Loading story…
systemd 262 has been released with Live Update Orchestrator (LUO) session support, enabling integration with Linux live-update workflows designed to reduce disruption during host maintenance. LUO is also being explored in experimental kernel work to keep KVM guests running while a host kernel is offline for an update or reboot; that orphaned-VM design remains an early, non-production RFC tested across Intel, AMD, and Arm server systems.
The release adds signed systemd-report output using Ed25519, configfs TSM, or TPM2 PCR-based signing; FIDO2 PIN support; and a systemd-journald Forward Secure Sealing implementation based on OpenSSL rather than libgcrypt. Other changes include expanded systemd-sysupdate controls, dm-clone provisioning support, static or multicall build options, restart randomization, slice activation-concurrency limits, enhanced NUMA policies, and an AI/LLM canary intended to flag unreviewed AI-generated code contributions.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
systemd 262 was released as a feature update for the Linux init system and service manager. It added embedded fallback unit files, static/multicall build support, dm-clone and sysupdate enhancements, LUO session integration, signed reporting, FIDO2 PIN support, and an AI/LLM code-review canary.
Google engineer Pasha Tatashin proposed a 46-patch RFC for Orphaned VMs, intended to let KVM guests continue executing while the host kernel is offline during a reboot or live security update. The early, non-production design uses LUO and a privileged Caretaker layer, and has been tested on Intel, AMD, and Arm server processors.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
opennet.me
Open sourceopennet.ru
Open sourcephoronix.com
Open sourcephoronix.com
Open sourcefreedesktop.org
Open sourcefreedesktop.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Linux `7.2` merge window has introduced several security-focused changes, including support for updating Intel **Trusted Domain Extensions** (TDX) modules on running systems, a step aimed at improving maintainability for confidential-computing deployments without requiring downtime. The kernel also adds arm64 hardening to remove data regions from the linear map, strengthens `openat2()` with `OPENAT2_REGULAR` and `EFTYPE` handling, and extends `fs-verity` support in `iomap` alongside a new `dm-inlinecrypt` device-mapper target. Additional protections target exploit resistance and attack-surface reduction across the kernel. The slab allocator now supports Clang allocation tokens to make cross-object memory corruption harder to exploit, while PowerPC’s hardware-optimized `MD5` implementation is being removed and `AF_ALG` is being deprecated after multiple recent security issues, including removal of its hardware-accelerator support. The update also includes broader networking and BPF changes, but the most notable theme is a sustained push to harden core kernel subsystems and reduce exposure from legacy or problematic components.
Aug 17, 2026
dCERT published two advisories covering **multiple vulnerabilities in `systemd`**, the widely deployed Linux init system and service manager. The notices identify separate batches of flaws affecting `systemd`, indicating an ongoing stream of security issues in a core component used across many Linux distributions and enterprise environments. Because `systemd` is deeply integrated into system startup, service control, logging, and host management, vulnerabilities in the software can have broad operational and security impact depending on the affected component and deployment. Organizations using Linux systems with `systemd` should review the dCERT advisories **2026-0707** and **2026-0815**, determine exposure across their fleets, and prioritize vendor patches or mitigations as they become available.
Jun 29, 2026
Arch Linux's `mkinitcpio` version `42-1` adds `systemd-pcrphase.service` to the systemd hook, matching the intended behavior introduced in systemd v261. The service changes TPM Platform Configuration Register measurements for PCRs `0-7`, `9`, and `12-14`, affecting systems whose LUKS volumes are automatically unlocked through TPM2 policies bound to those measurements. Administrators must re-enroll affected TPM2-bound LUKS unlock configurations before or after deploying the update to avoid boot-time unlock failures. Systems using pinned PCR values should follow `systemd-cryptenroll` guidance; deployments using custom PCR policies with `systemd-pcrlock-make-policy.service` disabled should instead use the `systemd-pcrlock` documentation to regenerate or update their policies.
Sep 22, 2026