Operations | Monitoring | ITSM | DevOps | Cloud

Max Justicz discovered and responsibly disclosed a vulnerability in APT, the package manager used in Debian, Ubuntu, and derivative Linux distributions. The vulnerability has been assigned the identifier CVE-2026-109518 and has a severity of High. An on-path attacker who can manipulate the HTTP traffic between a system and an archive server can trigger the installation of an attacker-controlled.deb package file and obtain root privileges on the target system.

If you work with robots, perhaps you’ve come up against a common, but annoying situation: the one field run that mattered is the one nobody recorded. Or it was recorded but the ROS 2 bag (a recording of ROS 2 topics) is sitting in the robot’s storage, at a customer site, three time zones away. This issue is commonly caused by manually starting ros2 bag record and using scp to copy gigabytes off the robot after every test, which just does not scale.

Personas are easy to create but often ignored. This is the first of two posts about how we developed archetypes to keep our personas fresh at Canonical. These are shared, machine-readable descriptions of our users that multiple teams and their agents can use. This post explains the system, its purpose, and its structure. The second post’ll cover how we maintain and update it. Personas should be functional tools.

As an Android developer, you’ll almost always have access to a device. However, when handling hardware, the device that you actually need often happens to be already in use, set up incorrectly, stored in another lab, or simply waiting to be reset. That’s when Android development costs start to increase.

Today Canonical announced the release of Ubuntu 26.10, codenamed “Stonking Stingray,” available to download and install from ubuntu.com/download. Building on previous releases, Ubuntu 26.10 advances enterprise security features, completes the rollout of the Rust-based uutils coreutils, and strengthens integrations for user authentication using Microsoft Entra ID.

On 7 October 2026, Daniel Stenberg published a blog post describing a plan to release a new version of curl on 14 October 2026 in order to address 22 known security vulnerabilities. These vulnerabilities have varying severities, with a single vulnerability assessed as high (CVE-2026-92392), while the others have a low or medium severity. The curl maintainer has coordinated with downstream vendors, including Ubuntu, under embargo and the vulnerabilities have been publicly disclosed on the planned date.

A few months ago, we introduced Myna, our project to bring private, local speech-to-text dictation to Ubuntu Desktop. Named after the speech-mimicking myna bird, Myna is an optional Ubuntu 26.10 feature that offers real-time visual feedback during speech recognition. Since then, Myna has grown into something you can install and use on your desktop. Today, we’re making it available as a technology preview to the wider Ubuntu community.

Ubuntu 26.10 “Stonking Stingray” arrives at a time when AI tools are accelerating vulnerability discovery. Patching faster is essential, but the resilience of the underlying operating system must also limit what an attacker can achieve before a fix is available.

Confidential computing is essential when an organization needs to process sensitive data on infrastructure where the operators should not have access to it.

How on-demand Android environments turn validation into a repeatable pipeline stage In the first article, we looked at automation: how Android environments can be created and managed programmatically. In the second, we looked at scaling: how shared infrastructure can make those environments available to more developers, tests, and workloads. This third article looks at the next step: integrating those environments directly into CI/CD.