Loading story…
GNOME 51, codenamed A Coruña, has been released with passkey-based login support, offline Maps capabilities, drawn PDF signatures, compositor performance improvements, and enhanced remote-desktop functionality. The release adds SSH-password configuration for remote login, web-client access and Kerberos authentication for Remote Desktop, password-quality assessment through pwquality, and the Rust-based oo7 D-Bus Secret Service provider as a replacement for gnome-keyring.
The release removes WEP configuration from the Network settings panel, ending built-in support for the obsolete Wi-Fi security protocol. It also drops Mutter's legacy NVIDIA EGLStreams/EGLDevice path, meaning systems with proprietary NVIDIA drivers on most GeForce 700-series and older GPUs will fall back to Nouveau; GTX 750 Ti, GTX 750, and GTX 745 are listed exceptions. GNOME 51 is expected to ship in Fedora 45 and Ubuntu 26.10.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
GNOME 51 replaced gnome-keyring's D-Bus Secret Service provider with oo7, a Rust-based implementation, and added pwquality support for password-quality evaluation.
GNOME 51 removed support for configuring deprecated WEP wireless security in the Settings Network panel, potentially affecting users of legacy WEP Wi-Fi networks.
Mutter removed its NVIDIA-specific EGLStreams and EGLDevice/EGLStream paths. Older GeForce 700-series and earlier systems using affected proprietary drivers may fall back to Nouveau, while specified GTX 750 Ti, GTX 750, and GTX 745 models are exceptions.
GNOME 51 was released with offline Maps regions and live transit data, smart-card/passkey/QR-code GDM login options, Remote Desktop smart-card passthrough and Kerberos support, SSH socket servers for Remote Login, and PDF visual-signature functionality in Papers.
GTK version 4.24, the toolkit paired with GNOME 51, shipped.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceopennet.me
Open sourcerelease.gnome.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FreeRDP 3.31.0 fixes 22 security vulnerabilities, including a three-flaw chain that can yield **pre-authentication remote code execution** against GNOME Remote Desktop (GRD) Remote Login deployments. The demonstrated chain bypasses system-wide remote-login authentication, uses an `RDPGFX ResetGraphics` message to disclose uninitialized heap memory, and triggers an out-of-bounds write during `RDPDR` device-redirection channel processing to control an indirect function call. The resulting shell runs under a temporary `gdm-greeter-N` account rather than root, but testing found that account was not sandboxed on affected Fedora and Ubuntu configurations. The complete exploit path has limited exposure because it requires GRD 51 or later with `RDPDR` enabled; however, organizations should update FreeRDP and embedded distributions to 3.31.0 promptly. The release also remediates issues across graphics decoding, dynamic virtual channels, RD Gateway parsing, clipboard, smart-card, USB/device redirection, memory management, and authentication/error-handling components.
Sep 10, 2026
X.Org Server **26.1** has been released as the project’s first major feature update in roughly five years, succeeding the 21.1 series and marking a significant refresh of the long-running display server stack. The release, identified in one report as `xorg-server 26.0.99.901`, replaces the legacy Autoconf/Automake build system with **Meson** and introduces protocol and platform updates including **DPMS 1.2** event support, **XFixes 6.1**, BSD DRM platform support, and expanded **Xvfb** capabilities. The update also brings several security-relevant hardening changes across X.Org-based servers including **Xorg, Xephyr, Xnest, Xvfb, Xwin, and Xquartz**. Reports say the server now **disallows byte-swapped clients by default** and **disables font server connections by default**, while also changing log storage behavior for rootless mode and removing older components such as **DMX**, **EXA**, and shadow pixmap code. Xorg additionally now requires `libpciaccess 0.19` because of a new API dependency, reflecting broader modernization of the codebase alongside the security improvements.
Aug 20, 2026
Debian has released **Debian 13.6** as a point update focused on security and maintenance, alongside **Debian 12.15** for the previous stable branch. Debian 13.6 bundles roughly **120 security updates** and more than **120 bug fixes**, with patches affecting the Linux kernel and widely deployed packages including **Nginx, Redis, FFmpeg, Thunderbird, Chromium, PHP, Postfix, Samba, wireless-regdb,** and **Wireshark**. The update is intended to bring existing installations current rather than introduce a new major version. A notable change in Debian 13.6 is an updated **`shim-signed`** and **`fwupd 2.0.20`** stack to support newer Microsoft UEFI Secure Boot certificate chains and updates to Secure Boot **CA, KEK, and DBX** databases after expiration issues with the default UEFI Secure Boot CA used on many PCs. Debian also reverted or removed the legacy **`geoip-database`** package because newer GeoLite data was found incompatible with Debian Free Software Guidelines and the older dataset had become outdated, pushing migration toward maintained alternatives such as **GeoLite2**.
Jul 13, 2026