Arch Linux has published its 2026.11.01 rolling-release snapshot, built around the fresh Linux 7.2.11 kernel in a lean 1.2 GB x86-64 ISO. The image is meant for new installations only, since existing users can stay current with a single pacman -Syu. It inherits the improved Archinstall 4.5 guided installer plus critical security fixes, including PHP RCE patches and compromised CA certificate removals.

Arch Linux 2026.11.01 ships with the Linux 7.2.11 kernel

Arch's November rolling-release snapshot is now live, though the headline move is a kernel bump, not anything flashier.

Arch dropped its 2026.11.01 snapshot today, built around the Linux 7.2.11 kernel and weighing in at a lean 1.2 GB. It's x86-64 only, and the download page doesn't mince words about who this is actually for.

New installations. If you're already running Arch, skip the download entirely; a fresh copy buys you nothing you can't get from a single pacman -Syu.

The release and what changed it up

I'll be honest: the kernel is the story here, and that's by design. Arch's whole pitch is handing you the freshest stable kernel the moment a snapshot goes out, so a higher 7.2.x number is exactly the point rather than a letdown.

Look back at the 2026 timeline and the arc is obvious. The May image was the first to cross into the Linux 7.0 era with 7.0.3. September settled on 7.2.2. October brought 7.2.7 alongside a refreshed Archinstall 4.5. Now November lands on 7.2.11.

The ISO is a touch smaller than some earlier snapshots this year, which tracks with ongoing compression work. It's the smallest Arch disc in a while.

The real durability win rides along from October. Archinstall 4.5 is the guided, text-mode installer that's quietly made booting into Arch feel less like a rite of passage. It picked up RT kernel variants, AArch64 support for GRUB and Limine EFI, and optdepends handling for the linux-firmware package. It also switched polkit over to systemd-logind for the Hyprland, Sway, Niri, and Labwc profiles.

For anyone who has survived the manual install process end to end, this matters more than the spec sheet suggests. Since the guided script became the default back in April 2021, Arch has kept lowering the ladder while making crystal clear that you still climb in yourself.

The security situation

You can't write about an Arch release without flagging what's been sitting on top of the software base. Late 2026 has been busy.

On October 21st, maintainer David Runge pushed hard for a PHP update. You need php ≥ 8.5.12 or php-legacy ≥ 8.3.36 to close two remote-code-execution holes, CVE-2026-109618 and CVE-2026-109619. The advisory singles out systems publicly serving PHP apps. That's the part that actually hurts.

Same fix date. Arch pulled compromised certificates out of the eMudhra intermediate CA via ca-certificates-mozilla ≥ 3.131.1-1. Skip that one and you're leaving yourself open to man-in-the-middle attacks.

If you rely on TPM2-unlocked LUKS encryption, there's a longer tail. Since mkinitcpio 42, the systemd hook started including systemd-pcrosseparator.service, which shifts the measured PCR values you'd otherwise use to unlock your disk. The workaround is manual: re-enroll your TPM2, as documented in systemd-cryptenroll(1).

The June AUR attack still stings more than the rest. Campbell Jones announced it on June 12th, describing a "high volume of malicious package adoptions and updates" that forced the project to lock down new accounts, updates, and adoptions for a stretch. Tampered PKGBUILDs had installed malicious npm packages. Days later, more obfuscated malware showed up and got cleaned out. Arch's advice hasn't budged: read your PKGBUILDs, especially when you lean on an automated AUR helper. It's arguably the most instructive security moment the project's had in years, even if the lesson is the annoying kind.

All of this runs on volunteers, and the leadership side has stayed put. Levente "anthraxx" Polyák won a second two-year term as Project Lead in the June 2026 election. The role breaks deadlocks, enforces the Code of Conduct, and handles money through the SPI foundation. It's a detail worth following because it's Polyák's office that ultimately decides which advisories get priority.

In September 2024 Arch partnered with Valve, focusing on build-service infrastructure and a secure signing enclave. Signed packages have been mandatory since 2011 or so, and that's precisely what makes a signing enclave useful — it's the anti-tamper spine of a system where you trust what you downloaded from a random mirror.

Getting it

Head here to download the ISO image. For a fresh install, the guided installer makes the leap into Arch feel genuinely less steep. For anyone who's been doing this for years, it's just another pacman -Syu away from staying current. And as always with Arch, the ISO is only the front door. What you build inside is up to you.