The recent nginx security update for CVE-2026-42533 introduced a regression: on some configurations, nginx randomly answers a small share of requests with HTTP 500 and logs [alert] ... no buffer space in script copy. Users reported it to us after updating, and we were able to reproduce it on every AlmaLinux release that received the update. We’ve found the root cause and built fixed nginx packages…
HashiCorp is retiring the HCP Vagrant registry (formerly Vagrant Cloud), the service that has hosted the almalinux/* Vagrant boxes since 2021. To keep the boxes available, AlmaLinux now runs its own Vagrant box catalog at vagrant.almalinux.org. It has every version that was ever published to HCP, plus all new releases. The box names stay the same: you only need to tell Vagrant where to find them.…
Update: The fix is now in regular kernel updates2026-11-02: The CVE-2026-98432 fix is now included in the regular AlmaLinux kernel updates in the production repositories for AlmaLinux 8, 9, and 10. You no longer need to enable the testing repo. Just run: sudo dnf clean metadata && sudo dnf upgrade sudo reboot The fix is included since kernel-4.18.0-553.182.1.el8_10 (AlmaLinux 8), kernel-5.14.0-687…
For a very long time, our community has done a fantastic job of translating the text on almalinux.org. I want to pause both to thank the people who have been contributing already, and to highlight where we might need some assistance. And also to show you how easy it is! How website translations workEverything from the navigation, buttons, page sections, and other shared site text (nearly everythin…
Hello AlmaLinux community! At TuxCare, we’ve contributed free DISA STIG automation for AlmaLinux OS 9 to the ComplianceAsCode project, and the maintainers merged it on October 20, 2026. That means you can now point OpenSCAP at an AlmaLinux OS 9 system and get a report of which STIG requirements it meets, rather than working through a few hundred of them by hand. So what is a STIG?STIG stands for S…
Update: The fix is now in regular kernel updates2026-10-28: The ZDI-CAN-33367 fix is now included in the regular AlmaLinux kernel updates in the production repositories for AlmaLinux 8, 9, and 10. You no longer need to enable the testing repo. Just run: sudo dnf clean metadata && sudo dnf upgrade sudo reboot The fix is included since kernel-4.18.0-553.178.1.el8_10 (AlmaLinux 8), kernel-5.14.0-687.…
Update: Patched PHP packages are now in production2026-10-21 21:15 UTC: The patched PHP packages are now rolling out to the production repositories for every PHP stream on AlmaLinux 8, 9, and 10. You no longer need to enable the testing repo to get them. Just run: sudo dnf clean metadata && sudo dnf upgrade 'php*' sudo systemctl restart php-fpm If you use mod_php on AlmaLinux 8, restart Apache wit…
Update: Patched kernels are now in production2026-10-23 17:16 UTC: Kernels with the PwnEscape fix are now in the production repositories for AlmaLinux 8, 9, and 10. You no longer need to enable the testing repo. Just run: sudo dnf clean metadata && sudo dnf upgrade sudo reboot The fixed versions in production are kernel-4.18.0-553.177.1.el8_10 (AlmaLinux 8), kernel-5.14.0-687.59.1.el9_8 (AlmaLinux…
This change has been a long time coming, and I’m excited to tell you about it. The Marketing SIG is now the Promo SIG! If you haven’t run into us before, the Marketing SIG is one of the many SIGs (Special Interest Groups) that make the AlmaLinux project do all the cool things it does. We started it in the project’s early days, and it’s grown to manage a lot of important things related to the proje…
AlmaLinux has grown a lot since we started, and I want to make sure the work we take on next is the work you need from us. That means that before we decide, I want to hear from you! What we’ve builtOver the last few years, we’ve built a pipeline for AlmaLinux OS with security at its center, backed by a mirror network that serves users all over the world, and with millions of devices running AlmaLi…
The Atomic SIG has just released v13 of atomic-ci, and it’s the biggest change to our build tooling in quite some time. When we started the Atomic SIG last year, we built our images with the best tools available at the time. Since then, the bootc community has learned a lot from those tools and built better ones. This release moves us onto them, aligning with the rest of the bootc community. Most…
It’s official! Please join us in welcoming Tristan Théroux and Muuhh (Munehiro) Ikeda to the AlmaLinux OS Foundation board! Meet the New Board MembersA connection between our members and the board is incredibly important, so we asked both candidates for introductions to share with the community. Learn more about who they are below! Nominated by Cybertrust Japan Co., Ltd., a Platinum sponsor. Muuhh…
Two years ago we announced the AlmaLinux Certification SIG and the Hardware Certification Program. That post ended with three things we wanted and didn’t have yet: software certification, toolkits so that vendors and community members could certify things easily themselves, and a way to certify a machine without installing AlmaLinux on it first. We have all three today, plus a new place to share t…
Hello Community! The AlmaLinux OS Foundation is announcing the availability of AlmaLinux 9.9 Beta “Chartreuse Bobcat” for all supported architectures: Intel/AMD (x86_64) ARM64 (aarch64) IBM PowerPC (ppc64le) IBM Z (s390x) Beta ISOs are available at vault.almalinux.org. A usual reminder: this is a BETA release. It should not be used for production installations. The provided upgrade instructions sh…
Nominations closed on September 8, and we have our ballot. Two people are running for the two open Cohort A seats: Muuhh Ikeda and Tristan Theroux. This is the first election under the new bylaws and annual election process we adopted in April, and it fills the seats that Jun Yoshida and Jesse Asklund held. Voting opens today, September 14. If you were a member in good standing by July 16, your ba…
