trixie

Debian 13.6 security update patches over a hundred advisories in trixie Most PCs still run with a UEFI Secure Boot certificate authority, installed by default since 2013, that has now expired. That certificate signed the bootloaders letting machines start with Secure Boot turned on. Its expiry sits at the center of the sixth update to Debian 13, codenamed “trixie.” The point release carries mostly security corrections along with a few fixes for serious problems. The Secure Boot problem gets handled through fwupd, updated to upstream version 2.0.20. The new build can update the Secure Boot certificate authority, the Key Exchange Key, and the revocation database on affected machines. Systems that skip these updates risk a specific failure. Future updates to “shim-signed” could leave them unable to boot with Secure Boot enabled. Debian advises users to apply the CA, KEK, and DBX updates supplied by their system OEM. The shim package received its own attention. It moved to a new upstream release built with the default compiler, and its SBAT revocation level was set to 2025021800. The signed shim binaries were rebuilt to keep Secure Boot working with the 2023 Microsoft UEFI certificate, and the installer now checks for likely boot problems before it proceeds. Licensing drove a second change. The “geoip-database” package reverted to a build dated around December 2019, because recent GeoLite versions conflict with the Debian Free Software Guidelines and cannot be shipped. Software reading the database may return stale network allocation data as a result. Debian encourages anyone depending on this data to obtain a GeoLite license directly. Web tooling saw heavy patching. The curl package alone took 13 fixes covering bearer token leaks on redirects, reuse of the wrong cached certificate authority, connection reuse across HTTP Negotiate and proxy sessions, reuse of plaintext STARTTLS connections, a use-after-free in its SMB code, and leaked credentials during redirects. rsync gained a limit on overly long HTTP proxy response lines. python-urllib3, nginx, and squid each received separate advisories from the Security Team. The apache2 web server received corrections for 13 tracked flaws. These covered use-after-free bugs, a cross-site scripting hole, several buffer overflows, denial-of-service conditions, out-of-bounds reads, and a file read issue. A further advisory, DSA-6323, covered additional apache2 work. Virtualization users have a large batch to apply. The qemu emulator moved to a new upstream stable release carrying 25 security fixes. The Python interpreter shipped as python3.13 gained fixes for CR/LF injection in proxy tunnel headers, denial-of-service conditions, a path traversal, and a server-side request forgery. Cryptographic libraries received targeted hardening. The libcrypt-pbkdf2-perl module changed its default hashing to HMAC-SHA256 and raised its default iteration count to 600,000, and it adopted constant-time comparison to close a timing attack. The nss library improved its handling of escape sequences during URI parsing. Separate advisories addressed openssl, gnutls28, libgcrypt20, and krb5. The Security Team released more than a hundred advisories folded into this revision. Chromium accounted for close to a dozen of them, reflecting the browser’s steady stream of upstream releases. The Linux kernel appeared across several advisories covering its amd64 and arm64 signed builds. Firefox ESR, Thunderbird, Samba, PostgreSQL, and BIND rounded out the roster of widely deployed software with named fixes. Several fixes targeted media and document handling, a common source of memory-safety bugs. giflib, libvncserver, graphite2, and rlottie all gained corrections for out-of-bounds access and memory corruption. The openslide library received a fix for a possible code execution flaw, and poppler corrected invalid signature creation. Upgrading an existing installation can be achieved by pointing the package management system at one of Debian’s many mirrors.

