Anonymous
2025-08-15 09:51
2025-08-15 09:51
Product
Last Report
Anonymous
2024-07-07 07:01
2024-07-07 07:01
Anonymous
2024-02-07 19:23
2024-02-07 19:23
Anonymous
2026-09-01 09:28
2026-09-01 09:28
Anonymous
2026-07-19 18:49
2026-07-19 18:49
Anonymous
2026-06-11 07:27
2026-06-11 07:27
Anonymous
2019-11-27 17:19
2019-11-27 17:19
Anonymous
2019-11-11 09:02
2019-11-11 09:02
Anonymous
2019-07-21 13:03
2019-07-21 13:03
2026-11-05
The OpenVPN community project released version 2.7.9 on November 5, 2026, officially a bugfix release that also fixes several security issues centered on the Windows build. The two new CVEs, both found by researcher Heiko Hund, harden the interactive service by restricting DLL loading, running openvpn.exe at high integrity, and tightening environment-variable and command-line handling. Beyond security, the update adds Linux packet prioritization via IFF_BACKPRESSURE, a Windows GUI username pre-fill hint, and ongoing OpenSSL 4.1 and buffer-hardening work. Windows users running the service or GUI should update now, with 64-bit, 32-bit, and ARM64 MSI installers plus a signed source tarball available from the GitHub release page.
yserver 1.9.0, released today, adds native Windows support to the from-scratch Rust X11 server, its first platform outside Linux, the BSDs, and macOS. The Windows build runs on Windows 11 in x86_64 and aarch64 with a Vulkan 1.3 requirement, offering rootless and rooted modes, a shared clipboard, DPI awareness, and ssh -Y X forwarding via portable, no-install zips. Beyond Windows, the release claims window operations up to 700× faster on slow hardware, the first steps toward client isolation through xhost-style access control, and a pile of Xorg-parity correctness fixes. Developed largely with AI coding agents under a strict spec-first methodology, yserver is already a live example of a security-relevant systems project built that way, with 614 stars and 38 forks on GitHub.
Alpine Linux disclosed a passwordless SSH login flaw with no CVE yet, working in a single connection when OpenSSH runs without PAM. Debian and Ubuntu both fixed a shared APT vulnerability that lets a man-in-the-middle swap verified packages and get arbitrary root code execution, with Ubuntu backing all the way to 14.04 LTS. Fedora's batch centers on the still-lingering eMudhra CA distrust plus a Python update bundling four interpreter versions, while fence-agents Criticals and 145-CVE Firefox pushes show up across RHEL, Oracle, Rocky, and AlmaLinux. The practical advice: patch Alpine sshd and restart the daemon, grab the APT fix even on old releases, and pull Fedora's Python update first.
KDE shipped KDE Gear 26.08.3 on November 5, 2026, a maintenance update touching more than 180 applications and dozens of libraries. There are no new features; it's a bugfix pass that patches crashes, closes regressions, and hardens code. The standout changes include a security hardening sweep in KDE Connect and major stability fixes for the Kdenlive video editor.
Strata 0.2.11 shipped on 5 November 2026, adding seven new Unsloth model files compressed from roughly 1-bit to 4-bit that let you run Alibaba's 125-billion-parameter Qwen3.8-Flash-Next on hardware with as little as 12 GB of VRAM. The release also speeds up prompt processing by up to 70% on NVIDIA cards and 32.7% on four Radeon AI PRO R9700 cards, while fixing multi-card starts that previously failed outright. A standout change is a privacy fix for issue #2892 that stops replies from being routed to the wrong user, along with conversations now saved as files instead of browser storage. It's the most feature-rich release from Niko Veit's fast-rising project, though the numbers are self-reported and low-bit quality still has limits.
Alpine Linux released four coordinated point updates today, fixing a critical OpenSSH flaw that lets attackers log in without a password using just a single, unusually long login attempt. The bypass works when sshd runs without PAM, password authentication is enabled, and at least one account has a scrypt or SHA hash nearby, which covers a lot of default Alpine setups. Alpine shipped the fix via OpenSSH 10.6p2 while still patching the now-EOL 3.21 branch and backing all the way down to 3.16, alongside a separate apk-tools crash fix spanning both package-manager generations. If you run sshd, upgrade with apk upgrade -U -a and restart the daemon, since the running service keeps serving the vulnerable code until you do.