Hello Community! The AlmaLinux OS Foundation is announcing the availability of AlmaLinux 10.3 Beta “Mauve Lion” for all supported architectures: Intel/AMD (x86_64) Intel/AMD (x86_64_v2) Intel/AMD 32-bit (i686) ARM64 (aarch64) IBM PowerPC (ppc64le) IBM Z (s390x) Beta ISOs are available at repo.almalinux.org. A usual reminder: this is a BETA release. It should not be used for production installation…
Nominations for this year’s board election open today, August 3, and they close on September 8. There are two Cohort A seats to fill, and this is the first election under our new bylaws and election process. More details are available on the 2026 election page. Why to join the AlmaLinux OS Foundation BoardAlmaLinux runs in places none of us can fully see: hospitals, banks, universities, homelabs -…
AlmaLinux Day: LA happened just over a week ago, on Saturday, July 18, at the E-Central Downtown Los Angeles Hotel, and it was a genuinely great day. We got to hang out with some of our new best friends, and I left with the strong sense that we’re doing something right. The dayDoors opened just before 9, and we had a real rush: a big chunk of attendees showed up to the event in that first hour. Th…
You may have seen news that the Microsoft UEFI Secure Boot certificates from 2011 have expired. The short version for AlmaLinux users: everything is covered, and your systems will not stop booting. There is nothing you have to do right now, but a quick check will make sure you are ready for future shim updates. Here is what happened and what we recommend. What happened?The Microsoft certificates t…
Update: The fix is now in productionThe patched kernel for GhostLock (CVE-2026-43499) has been released to the production repositories for every affected AlmaLinux release — 8, 9, and 10. You no longer need to enable the testing repo. Just run: sudo dnf clean metadata && sudo dnf upgrade sudo reboot The fixed versions released to production are kernel-4.18.0-553.141.2.el8_10 (AlmaLinux 8), kernel-…
Update: All patches are now in productionThe patched kernels for Januscape (CVE-2026-53359) and Bad Epoll (CVE-2026-46242) have been released to the production repositories for every affected AlmaLinux release — 8, 9, and 10. You no longer need to enable the testing repo. Just run: sudo dnf clean metadata && sudo dnf upgrade sudo reboot The fixed versions released to production are kernel-4.18.0-5…
Update: The fix is now in productionThe patched AlmaLinux 10 kernel has been released to the production repositories. You no longer need to enable the testing repo to get it. Just run: sudo dnf clean metadata && sudo dnf upgrade sudo reboot The fixed version released to the public is kernel-6.12.0-211.29.1.el10_2 (or higher). Confirm you are running it with uname -r after rebooting. Most mirrors s…
We announced earlier today that AlmaLinux OS 9.2 is now certified under Common Criteria, the international standard (ISO/IEC 15408) for independently evaluating the security of IT products. I keep coming back to how big this is for a community project. AlmaLinux is a community-owned non-profit foundation, with no corporate owner. For an operating system that is built in the open and given away for…
The schedule is live, the speakers are confirmed, and I’m genuinely excited to finally show you what the day looks like. We’re gathering Saturday, July 18, 2026 at the E-Central Downtown Los Angeles Hotel, the day before SIGGRAPH. Registration is open, it’s free, but the room is capped. So if you were waiting to see the lineup before grabbing your seat, here it is! It goes both waysThe thing I kee…
Last September, we cancelled an election in progress because we found inconsistencies in how our own processes, bylaws, and committee guidelines fit together. We wanted to fix that properly, and then to come back to you when the work was done. The work is done. I’m happy to share that as of the April Board meeting, we have adopted new bylaws, along with a reworked election process and a predictabl…
Update: CVE assigned and patched kernels are now in production 2026-06-02 15:31 UTC: The vulnerability has been assigned CVE-2026-46243, and the patched kernels have been released to the production repositories/mirrors. You no longer need to enable the testing repo to get them. Just run: sudo dnf clean metadata && sudo dnf upgrade sudo reboot Thanks to everyone in the community who helped verify t…
AlmaLinux OS 9.8 and 10.2 Stable Now AvailableHello Community! The AlmaLinux OS Foundation is announcing the general availability of two stable releases at once: AlmaLinux OS 9.8 codenamed “Olive Jaguar” and AlmaLinux OS 10.2 codenamed “Lavender Lion”! This is the first time we have ever shipped two AlmaLinux releases on the same day, and it’s a milestone we’re proud of. It’s the direct result of…
We have a venue! AlmaLinux Day: Los Angeles will take place Saturday, July 18, 2026, at the E-Central Downtown Los Angeles Hotel at 1020 S Figueroa St — and you can register now. These are the seats waiting for you. The room is real, the date is locked, and there’s enough space for a great conversation but not enough for everyone who’ll want in — which brings us to the rest of the announcement.
Update: Patched kernels are now in production2026-05-16 15:05 UTC: The patched kernels are now rolling out to production repositories/mirrors. You no longer need to enable the testing repo to get them. Just run: sudo dnf clean metadata && sudo dnf upgrade sudo reboot Most mirrors have a sync frequency of 3 hours. If the updates are not available to you yet we recommend trying again in about an hou…
Update: Patched nginx is now in production2026-05-14 22:41 UTC: Patched nginx packages are now rolling out to the AlmaLinux production repositories for every supported release. This covers the default nginx package on AlmaLinux 8, 9, 10, and Kitten 10, and every nginx module stream we ship on AlmaLinux 8 (nginx:1.16, nginx:1.18, nginx:1.20, nginx:1.22, nginx:1.24) and AlmaLinux 9 (nginx:1.24, ngin…