Ubuntu

Canonical and Oracle link shorter security-update intervals to AI-assisted bug discovery; Debian's four kernel advisories since September 29 list 3 to 1,313 CVE IDs, and one CVE reached Ubuntu 25 days after Debian's advisory (Herald counts).

Ubuntu's documentation lists seven commands configured to use GNU Coreutils in 25.10, five in 26.04 LTS and none in 26.10; press and project sources show bugs surfacing through scripts, an audit and image builds.

Debian, Ubuntu and APT's developers published fixes on November 4 for CVE-2026-109518, which needs an attacker on the HTTP path and a non-zero Acquire::Retries setting.

Canonical releases Ubuntu 26.04 LTS on April 23, shipping Rust-based coreutils and sudo as defaults, GNOME 50 without X11, and a 6 GB RAM floor that redefines the distribution's baseline for the next decade.

Canonical has joined the Rust Foundation at the Gold membership tier, pledging $150,000 annually to support language governance and ecosystem security as Ubuntu 26.04 LTS prepares to ship with Rust-based coreutils and sudo by default.

Ubuntu 26.04 LTS enters beta on March 26, shipping Rust-based coreutils and sudo, GNOME 50 without X11, post-quantum SSH, and AMD ROCm in official repositories.

GNOME 50 completely removes X11 from Mutter, Shell, and GDM, making Wayland the sole display protocol. The release stabilizes VRR and fractional scaling, and will ship in Ubuntu 26.04 LTS and Fedora 44.