Proxmox releases Mail Gateway 9.1 with quarantine and backup encryption changes Proxmox Mail Gateway 9.1 adds updated system components, changes to the spam quarantine interface, and encryption for backups. It works as a mail proxy positioned between the firewall and internal mail servers, screening incoming and outgoing traffic for spam, viruses, Trojans, and phishing attempts. Updated system components Version 9.1 runs on Debian 13.5 Trixie and ships with Linux kernel 7.0 as the stable default. The release includes SpamAssassin 4.0.2 with continuously updated rulesets, ClamAV 1.4.4, PostgreSQL 17, and ZFS 2.4. These versions track the current major open-source security packages that the platform depends on. Quarantine interface changes Several updates apply to the web-based quarantine, where administrators and end users review filtered messages. Within shared mailboxes, users can now mark quarantined emails as “seen,” which keeps teams from auditing the same message twice. The status appears inline as a checkmark and can be switched on or off with an action button. The quarantine overview shows the positive and negative parts of an email’s spam score at the same time, giving administrators direct insight into the reasons a message crossed a filtering threshold. External images in quarantined messages can be set to load only on demand. A user who wants to view those images clicks a “Load Images” button in the quarantine view. This lets staff inspect message content and keeps external image requests from firing automatically, which protects privacy and reduces exposure to web-based threats. Administrators gain a “Copy Link” option on the admin dashboard. The option copies a recipient’s private quarantine access link, which an administrator can then pass along through any channel or build into a custom interface. Encryption for backups Version 9.1 adds native encryption for backups sent to a Proxmox Backup Server instance. The encryption covers email configuration settings, user-created rule system data, and historic and private statistics data. Proxmox Mail Gateway encrypts this material on the client side before it leaves the system, and it stays encrypted on the backup storage target. Availability and pricing Proxmox Mail Gateway 9.1 is open-source software and is available for download now. A complete ISO image carries the entire feature set and installs on bare-metal hardware through an installation wizard. Administrators can also place the software on an existing Debian system or run it as a Linux Container on Proxmox VE. Existing deployments on version 8.2 or 9.0 can move to 9.1 through a tested upgrade path in the APT package management system.

Debian 13.5 point release lands with security fixes, bug patches Debian 13.5 is the fifth point release for the stable distribution “trixie.” The update folds in roughly 100 Debian Security Advisories and corrections for more than 130 source packages, covering everything from the Linux kernel and Apache HTTP Server to OpenSSH, sudo, systemd, OpenSSL, glibc, and FreeRDP. Fresh installer images carrying the same fixes will follow at the regular download locations. Sysadmins running trixie do not need to reinstall. Existing media remain valid, and machines already pulling from security.debian.org will find that most of the patches in 13.5 are already on disk. The headline items include a new Apache upstream release that closes an authentication bypass and a use-after-free flaw, a privilege escalation fix in sudo, an nspawn container escape patch in systemd, multiple OpenSSH corrections affecting scp and key handling, and a sweeping FreeRDP3 update that resolves dozens of CVEs. One package, dav4tbsync, was withdrawn because Thunderbird 140 now covers its functionality. Wide range of package corrections The miscellaneous bugfix section covers more than a hundred source packages. Apache HTTP Server moves to a new upstream stable release that addresses a use-after-free flaw (CVE-2026-23918), a privilege escalation issue (CVE-2026-24072), an authentication bypass (CVE-2026-33006), HTTP response splitting (CVE-2026-33523), and several out-of-bounds read and NULL pointer dereference conditions. OpenSSH receives corrections covering scp behavior around setuid and setgid bits (CVE-2026-35385), a command execution flaw (CVE-2026-35386), incomplete enforcement of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms for ECDSA keys (CVE-2026-35387), connection multiplexing handling in proxy mode (CVE-2026-35388), and the authorized_keys “principals” option (CVE-2026-35414). Sudo gains a fix for a privilege escalation flaw (CVE-2026-35535). Systemd moves to a new upstream stable release and addresses an nspawn container escape (CVE-2026-40226), code execution issues (CVE-2026-40225 and CVE-2026-4105), and a freeze condition (CVE-2026-29111). The glibc package corrects DNS response handling errors tracked as CVE-2026-4437 and CVE-2026-4438, along with an assertion failure (CVE-2026-4046). FreeRDP3 sees one of the largest single-package updates, with corrections for dozens of CVEs spanning use-after-free conditions, buffer overflows, out-of-bounds reads, and denial of service flaws. The OpenSSL package also moves to a new upstream stable release. Other notable packages receiving security or stability fixes include curl, nginx, rsync, jq, jpeg-xl, libarchive, libcap2, sed, nano, exim4, dovecot, and python3.13. Security advisories rolled in The release incorporates roughly one hundred Debian Security Advisories. Among the packages covered are the Linux kernel, Chromium, Firefox ESR, Thunderbird, OpenSSL, OpenSSH, BIND 9, MediaWiki, GIMP, MuPDF, Pillow, Roundcube, Dovecot, Tor, OpenJDK 21, OpenJDK 25, Apache HTTP Server, Wireshark, LibreOffice, Prosody, strongSwan, and several PowerDNS components. Three separate kernel advisories appear in the list, reflecting ongoing Linux maintenance across the trixie cycle. Installer and infrastructure The Debian Installer was rebuilt to include the fixes pulled into stable through this point release, including a bump of the Linux ABI to 6.12.86+deb13. Supporting data packages received routine refreshes. The tzdata package picks up an updated time zone database with corrections for British Columbia, and distro-info-data adds an entry for Ubuntu 26.10 “Stonking Stingray.” The libdatetime-timezone-perl package was updated to match the new tzdata. Administrators can apply the changes by running their normal package management update against any Debian mirror.

