news
Canonical/Ubuntu: Local Privilege Escalation (LPE), CVEs, and Boosting of Rust
-
Qualys ☛ snap-confine + systemd-tmpfiles = root (CVE-2026-3888)
We discovered an unusual Local Privilege Escalation (LPE), from any unprivileged user to full root, in the default installation of Ubuntu Desktop >= 24.04. We found this vulnerability particularly interesting: [...]
-
Ubuntu ☛ Hot code burns
Zero CVEs doesn’t mean secure. It means unexamined. New code has zero CVEs because no one has studied it yet, and if you’re rebuilding nightly from upstream, you’re signing first and asking questions later. In software supply chain security, the freshest code isn’t always the safest. Sometimes the most secure component in your pipeline is the one you haven’t touched in eighteen months.
-
Ubuntu ☛ Canonical joins the Rust Foundation as a Gold Member
Canonical’s Gold-level investment in the Rust Foundation supports the long-term health of the Rust programming language and highlights its growing role in building resilient systems on Ubuntu and beyond.