2026-06-03 GIGATAP Team #opsec

Tails 7.8 Closes a Long-Standing Security Gap

Tails 7.8 is now available, and the most important change is not a new privacy feature. It is a security correction to a problem that could leave users running outdated software inside an operating system designed for anonymity.

Users who rely on Tails for sensitive browsing, research, journalism, activism, or operational security should pay particular attention to how the release changes software updates and addresses privilege-escalation vulnerabilities.

What Changed#

The headline change is the handling of Thunderbird.

The Tails team has removed Thunderbird from the default installation. Users who want it can still install it as additional software. When Thunderbird is installed this way and Persistent Storage is enabled, the latest version is automatically installed from Persistent Storage during startup.

This change addresses a practical maintenance problem.

According to the project, previous Tails releases often shipped with an outdated Thunderbird version because Thunderbird updates in Debian frequently arrived shortly after a Tails release. The result was a recurring lag between available security fixes and the version included in Tails.

For a platform whose users often operate in higher-risk environments, that lag matters. An anonymity-focused system is only as strong as the software running inside it.

Tails 7.8 also fixes multiple security vulnerabilities affecting the Linux kernel and haveged. The project warns that such flaws could potentially allow an application running inside Tails to gain administrative privileges.

The concern is not that these vulnerabilities automatically deanonymize users. The concern is chain exploitation. If an attacker first discovers or exploits another weakness in an application, a privilege-escalation vulnerability can become the next step toward full system compromise.

Why It Matters#

Security discussions often focus on remote exploits and headline vulnerabilities. In practice, privilege escalation remains one of the most valuable stages in a real attack chain.

Tails itself highlights this risk. An attacker who gains limited execution inside the system may attempt to leverage kernel-level flaws to obtain broader control. Once administrative access is achieved, the protections that users depend on become much harder to trust.

The Thunderbird change is also notable because it addresses process risk rather than a single bug.

Many security incidents stem from update timing, packaging delays, and maintenance friction rather than dramatic technical failures. By changing how Thunderbird is delivered and updated, Tails reduces dependence on release synchronization between projects.

That does not eliminate risk, but it removes a recurring source of exposure that previously left users behind the latest security fixes.

What Users Should Check#

Existing users running Tails 7.0 or later can use the project’s automatic upgrade path to move to Tails 7.8 while keeping their Persistent Storage.

A few practical checks are worth making after upgrading:

Confirm the upgrade completed successfully.
Verify that Persistent Storage is still available and functioning as expected.
If Thunderbird is part of your workflow, confirm it is installed as additional software and persists correctly across reboots.
Review any operational procedures that assume Thunderbird is included by default.
Check that security-sensitive workflows still behave as expected after the upgrade.

Users performing a fresh installation should pay close attention to the distinction between upgrading and reinstalling. The project notes that installing Tails on a USB drive instead of performing an upgrade will erase the existing Persistent Storage on that device.

What Not to Overclaim#

Tails 7.8 should be viewed as a security maintenance release, not a fundamental redesign of the platform.

The project has fixed vulnerabilities and improved software delivery, but users should avoid treating the release as a guarantee against deanonymization or compromise. Security remains dependent on the entire chain: the operating system, installed applications, user behavior, and unknown vulnerabilities that may still exist.

The stronger takeaway is operational.

An anonymity-focused system becomes weaker when critical applications regularly fall behind security updates. Tails 7.8 reduces that risk and closes several known privilege-escalation paths. For most users, that is the real value of this release.

Schibsted Pay or Okay raises consent legality questions - Schibsted’s Pay or Okay rollout faces a complaint in Norway over whether paid opt-outs still count as freely given consent under GDPR.
AI Opt-Outs Are Starting to Look Like Data-Broker Playbooks - A new study argues that major AI providers are adopting privacy opt-out patterns long criticized in the data-broker industry. The key issue is not whether
Statement end: why ISS World Europe now needs scrutiny - EDRi’s call to cut ties with ISS World Europe turns a surveillance trade fair into an operational due-diligence problem for public bodies, universities, an
Why Vermont's Privacy Bill Is Facing Privacy Advocate Opposition - EPIC and Consumer Reports say Vermont's S. 71 would weaken existing privacy protections, raising questions about what the bill actually changes.
EPIC Coalition Targets ALPR Creep With a Tolling-Only Line - EPIC and more than 40 groups are urging Congress to limit automatic license plate readers to tolling. The practical issue is purpose control, not just data
What behind EU digitalisation: rights or control? - EDRi argues the EU’s digitalisation push is not just a service upgrade. The operational risk sits in identity, welfare access, health data reuse, and syste
Czech stadium facial recognition hits a legal push back - A Prague derby security failure triggered calls for facial recognition. The push back shows why biometric systems need legal and operational checks first.
Failed YouTube warrants exposed a wider privacy risk - Unsealed records show failed warrants targeting journalists’ YouTube accounts. The key risk is not only press freedom, but platform metadata and sealed pro

Latest articles

Crypto clipper adds Tor and worm-like spread to theft model - Microsoft analysis shows crypto clipper evolving into a persistent threat combining clipboard hijacking, Tor-based control, and worm-like propagation.
US Government AI Inventory Raises Privacy Questions - US agencies list 3,611 AI use cases, exposing gaps in transparency and raising questions about automated decision-making and privacy.
BCI moves from trial to real use as AI national strategy expands - A brain implant user with ALS signals early real-world BCI use while South Korea accelerates national AI focus and infrastructure alignment.
Canada’s Bill C-22 Pushes Encryption Toward Built-In Access Risk - Bill C-22 expands surveillance powers in Canada and introduces mechanisms that could force access paths into encrypted systems, raising structural privacy
Postinstall payloads in npm supply chains and Mastra breach - Mastra npm packages were compromised through a postinstall hook that executed during install, exposing CI/CD pipelines and developer environments to remote
Security beyond benchmarks: Microsoft MDASH moves to production - Microsoft’s MDASH moves from benchmark success into live engineering pipelines, embedding AI-driven vulnerability discovery directly into DevSecOps workflo
VHDX Delivery Chain Hides Remcos RAT via JavaScript Stage - A ZIP file uses a VHDX disk image to expose JavaScript after auto-mounting on Windows, leading to Remcos RAT deployment through layered execution.
Wolf Gallery and the F-Droid packaging bottleneck - Wolf Gallery’s F-Droid request shows how strong local encryption and offline design still depend on packaging work before reaching users through trusted di

Tails 7.8 Fixes a Security Weak Point

Tails 7.8 Closes a Long-Standing Security Gap

What Changed#

Why It Matters#

What Users Should Check#

What Not to Overclaim#