Raspberry Pi OS 6.2 disables passwordless sudo by default Raspberry Pi OS 6.2, based on the Trixie version, introduces small changes, bug fixes, and disables passwordless sudo by default for new installations. Screenshot of password prompt (Source: Raspberry Pi) “We continually review the security of Raspberry Pi OS to ensure it is sufficiently robust to withstand potential attacks. This is always a balance, as anything that makes the operating system more secure can inconvenience legitimate users to some extent, so we try to keep such changes to a minimum. This particular security update is one that many users may not even notice, but it will affect some,” Simon Long, Senior Principal Software Engineer at Raspberry Pi, explained. Access control with sudo Administrator and regular user are the two types of user accounts in Linux systems. Administrators can write to restricted parts of the file system, while regular users may need to perform administrative tasks. The Linux sudo utility enables this without logging out and back in as an administrator. Short for “superuser do,” sudo is a command prefix that instructs the system to perform an action with administrator privileges. It is commonly used in the terminal. Since a regular user cannot write to the /usr/share directory, the command sudo cp file.txt /usr/share/ allows this. This has been configured with passwordless sudo enabled by default. It allows administrative actions from a regular user account without authentication, which creates a potential security risk for anyone with access to the device. Passwordless sudo disabled by default With the 6.2 release, passwordless sudo is disabled by default on new installations. Users are prompted to enter the current user’s password to gain administrative access. The prompt appears in the terminal when a sudo command is issued. Entering a valid password allows the action, while an incorrect password denies it. sudo access is also required for certain actions in the desktop interface. In those cases, a dialog box requests the password. Once entered, additional sudo actions can be performed for the next five minutes without another prompt. In Control Centre’s System tab, this option can be reverted to passwordless behavior by toggling off “Admin Password.” The system will then run sudo commands without requesting a password in both the terminal and desktop interface. Long noted that this change does not affect updates to existing installations of Raspberry Pi OS. Passwordless sudo remains enabled on those systems unless manually disabled.

Tails 7.6 ships automatic Tor bridge retrieval and a new password manager Tails 7.6 is out, and for users operating on networks that block Tor, the most consequential addition is built-in bridge retrieval. The Tor Connection assistant can now detect when a direct connection to Tor is restricted and automatically request bridges suited to the user’s region. The request goes through the Tor Project’s Moat API, and the connection to that API is disguised via domain fronting, making it appear as traffic to an ordinary website. Previously, users on censored networks had to obtain bridges manually and enter them by hand. The feature closes a long-standing gap in Tails’ censorship-circumvention capability. Users who prefer to take action themselves can also select the option to request region-specific bridges directly from the connection assistant screen. Password manager switches from KeePassXC to Secrets Tails 7.6 replaces KeePassXC with the GNOME Secrets password manager as the default credential storage tool. Secrets has a simpler interface and integrates more tightly with the GNOME desktop environment. Accessibility features that were broken under KeePassXC, including the on-screen keyboard and cursor size adjustments, work again with Secrets. Existing KeePassXC database files are compatible with Secrets’ format, so stored credentials carry over without any conversion step. Users who depend on features specific to KeePassXC can still install it manually. Component upgrades and Qt5 removal The kernel moves to Linux 6.12.74. Tor Browser advances to 15.0.8, built on Firefox ESR 140.9. Thunderbird reaches 140.8.0esr. Electrum moves to 4.7.0, and that upgrade is tied directly to the removal of Qt5 from the distribution. The changelog confirms that Qt5 support packages have been stripped out entirely, and tests now verify that no Qt5 package ships with the build. The base distribution advances to Debian 13.4 (Trixie). Firmware packages also receive an update: firmware-nonfree moves to version 20260110-1, improving hardware support for graphics cards and wireless adapters on newer machines. The forge.js library, used in Tails’ web-facing components, upgrades to v1.3.3. The update includes a step to make it harder for external CDNs to target the project, and it brings the project’s license documentation into compliance with BSD 3-clause terms. Bug fixes targeting localization and upgrade reliability Three user-facing bugs are resolved in this release. Automated upgrades failed for users running Tails with the language set to Turkish; that problem is fixed. A broken link in the Thunderbird migration notification, the “Learn More” button that was supposed to point users to documentation, is restored. The confirmation dialog displayed when saving a language and keyboard layout to the USB stick in unencrypted form was not honoring available translations; it now renders in the user’s selected language. Upgrading Automatic upgrades are available for any installation running Tails 7.0 or later. The upgrade preserves data stored in Persistent Storage. Users whose automatic upgrade fails, or whose system does not start after an update, can follow the manual upgrade path available on the Tails documentation site.

