This week in EmbeddedOS — 2026-10-08
Zephyr Developer Summit day 2 digs into functional safety and CRA readiness, the org lands a ~45-issue audit-fix merge wave, four new boards join the platform roster, ESP-IDF v6.1 brings ESP32-P4 Wi-Fi back — and two MCP CVEs turn protocol warnings into patch notes.
Zephyr Developer Summit, Day 2 (Prague)
Day 2 centered on functional safety and CRA readiness — the two tracks the eos-aero safety work exists for. The assessor's view of evidence formats is the takeaway: a hazard log should show the reasoning that closed each hazard, not just the list of what could go wrong. CRA's 24h/72h/14d reporting duties (live since September 11) framed the embedded sessions; aerospace products are in scope.
The merge wave
Roughly 45 audit findings landed across the org in two waves — Kartikey's fix PRs merged on eBoot, ebuild, eAI, eNI, EoSim, eDB, eApps, eBrowser, eos-health, www, and .github, closing the issues with them. The loop reviewed the open remainder (ebuild#179, eosllm#18) and is building on post-merge master everywhere.
Four new boards
DEBIX M8391-01 (MediaTek Genio 720, 9-TOPS NPU850, industrial temperature range) for mid-tier NPU vision; Arduino VENTUNO Q (Qualcomm Dragonwing IQ-8275 plus STM32H5F5 — the dual-brain pattern in hardware, with ROS 2); NXP FRDM-IMXRT1186 (dual GbE TSN plus EtherCAT-capable Ethernet, the deterministic-comms reference); and the Upbeat Bluemag Pi (SiFive E3+E2 RISC-V flight controller with onboard AI, demoing at CEATEC next week). All four have EoSim platform definitions as of today.
ESP-IDF v6.1: P4 Wi-Fi lives, ECDSA-SBv2 dies
Espressif's v6.1 release unblocks ESP32-P4 Wi-Fi (the blocker since July is closed) and fixes the LP-SPI MISO bug — but it disables ECDSA Secure Boot V2 on the H2, C5, and P4 for a security vulnerability in the ECDSA secure-boot flow, details pending in the chip errata. eBoot's threat model and eFirmware's bring-up baseline both carry the watch item: do not provision new devices against that flow.
MCP security: from warnings to CVEs
Two disclosures this week convert the MCP protocol warnings into patch-level evidence: CVE-2026-105697 (CVSS 9.9) — Langflow's MCP server config executed user-typed commands via bash with no allowlist — and CVE-2026-104120 (SSRF in mcp-server-fetch). The org's answer is the hostile-protocol posture now documented across eSec, eIPC, eosllm, and eVera: tool-registration command allowlists, pinned versions, credential isolation, and no intra-network trust.
About these articles
How these articles are published
Every article on this site renders through this one page, from the Foundation's shared content registry. The title, date, badge, tags, and body all come from the same data the News page lists — which is why the two can never disagree about what an article says or when it appeared.
The registry replaced eight separate article pages whose metadata had drifted apart: seven of them showed a different publication date than the news listing. One source of truth is less interesting than eight bespoke pages, and considerably more honest.
What an article is
Articles are the long form: explanations of how something works, technical writing about the stack, and reflections on the work. News carries the timely announcement; the article carries the full treatment — the reasoning, the context, and the detail that would not fit in a listing.
Each article states its assumptions and links its evidence where evidence exists. The source material behind the technical claims — the code, the measurements, the filings — is public in the Foundation's repositories.
Dates and addresses
The date on an article is its publication date. The address is /article/ followed by the article's slug, and the older /article-xxx addresses from the previous site still resolve to the same pages — nothing already linked or indexed breaks.
If an article is corrected after publication, the correction is noted rather than silently made — the same standard our press releases are held to. The page you are reading is the current version, and the record of what changed stays with it.