Archive

Security

23 stories filed under Security.

1. Tuesday, 3 November 2026 · In brief

   Linux kernel "v7.2.15" is on the stable channel

   Linux kernel "v7.2.15" is on the stable channel, with the fix for the "CVE-2026-98432" security issue, and the Omarchy account said to hit Update > Omarchy to update.

2. Monday, 2 November 2026

   The update refreshes omarchy-keyring before the system upgrade

   An update left omarchy-keyring inside the system upgrade, so pacman checked signatures against the keyring already installed. A change merged into quattro puts omarchy-keyring on the refresh that already runs before that upgrade, and does nothing while the installed keyring is current.

3. Tuesday, 27 October 2026

   An unresolved FIDO2 path keeps the migration pending

   A change merged into quattro keeps the FIDO2 migration pending when the auth file is a symlink or not a regular file, so later migrations and an update wait.

4. Saturday, 24 October 2026

   Fingerprint removal deletes prints stored on the reader

   Pull request 16403, merged into quattro, deletes a user's prints on the reader with fprintd-delete before the local files go. A match-on-chip reader keeps each enrolled print on the device as well as in /var/lib/fprint.

5. Saturday, 24 October 2026

   Touch ID stays off until a Mac owner agrees

   Pull request 16360, merged into quattro, asks a Mac owner to agree before Touch ID turns on. Turning it on creates a Linux key store and advances a Secure Enclave anti-replay state that macOS shares, so the owner has to read what that means first.

6. Thursday, 22 October 2026 · In brief

   HackerOne reports on Omarchy reach 1,521

   Afonso Oliveira said Omarchy has gotten 1,521 HackerOne reports, in a post.

7. Wednesday, 21 October 2026

   Fingerprint setup tells a press sensor to touch, lift, and touch again

   Pull request 15512, merged into quattro, tells a press sensor to touch, lift, and touch again. scottjones wrote that on a press sensor like a Mac's Touch ID, setup read as one touch and wait.

8. Wednesday, 21 October 2026

   Resumed drive password change confirms the new slot first

   Pull request 14874, merged into quattro, makes a resumed system-disk password change confirm the new key slot before it removes one. scottjones wrote that the rerun used to treat any single slot added since the change began as the new key.

9. Monday, 19 October 2026

   Non-Latin keyboard file stays out of Plymouth's boot image

   Pull request 14885, merged into quattro, keeps a non-Latin keyboard file out of the boot image after Plymouth's hook started copying it. The pull request says x86 stable and rc still served the older package on Oct. 10.

10. Thursday, 15 October 2026

    A blanked lock pauses the fingerprint reader

    Pull request 15294, merged into quattro, holds the fingerprint reader back once the lock blanks the displays. The pull request says a finger alone does not unlock while the display is off. The merge is not in version 4.0.4.

11. Tuesday, 13 October 2026

    Signing keyrings refresh only for a newer package

    pull request 15034, merged into quattro, refreshes the signing keyrings only when a newer package is out, instead of reinstalling them on every update. The merge is not in version 4.0.4.

12. Tuesday, 13 October 2026

    Two USB revert proposals close without merging

    pull request 14936 and pull request 14938 closed without merging. Both would revert default USB and Thunderbolt authorization. pull request 14937 stays open and proposes blocking unfamiliar devices while the screen is locked.

13. Monday, 12 October 2026

    USB and Thunderbolt approval is reverted from the merged defaults

    USB and Thunderbolt approval comes out of the merged defaults in pull request 15091, which reverts pull request 11874. The revert is not in version 4.0.4.

14. Monday, 12 October 2026

    Lock requests read the session state directly in the merged shell

    Pull request 14978 merges a lock request that reads the session state directly, after David Heinemeier Hansson wrote that a suspend left the screen unlocked. He opened and merged it into quattro. The merge is not in version 4.0.4.

15. Monday, 12 October 2026

    Session-lock recovery, in this merge, will not take a lock another program may hold

    Pull request 15020 merges a recovery that will not take a session lock while another Quickshell or hyprlock for that user is running. David Heinemeier Hansson wrote that a second shell had taken a live lock. The merge is not in version 4.0.4.

16. Sunday, 11 October 2026

    Thunderbolt checks, in this merge, wait longer on a machine with no controller

    Pull request 14931 merges a slower Thunderbolt check while a machine has no Thunderbolt controller. maralcbr wrote that idle process launches fell from 1,587 a minute to 334. The merge is not in version 4.0.4.

17. Saturday, 10 October 2026

    USB and Thunderbolt devices wait for approval in merged security defaults

    Pull request 11874 merges a default that blocks a new USB device, and a new Thunderbolt or USB4 accessory, until the user approves it. Devices connected during setup are trusted. The merge is not in version 4.0.4.

18. Saturday, 10 October 2026 · In brief

    Factory reset, once merged, elevates the packaged command even from a development checkout

    Pull request 13047 merges a factory reset that always elevates /usr/bin/omarchy-system-factory-reset, including from a development checkout. The merge is not in version 4.0.4.

19. Thursday, 8 October 2026

    Omarchy merges a menu for how long passwordless sudo lasts

    Pull request 14435 merges a menu that asks how long passwordless sudo should stay on, and a red bar icon while that access is active.

20. Monday, 5 October 2026

    Fingerprint setup was skipping the lockout on privilege prompts

    Setting up a fingerprint or a FIDO2 key wrote a polkit stack that ignored repeated password failures. Pull request 9873 restores the lockout.

21. Monday, 5 October 2026

    Fingerprint unlock stops treating an empty reader as enrolled

    Fingerprint unlock could stay off, or retry without stopping, when no finger was enrolled or a reader failed. Pull request 7158 merged into quattro.

22. Monday, 5 October 2026

    Flatpak apps can store a secret in the keyring again

    Flatpak apps that keep a login in the system keyring could not reach it, so Zotero 10.0.1 sat waiting to sign in. Pull request 9594 merged into quattro.

23. Saturday, 3 October 2026 · Corrected

    Omarchy opens a HackerOne bug bounty and names a head of security

    Omarchy opened an official bug bounty on HackerOne, funded with $100,000, and named a head of security, in this post.