Today's reviews are dominated by value, with six of eight new products pitched as more features per dollar. The standouts include a $49 NZXT S5 RGB case that ships with a 360mm fan, the ~$80 Cougar DUOAIR RGB, which cools GPUs better than pricier cases, and the £779 Philips Evnia Penta Tandem QD-OLED monitor that earns a 4.5/5 despite US unavailability. Keyboard makers are pushing silent tactile switches with the be quiet! Light Mount TKL and EPOMAKER RT75 both landing under $120, while the Logitech G Pro X3 mouse is praised as better than its predecessor yet deemed not worth $200. Storage gets an affordable entry into PCIe 5.0 with Kioxia's DRAM-less QLC Exceria G3, though sustained performance and endurance remain the catch.
NVIDIA released its first Linux R620 production-driver build, 620.70.06, and it's mostly here to tidy up messes rather than add features. The headline fix resolves the Assassin's Creed Shadows hang that had plagued Linux gamers for about three months. It also patches Final Fantasy VII Rebirth crashes, improves Wayland performance, and fixes a kernel crash on servers. NVIDIA says it's a sensible upgrade from the 595 series, though users should confirm GPU and distro compatibility first.
LXQt 2.5.0 shipped today, with its newest feature release bumping the Qt floor to 6.10 and cutting its final LXDE tie by folding menu-cache into libfm-qt. The terminal stack took the brunt of the development, gaining background images, OSC-8 hyperlinks, a visual bell, and range selection. The maintainers also honestly flagged an X11 regression from libkscreen-6.8 and promised a point release to fix it. Available across virtually every major Linux distribution, the update keeps LXQt current without losing its lightweight ethos.
Simple Taskbar 7.2.0, a popular GNOME Shell extension, released today with a new settings search box and a batch of panel and geometry improvements. The update reads as a polish-and-usability release rather than a feature bomb, refining icon magnification, adaptive sizing, and fixes for vertical and multi-monitor setups. It supports GNOME Shell 48 through 51, collects no telemetry, and is available for free through the GNOME Extensions store or by building from source.
AM version 10.7 has pushed its AppImage package catalog to 9,233 unique applications, more than doubling since the September 10.5 build. That surge comes largely from an improved -t template option that automates the creation of install scripts for GitHub-hosted AppImages, reportedly generating 15 scripts per minute. The real drama, though, is a public falling-out between Sala and the upstream AppImage maintainers over stricter validation in appimagetool, which now turns warnings like broken icons into hard build failures. Rather than reconcile, Sala forked both appimagetool and type2-runtime and shifted to Pkgforge's implementation, a split many are reading as an early fault line in the fight over Linux desktop packaging.
Bottles 67.6, the latest stable release of the open-source tool for running Windows apps and games on Linux. The update lets you move and duplicate bottles into custom locations, adds per-bottle notes, and introduces three new DPI scaling modes. Its most technically interesting work deepens UMU integration, letting you run Proton games outside Steam with optional launch controls and in-library download progress. A broad sweep of fixes rounds out the release, tackling interrupted downloads, Battle.net relaunch loops, Fsync/NTSync toggling, and external-drive import regressions.
Ungoogled-chromium released version 157.0.8103.38-1 today, marking a rare all-platforms build that covers Linux, Windows, and macOS rather than the usual Linux-only drop. The version inherits Chromium 157's unusually large haul of 213 security fixes, seven of which are rated Critical and target graphics and rendering subsystems. As a de-Googled fork, it strips out Google's background requests and services, giving privacy-conscious users stock Chromium without the phone-home behavior. Users must accept trade-offs like no auto-updater, no Widevine DRM, and cookies that clear on close, but can install it through most package managers or build it from source for a fully verifiable copy.
Shelly ALPM v3.2.0, codenamed "The Bug Bash," shipped today as a targeted bug-fix pass over one of the project's most aggressive rewrite cycles. It follows the introduction of RLPM, a from-scratch Zig reimplementation of Arch's libalpm that Shelly quietly developed while it became CachyOS's default package manager. The release corrects real regressions, including a Flatpak elevation break, a stuck tray icon, broken restart detection, and flaky AUR builds, while tucking in features like multi-package downgrades and live download-speed readouts. It's not a feature-heavy update, but the project's candor about its still-incomplete libalpm compatibility makes it worth paying attention to as it now serves hundreds of thousands of users.
