Loading story…
Germany’s Sovereign Tech Fund will invest €508,640 in Flatpak over two years, funding security and platform-development work through the end of 2027. The initiative prioritizes stronger application sandboxing and expanded XDG portals, which broker sandboxed applications’ access to devices, system services, and other privileged resources without granting broad permissions.
Planned development includes PipeWire-based audio portals, improved network isolation, and a VPN portal modeled on Android and iOS APIs. Flatpak will also pursue portals for spell-checking, writing assistance, browser NativeMessaging, and other service or device interactions, while exploring password autofill, static-permission entitlements, service-declaration intents, and libdex support for asynchronous application-service integrations.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Germany's Sovereign Tech Agency, through its Sovereign Tech Fund, awarded Flatpak approximately €508,000–€508,640 to support two years of security and platform-development work through the end of 2027. The funded work targets stronger application sandboxing and expanded narrowly scoped XDG portals, including VPN, audio/PipeWire, NativeMessaging, and other system-service integrations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
opennet.ru
Open sourcephoronix.com
Open sourcemodal.cx
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Flatpak released **1.16.4** to fix four security issues affecting earlier versions, led by **`CVE-2026-34078`**, a critical flaw in the `flatpak-portal` D-Bus service that can let a malicious sandboxed app escape confinement, access arbitrary host files, and potentially execute code in the host context. The bug stems from acceptance of app-controlled symlinked `sandbox-expose` paths that are resolved and mounted from the host into the sandbox. Flatpak also patched **`CVE-2026-34079`**, which allows arbitrary file deletion on the host through improper validation during `ld.so` cache cleanup, along with a low-severity arbitrary file-read issue in the `flatpak-system-helper` context when a system OCI repository is configured and a cross-user `CancelPull` flaw. The fixes were issued in **Flatpak 1.16.4** and the development branch **1.17.4**, with later **1.16.5** and **1.17.5** releases addressing regressions introduced by the critical patch; the fixes are also slated for **1.18.0**. Multiple Linux distributions, including Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch, and Fedora, were reported as affected or tracking updates, and Debian published a security advisory for Flatpak. Flatpak and downstream advisories urged administrators to upgrade promptly, while temporary mitigation for the sandbox-escape issue included disabling or masking the Flatpak Portal, with the warning that some applications may stop working correctly.
Jun 29, 2026
Flatpak released **1.18.4**, with the same fixes in development version **1.19.2**, to address high-impact flaws affecting its Linux application sandboxing and distribution framework. The updates prevent malicious applications from abusing privileged operations to overwrite or delete arbitrary host files, including attacks involving empty files or a symlink to `/run/host/monitor/resolv.conf`. They also stop authenticated OCI repository download tokens from being exposed to other local users, restrict unsafe fields in `.desktop` and D-Bus `.service` files, and prevent sandboxed applications from signaling process groups containing host parent processes, an action that could terminate the desktop environment. Earlier Flatpak **1.18.1** fixes addressed a broader set of symlink and path-traversal weaknesses, including sandbox escape conditions that enabled host filesystem read/write access, root-level arbitrary writes, arbitrary host-file reads, an anti-downgrade bypass, and a 32-bit buffer overflow. CVE assignments were published for the resolved issues, while two remained pending MITRE assignment at the time of the disclosure; a separate identifier, `CVE-2026-76925`, applies to a RHEL-specific backport issue rather than upstream Flatpak. Organizations should update deployed Flatpak installations to a fixed maintenance or development release and review systems where untrusted Flatpak applications may have run.
Sep 28, 2026
Linux kernel maintainers are evaluating a new approach to **authenticate developers and verify code provenance**, aiming to reduce reliance on the current PGP-based web-of-trust process that requires in-person identity checks and manual key signing. The push is framed as a supply-chain hardening measure informed by past ecosystem compromises, including the 2011 `kernel.org` breach and the more recent **xz** backdoor attempt, and is positioned as a model that could be adopted by other open-source projects. Separately, Google’s plan to expand **developer identity verification** to Android app *sideloading* distribution channels is facing organized opposition from dozens of technology and civil society groups. The policy would require identity checks and a one-time $25 registration fee for developers distributing apps for installation on certified Android devices outside Google Play, prompting concerns about increased gatekeeping, privacy/surveillance risk, barriers to entry for smaller developers, and potential antitrust implications; an unrelated ZDNET piece on PCLinuxOS focuses on distro popularity and usability rather than security controls or a specific security event.
Jun 29, 2026