Arch Linux Ships Its First ISO With Kernel 7.1 as the Project Tightens AUR Security
Arch Linux published its archlinux-2026.08.01 ISO, a 1.5 GB x86_64 build shipping kernel 7.1.5 and roughly 16,031 packages across core, extra, and multilib. It is the first Arch install medium powered by the 7.1 series.
Arch is a rolling release, so the monthly ISO exists purely to give new installations a recent starting point. Existing users get everything through pacman -Syu and never need to download it.
Archinstall 4.4
The snapshot carries Archinstall 4.4, which adds several things worth knowing about:
- A Niri DankMaterialShell desktop profile
- Support for configuring the Plymouth boot splash
- An IWD standalone option in network configuration
- Console font selection from the Locales menu
The Niri profile is a notable addition. Niri is a scrollable-tiling Wayland compositor that has picked up a following over the past year, and having it available as an installer profile lowers the barrier considerably for anyone curious.
The IWD option matters more than it sounds. IWD is Intel’s wireless daemon and a lighter alternative to wpa_supplicant, and being able to select it standalone rather than as a NetworkManager backend is useful on minimal installs.
The AUR security question
The more consequential story around Arch this year is the security work on the AUR.
A June incident led to the temporary suspension of user package adoption after malicious activity was detected. The AUR’s threat model has always been explicit: it is a repository of user-submitted build scripts, those scripts run on your machine, and reviewing them is your job. That model is honest, and it also depends on users actually reading PKGBUILDs, which many do not.
An orphaned package being adopted by an attacker is a particularly effective path, because the package already has users who have already decided to trust it. Suspending adoptions was a blunt response to a real gap.
Our AUR and yay explainer covers what the AUR is and why the trust model works the way it does. The short version has not changed: read the PKGBUILD, especially for packages that recently changed maintainers.
Project leadership
Levente Polyák, better known as anthraxx, continues as project lead following a June re-election to a second term. The period has included a run of aggressive upstream modernization, including the switch from iptables to nftables and the adoption of the open NVIDIA kernel modules.
Getting it
# Existing Arch users need none of this
sudo pacman -Syu
# New installs: verify the signature before writing
gpg --verify archlinux-2026.08.01-x86_64.iso.sigOur Arch Linux explainer covers what the distribution expects from you, and the pacman guide covers day-to-day package management.