Liquorix maintainer Steven Barrett tagged kernel 7.2-25 on GitHub November 4, another release built on top of upstream Linux 7.2.15. The release centers on four patches to the custom sched/alt scheduler that tighten task placement on cores and refine "sleep credit" priority boosts. It's a maintenance and refinement release rather than a feature bump, aimed at shaving microseconds off wake latency to make interactive workloads feel snappier. Liquorix remains a single-maintainer, AMD64-only kernel that improves responsiveness in gaming and A/V production while trading some raw throughput.
Canonical released Mir 2.31.0 on 4 November 2026, a stabilization update to the open-source display-server library built from 366 commits across 21 contributors. The release bumps no library ABIs and removes no public APIs, sending a deliberate signal that it's a safe upgrade for integrators. Headline changes include a freely positioned on-screen magnifier, a new output-configuration API, and experimental privacy-preserving buffer-capture support. Mir keeps powering Ubuntu Frame, Miriway, and Ubuntu Touch as the project edges toward a fully Rust-based compositor on its published roadmap.
2026-11-04
Zed Industries rolled out Zed 1.27.0 today as an incremental stable update that arrives months after the editor's 1.0 milestone. The round centers on AI and Git refinements, trimming memory and CPU in the Agent Panel while making commit suggestions echo your repo's own style. It also ships two breaking shifts: a bump to macOS 12.0 Monterey as the new minimum and the retirement of agent "checkpoints" that tended to stall large repositories. Much of the work came from outside contributors, part of the open-source engine that sustains Zed's weekly cadence even as its ecosystem lags behind VS Code.
Valve pushed SteamOS 0.5.7 to the Steam Frame's beta channel today, bringing a tracking fix for pose prediction, WebXR support in Chromium 157, and an audio repair that stops speakers from cutting out when an app accesses the microphone. The update rides along with SteamVR 2.19.1 for better streaming image quality, adds a 30-second display dim before sleep, and gives the Frame Controllers correct 0% battery reporting. However, the most-discussed change is the quiet removal of Advanced Supersampling support, which Valve never explained. The update is opt-in only and ships to stable later, but it does so alongside a reported foveated-streaming regression in the underlying SteamVR build.
MangoWC, the lightweight Wayland compositor known as "dwm but Wayland," released version 0.18.5 today. On paper the tag is a single-line version-string bump, but it quietly bundles two weeks of work spanning 13 commits from three contributors. The update adds a cross-monitor special-tag option, exposes output transform via IPC, and fixes resize stutter, XWayland mapping failures, and Electron tray icons that vanish on restore. It's a maintenance patch in a fast-moving 0.18 series, signaling the project is moving into steady-state growth rather than another major feature drop.
On November 4, the Apache NetBeans project published RC3, the third and final release candidate for NetBeans 32 before its general-availability launch. Released as a small bug-fix-only build via commit fc5046f, it delivers three maintenance fixes including an AI-assisted annotation fix from the project's first-time contributor mvanhorn. RC3 also carries a recurring warning for plugin developers, since MIME-type content types for editor kits will break on JDK 27 and later.
ML4W OS 2.17, released today by Stephan Raabe, adds a macOS-style app switcher triggered by ALT + Tab to his popular Hyprland dotfiles package. The update also brings a wallpaper carousel, a window-mode toggle, microphone and audio-output controls, and a redesigned screenshot menu. Most tellingly, default apps now install only on the first setup instead of with every update, preserving deliberate user changes. As one of the most populated Hyprland configs at ~5,080 stars, the quality-of-life release reinforces ML4W's push toward polished, cross-distro desktops.
Mir's automation bot tagged v2.28.1-rc, beginning the freeze on Canonical's next maintenance release. The candidate carries practically nothing new: just three commits touching packaging and CI files, with no feature or bugfix additions over Mir 2.28.0. ABI stays intact, so shell authors and packagers needn't recompile anything to track the update. Those who want to test it can grab it from the ppa:mir-team/rc PPA, with the stable 2.28.1 expected once release-candidate testing clears.
