Loading story…
Fedora has retired all Deepin Desktop Environment (DDE) packages from its official repositories after concluding that long-running security concerns and poor maintainer engagement were not resolved. Fedora said the packages had been in poor condition for an extended period and that efforts to re-establish effective maintenance failed, even after maintainers were given a final four-week window to respond. The distribution said Deepin could return only after undergoing a fresh security review.
The move follows SUSE/openSUSE dropping Deepin packages over similar concerns, including an alleged packaging policy violation that bypassed normal RPM security review requirements to install restricted assets. Scrutiny of Deepin has persisted since a 2018 controversy in which the Deepin Store sent unencrypted requests to CNZZ containing browser-agent and other user information; although that telemetry issue was reportedly fixed and later reviews found no active spyware in Deepin's core, trust in the project continued to erode. Deepin packages are now absent from the official Fedora and SUSE repositories pending stronger review and remediation.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Fedora decided to retire all Deepin packages after its own review found poor package condition, unresolved security concerns, and failed attempts to re-establish effective maintainer engagement. Fedora said Deepin could return only after passing a fresh security review.
Before retiring the packages, Fedora gave Deepin maintainers a final four-week period to engage and improve the security and maintenance situation. Fedora later concluded that key maintainers did not adequately respond.
Matthias Gerstner reported that dde-file-manager-daemon exposed dangerous privileged functionality over D-Bus without proper polkit protection, allowing any user to potentially hijack the service and access sensitive data including cleartext Samba passwords. The audit also found insecure world-readable logging and multiple unsafe methods affecting user, group, Samba, tagging, and filesystem operations, concluding the package was not acceptable for openSUSE in its current form.
In May 2025, SUSE removed Deepin packages from openSUSE after identifying a packaging policy violation that bypassed normal RPM security review requirements to install restricted assets. The decision was tied to broader security concerns around Deepin packaging practices.
In 2018, Deepin faced scrutiny after the Deepin Store was found sending unencrypted requests to CNZZ that included browser agent and other user information. Deepin reportedly later addressed the telemetry issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcezdnet.com
Open sourcexda-developers.com
Open sourcebugzilla.suse.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Debian has released **Debian 13.6** as a point update focused on security and maintenance, alongside **Debian 12.15** for the previous stable branch. Debian 13.6 bundles roughly **120 security updates** and more than **120 bug fixes**, with patches affecting the Linux kernel and widely deployed packages including **Nginx, Redis, FFmpeg, Thunderbird, Chromium, PHP, Postfix, Samba, wireless-regdb,** and **Wireshark**. The update is intended to bring existing installations current rather than introduce a new major version. A notable change in Debian 13.6 is an updated **`shim-signed`** and **`fwupd 2.0.20`** stack to support newer Microsoft UEFI Secure Boot certificate chains and updates to Secure Boot **CA, KEK, and DBX** databases after expiration issues with the default UEFI Secure Boot CA used on many PCs. Debian also reverted or removed the legacy **`geoip-database`** package because newer GeoLite data was found incompatible with Debian Free Software Guidelines and the older dataset had become outdated, pushing migration toward maintained alternatives such as **GeoLite2**.
Jul 13, 2026
Fedora maintainers and Red Hat engineer Adam Williamson raised concerns that contributor Nathan Giovannini used suspected AI-generated bug reports and package submissions as part of a broader pattern of inauthentic activity. The allegations drew added scrutiny because they echoed ecosystem fears after the `xz` backdoor case: maintainers said multiple GitHub accounts appeared linked to the same person, profile and contact details were reused, and several reports and code changes showed signs of low-quality or machine-generated content intended to build trust inside the project. Fedora reviewed bug reports and package changes tied to the contributor, closing some issues as **NOTABUG** and examining modifications affecting projects including **Anaconda**, **osc**, **lxqt-policykit**, **gwenview**, and **easyeffects**. At least one Anaconda change was merged into version `45.5` and later reverted in `45.6`, while Fedora maintainers said access was disabled or removed after the concerns surfaced, though they also noted that not every allegation had been definitively proven.
Jun 29, 2026
Fedora warned that older Microsoft-signed `Shim` bootloaders used to start Linux under UEFI Secure Boot can remain trusted long after fixes are available, allowing vulnerable components to load unless their signatures are added to the UEFI `DBX` revocation list. The warning highlights legacy `Shim 0.9` builds from 2016 and ties the risk to **CVE-2026-8863** and **CVE-2026-10797**, which could let attackers bypass Secure Boot protections on systems still relying on outdated binaries. Fedora said an updated Shim with additional protections is already present in Rawhide for Fedora 45, while Microsoft is expected to enforce broader revocations through the UEFI `DBX`. Users were urged to verify whether Secure Boot systems still depend on old Microsoft-signed Shim binaries and to update affected components, with older platforms such as **RHEL 7.2**, **CentOS 7.2**, **Oracle Linux 7.2**, **ROSA Linux R10/R9**, and some **openSUSE** installations identified as potentially exposed.
Jun 29, 2026