debian

Canonical and Oracle link shorter security-update intervals to AI-assisted bug discovery; Debian's four kernel advisories since September 29 list 3 to 1,313 CVE IDs, and one CVE reached Ubuntu 25 days after Debian's advisory (Herald counts).

Debian, Ubuntu and APT's developers published fixes on November 4 for CVE-2026-109518, which needs an attacker on the HTTP path and a non-zero Acquire::Retries setting.

Debian Developers began voting on eight rival LLM-usage proposals August 15, after a corrected ballot replaced the project secretary's first call for votes.

Debian has opened a General Resolution with four competing proposals on AI-assisted contributions, from an outright ban to conditional acceptance, with no vote date set yet.

The window Julian Andres Klode set for APT's hard Rust dependency has arrived, but no Rust code has landed in APT yet and alpha, hppa, m68k, and sh4 still lack toolchains.

Debian's release team has switched on a migration block for any package that fails to build reproducibly, with 98.29% of architecture-independent packages already passing.

An integer overflow in PgBouncer's SCRAM packet parser lets unauthenticated attackers crash the pooler, and three more flaws ship in the same release. Debian stable, testing, and pre-release archives are all still vulnerable.

Raspberry Pi OS 6.2 tightens security by requiring a password for sudo commands on new installations and replaces PulseAudio with PipeWire across the desktop stack.