Loading story…
Linux kernel maintainers are evaluating a new approach to authenticate developers and verify code provenance, aiming to reduce reliance on the current PGP-based web-of-trust process that requires in-person identity checks and manual key signing. The push is framed as a supply-chain hardening measure informed by past ecosystem compromises, including the 2011 kernel.org breach and the more recent xz backdoor attempt, and is positioned as a model that could be adopted by other open-source projects.
Separately, Google’s plan to expand developer identity verification to Android app sideloading distribution channels is facing organized opposition from dozens of technology and civil society groups. The policy would require identity checks and a one-time $25 registration fee for developers distributing apps for installation on certified Android devices outside Google Play, prompting concerns about increased gatekeeping, privacy/surveillance risk, barriers to entry for smaller developers, and potential antitrust implications; an unrelated ZDNET piece on PCLinuxOS focuses on distro popularity and usability rather than security controls or a specific security event.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Google plans to begin requiring developers to register apps for sideload installation on certified Android devices, including identity checks and a one-time $25 fee. The change would extend Google Play-style registration controls to alternative app distribution channels.
Linux kernel and Linux Foundation Decentralized Trust participants began exploring a new identity and code-authentication approach based on decentralized identifiers and verifiable credentials. The effort remained in prototype stage, with further discussion planned for Linux Plumbers and the Kernel Summit.
A coalition of 37 technology companies, nonprofits, and civil society groups published an open letter calling on Google to withdraw its planned Android developer registration requirement for sideloaded apps on certified devices. The group argued the policy would centralize control, create barriers for smaller developers, and raise privacy, competition, and antitrust concerns.
Google applied developer registration requirements, including identity checks and a one-time fee, to Google Play developers. The later sideloading policy was described as an extension of this requirement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has announced significant changes to the Android app ecosystem by introducing mandatory developer verification for all apps installed on certified Android devices. This new policy, set to take effect in 2026, requires that developers verify their identity with Google before their apps can be installed, even when sideloading outside the official Play Store. Google has emphasized that sideloading, a fundamental feature of Android allowing users to install apps from sources other than the Play Store, will not be eliminated. Instead, the company asserts that the new rules are designed to enhance user safety by ensuring that all apps, regardless of their source, are digitally signed by verified developers. The move is positioned as a security measure to protect users from malicious actors and to ensure that apps are genuinely from the developers they claim to be. However, the policy has sparked concern among privacy advocates and the open-source community, particularly the F-Droid project, a prominent third-party app store for free and open-source Android software. F-Droid warns that the new requirements could threaten its existence, as many open-source developers are unwilling or unable to provide personal identification to Google or pay associated registration fees. The project highlights that it cannot compel developers to register with Google, nor can it take over app identifiers without undermining the open-source ethos. F-Droid's board members have stated that the enforcement of this policy could effectively end the project and similar alternative app distribution platforms. Critics argue that while the policy is framed as a security enhancement, it may also serve to consolidate Google's control over the Android ecosystem and limit user choice. The new rules mirror Apple's longstanding approach to app developer verification, signaling a shift towards a more tightly regulated app environment on Android. Google maintains that the changes are not intended to restrict access to apps but to provide greater transparency and accountability for both users and developers. The company has reiterated that sideloading will remain possible, but only for apps from verified developers, aiming to strike a balance between openness and security. The debate continues as stakeholders assess the long-term implications for app diversity, user privacy, and the future of open-source software on Android devices. The policy's rollout and its impact on alternative app stores and the broader Android community will be closely watched in the coming years. Security professionals and CISOs should monitor these developments, as they may affect app deployment strategies, user device management, and compliance requirements for Android environments.
Jun 29, 2026
Google’s move toward **developer verification** for Android app distribution is drawing criticism from parts of the open-source and alternative app-store ecosystem, including an open letter from the **F-Droid** community and dozens of organizations warning the change could undermine Android’s historically open sideloading and third-party store model. Critics argue verification could make it harder to install apps outside Google-controlled channels—especially in constrained environments (e.g., unreliable connectivity)—and could push some independent developers toward *progressive web apps* or away from Android development entirely; they also note that fully opting out may increasingly require leaving Google-certified Android builds. In parallel, **Motorola** announced a long-term partnership with the **GrapheneOS Foundation** to strengthen smartphone security, citing GrapheneOS’s hardened Android-based architecture (e.g., stronger sandboxing and boundaries intended to reduce exploit impact). The GrapheneOS team publicly noted Motorola devices do not yet meet GrapheneOS hardware requirements and that work is ongoing, and Motorola has not disclosed which specific GrapheneOS features will be integrated; the companies described the effort as joint research and future software/security capability development rather than an immediate product rollout.
Jul 2, 2026
Google is preparing an Android change that adds an **“Accountability Layer”** to sideloaded (third‑party) apps, introducing a higher-friction installation flow intended to make users acknowledge the risks rather than banning sideloading outright. Google’s Matthew Forsythe said advanced users will still be able to proceed via an *Install without verifying* option, while Android’s developer verification requirements are being expanded, including a new account type aimed at students and hobbyists that can distribute apps with limited reach without completing full verification. The move aligns with continued growth in Android malware distributed via sideloaded APKs, which threat researchers report remains a primary infection vector despite protections like **Google Play Protect**. Kaspersky reported preliminary 2025 data showing Android threat detections rising by nearly half, with Q3 detections up **38%** versus Q2 and sharp growth in **trojan banker** activity; attackers commonly deliver malicious APKs through messaging apps (often using deceptive filenames like `party_pics.jpg.apk`) and then propagate further via victims’ contact lists, with search-engine spam and email lures also used to drive installs outside official app stores.
Jun 29, 2026