Loading story…
openSUSE Leap 16.1 introduces an optional Immutable Mode built on transactional updates and a read-only root filesystem. Selected during installation, the mode prevents normal-operation changes to core paths including /usr and /etc, reducing the opportunity for malicious scripts or compromised processes to persistently alter the operating system. Atomic updates also allow straightforward rollback if an update causes operational issues.
Derived from the model used in Leap Micro, the feature is aimed at container and virtual-machine hosts, edge deployments, and desktops requiring stronger configuration integrity. It complements existing Leap controls including SELinux, firewalld, compiler-based binary hardening, permission profiles, and Snapper-managed Btrfs snapshots; users can continue deploying standard mutable Leap installations where required.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
openSUSE Leap 16.1 became the first Leap release to offer an optional Immutable Mode, selectable during installation. The mode uses transactional updates and a read-only root filesystem, preventing normal modification of protected paths including /usr and /etc and supporting atomic rollback.
Beginning with Leap 16.0, openSUSE replaced AppArmor with SELinux as its mandatory access-control framework. SELinux enforces policy-based restrictions on labeled files, processes, and ports, including for root users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Linux desktop and server ecosystems saw several distribution-level changes and guidance updates, including renewed attention to *immutable* and *atomic* Linux designs. Atomic distributions emphasize **transactional (all-or-nothing) OS updates** applied to a separate image/subvolume and activated on reboot, reducing the risk of partial upgrades leaving systems in an inconsistent state. Immutable distributions mount core system paths (e.g., `/usr`, `/bin`, `/sbin`, `/lib*`, `/etc`, `/boot`, `/opt`) as **read-only**, limiting post-compromise tampering and configuration drift by preventing direct modification of the base OS. Separately, Canonical shipped **Ubuntu 24.04.4 LTS** as refreshed installation media that bundles cumulative security and bug fixes and includes a newer hardware enablement stack (notably a newer Linux kernel and Mesa graphics libraries) for improved hardware support; existing Ubuntu 24.04 systems receive the same updates through normal patching without reinstalling. In the Linux Mint project, the lead developer indicated Mint is considering a **slower release cadence** to enable larger development leaps per release, while also signaling continued support for both **X11 and Wayland** in the near term rather than following Ubuntu’s full transition to Wayland immediately.
Jun 29, 2026
**systemd 262** has been released with Live Update Orchestrator (LUO) session support, enabling integration with Linux live-update workflows designed to reduce disruption during host maintenance. LUO is also being explored in experimental kernel work to keep KVM guests running while a host kernel is offline for an update or reboot; that orphaned-VM design remains an early, non-production RFC tested across Intel, AMD, and Arm server systems. The release adds signed `systemd-report` output using Ed25519, configfs TSM, or TPM2 PCR-based signing; FIDO2 PIN support; and a `systemd-journald` Forward Secure Sealing implementation based on OpenSSL rather than libgcrypt. Other changes include expanded `systemd-sysupdate` controls, dm-clone provisioning support, static or multicall build options, restart randomization, slice activation-concurrency limits, enhanced NUMA policies, and an AI/LLM canary intended to flag unreviewed AI-generated code contributions.
Sep 23, 2026
The Linux `7.2` merge window has introduced several security-focused changes, including support for updating Intel **Trusted Domain Extensions** (TDX) modules on running systems, a step aimed at improving maintainability for confidential-computing deployments without requiring downtime. The kernel also adds arm64 hardening to remove data regions from the linear map, strengthens `openat2()` with `OPENAT2_REGULAR` and `EFTYPE` handling, and extends `fs-verity` support in `iomap` alongside a new `dm-inlinecrypt` device-mapper target. Additional protections target exploit resistance and attack-surface reduction across the kernel. The slab allocator now supports Clang allocation tokens to make cross-object memory corruption harder to exploit, while PowerPC’s hardware-optimized `MD5` implementation is being removed and `AF_ALG` is being deprecated after multiple recent security issues, including removal of its hardware-accelerator support. The update also includes broader networking and BPF changes, but the most notable theme is a sustained push to harden core kernel subsystems and reduce exposure from legacy or problematic components.
Aug 17, 2026