Arch Linux

1. Update to php ≥ 8.5.12 and/or php-legacy ≥ 8.3.36 to prevent remote code execution

   PHP versions prior to 8.5.12 and 8.3.36 are affected by CVE-2026-109618 and CVE-2026-109619, which allow for remote code execution.

   For any system publicly exposing a PHP application with the help of a prior version of PHP, we urge users to upgrade those systems to the latest available version of PHP (php ≥ 8.5.12 and php-legacy ≥ 8.3.36) immediately.

   Edit: For further details and instructions, please refer to the Arch Linux Security Advisories ASA-202610-1 and ASA-202610-2.

2. Update to ca-certificates-mozilla ≥ 3.131.1-1 to prevent man-in-the-middle attacks

   On 2026-10-20 it was revealed, that several certificates of the eMudhra intermediate Certificate Authority have been compromised.

   The compromised certificates have been removed/invalidated with ca-certificates-mozilla ≥ 3.131.1-1.

   Without an update to this central certificate bundle, systems are susceptible to man-in-the-middle attacks. As such, we urge everyone to upgrade their systems immediately.

3. Mkinitcpio >=42 requires manual intervention for TPM2-based unlocking of LUKS devices

   Starting with package version 42-1, the mkinitcpio systemd hook now includes systemd-pcrosseparator.service (as intended by systemd v261).

   This affects the measurements of PCR values 0-7, 9 and 12-14. If you configured the systemd hook and unlock LUKS partitions, that depend on these values, you need to re-enroll the TPM2 in use.

   For guidance, please refer to systemd-cryptenroll(1), or the ArchWiki article on systemd-cryptenroll, when using pinned values. Refer to systemd-pcrlock(8), when relying on custom policies and a disabled systemd-pcrlock-make-policy.service.

4. virtualbox-ext-vnc >= 7.2.12-2 requires manual intervention

   Previously, we installed its contents in a way that made pacman not aware of the files (using VBoxManage extpack install... from an install script). To mitigate issues during upgrade, you can use one of the following methods:

   • Uninstall virtualbox-ext-vnc before upgrading the system, then installing it again.
   • Run VBoxManage extpack uninstall 'VNC' as root before upgrading the system.
   • Instruct pacman once to overwrite the existing files:

   pacman -Syu --overwrite '/usr/lib/virtualbox/ExtensionPacks/VNC/*'

5. Active AUR malicious packages incident

   We are currently experiencing a high volume of malicious package adoptions and updates in the Arch User Repository.

   We are actively working to track down existing malicious commits and attempting to prevent additional malicious commits from being pushed. While this is happening, and while we work to create a more permanent solution, users may see issues with the following:

   • Creating new accounts on the AUR
   • Pushing package updates
   • Adopting or creating new packages

   We continue to encourage all users of AUR packages to review all PKGBUILD and install script changes when updating, especially during this time. If you notice suspicious commits to a package that you use, please reach out to Arch staff via the aur-general mailing list with more information.