Loading story…
AWS has released Amazon Linux 2027 (AL2027) in public preview, building on the Amazon Linux 2023 baseline but changing SELinux to enforcing mode by default. Applications that ran under AL2023's permissive SELinux configuration may now be blocked when policy violations occur, making SELinux policy validation and remediation a primary migration requirement.
The preview includes kernel 7.1 or later, AWS-LC cryptography, and accelerator drivers including AWS Neuron support. AWS has made AMIs and container images available, while on-premises images are not yet offered; the final kernel may change before an LTS release is selected, and AWS has not announced either AL2027 general availability or an end-of-support date for AL2023.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
AWS released Amazon Linux 2027 (AL2027) in public preview, based on the Amazon Linux 2023 baseline. The preview enables SELinux enforcing mode by default and provides AMIs in commercial regions plus container base images through the Amazon ECR Public Gallery.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon has released a preview of **Amazon Linux 2027 (AL2027)** for AWS cloud infrastructure and Amazon EC2. Available for `x86_64` and `ARM64/Aarch64`—including AWS Graviton—the distribution draws on Fedora Linux 44 and 45 components and includes an AWS-oriented kernel with Elastic Network Adapter (ENA), Elastic Fabric Adapter (EFA), EC2-service integration, and live kernel patching. AL2027 strengthens default platform security by enabling SELinux in enforcing mode and enabling post-quantum **ML-DSA** and **SLH-DSA** signatures by default across OpenSSH, OpenSSL, GnuTLS, and NSS. The release also moves to RPM 6.0 and DNF5 and refreshes major components including GCC, LLVM, OpenSSL, glibc, systemd, and Python.
Sep 4, 2026
Linux **7.2** has been released with a broad set of platform, performance, filesystem, networking, virtualization, and driver updates, including Cache Aware Scheduling, `USB4STREAM`, AMDGPU HDMI 2.1 FRL support, storage improvements across XFS, Btrfs, Ext4, F2FS, NFS, SMB, NTFS, Ceph, and Device Mapper, and security-relevant additions such as Intel TDX support, KVM support for Intel MBEC and AMD GMET, Landlock enhancements, IMA updates, and TCP-AO support without a `libcrypto` dependency. The release also brings reported I/O gains on AMD and Intel systems, faster poll performance, graphics improvements for Intel Arc and other GPU stacks, and continued Rust-for-Linux progress. The final release incorporated several late fixes and reverts, including a new `tlbi=` boot parameter added through an x86 urgent pull request. The currently supported setting, `tlbi=ipi`, restores older IPI-based TLB flushing as a debugging and mitigation aid after recently discovered `INVLPGB` and `TLBSYNC` issues on AMD CPUs were suspected of contributing to user-space crashes when broadcast TLB flushing is used. Kernel developers also reverted the newer DRM fair scheduler after regressions, and the `tlbi=ipi` change is slated for backporting to stable kernel branches.
Aug 20, 2026
The Canadian Centre for Cyber Security issued multiple advisories urging organizations to apply vendor patches released between **February 16–22, 2026**, including updates addressing **Linux kernel vulnerabilities** impacting **Ubuntu** (16.04 LTS through 25.10) and **Red Hat** platforms (including *RHEL* and related offerings). The advisories emphasize routine but potentially high-impact exposure from unpatched kernel flaws across widely deployed enterprise and server environments, and direct administrators to review upstream vendor notices and deploy the corresponding updates. Separate Cyber Centre advisories also flagged patch requirements outside the Linux kernel: Microsoft released an update for **Microsoft Edge Stable** to remediate vulnerabilities in versions prior to `145.0.3800.70`, IBM published security advisories covering multiple products (including *Aspera Enterprise WebApps*, *Cloud Pak System*, *Storage Defender*, and others), and CISA issued ICS advisories for vulnerabilities across several industrial and IoT/OT products (including **Delta Electronics**, **GE Vernova**, **Honeywell CCTV**, **Siemens Simcenter**, and others) with recommended mitigations and updates where available. A Linux 7.0 release-candidate feature article is not a security advisory and does not materially relate to the patch/vulnerability notices in the other items.
Jun 29, 2026