The "Akrites" vulnerability-mitigation project launches [LWN.net]

The Linux Foundation, in a letter co-signed by a large range of organizations and companies, has announced the launch of "Akrites", a project to fast-track vulnerability fixes into projects.

As Akrites works upstream to fix projects at the source, we commit to support downstream efforts to secure critical infrastructure before it can be exploited. When patches are released to the public, adversaries are able to utilize AI to rapidly reverse engineer the underlying vulnerabilities, develop exploits, and launch attacks. The success of our efforts therefore will be measured in patch deployment, not publication. We will partner with critical infrastructure owners and operators, civil society efforts, and governments as they increase coordination to achieve these goals.
Confidentiality is non-negotiable: An undisclosed flaw in a widely deployed package is, in effect, a weapon, and the program is built first to prevent leaks. Fixes flow back into each project's own home, working with the maintainers. The engineering resources and other capabilities provided by Akrites participants contribute to this effort. Additionally, when a critical package has no one maintaining it, Akrites will stand as the maintainer of last resort so a fix can still reach everyone in a timely fashion. We will also align with government efforts so that public and private defenders move together, rather than in a disjointed fashion.

to post comments

Does Coordinate Vulnerability Disclosure make sense here?

Posted Jun 26, 2026 13:35 UTC (Fri) by ebiederm (subscriber, #35028) [Link] (5 responses)

With the vulnerabilities being found by AI, a persuasive argument has already been made that they are effectively public.

Does Coordinate Vulnerability Disclosure make sense here?

Posted Jun 26, 2026 14:19 UTC (Fri) by bluca (subscriber, #118303) [Link]

Access to an LLM is not enough, it requires actual expertise to get them to find _real_ issues, rather than just opportunities for hardening. The rest is hype

Does Coordinate Vulnerability Disclosure make sense here?

Posted Jun 26, 2026 14:31 UTC (Fri) by Paf (subscriber, #91811) [Link] (3 responses)

It also requires someone be looking in that specific spot/at that package, so many things will not be found repeatedly. At least, not right away.

Does Coordinate Vulnerability Disclosure make sense here?

Posted Jun 26, 2026 15:02 UTC (Fri) by ebiederm (subscriber, #35028) [Link] (2 responses)

Deduplication is explicitly called out as one of their efforts.

Duplicate bug reports is part of what people have been complaining about.

From a study I saw someone was able to reproduce about 40% of the bugs the top tier model Mythos had found, just by asking other models the equivalent of find me the bug in this file.

So unless everyone who has the resources to use these models to seriously hunt for bugs is in the consortium, it seems unreasonable to expect someone else will not find many of the bugs.

But perhaps this new effort will have enough of the people looking that it won't be a complete waste of time to coordinate disclosure.

If it works it will mean that bugs are patched before they are exploited. Which is good for people using the software. Recent history strongly suggests that can't be counted on.

Does Coordinate Vulnerability Disclosure make sense here?

Posted Jun 28, 2026 9:47 UTC (Sun) by wtarreau (subscriber, #51152) [Link] (1 responses)

I completely agree. It's just a dream to imagine that by asking not to disclose, issues won't be found in parallel. On the kernel I think that we've seen up to 8 independent reports for the same unfixed issue within a few days. Coordinating disclosure will just keep victims exposed longer to bugs, it's always the same story, there is bureaucracy on one side where it's impossible to push a fix quickly, and there are attackers exploiting vulnerabilities on the other side, and whose business is to play with unfixed issues. The longer the delay between the discovery by the *attacker* and the fix being deployed, the higher the exposure. Anything that contributes to delaying deployment (which CRD is) is just extending exposure and making more users vulnerable.

Does Coordinate Vulnerability Disclosure make sense here?

Posted Jun 28, 2026 17:29 UTC (Sun) by deepfire (guest, #26138) [Link]

Thank you, for making sense!

Interesting to see the Linux Foundation go against Linux kernel policy

Posted Jun 26, 2026 18:38 UTC (Fri) by hailfinger (subscriber, #76962) [Link] (1 responses)

> Confidentiality is non-negotiable: An undisclosed flaw in a widely deployed package is, in effect, a weapon, and the program is built first to prevent leaks.

OTOH, the Linux kernel considers all AI-found vulnerabilities to be already public.

Even more interesting is how the forced confidentiality interacts with the reporting obligations under the EU Cyber Resilience Act.

Interesting to see the Linux Foundation go against Linux kernel policy

Posted Jun 27, 2026 5:06 UTC (Sat) by kleptog (subscriber, #1183) [Link]

The requirement to report issues to regulators per the CRA does not mean those reports are public. The CRA is not about public disclosure at all. It's so regulators have insight into the cybersecurity landscape and can help with coordination if necessary. And other regulatory goals.

So there is no incompatibility with coordinated disclosure.

(There are unresolved issues w.r.t. the CRA mandatory reporting requirements, but this isn't one of them.)

so much text

Posted Jun 29, 2026 8:23 UTC (Mon) by bagder (guest, #38414) [Link]

As an "upstream" representative I tried to read some of their announcements to figure out exactly how they would go about and actually help us but I only find several walls of corporate mumbo jumbo so I remain clueless. I don't understand how this will help us at all. They have not talked to us. I don't have a high trust that they will. I remain a skeptic.

/ Daniel, curl maintainer