Ubuntu blog

Two critical security vulnerabilities affecting PHP have been identified that result in unauthenticated remote code execution (RCE) for any PHP application. The vulnerabilities have been assigned the CVE-2026-109618 and CVE-2026-109619 identifiers, but are also referred to using the php2shell nickname. Ubuntu has released fixes for the affected packages for...

The private keys of the eMudhra Certificate Authority (CA) have been demonstrated on 20 October 2026 to have been compromised. The Ubuntu Security Team has released updates to the system PKI (Public Key Infrastructure) root CA store in the ca-certificates package.

Personas are easy to create but often ignored. This is the first of two posts about how we developed archetypes to keep our personas fresh at Canonical. These are shared, machine-readable descriptions of our users that multiple teams and their agents can use. This post explains the system, its purpose, and its structure. The second post’ll cover how we maintain and update...

As an Android developer, you’ll almost always have access to a device. However, when handling hardware, the device that you actually need often happens to be already in use, set up incorrectly, stored in another lab, or simply waiting to be reset. That’s when Android development costs start to increase.

Because it’s not just the device itself that gen...

October 15, 2026

Today Canonical announced the release of Ubuntu 26.10, codenamed “Stonking Stingray,” available to download and install from