Debian 13.3 is now available with targeted corrections, updates Debian 13.3 is the third maintenance update for the stable Debian 13 distribution, codenamed “trixie”. It updates package content to address security and other issues reported since the last point update. This release includes more than 100 adjustments and multiple security patches across a range of packages. It includes updates for core services and applications such as Apache HTTP Server, GNOME components, and container tools. Existing systems running Debian 13 can install the 13.3 update through the standard package management system. Users should point their system’s package sources to an up-to-date Debian mirror and install available upgrades. The Debian Project notes that systems that regularly apply updates from the security repository will already include most of the fixes in this point release. Read more: Debian seeks volunteers to rebuild its data protection team

Proxmox Mail Gateway: Open-source email security solution reaches version 9.0 First released in 2005, the open-source Proxmox Mail Gateway has become a widely adopted mail proxy, positioned between the firewall and the internal mail server to stop threats before they reach users. The platform delivers anti-spam and antivirus filtering to help organizations counter email-borne risks such as malware, Trojans, and phishing campaigns. What’s new in Proxmox Mail Gateway 9.0 Debian 13 “Trixie” at the core The latest release of Proxmox Mail Gateway is built on Debian 13 “Trixie,” which brings updated packages, stronger hardware support, and better security. Version 9.0 also introduces Linux kernel 6.14 as the stable default, giving organizations improved compatibility and performance out of the box. On top of that, the platform now includes the latest versions of ClamAV (1.4.3) and SpamAssassin (4.0.2). A redesigned quarantine interface for mobile Managing quarantined messages is now easier on smartphones and tablets. The interface has been rebuilt with the Rust-based Yew framework, offering a faster, and more user-friendly experience than before. More flexible authentication and SSO Authentication and SSO features have taken a big step forward in this release. OpenID Connect realms are now fully configurable through the graphical user interface, with support for claim mappings and default role assignments for auto-provisioned users. This makes it easier to integrate with popular identity and access management platforms. Security enhancements and smarter filtering Proxmox Mail Gateway 9.0 also tightens defenses with several hardening measures. The Content-Type filtering engine has been updated to handle new MIME type definitions for Microsoft executables, helping ensure that high-risk files continue to be reliably blocked before they reach end users. Availability Proxmox Mail Gateway 9.0 is available for download here. The ISO image contains the complete feature-set and can be installed on bare-metal using the installation wizard. Upgrades from version 8.2 to 9.0 are supported and a detailed migration guide is available. It is also possible to install the solution on top of Debian or as a container appliance inside Proxmox VE. Must read: 35 open-source security tools to power your red team, SOC, and cloud security GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token salesAI gateways look promising as companies struggle with model orchestration ai and ml Anthropic says text watermarking scheme relies on inconsequential words'Shall I compare thee to a summer's afternoon' is the sort of thing this will make, and others look likely to adopt it AI and ML DeepSeek's innovative harness treats everything as a plug-inChinese AI labs keep moving forward while US labs play defense SECURITY Autonomous AI attacks pose 'clear and present danger' to critical infrastructureWeaponized agents could turn digital intrusions into kinetic disasters, experts warn off-prem Rent-a-GPU outfit Nebius promises rapid 1 GW powerup plan isn't nebulousAnd it'll jump through every financial hoop it can to get there Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