VS Code 1.145 reached the Stable channel today, pushing the editor further into "agent host" territory with sessions that survive across windows, machines, and folder closures. The biggest additions are remote agents that feel local, cron-powered scheduling for recurring automations, verbosity controls to mute chat noise, and the ability to mix different AI harnesses in a single session. On the enterprise side, organizations now get authoritative MCP allowlisting, blocked uninstall for managed plugins, and clearer sandboxing guidance. Microsoft also trimmed several tools from the Local harness, shipped two bug fixes, and included a throwaway Blobby jump game.
Six freshly reviewed products from early November 2026 all share an uncomfortable theme: the RAM and storage crunch has pushed memory to five times last year's price and SSDs to roughly double or triple. The ASUS ROG Xbox Ally X20 OLED at $1,299 wins on its OLED screen rather than raw speed, yet reviewers still call the $300 bump justified given the market. Other standouts include the $99.99 Sudokoo SK700V MACH cooler with a live display, the four-foot-tall Bambu Lab H3C tool-changer printer at $2,499, the Beelink ME Pro 4 NAS with a buggy App Center, and the $175 Patriot VP4300 Lite budget SSD. With raw specs no longer justifying climbing prices, vendors are now differentiating through clever features like screens, tool-changers, and custom operating systems instead.
A wave of security updates swept Linux distros, with Ubuntu, Red Hat, Oracle, SUSE, Qubes, and several others pushing patches. The most alarming is Qubes QSB-121, which fixes a Xen flaw (XSA-523) that lets a malicious qube read and write arbitrary memory in other qubes and dom0. Images and HTTP libraries recur throughout the batch, featuring critical Pillow fixes across Oracle and SUSE alongside 31 new CVEs for curl, while kernels dominate the Ubuntu, Oracle, and Red Hat releases. Patch Pillow, update curl, don't skip the kernel bumps, and prioritize the Qubes fix since most of this reaches you through your distro's normal patching.
Bazzite, the Universal Blue gaming distro, just released its first stable image built on Fedora 45 (45.20261103), landing at 23:01 UTC on November 3, mere hours after Fedora 45 reached general availability. The rebase jumps GNOME from 50 to 51, KDE Plasma from 6.7.5 to 6.8.2, and the OGC kernel to 7.2.15-ogc1.1, plus upgrades PowerStation, Mesa, and Nvidia LTS drivers. A follow-up patch (45.20261104) arrived just an hour and a half later, adding only a one-line Secure Boot warning for Steam Deck and Steam Machine users. Universal Blue advises pinning your current deployment before upgrading, since crossing a Fedora major-version boundary can complicate rollbacks despite a 90-day image retention window.
GIMP 3.2.8 shipped as a focused maintenance release rather than a feature-packed upgrade. Its standout fix restores "Offset" as a non-destructive filter that had been accidentally disabled in an earlier 3.2 update. The patch bundles dozens of other refinements, from fixed RTL text editing and faster large-gradient handling to a transparent look at a wave of security reports. It's now available for free download on Linux, Windows, and macOS.
Rails shipped two coordinated security releases this week, 8.1.4.1 and 8.0.5.2, patching 21 issues across nearly every subsystem in a single batch. A Critical 9.8 flaw in Active Storage dominates the list, letting attackers read and write arbitrary files through ImageMagick and potentially reach remote code execution. Most of the remaining issues sit in the Medium and Low range, including an XSS cluster in Action View's text helpers and a Strong Parameters bypass. The bigger story is the calendar: security support for Rails 8.0 ends on 7 November 2026, just three days after these releases, making 8.0.5.2 likely the final 8.0 security patch.
The PHP Group shipped three release candidates at once, with 8.6.0 RC5 being the final one before 8.6.0 goes general availability on 19 November 2026. The two older lines got their next maintenance candidates too, 8.5.13 RC1 and 8.4.28 RC1, each inheriting fixes for the two critical RCE vulnerabilities disclosed on 21 October. 8.6's headline feature is partial function application, letting you pre-fill arguments with ? or ... placeholders, while the RC-level changelogs are dominated by the usual memory-safety and JIT fixes. All three are test software, not for production, and should release as stable versions within days if no blockers turn up.
[ Archive ]
