CA distrusts, PHP RCEs, and distro plumbing updates

Certificate authority compromises and PHP remote code execution flaws prompted urgent update advisories across Fedora, Arch Linux, and OpenWrt. Kernel enhancements for binary formats plus service and concept releases rounded out the day's technical discussions.

Fedora blacklists weak eMudhra CAs

Fedora developers shared blacklist commands for eMudhra certificate authorities in ca-certificates after disclosure of trivially weak private keys for entries 4, 56, and 115. The thread focuses on practical untrust steps to remove the affected CAs. Operators should apply the changes promptly to reduce man-in-the-middle exposure from the compromised authorities.

Linux 7.3 adds programmable binfmt_misc

Linux 7.3 introduces more powerful binfmt_misc support aimed at sophisticated distributions such as NixOS. The change enables dynamic interpreters needed for Nix relocatable binaries. NixOS discourse participants examined how the feature improves packaging flexibility for relocatable workloads.

Arch finalizes ca-certificates-mozilla news item

Arch Linux developers completed an urgent news item calling for an update to ca-certificates-mozilla at version 1.131.1-1 or newer to block man-in-the-middle attacks after the eMudhra certificate compromise. One reply observed that coverage of other related packages remains incomplete. The advisory aligns with parallel distrust actions in other distributions.

Arch drafts PHP upgrade advisory for RCEs

Arch Linux developers are preparing a news item that urges immediate upgrades to PHP and php-legacy packages to address two remote code execution CVEs. The draft emphasizes prompt action on the affected versions. Systems running PHP should treat the update as high priority.

OpenWrt 25.12.6 ships uhttpd security fixes

OpenWrt released version 25.12.6 as a service update that includes uhttpd security fixes for multiple remotely exploitable issues in a default-enabled service. The announcement generated extensive forum discussion. Network operators running OpenWrt should install the release to close the remote attack surface.

OpenWrt flags critical PHP RCE flaws

OpenWrt forum participants highlighted critical remote code execution vulnerabilities in PHP and pointed to a packages pull request updating to the fixed 8.4.27 and 8.3.36 releases. The note follows similar alerts in other projects. Users of OpenWrt PHP packages need to pull the corrected builds.

Netherlands adopts NixOS for government desktop

The Dutch government project DAWO is building a sovereign desktop environment on NixOS, citing declarative reproducibility and sovereignty goals. Discourse discussion weighed the relative weight of technical versus origin motives. The effort represents a concrete public-sector deployment of NixOS packaging principles.

Ubuntu Concept 26.10 enables Snapdragon X2

Ubuntu published an experimental Concept ISO based on the 26.10 beta that adds initial Snapdragon X2 enablement. Forum users reported driver and firmware issues during testing. The image serves as an early probe of ARM hardware support for upcoming Ubuntu releases.