Beyond Mythos: responding to a new threat landscape<br>| Ubuntu

Your submission was sent successfully!<br>Close

Thank you for contacting us. A member of our team will be in touch shortly.<br>Close

You have successfully unsubscribed!<br>Close

Thank you for signing up for our newsletter!

In these regular emails you will find the latest updates about<br>Ubuntu and upcoming events where you can meet our team. e.preventDefault()">Close

Your preferences have been successfully updated. Close notification

Please try again or<br>file a bug report.

Close

Blog

Canonical’s security philosophy has always been built on the premise that vulnerabilities exist and will be discovered. Our response relies on defense-in-depth architecture, rapid patch deployment, and strict adherence to Coordinated Vulnerability Disclosure (CVD).

AI changes vulnerability discovery volume and speed. We have a robust vulnerability management process that is backed by rigorous compliance certifications. These processes have demonstrated robustness in stringent ecosystems and we are adapting them with more exposure mapping, better customer guidance, and clearer remediation paths. This is where AI makes our customer service and internal responses more efficient.

To address real-world security we contain the blast radius of newly weaponized legacy bugs using our historically proven confinement tools, enforcing strict kernel-level boundaries with AppArmor and native container isolation (LXD). Building on this securely-designed foundation, we continue to modernize and harden Ubuntu by championing memory-safe languages like Rust.

We align our multi-tiered risk model with upcoming compliance requirements like the EU Cyber Resilience Act (CRA) focusing on actual threat impact rather than blindly chasing raw CVSS scores. Because AI will continuously unearth decades-old dormant flaws, we secure this foundation and your long-term compliance with up to 15 years of security maintenance through Ubuntu Pro.

Additionally, through the Ubuntu Security Research Alliance Program we’re partnering directly with leading security scanning providers in order to improve how accurately our data is presented in scan results, and to ensure that every piece of open source software distributed by Canonical is properly assessed.

1. What is Canonical’s  current awareness of the Mythos / Glasswing CVE disclosure?

Canonical’s Security Team is transforming its processes and infrastructure to adapt to the scale and speed of new frontier models, such as Mythos, GPT-5.5, and open-weight models. This ensures our incident response teams are fully prepared to triage and remediate the anticipated influx of AI-generated vulnerability reports.

2. Has Canonical conducted any internal AI-assisted vulnerability analysis across its own product estate?

Yes, we are actively integrating agentic AI frameworks to conduct independent vulnerability analysis across our estate. This evolution builds directly on our strict, foundational quality management practices, such as the extensive package auditing required by our Main Inclusion Review process.

3. Do you have a list of products that you would consider most exposed to the latest frontier-model vulnerability categories?

Because the foundational Linux stack is historically written in non-memory-safe C/C++, exposure to these classes of vulnerabilities is systemic across the entire open source ecosystem. Rather than maintaining a flat, theoretical “exposed list,” Canonical mitigates these risks structurally. First, we enforce mandatory compiler-level protections that go hand in hand with Linux kernel features for application hardening across the entire Ubuntu archive to reduce exploitability.

Furthermore, we evaluate exposure and prioritize our engineering response through a multi-layered risk model, ensuring that a massive influx of AI-discovered CVEs does not lead to a panicked, one-size-fits-all response. Instead, we right-size our response based on the component at hand:

Critical Foundation: Core components that could have significant impact on a system. This includes the kernel, glibc, OpenSSL, systemd, sudo, PAM, and core container runtimes.

Infrastructure & Orchestration: Canonical’s management, isolation, and deployment layers. This includes snapd, AppArmor, cloud-init, LXD, MAAS, Juju, and MicroK8s. These tools govern how the infrastructure is secured and scaled.

Application Ecosystem: The thousands of open-source applications and dependencies residing in the Universe repository, which are covered under Ubuntu Pro. While an AI-discovered CVE here might impact a specific business service, the threat might be contained by the structural protections (like AppArmor) established by the tiers above it.

and

Custom Workloads: Customer-specific applications and proprietary code operating outside of Canonical’s scope.

4. What is Canonical’s typical turnaround time for releasing CVE fixes, and how do you prioritize which vulnerabilities get...