Your Secure Boot chain ends at a key you do not own. RHEL 10 has sealed images as a Technical Preview. Fedora 45 is adding the flags. Kheeper already boots them with your own keys. The unsealed path is the Microsoft shim. Enable Secure Boot, trust Microsoft's UEFI CA, and the chain stops at the kernel. That is fine until it is not. Your image is only as sealed as the key you do not control. The sealed path signs every file with keys you generate. `kheeper secureboot init` makes the keys on your workstation and uploads the certificates. The CLI builds the rootfs, signs the systemd bootloader, and generates a signed UKI. The registry will not let you push an unsealed release to a host that is enforcing it. Works today on bare metal where you can reach the UEFI menu. Latitude.sh is the cheap one to try it on. More details here 👇

Mozilla just blocked eight compromised intermediate certificates. The chain that signed your kernel is next. eMudhra’s private keys leaked. Attackers can now issue fake HTTPS certs for sites they do not control. Firefox 158.0.1 updated OneCRL to kill them. NetBSD already told users to block the certs. Every other distro is waiting for the package. That is a browser list today. It is a kernel and a bootloader tomorrow. The Microsoft shim that signs most Secure Boot paths is still the same chain. If the intermediate that signed your kernel image is in the next batch, the host does not care that you “updated Firefox.” If the OS is a bootc image, the certificate is in the digest you chose. You do not boot “whatever the distro pulled this morning.” Pin the image. Keep the previous one. When the next CRL lands, that is a rebuild and a reboot, not a package that arrived while you were offline.

The Linux 7.4 merge window opened today. Linus is on vacation. He warned the schedule may be "a bit unusual for a while." The 7.3 release was on time. The next one is already moving while the maintainer is offline. That is normal for a merge window. It is a bad default for a fleet if the only record of what you booted is "whatever landed this morning." This is the window where an image either gets boring or it gets surprising. After 7.3 the kernel stops moving unless a blocker lands. That is the digest you want to pin, not the daily from the merge window, and not "whatever the distro ships the morning you build." Build it. Boot the spare box. Keep the previous image. If 7.4 ships a fix you care about in December, that is a rebuild and a reboot, not a surprise on a host you are afraid to touch.

Linux 7.3 is out. Ubuntu already put the RC on every image three days ago. Linus released it Sunday, on schedule. 18,765 commits. Record on all fronts. Faster Btrfs and ext4, new sandboxing, Zen 6 prep, Steam Controller driver, better VRAM handling for low-end cards. Ubuntu 26.10 shipped Wednesday with the release candidate. The distro and the kernel were three days apart, and one of them was already in production. That is fine if you chose the digest. It is a surprise if the host just "follows the release." 7.3 stable is a rebuild you schedule. Pin the image you booted. Keep the previous one. The rollback is the point. "We patched it" should mean the host you reboot into, not a kernel that arrived because the calendar said so.

Fedora 45 slipped again. GA is now October 30. It was final freeze on the 7th. Then a NO-GO. Then RC-1.1 for testing. The ship date keeps moving, and the image you would have built on the 20th is not the one that will ship. This is the window where an image either gets boring or it gets surprising. After freeze the kernel and userspace stop moving unless a blocker lands. That is the digest you want to pin, not the daily from last Tuesday, and not "whatever Fedora ships the morning you build." Build it. Boot the spare box. Keep the previous image. If October 30 ships a fix you care about, that is a rebuild and a reboot, not a dnf update on a host you are afraid to touch.

Linux 7.3 was supposed to land today. Ubuntu already shipped the RC three days ago. Stonking Stingray went out Wednesday with a kernel that was still a release candidate. Upstream said rc7 was hopefully the last one, and Sunday was the target for stable. The distro and the kernel are on different calendars, and one of them is already in production. That is fine if you chose the digest. It is a surprise if the host just "follows the release." When 7.3 stable actually drops, that is a rebuild you schedule. Pin the image you booted. Keep the previous one. The rollback is the point. "We patched it" should mean the host you reboot into, not a kernel that arrived because the calendar said so.

systemd 262.1 is out. The AI canary is in it. Security fixes, and the canary that flags AI-generated code merged without a human review is now in the release. NetworkManager hid "biblioklept" for the same reason. The kernel is still arguing about whether to keep the Assisted-by tag. systemd already shipped the check. The canary does not make the patch safe. It makes the unreviewed one obvious. If that systemd is inside a bootc image, you choose the tag. You do not boot "whatever the model and the distro agreed on this morning."

Linux 7.3 stable lands tomorrow. Ubuntu already put the RC on every image. Phoronix this morning: last-minute fixes for rare boot hangs, tracked to a change from two years ago. Final is expected Sunday if nothing else lands. Ubuntu 26.10 shipped Wednesday with the release candidate. The distro and the kernel are three days apart, and one of them is already in production. That is fine if you chose the digest. It is a surprise if the host just "follows the release." Pin the image you actually booted. Keep the previous one. When 7.3 stable drops tomorrow, that is a rebuild you schedule, not a kernel that arrived because the calendar said so.

Ubuntu 26.10 is out. The kernel you just booted was still a release candidate last week. Stonking Stingray. Linux 7.3, GNOME 51, Rust coreutils as the default, Sequoia PGP for package signing, post-quantum tokens, Entra ID auth, Myna speech-to-text. Nine months of support through July 2027. Official flavors are out with it. The tag is real. The kernel finished being an RC this week. That is fine for a test box. It is a bad default for a fleet if the only record of what you booted is "whatever Ubuntu shipped yesterday." If you bake 26.10 into a bootc image, pin the digest you actually ran. Check the first-boot scripts. `cp` and `rm` are not the binaries your Containerfile grew up with. Keep the previous image. The rollback is the point.

