Manjaro Unstable November 2026: Linux 7.2 EOL, Plasma 6.8 drops X11, PHP RCE fixes

Manjaro Linux has published its November 2026 unstable branch update, marking the end-of-life for the Linux 7.2 kernel series at version 7.2.15 and urging migration to Linux 7.3 or the 6.18 LTS kernel. The update also retires support for starting X11 sessions in KDE Plasma 6.8, requiring affected users to switch to Wayland or a virtual console before applying the update. Security fixes include mandatory updates to ca-certificates-mozilla 3.131.1-1 to mitigate compromised eMudhra intermediate CA certificates, and PHP 8.5.12/8.3.36 to address CVE-2026-109618 and CVE-2026-109619, both enabling remote code execution.

The update carries additional breaking changes for Python users: AUR packages installing to Python 3.13 site-packages or linking against libpython3.13.so must be rebuilt for Python 3.14 compatibility, with rebuild-detector available to identify affected packages. Manjaro continues to emphasize that AUR packages remain unsupported by both Arch and Manjaro maintainers.

Kernel, desktop, and security changes in Manjaro Unstable

• Linux 7.2 EOL: The 7.2 kernel series is end-of-life as of 7.2.15; users must install linux73 or the 6.18 LTS kernel via mhwd-kernel.
• Plasma 6.8 X11 removal: Starting X11 sessions is no longer supported; users must switch to Wayland or a TTY (Ctrl+Alt+F1 through F6) before updating.
• Certificate authority fix: ca-certificates-mozilla 3.131.1-1 removes compromised eMudhra intermediate CA certificates to prevent man-in-the-middle attacks.
• PHP security patches: PHP 8.5.12 and php-legacy 8.3.36 fix CVE-2026-109618 and CVE-2026-109619, both allowing remote code execution on publicly exposed PHP applications.
• Python 3.14 migration: AUR packages with files in /usr/lib/python3.13/ or links to libpython3.13.so require rebuilding; pacman -Qoq and rebuild-detector identify affected packages.

Why it matters

For Manjaro users tracking the unstable branch, this update forces proactive kernel and display server decisions that will eventually flow to stable releases. The X11 retirement in Plasma 6.8 accelerates Wayland adoption across Arch-based distributions and signals broader desktop ecosystem momentum away from Xorg. The bundled security fixes for certificate infrastructure and PHP reflect upstream Arch Linux's rapid vulnerability response, benefiting the entire Arch derivative ecosystem including EndeavourOS and Garuda Linux.