Anonymous
2025-08-15 09:51
2025-08-15 09:51
Product
Last Report
Anonymous
2024-07-07 07:01
2024-07-07 07:01
Anonymous
2024-02-07 19:23
2024-02-07 19:23
Anonymous
2026-09-01 09:28
2026-09-01 09:28
Anonymous
2026-07-19 18:49
2026-07-19 18:49
Anonymous
2026-06-11 07:27
2026-06-11 07:27
Anonymous
2019-11-27 17:19
2019-11-27 17:19
Anonymous
2019-11-11 09:02
2019-11-11 09:02
Anonymous
2019-07-21 13:03
2019-07-21 13:03
2026-10-21
Python pushed three expedited security releases today, 3.15.1, 3.14.9, and 3.13.17, all designed to swap in pip 26.2.2 with certifi 2026.10.19, dropping trust in eMudhra's compromised certificate authority. The CA's eight intermediate keys were useless, generated with private values small enough to guess, which lets attackers forge any website's HTTPS identity. Updating your OS won't fix it, since pip ships its own bundled certificate store, so upgrading pip or one of these releases is the only real defense. If you're on a pip older than 26.2.2, install the update from a pinned checksum URL and rebuild any container images that pin old versions.
Simple Taskbar V72 for GNOME shipped today as a polish and stability release focused on performance and multi-monitor geometry. The update caches panel settings, avoids unnecessary button rebuilds, and improves Blur My Shell compatibility alongside ten bug fixes centered on vertical and secondary-monitor layouts.
PHP 8.6.0 RC4 shipped today, carrying a feature list frozen since the September hard freeze and roughly 50 bug fixes since RC3. It arrived the same morning the PHP team emergency-patched two critical, unauthenticated RCE flaws dubbed "php2shell," which affect every version from 5.4 through 8.5.11.
XanMod shipped fresh stable builds across all three of its branches, with MAIN riding Linux 7.2.12 and both LTS and RT following 6.18.58. Each release was personally tagged by solo maintainer Alexandre Frade and built on the latest upstream updates curated by Greg Kroah-Hartman. The MAIN build brings cache-aware scheduling, a revised GPU scheduler, and Btrfs gains, while the 6.18.58 LTS line offers longer-term stability plus a real-time PREEMPT_RT option. Both bundles include backported security fixes, but XanMod warns that proprietary DKMS modules like NVIDIA, OpenZFS, and VMware Workstation may need to be verified before upgrading.
Zen Browser 1.23.4b as a security-critical stable release built on Firefox 158.0.1. Its most important move is baking Mozilla's OneCRL block directly into the browser, protecting users against the eMudhra certificate compromise even offline or under restrictive network policy. Alongside the security work, Zen adds a "Focus" mode to its per-site Boosts feature and a CSIR PGO performance bump for Windows users. It rounds out the update with a stack of smaller bug fixes and the full MFSA2026-111 advisory, which Mozilla rated high impact.
PHP issued an emergency out-of-band patch today for two critical RCE flaws dubbed PHP2Shell, rated 9.2 on CVSS v4.0, and sury.org has already published the builds for Debian and Ubuntu. The four current branches get native fixes, 8.5.12, 8.4.27, 8.3.36, and 8.2.35, while the seven end-of-life branches from 8.1 down to 5.6 get the same protection backported. Since the bugs permit unauthenticated RCE and memory disclosure across every deployment model, PHP says updating is the only reliable fix, though interim steps like disabling session.upload_progress can buy a little time. Operators can update in place with a standard apt command and then restart PHP-FPM or Apache, sidestepping the emergency migration many had feared.
The PHP Foundation released an emergency out-of-band update today, fixing two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, each scored 9.2, that let unauthenticated attackers run code in PHP's native request-parsing layer before any application logic runs. The embargo broke down fast: details leaked to Hacker News ahead of schedule, Cloudflare had already spotted live attacks, and Sansec expects mass exploitation within roughly 15 minutes. PHP's patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the foundation stresses there are no real mitigations, only an update makes you safe, with Apache mod_php being the easiest to weaponize. Analysts note that reliable public exploits remain unproven so far, but the guidance is clear: patch internet-facing PHP first and check logs for signs of compromise.
ISC has released BIND 9.20.30 (stable) and 9.21.27 (development) as its fourth monthly BIND security update of 2026, all four vulnerabilities rated High. One flaw, CVE-2026-94300, carries a CVSS 8.1 score and a working path to remote code execution via GSS-TSIG memory corruption, though exploitation complexity is High. The remaining three flaws are denial-of-service variants rated 7.5, each requiring specific or unusual resolver configurations. ISC says it isn't aware of active exploitation and urges operators on branch 9.18 to migrate to 9.20.