Open-source server management platform Proxmox VE 9.0 released Proxmox Virtual Environment (VE) 9.0 introduces advancements in both storage and networking capabilities, addressing critical enterprise demands. A highlight is the long-awaited support for snapshots on thick-provisioned LVM shared storage, improving storage management capabilities especially for enterprise users with Fibre Channel (FC) or iSCSI SAN environments. With newly added “fabric” support for Software-Defined Networking (SDN), administrators can construct highly complex and scalable network architectures. Highlights in Proxmox Virtual Environment 9.0 Debian 13 “Trixie” at the core This core update is based on Debian 13 “Trixie”, bringing the latest Debian release as foundation for Proxmox VE including newer packages, improved hardware support, and enhanced security. Proxmox VE is using a newer Linux kernel 6.14.8-2 as stable default enhancing hardware compatibility and performance. Also, updates to the latest versions of leading open-source technologies for virtual environments like QEMU 10.0.2, LXC 6.0.4, Ceph Squid 19.2.3, and ZFS 2.3.3 are included. ZFS now supports adding new devices to existing RAIDZ pools with minimal downtime. For existing users of Proxmox VE 8.4 or older versions, an extensively tested and detailed upgrade path is available. Snapshots for thick-provisioned LVM shared storage VMs utilizing thick-provisioned LVM shared storages, such as those backed by iSCSI or FC-based SANs, now benefit from snapshot functionality out of the box. This is achieved by implementing snapshots as volume chains, where a volume based on a snapshot only records differences to its parent snapshot volume. Directory, NFS, and CIFS storages also gain additional support for snapshots as volume chains. This new feature provides a powerful and highly requested capability for customers with traditional SAN infrastructure who have historically relied on clustered file systems. While direct integrations from many storage vendors continue to grow, this new feature closes the gap by providing a storage-independent solution for snapshots. New Fabrics feature for the SDN stack This release enhances the SDN capabilities with the introduction of an SDN Fabrics feature, designed to simplify the configuration and management of complex routed networks. Engineered for reliability, SDN Fabrics facilitates multiple paths between nodes and automatic failover across Network Interface Cards (NICs), enabling the configuration of robust two-layer spine-leaf architectures for improved network redundancy and performance. This new feature simplifies the management of dynamically routed networks which can for example be used as Ethernet VPN (EVPN) underlay or full-mesh networks for Ceph. The SDN stack in Proxmox VE gains support for two different routing protocols, OpenFabric and OSPF, and provides intuitive tools for the simplified configuration and precise management of those dynamic routing protocols. Affinity rules in High Availability (HA) clusters The Proxmox team introduces HA resource affinity rules to enable fine-grained control and flexibility over resource placement in HA clusters, ensuring optimal performance, enhanced resiliency, and minimized latency for critical workloads. To better control complex, interconnected applications, the new HA Resource Affinity Rules allow administrators to precisely define how virtual machines and other HA resources are distributed across a cluster. Interdependent HA resources, such as for example an application server and its associated database, can be kept together on the same physical node to minimize network latency. For services requiring maximum redundancy, like multiple VMs running the same mission-critical application, the rules can ensure these instances are kept on different nodes. This increases fault tolerance and ensures resiliency even during HA failovers. Enhanced mobile interface The Proxmox VE mobile interface has been thoroughly reworked, using the new Proxmox widget toolkit powered by the Rust-based Yew framework. The redesigned interface provides quick access to service overviews and includes essential management functions, including starting and stopping virtual guests and basic configuration. It is now easier than ever for users to access fundamental functionalities of Proxmox VE directly from their mobile browsers. Download Proxmox VE 9.0 is available for download. The ISO contains the complete feature-set and can be installed on bare-metal. The virtualization platform from Proxmox comes stocked with all the essential management tools, as well as an easy-to-use, web-based user interface. This allows for simple, out-of-the-box management of the host, either through the command line or a standard web browser. Seamless upgrade instructions from Proxmox VE 8 to 9 are available. It’s also possible to install Proxmox VE 9.0 on top of Debian.