Sealed images kill soft reboots. Every release is a full reboot. You download the full base image and upload an extra layer with the EFI binaries. One-time UEFI setup to flip Secure Boot on. The filesystem is ext4, because fs-verity does not work with xfs. That is the cost of the chain ending at your key instead of Microsoft's. The registry rejects an unsealed release on an enforcing host. You cannot accidentally boot the unsealed version. If the OS is a bootc image and the signing keys are yours, the host and the image move together. The previous digest is still there when the new one does not come back.

KDE turns 30 today. The desktop that is about to drop X11 is the same project that started on October 14, 1996. Plasma 6.8 is already in public beta. The launch is Wayland-only. Sessions, display servers, and the thing your first-boot script assumes is running are about to diverge. A Containerfile that hardcodes X11 tooling is going to fail on a host that only has Wayland. Thirty years of a desktop does not make the session optional. Pin it in the OS image. Boot the spare box before you point a real host at it. Do not discover the missing session on the machine you cannot SSH into.

Ubuntu 26.10 ships tomorrow. The kernel is still a release candidate. Stonking Stingray. Desktop, Server, WSL, Cloud. Linux 7.3 has not been called stable. Upstream said rc7 was hopefully the last one, and the final is expected around the weekend. Canonical is putting it on the ISO anyway. Rust coreutils are already the default. Signed, slimmed GRUB is in. Nine months of support after that, through July 2027. Tomorrow is a tag. It is not a reason to point a production host at a kernel that finished being an RC this week. If you bake 26.10 into a bootc image, pin the digest you actually booted. Check the first-boot scripts, because `cp` and `rm` are not the binaries your Containerfile grew up with. Keep the previous image. The rollback is the point.

KDE Plasma 6.8 is in public beta. The Wayland-only desktop is no longer a roadmap line. The release that drops the X11 session is now something you can install. Sessions, display servers, and the thing your first-boot script assumes is running are about to diverge. A Containerfile that hardcodes X11 tooling is going to fail on a host that only has Wayland. Pin the desktop in the OS image. Boot the spare box before you point a real host at it. Do not discover the missing session on the machine you cannot SSH into.

Linus just got a 3x speedup in the kernel. With Claude. An eight-patch series that cuts the work the kernel does when many threads read the same file. He used Claude Code to draft it. The branch credits the model. He has said he likes AI for the things he is bad at, and not for the serious work. This one is in the tree. That does not make the review optional. The same week, maintainers are still adding canaries so AI commits get rejected if nobody looked. The speedup is real. The person who can explain the patch is still the gate. If that kernel is inside an image you boot, you choose the tag. You do not boot "whatever the model and the distro agreed on this morning."

Linus is writing kernel code with Claude. Phoronix this morning: he is working on a hefty kernel improvement with Claude Code. Same week the tree is already drowning in AI-shaped patches, and same week he said he likes using AI for the things he is bad at, and not for the serious work. Both of those can be true. The patch still has to be reviewed by a person who can explain it. Maintainers have been adding canaries for a reason. NetworkManager hid "biblioklept" in AGENTS.md so AI commits get rejected. The kernel is not going to be the place that skips that. If that kernel is inside an image you boot, you choose the tag. You do not boot "whatever the model and the distro agreed on this morning."

Linux 7.3-rc7 just dropped. Ubuntu 26.10 ships it in three days. Mount hardening. An ext4 deprecation. An AMD errata workaround. This is still a release candidate. Final is October 15. Upstream has not called 7.3 stable, and the distro is about to put it on every Server and Desktop image anyway. That is fine for a test box. It is a bad default for a fleet. The kernel you boot next Thursday is the one that was an RC this morning. If you bake 26.10 into a bootc image, pin the digest you actually booted. "Follow the release" is how a host becomes a surprise. Rebuild when you mean to. Keep the previous image. The rollback is the point.

Nine distros shipped kernel patches the same day. More than 1,100 CVEs in one of them. Oracle’s Unbreakable Enterprise kernel closed over 1,100. Ubuntu’s NVIDIA 5.15 kernel closed about 950. AlmaLinux, Debian, Fedora, Red Hat, Rocky, Slackware, SUSE were all in the same pile. A decade of backports, one advisory, one reboot. The number is not 1,100 independent emergencies. Most of it is the normal RHEL pattern of shipping years of fixes at once. The reboot is still real. The kernel you are running and the kernel you will boot next are different things until you restart. If the OS is a pet, that is nine advisories and a maintenance window you are afraid of. If the OS is a bootc image, it is one rebuild, one digest, and the previous image still there when the new one does not come back.

Ubuntu’s download page went down. A DDoS took the website and the ISO downloads with it. Thursday. People trying to grab an image found the site “inoperable.” Canonical confirmed it. It is back. That is not the point. The point is the moment you need the image is the moment you find out you do not have it. An ISO on their CDN is a link. A bootc image in a registry you pay for is a digest you already pulled. The DDoS does not care which one you were counting on. Pin the image. Keep the previous one. If the vendor’s page is the only place the OS lives, an attack on their website is an attack on your install.

KDE is about to kill X11. Plasma 6.8 is in the final stretch. The launch is Wayland-only. Finishing touches, then the desktop that still has an X11 session stops having one. This is not a theme argument. Sessions, display servers, and the thing your first-boot script assumes is running are about to diverge. A Containerfile that hardcodes X11 tooling is going to fail on a host that only has Wayland. The host image and the app image have to agree, or the box comes up and the session does not. Pin the desktop in the OS image. Do not discover the missing session on the machine you cannot SSH into.