Strata 0.2.2 runs a 125-billion-parameter model on ordinary consumer hardware with a one-click installer. This update ports the memory-light "Gyro" variant onto Intel Arc and Apple Silicon for the first time, plus faster NVIDIA cards and a new per-GPU role system. The project has exploded in popularity, climbing from under 1,000 stars to roughly 29,600 since its September launch. It's free and MIT-licensed, runs entirely offline, and keeps its blunt honesty by flagging exactly what remains untested.
Visual Studio Code 1.143 makes the Copilot harness the default for new agent sessions, folding Microsoft's AI-agent strategy into the stable build. The release also adds side-by-side model comparison, on-device coding via MAI Code 1.1 Flash, and a tool to reclaim disk space from abandoned worktrees. A big chunk of the update targets IT admins, with managed model defaults, automatic plugin installs, and rules that can force Copilot while disabling Local, Claude, and Codex. Performance upgrades cut the time to open huge chats from up to 35 seconds down to single-digit seconds.
The second release candidate for Fedora Linux 45 has been released for testing today as make-or-break media after the project hit a NO-GO on October 15. The candidate must pass release-validation with no blocker bugs at Thursday's Go/No-Go if Fedora 45 is to hit its October 27 ship date. Highlights include the kmscon console overhaul, GNOME 51, KDE Plasma 6.7, kernel 7.2, fully reproducible builds, and default RPM signature enforcement. Testing is mostly green so far, with only image-size threshold flags and pending Security Lab results holding things up.
The Linux kernel project is finalizing four stable releases this week, 7.2.12, 6.18.58, 6.12.114, and 6.6.160, each on a different maintenance track from newest mainline to oldest LTS. All four inherit the fix for CVE-2026-99999, a critical guest-to-host VM escape nicknamed "PwnEscape" that dated back to Linux 2.6.27. Patch volume is staggering, with 6.6.160 carrying 1,674 fixes after nearly three years of backporting while the fresh 7.2.12 needs just 10. Linus Torvalds calls this volume "the new normal," driven by AI-assisted review, and operators' best move is simply to update to the newest point release for their branch and reboot.
VirtualBox 7.2.22 shipped October 20, 2026, described by Oracle only as "a maintenance release with security-related fixes," with no CVE list published. It landed the same day as Oracle's October Critical Patch Update, strongly indicating it's Oracle's VirtualBox contribution to this quarter's security cycle. VirtualBox 7.1 has been unsupported since March 31, 2026, so those users should migrate to the still-supported 7.2 line. 7.2 users should jump to 7.2.22 to pick up the latest fixes, and ARM VM owners should shut down saved machines before upgrading due to a 7.1-to-7.2 snapshot incompatibility.
Eight reviews landed between 20 and 21 October 2026, spanning audio cards, PC cases, an AI laptop, a desk lamp, a gaming mouse, DDR5 memory, a power supply, and a JRPG. The recurring theme was that "smart" features often didn't pay off, from Corsair's underwhelming PureVector aim calibration to NVIDIA's software-dependent unified-memory laptop. Meanwhile a few genuine standouts emerged, including record-breaking Patriot DDR5-9200 RAM and the quiet, monster-cooling Cooler Master HAF II 500 case. Buyers are advised to favor value and verified performance over marketing claims.
A wave of Linux security updates landed across the major distros today, with compromised CA certificates appearing simultaneously in Gentoo, Debian, and Ubuntu. AlmaLinux led with twenty advisories featuring a dangerous X11 display-server release, while RHEL handed out nine Critical fixes that all target .NET. Several distros also patched widely used libraries including libssh, BIND, XZ Utils, and sudo-rs for remote and local code execution. The clear priorities are refreshing your certificate trust anchors and chasing the Critical-rated patches before rebooting.
OBS Studio has shipped 33.0.0 Release Candidate 3 on October 20, 2026, the final test build before the stable release of this major version. The candidate is mostly bug fixes layered on top of two structural overhauls: a massive CEF/Chromium upgrade for browser sources and a complete rewrite of the plugin loading system. The plugin change is the most user-facing of the bunch, since third-party plugins installed in old locations get a "Legacy" flag and stop working entirely in OBS 34.0.
System76 has released COSMIC Epoch 1.11.0, the latest point release in the fast-launch cycle backing Pop!_OS, landing on October 20 just two weeks after 1.10. The headline change adds xdg-dialog-v1 Wayland protocol support so modal dialogs stop hiding behind other windows, paired with fixes that make the correct GPU get used on hybrid graphics systems. It's fundamentally a maintenance build, though, with three commits repointing dozens of submodules across roughly 15 projects to deliver touchpad gestures, smarter launcher search, and a batch of usability bugfixes. Not a reason to upgrade on principle, but Pop!_OS users will get it through the normal update path while Fedora and Arch users can pick it up separately.
