Stories from Arch Linux's official feed, newest first. Every one links to the original.
3 stories
Oct 212026
PHP versions prior to 8.5.12 and 8.3.36 are affected by CVE-2026-109618 and CVE-2026-109619, which allow for remote code execution. For any system publicly exposing a PHP application with the help of a prior version of…
On 2026-10-20 it was revealed, that several certificates of the eMudhra intermediate Certificate Authority have been compromised. The compromised certificates have been removed/invalidated with ca-certificates-mozilla…
Sep 222026
Starting with package version 42-1, the mkinitcpio systemd hook now includes systemd-pcrosseparator.service (as intended by systemd v261). This affects the measurements of PCR values 0-7, 9 and 12-14.