Debian Decided to Postpone the 12.6 Release
Without a doubt, the deliberate infiltration of backdoored upstream XZ tarballs into the Debian sid repository a few days ago, allowing remote SSH access without authentication, sparked a real storm in the Linux community.
This security vulnerability, CVE-2024-3094, didn’t just affect Debian sid. It also impacted several other Linux distributions, including certain versions of Fedora, Arch, openSUSE Tumbleweed, Kali, and more.
In light of this, the Debian project has announced a delay in releasing its upcoming version 12.6, initially planned for April 6. This decision comes as the team undertakes a thorough investigation involving assessing its potential impact on the Debian Archive, a comprehensive collection of Debian software packages.