2026-10-20
Simple Taskbar V71 reached GNOME users today, and this release is more about polish than new features. Developer Sultech rebuilt the settings panel into visual "settings hubs," added a Spanish translation, and capped window previews at 2000 ms while locking application labels to a 30px minimum. The update also kills several nagging bugs, including a preferences-window crash on profile import and sliders that silently overwrote restored settings. It's a free, GPL-2.0 extension supporting GNOME Shell 48 through 51, and this marks the third month of rapid weekly releases for a project created just in mid-July.
SparkyLinux released SparkyOS onUSB 2026.10 today, its first-ever Arch Linux-based image, bringing the rolling-rolling AUR experience to a portable Linux setup. The system boots entirely off a USB flash drive as a pre-configured .img, so it works like a normally installed desktop without partitioning or installing anything on the host. It runs Xfce on Linux 7.2.11, ships with a default sparky/sparky login, and needs an x86_64 UEFI machine plus a 16 GB+ stick (USB 3.0 recommended).
KDE shipped Plasma 6.8.1, its first Wayland-exclusive point release. The bugfix-only update packs fixes across roughly 40 projects, with the heaviest work landing in KWin, remote desktop, and power management. Most users will feel the change in daily tasks: Windows RDP connections connect cleanly, cursor flicker disappears, and multi-GPU setups stop crashing. It sits between the 6.8.0 milestone and the 6.9 feature release due late February 2027.
Strata 0.2.1 letting you run Qwen3.8-Flash-Next, a 125-billion-parameter model, on an ordinary gaming PC. It fixes the crashes, stuck downloads, and settings-overwriting bugs from the beta while adding vision support for macOS and Intel Arc, faster downloads, and Docker images. The biggest move is a fixed, checksummed benchmark suite that lets users verify results instead of trusting author-only numbers. But speed and quality still depend heavily on your hardware, quantization tier, and workload, so independent reports range from enthusiastic to skeptical depending on the rig.
Floxlor 2.3.16 shipped today as a standard bugfix release in the project's 2.3 line. The update adds PHP 8.5 support, honors a customer's traffic-privacy setting in the listing endpoint, fixes symlink path handling, and bumps dependencies, but introduces no new features. It lands roughly a couple of weeks after 2.3.15 and nearly two months after 2.3.12, which closed most of the security holes Froxlor picked up in 2026. Those CVEs included a critical symlink-based root-escalation bug and triggered a warning from Germany's CERT-Bund agency.
BlueOnyx published fresh installation media for all three of its active releases, 5210R, 5211R and 5212R, on 19 October 2026. The update is a roll-up of all recent DNF maintenance packages combined with a targeted first-boot bug fix sweep the team called "Four Days of Chasing First-Boot Ghosts." The headline improvement is that fresh DHCP installs now flow straight into the setup wizard and GUI, dropping the old ritual of manually running network_settings.sh in the shell. The refreshed content ships as Netboot and Complete ISOs, VirtualBox and VMware appliance images, and Incus/LXC container images across a global mirror network.
SUSE led today's Linux security roundup with nearly 190 CVEs across 17 updates, most of them funneling through Mozilla Thunderbird 153.5's 86 vulnerabilities. Red Hat issued 40 advisories for RHEL 8, 9, and 10, with bubblewrap alone accounting for ten of them as container sandboxing updates swept every support channel. Ubuntu came in with roughly 53 vulnerabilities spanning 5 notices, while curl and OpenSSH drew the most attention with 18 and 9 CVEs respectively. Administrators should prioritize the updates repeated across multiple vendors, webkit2gtk3, curl, OpenSSH, and reboot-required kernel patches, before tackling the rest.
TechPowerUp's review of AMD's Ryzen AI Max+ 395 Strix Halo mini-PC argues it's a local-AI workstation built to run frontier models a 32 GB RTX 5090 physically cannot hold. MSI's MEG CoreLiquid E15 360 pairs a 6.67-inch curved AMOLED with flagship cooling, though its performance verdict is still pending. The rest of the batch is mixed: the IQUNIX EC75 earns a strong 90% Recommended, but the Sennheiser Profile USB carries an unresolved boot-blocking issue while the Cooler Master Elite Gold 850W hides a warranty discrepancy. Taken together, the reviews suggest capacity, real-world compatibility, and fine-print details now matter more than raw spec-sheet numbers.
[ Archive ]
