Dear deepin users and community members, A vulnerability has been discovered in APT, the package manager, that allows package integrity verification to be bypassed. Under specific conditions, an attacker positioned on the network path can substitute a package of their own making for one that has already passed verification, and have it executed with root privileges. Since APT is the component through which every system update passes, the impact of exploitation would be substantial. All users are advised to update as soon as possible.   Vulnerability details CVE ID: CVE-2026-109518 Description: When following an HTTP redirect, APT can merge two ...Read more

Dear deepin users and community partners, Recently, the private keys of 8 intermediate CA certificates from the public CA organization eMudhra were confirmed to be compromised. The flaw stems from an implementation error when the CA generated keys — the private key can be recovered directly from the certificate itself. Anyone who obtains it can issue 'legitimate' TLS certificates and code-signing certificates for arbitrary domains, and these certificates chain to root certificates jointly trusted by mainstream browsers and operating systems. This update involves only one software package, 'ca-certificates'. Please upgrade as soon as possible.   Vulnerability Details Vulnerability ID: CVE-2026-111943 Description: Of the 8 affected intermediate certificates, 6 are TLS issuing certificates (DV / OV / EV TLS CA - G3B, G3C), chained to 'emSign Root TLS CA - G3'; 2 are code-signing certificates (EM OV CS CA - G3B, G3C), chained to 'emSign Root CS CA - G3'. In addition, there are cross-signed copies issued by Sectigo and chained to 'AAA Certificate Services'. Impact: An attacker holding these private keys, if positioned as a network man-in-the-middle, can conduct man-in-the-middle attacks against clients that do not check certificate revocation status — forging arbitrary websites and stealing or tampering with communications. Because these intermediate certificates have no records in Certificate Transparency (CT) logs, browsers that enforce CT validation (Chrome, Edge, Firefox, Safari) are not affected; however, components that use the system trust store, such as curl, wget, git, pip, apt, cannot learn the revocation information and will continue to trust these certificates. This must be fixed through this update. Severity: Critical (CVSS 9.1)   Scope of Impact All deepin 25 users who have not updated with this fix. It is recommended to update and upgrade immediately.   Fix Progress deepin 25: 'ca-certificates' has been upgraded to 20250419+deb13u1, following the Debian Security Team’s approach (Debian Bug 1151413): removing the two affected root certificates, 'emSign ECC Root CA - G3' and 'Comodo AAA Services root', from the system trust store, thereby cutting off the trust chains for the above 8 intermediate certificates and their cross-signed copies. Please update via Control Center, or use the terminal command upgrade: sudo apt update && sudo apt dist-upgrade This update does not require a system reboot. Restart running programs to load the updated trust store.   Note: Removing root certificates will also affect other normally issued certificates under those root certificates. Some sites may experience certificate validation failures. This is expected behavior and is consistent with the upstream handling by Debian, Mozilla NSS, and others.   That’s all for this update. Once again, thank you to every deepin community friend for your support!    

September Community Data Overview Learn more about deepin on DistroWatch: https://distrowatch.com/table.php?distribution=deepin Community Products deepin 25.2.2 Update: Window Split-Screen · Liquid Glass Effect On September 8, the deepin 25.2.2 official release was launched. The two most noticeable new features in this update come from the Treeland desktop environment; Window split-screen supports quickly tiling windows to the left or right side of the screen, making multitasking more efficient; The liquid glass effect replaces simple blurring with physical refraction, enriching the desktop's visual hierarchy. The Treeland underlying layer has been synchronized with upstream, removing the qwlroots dependency and upgrading to wiroots 0.20, adding support for pointer-constraints and relative-pointer protocols, and improving mouse interaction in games and 3D applications. At the system level, this update fixes multiple issues in system updates, the Panshi system and file management, input methods, document viewers, screenshot and screen recording, and other commonly used applications; improves connectivity for some MTK wireless network cards; enhances compatibility and recognition capabilities for some domestic graphics card platforms, graphics audio devices, and LPDDR5X memory; and fixes multiple security vulnerabilities in foundational components such as GLib, GStreamer, Ghostscript, curl, X.Org, and XWayland. The Linglong application update on September 24 focused on fixing issues such as missing desktop and taskbar icons after some Linglong applications were upgraded, failure to start normally, and abnormal host resource mounting, while also optimizing the DBus service security mechanism. Xiao U: Unified Scheduling and Multi-Agent Collaboration · Scenario-Based Recommendations Xiao U released version 3.3.0, upgrading around "ondemand loading and faster response": Xiao U automatically selects the required tools or dedicated sub-agents based on the task, loading only the capabilities needed for the current task; built-in tools, MCP, Skills, and subagents are unified into a single capability catalog, and conversations no ...Read more

Learn more about deepin on DistroWatch: https://distrowatch.com/table.php?distribution=deepin I. June Community Data Overview II. Community Products 1. deepin 25.1.1 Release: Comprehensive Optimization and Security Hardening In June, deepin officially released version 25.1.1, delivering comprehensive upgrades in system security, hardware compatibility, desktop experience, and AI capabilities, including multiple feature improvements and CVE vulnerability fixes. Security Fixes: Fixed high-risk vulnerabilities including curl cookie leak and OpenSSH; simultaneously patched security issues in core components such as systemd, xorg-server, mesa, glibc, rsync, and nginx, enhancing overall security and reliability in network communication, image processing, display services, and other scenarios. Kernel & Hardware Compatibility: Updated 6.18/6.6 kernel components, ...Read more

Learn more about deepin on DistroWatch: https://distrowatch.com/table.php?distribution=deepin I. May Community Data Overview II. Community Products 1. UOS AI 3.0 In May, UOS AI was officially upgraded, transforming from a “ask-and-leave” dialog box into a system‑level “hardcore co‑pilot”, achieving breakthroughs in several core capabilities: Native system intelligence Leveraging MCP capabilities and extensive Skill support, the operational chain between deepin system and applications is now fully connected. With a single‑sentence command (e.g., “Download WeChat” or “Turn on Do Not Disturb mode”), XiaoU (Little U) completes the operation via native system control cards – new users never get lost, and veterans double their ...Read more

Learn more about deepin on DistroWatch: https://distrowatch.com/table.php?distribution=deepin The deepin 25.1.1 update is here! This update brings comprehensive optimizations in system security, hardware compatibility, desktop experience, AI capabilities, and more, including multiple feature improvements, bug fixes, and CVE vulnerability patches. We recommend upgrading as soon as possible via Control Center → System Update, or by using the terminal command: sudo apt update && sudo apt dist-upgrade   I. deepin 25.1.1 Release Notes Security Fixes Fixed high‑risk vulnerabilities including CVE‑2026‑6276 (curl cookie leak), systemd, and CVE‑2026‑35385 (OpenSSH). Addressed security issues in components such as inetutils, gnutls28, xorg-server, mesa, glibc, rsync, nginx, and wireshark. Fixed vulnerabilities in open‑source components including jpeg-xl, wget2, pillow, libexif, python-ldap, and ...Read more

deepin, an open‑source operating system that performs remarkably in the DistroWatch global ranking and is widely recognised by users worldwide, values the voice of every user. With the launch of deepin 25.1 in April, community feedback has been enthusiastic. This summary integrates user issues and feature requests collected from multiple channels, including the deepin Forum. Adhering to the principle of transparent co‑construction, we are normalising the regular synchronisation of progress. We now release the monthly community feedback summary for April 2026. Everyone is welcome to actively share suggestions on the deepin Forum and participate in product iteration together. Official Forum: https://bbs.deepin.org/ ...Read more