Loading story…
Debian has ended Long Term Support (LTS) for Debian 11 “Bullseye,” released in 2021. The volunteer Debian LTS Team had supplied security maintenance after the distribution’s standard support period, and systems remaining on Bullseye will no longer receive those community-provided fixes.
Freexian’s commercial Extended LTS (ELTS) service will provide selected Debian 11 vulnerability fixes until June 30, 2031 for i386, amd64, armhf, and arm64. Organizations should migrate to a currently supported Debian release where possible; those retaining Bullseye should confirm that their required packages and architectures are covered by ELTS.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
Debian released version 11, codenamed Bullseye.
Freexian offers paid Extended LTS security maintenance for selected Debian 11 packages on i386, amd64, armhf, and arm64 systems, for organizations unable to migrate immediately.
The Long Term Support period for Debian 11 Bullseye ended after maintenance by Debian's volunteer LTS Team.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
6 references tracked. Mallory keeps watching after this page renders.
opennet.ru
Open sourceopennet.me
Open sourcedebian.org
Open sourcewiki.debian.org
Open sourcewiki.debian.org
Open sourcewiki.debian.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Debian has released **Debian 13.6** as a point update focused on security and maintenance, alongside **Debian 12.15** for the previous stable branch. Debian 13.6 bundles roughly **120 security updates** and more than **120 bug fixes**, with patches affecting the Linux kernel and widely deployed packages including **Nginx, Redis, FFmpeg, Thunderbird, Chromium, PHP, Postfix, Samba, wireless-regdb,** and **Wireshark**. The update is intended to bring existing installations current rather than introduce a new major version. A notable change in Debian 13.6 is an updated **`shim-signed`** and **`fwupd 2.0.20`** stack to support newer Microsoft UEFI Secure Boot certificate chains and updates to Secure Boot **CA, KEK, and DBX** databases after expiration issues with the default UEFI Secure Boot CA used on many PCs. Debian also reverted or removed the legacy **`geoip-database`** package because newer GeoLite data was found incompatible with Debian Free Software Guidelines and the older dataset had become outdated, pushing migration toward maintained alternatives such as **GeoLite2**.
Jul 13, 2026
The Debian Project released **Debian 13.7** ("Trixie"), refreshing its installation media with fixes associated with 92 prior security advisories and corrections to 106 source packages. The update covers core and widely deployed software including the Linux kernel, glibc, QEMU, Chromium, ImageMagick, Samba, PHP, Postfix, Roundcube, Wireshark, Perl, Python 3.13, mbedTLS, wolfSSL, U-Boot, and Cyrus IMAPD. The bundled patches address memory-safety defects, Secure Boot bypass conditions, authentication and authorization weaknesses, credential forwarding during HTTP redirects, archive-extraction flaws, and denial-of-service issues in network services. Existing Debian 13 systems configured to receive updates from `security.debian.org` should already contain most security fixes; organizations deploying from older Debian 13 installation media should update immediately after installation.
Sep 14, 2026
Debian issued security advisories `DSA-6178-1` and `DSA-6179-1` for **Firefox ESR** and **Thunderbird**, releasing updated packages to address unspecified security flaws in the browser and email client. The notices were published through Debian Security Announce and indicate that both widely deployed Mozilla applications received coordinated fixes for vulnerabilities affecting Debian users. The updates highlight continued patching of internet-facing software that commonly processes untrusted web and email content, making both products high-priority targets for exploitation. Organizations running Debian systems should review the relevant advisories, deploy the updated `firefox-esr` and `thunderbird` packages promptly, and verify that endpoints and user workstations are aligned with the latest security releases.
Jun 29, 2026