The lead KDE neon developer Jonathan Riddell released a security advisory in which he urged KDE neon users to upgrade their systems or reinstall it.

The package archive of KDE neon was misconfigured, which allowed anyone to upload a package to the archive. It’s not known whether anyone uploaded any packages, but as a security measure they purged the archive, removed the ISOs built from it and they are now rebuilding it.