Arch Linux

vt_dev

Member

Registered: 2026-07-22

Posts: 1

No New Security Advisories since June 2025?

Hello Arch community,

I was wondering if anyone can shed some light on the current situation with Arch Security Advisories.

According to this page: https://security.archlinux.org/advisory they stopped being published in June 2025, with some scheduled advisories that never got published. I see in the history that there have been some other long gaps between published advisories in the past, but does anyone know when/if they will resume?

Lone_Wolf

Administrator

From: Netherlands, Europe

Registered: 2005-10-04

Posts: 15,515

Re: No New Security Advisories since June 2025?

https://wiki.archlinux.org/title/Arch_Security_Team links to arch-audit issue which indicates the  security tracker is currently not working.

---

Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.

clean chroot building not flexible enough ?
Try clean chroot manager by graysky

mpan

Member

Registered: 2012-08-01

Posts: 1,669

Website

Re: No New Security Advisories since June 2025?

Lone_Wolf: while we’re on this topic, may I ask for somebody in contact with schard to ping him about pointing to security.archlinux.org, like that happened in that thread? I have no options other than venues not exactly meant for that purpose, like Wiki talk pages. Thanks in advance.

---

Paperclips in avatars?

loqs

Member

Registered: 2014-03-06

Posts: 19,101

Re: No New Security Advisories since June 2025?

The Arch security team currently has four members.  Off gitlab activity two are active on average once a month, one twice a month with the last having activity most weeks.

schard

Forum Moderator

From: Hannover

Registered: 2016-05-06

Posts: 2,718

Website

Re: No New Security Advisories since June 2025?

@mpan I am also reading these forums more or less regularly.
I was unaware of the security tracker being non-functional up until today.
This does not change the action on the post you linked to though, since the solution was already provided in the linked article.

If the security tracker is actually down for a prolonged time, this should at least be mentioned with a big fat warning on its landing page.
People like me, who use it to update themselves on vulnerable packages are otherwise left with a false sense of security of new vulnerabilities not affecting Arch.
Just leaving it sit there not being updated defeats counteracts its purpose.

---

Inofficial first vice president of the Rust Evangelism Strike Force

mpan

Member

Registered: 2012-08-01

Posts: 1,669

Website

Re: No New Security Advisories since June 2025?

Schard, my comment wasn’t about your action as a moderator, or about pointing to Archie1 the article they linked answers the question. This was after all the basis of my own answer to them.

My comment was about sending users to security.archlinux.org. In this case I also received it as written in a tone similar to RTFM or LMGTFY. And that’s not useful, if security.archlinux.org is basically dead and checking it brings no answer in almost all cases.

The reason I asked for somebody to poke you is what you outlined here in the second paragraph. Not only it will not help people, but the at this point it may even have the opposite effect.

---

Paperclips in avatars?

loqs

Member

Registered: 2014-03-06

Posts: 19,101

Re: No New Security Advisories since June 2025?

2024 onward security.archlinux.org has covered 55 CVEs for comparison Debian has covered 21528 CVEs as of writing or put another way over 99.5% of issues Debian tracked have not been covered by Arch.  I agree with schard it does provide a false sense of security and counteracts what I assume it its intended purpose or being an accurate record of vulnerabilities in the distribution and it would probably be better for it to be removed from Arch's homepage.

omegadl2

Member

Registered: 2025-04-16

Posts: 1

Re: No New Security Advisories since June 2025?

Maybe sending an email to Arch-devops would be appropriate? Arch-security mailing list hasn't had any activity since 13 Jun '25.
I'm proposing arch DevOps since I don't know what other people might be contactable.

vindicator

Member

Registered: 2016-02-25

Posts: 40

Re: No New Security Advisories since June 2025?

I wasn't going to say anything here, since basically every needed has been said already. 
But when I went to one of Lone_Wolf's links https://gitlab.archlinux.org/archlinux/ … AxfQ%3D%3D (https://bbs.archlinux.org/viewtopic.php … 8#p2305998), I had an Anubis bot-check using "Difficulty=6" on my poor ancient Haswell which would take forever, but ended up with `Internal Server Error: administrator has misconfigured Anubis. Please contact the administrator and ask them to look for the logs around.`

When I saw that difficulty level, I refreshed the page hoping to get a lower difficulty because it worked once before elsewhere. 
After starting this reply, I went to the arch-audit repo (rather than the direct work-item link), with no anubis check, and now see the work item, with no activity from 4 months ago.

https://security.archlinux.org/log shows: `500: Deep Shit 79c19e2f` (whatever that error specifically refers to) 
That, along with the 2-month old out-of-date flag dracut, makes me nervous about the rustiness of Arch (especially with how the ARM variant turned out).