Update your system

A good distribution always moves, and never stops moving forward.

This week in security updates: two major issues

Well, there's more, but let's do the headlines for a second here:

The Linux kernel PwnEscape vulnerability was published as CVE-2026-99999, which could allow attackers to forcibly expose host memory and potentially execute arbitrary code from within a virtualized environment by crafting specific network packets.

Affected: Anyone executing untrusted code in any VM using a specific networking stack to do IPv4 packet processing.

This is a significant risk. For this reason the kernel community did a fix release across all active kernel.org branches before disclosing the CVE. At the time that the CVE was disclosed, The Ur Project had already built the fixed kernel and released it to our repositories.

If you run Sandcastle, update now, and reboot so the fixed kernel takes over:

$ sudo pkg upgrade
$ sudo systemctl reboot

See Basic system maintenance for more on updates and reboots.

eMudhra CA certificate keys compromised

A TLS certificate authority had 8 of its root keys compromised. Attackers will be able to use these to forge https:// domains and trick any browser into accepting these domain certificates as if they're real.

Affected: Anyone using a browser or download tool that uses TLS to verify and encrypt data for transit. That's a big surface. An attacker could impersonate any domain those CAs were allowed to issue certificates for.

NSS and ca-certs are updated. Browser picks this up automatically. I checked by doing a regular update and restarting it. The trust store is rebuilt by ca-trust(8) after pkg upgrade automatically, and the browser no longer lists the faulty authority CA as trusted.

But this is just the tip of the iceberg

Most issues don't get as much attention as these two events happened to get. You most likely wouldn't know about them at all, unless you follow certain security-minded news feeds or other sources that could inform you of them. This is really a big problem for any Linux distro. None of them can afford to be slow or lax here. How fast you can push out updates is a measure of how secure the OS is. Maybe this is better phrased as "risk reduction". Security is essentially nothing more than risk management.

In the age of AI, it's entirely feasible for hostile actors to continuously scan and try to exploit new vulnerabilities. The one defense we have is spotting vulnerabilities early, and shipping the updates fast.

And if you find one before we do, please tell us.

Dispatch does just that

Dispatch, our build system, monitors upstream sources for releases, and immediately stages a version bump. NSS and ca-certs were submitted to common-bumps at 2026-10-20T15:06:26Z by the upstream-watcher process. That was 8am for me local time. I merged the updates for both at 2026-10-20T18:25:27Z, a little over 3 hours later, about 11:30am local time for me. The sync to the repo server was done about 8-10 minutes later.

The effort for me to review the change: about 10 seconds to let my mind absorb the fact that it was a plain version number increment, nothing more. This is the way: let automated testing validate that images still work properly and nothing breaks, and don't get in the way of automatic updates.

Your role

is to update your system. Don't stop updating it. It's vital in many ways. I'm not saying that you should be paranoid about this, but if you're one of those people who don't manage their own risk, you'll run into problems at some later point. Keeping up to date is not that difficult.

It does remind me that The Ur Project still needs an actual automatic update mechanism. For now, everyone who installs Sandcastle must manually do the updates with sudo pkg upgrade regularly. I'll start building this out soon to do update scanning and risk management so people can be informed of risk. A big kernel update might get you to reboot for updates. Small library updates might just fly on a live system. You should have the choice, but you also have to be able to find out about them.

Part of that is already there: pkg check-update tells you whether there's anything to upgrade, and changes nothing while doing so. It's cheap enough to run on a timer.

--sofar (aka Auke)