.

The security news was not confined to OpenBSD. On 30 October, LWN reported on a remotely exploitable use-after-free bug in Linux multipath TCP. Anthropic first disclosed it on 27 October. A retransmitted SYN packet gets a response at the same moment the connection is established in another thread. The first thread then reads the connection's options structure after the second has freed it. The result can be kernel memory disclosure or a buffer overflow carrying an attacker-controlled payload. The fix delays the free until after an RCU grace period.

The Go security team weighed in on 29 October, according to the same LWN piece. All programs written in Go use multipath TCP by default. That means many systems may be exposed without their operators knowing. LWN's advice was blunt. Update to a patched kernel as soon as your distribution ships one.

Tooling moves around the edges

Two smaller items round out the release picture. Tom's Hardware reported on 1 November on an open-source UEFI tool, the nv-uefi-unlocker project. It boots from a FAT32 USB stick before the NVIDIA driver loads. It then removes the company's tensor limiter on RTX 20, 30 and 40-series desktop and laptop GPUs. It uses the community V67 payload with read-back verification, and the developer's own laptop RTX 4060 reached 65% higher FP16 math. The download contains only scripts and self-built binaries. One script fetches NVIDIA's public 610.43.03 driver packages, verifies them and rebuilds the firmware files locally. The project credits Zagitta's gpu-unlock as its porting source.

On the application side, InfoQ reported on 2 November that Google and Meta have open-sourced TorchTPU, a native PyTorch backend for Google TPUs. It replaces the older PyTorch/XLA path. Google says that path required intrusive source changes, suffered severe compile-time latency and lacked eager execution. Migration mostly means swapping the cuda device for tpu and the nccl backend for tpu_dist. Google says the DeferAndFuse hybrid mode can be 50% or more faster than Strict Eager while using less peak HBM memory. It tested roughly 5,000 Hugging Face models across 500+ architectures from TPU v5e onward. On a single TPUv7 chip, a 30-billion parameter Muse Glimmer model reached 25.7k token/s at 5,120 sequence length and 22.4k token/s at 10,240.

None of this is a launch event. It is the ordinary maintenance that keeps open systems usable, and this week it arrived in a cluster.

The wider open-source release queue is still moving. InfoQ's Spring roundup on 31 October covered first release candidates across Boot, Framework, Data, Security, Modulith and AI. ZDNET reported on 29 October that Mistral's Le Chonk now ranks as a top open model for coding, alongside Codex GPT-6.1 Terra. Interconnects' latest open artifacts roundup, published 20 October, covered DeepSeek V4.1 Flash 1017, American-made models and new regulatory controls in the US and China. CNEVPost reported on 26 October that BYD opened reservations for the second-generation Seal 07 with its Blade Battery and flash charging. That is a reminder that open-source thinking has spread well past the operating system.

The common thread is less glamorous than the headlines. Address spaces get bigger so GPUs can be mapped. Virtual machines get more CPUs. Old kernel branches die on schedule. A browser release closes a window-title leak. For the people running this software, that is the week.