Anonymous
2025-08-15 09:51
2025-08-15 09:51
Product
Last Report
Anonymous
2024-07-07 07:01
2024-07-07 07:01
Anonymous
2024-02-07 19:23
2024-02-07 19:23
Anonymous
2026-09-01 09:28
2026-09-01 09:28
Anonymous
2026-07-19 18:49
2026-07-19 18:49
Anonymous
2026-06-11 07:27
2026-06-11 07:27
Anonymous
2019-11-27 17:19
2019-11-27 17:19
Anonymous
2019-11-11 09:02
2019-11-11 09:02
Anonymous
2019-07-21 13:03
2019-07-21 13:03
2026-10-22
Wireshark 5.0.0rc1 is the first major version bump for the packet analyzer in years. The release candidate drops Qt 5 support, ends the odd/even numbering scheme, and adds a new theme engine alongside Zstandard-compressed captures and per-packet process attribution. Deep HTTP/3 dissection rounds out the headline features, though some of it has been available since 4.7.2. The team expects a final 5.0.0 date after SharkFest EU (November 2–6), and packagers should note several breaking changes worth tracking.
Zed 1.25.2 landed on the Stable channel on October 21, 2026, leading with a big cut to executable size that trims 33% on macOS, 28% on Windows, and 7% on Linux. The Rust-based editor strips debug symbols to hit those numbers, quietly answering years of complaints about bloated 220 MB installers on macOS. Security gets real attention too, with a fix that stops secrets like API keys from leaking into your local process list when passed to external agents. On top of the size and safety wins, the patch adds double-clickable inlay hints, faster SSH connections, and compaction for long-running agent sessions.
Node.js shipped a coordinated security release on October 21, 2026, patching ten vulnerabilities across all three supported lines at once, v26.12.1, v24.22.1, and v22.23.4. Four of those are rated High, headlined by a Brotli decompression flaw (CVE-2026-111497) that enables remote code execution and is easy to trigger since fetch() and Express 5 auto-decompress Brotli responses. The release also carries a second meaning, landing the day Node abandons its two-majors-a-year model in favor of one annual, year-numbered release starting with Node 27. With Node 20 and Node 25 already end-of-life and no fixes coming, teams are urged to upgrade to 22.23.4, 24.22.1, or 26.12.1 and rebuild any container or snapshot that embeds the runtime.
Eleven Linux distros shipped overlapping security patches today, and the same three stories repeat across nearly all of them. PHP's two arbitrary code execution flaws (CVE-2026-109618 and CVE-2026-109619) turned up on Arch, Debian, Fedora, Gentoo, RHEL, Rocky, Slackware, SUSE, and Ubuntu. A compromised eMudhra root CA forced distros to blacklist the emSign ECC Root CA and Comodo AAA entries, though patching only one of the affected stores leaves you half-protected. .NET claims the largest Critical ratings with patches for 8.0, 9.0, and 10.0, while Ubuntu's batch also sneaks in a .NET 11 release candidate inside a normal security update.
Matomo 5.14.2 is core release shipped today, in response to two critical, actively exploited PHP vulnerabilities collectively nicknamed "php2shell." The release closed just two tickets, one flagging vulnerable PHP inside the Matomo UI and another hardening a certificate dependency.
Liquorix 7.2-21 released on October 21, 2026, built on top of stable Linux 7.2.12 with maintainer Steven Barrett's usual low-latency tuning. Its headline change upgrades the compressed-swap system to "zswap v4 and zram v5," folding in four upstream patches that cut lock contention and speed up memory swapping when RAM runs tight. It's deliberately the most conservative of the project's recent builds, stepping away from the experimental MGLRU-FG memory code shipped in 7.2-20. Gamers and multimedia users can install it via a one-line script.
2026-10-21
Python pushed three expedited security releases today, 3.15.1, 3.14.9, and 3.13.17, all designed to swap in pip 26.2.2 with certifi 2026.10.19, dropping trust in eMudhra's compromised certificate authority. The CA's eight intermediate keys were useless, generated with private values small enough to guess, which lets attackers forge any website's HTTPS identity. Updating your OS won't fix it, since pip ships its own bundled certificate store, so upgrading pip or one of these releases is the only real defense. If you're on a pip older than 26.2.2, install the update from a pinned checksum URL and rebuild any container images that pin old versions.
Simple Taskbar V72 for GNOME shipped today as a polish and stability release focused on performance and multi-monitor geometry. The update caches panel settings, avoids unnecessary button rebuilds, and improves Blur My Shell compatibility alongside ten bug fixes centered on vertical and secondary-monitor layouts.
PHP 8.6.0 RC4 shipped today, carrying a feature list frozen since the September hard freeze and roughly 50 bug fixes since RC3. It arrived the same morning the PHP team emergency-patched two critical, unauthenticated RCE flaws dubbed "php2shell," which affect every version from 5.4 through 8.5.11.
XanMod shipped fresh stable builds across all three of its branches, with MAIN riding Linux 7.2.12 and both LTS and RT following 6.18.58. Each release was personally tagged by solo maintainer Alexandre Frade and built on the latest upstream updates curated by Greg Kroah-Hartman. The MAIN build brings cache-aware scheduling, a revised GPU scheduler, and Btrfs gains, while the 6.18.58 LTS line offers longer-term stability plus a real-time PREEMPT_RT option. Both bundles include backported security fixes, but XanMod warns that proprietary DKMS modules like NVIDIA, OpenZFS, and VMware Workstation may need to be verified before upgrading.
Zen Browser 1.23.4b as a security-critical stable release built on Firefox 158.0.1. Its most important move is baking Mozilla's OneCRL block directly into the browser, protecting users against the eMudhra certificate compromise even offline or under restrictive network policy. Alongside the security work, Zen adds a "Focus" mode to its per-site Boosts feature and a CSIR PGO performance bump for Windows users. It rounds out the update with a stack of smaller bug fixes and the full MFSA2026-111 advisory, which Mozilla rated high impact.
PHP issued an emergency out-of-band patch today for two critical RCE flaws dubbed PHP2Shell, rated 9.2 on CVSS v4.0, and sury.org has already published the builds for Debian and Ubuntu. The four current branches get native fixes, 8.5.12, 8.4.27, 8.3.36, and 8.2.35, while the seven end-of-life branches from 8.1 down to 5.6 get the same protection backported. Since the bugs permit unauthenticated RCE and memory disclosure across every deployment model, PHP says updating is the only reliable fix, though interim steps like disabling session.upload_progress can buy a little time. Operators can update in place with a standard apt command and then restart PHP-FPM or Apache, sidestepping the emergency migration many had feared.
The PHP Foundation released an emergency out-of-band update today, fixing two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, each scored 9.2, that let unauthenticated attackers run code in PHP's native request-parsing layer before any application logic runs. The embargo broke down fast: details leaked to Hacker News ahead of schedule, Cloudflare had already spotted live attacks, and Sansec expects mass exploitation within roughly 15 minutes. PHP's patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the foundation stresses there are no real mitigations, only an update makes you safe, with Apache mod_php being the easiest to weaponize. Analysts note that reliable public exploits remain unproven so far, but the guidance is clear: patch internet-facing PHP first and check logs for signs of compromise.
ISC has released BIND 9.20.30 (stable) and 9.21.27 (development) as its fourth monthly BIND security update of 2026, all four vulnerabilities rated High. One flaw, CVE-2026-94300, carries a CVSS 8.1 score and a working path to remote code execution via GSS-TSIG memory corruption, though exploitation complexity is High. The remaining three flaws are denial-of-service variants rated 7.5, each requiring specific or unusual resolver configurations. ISC says it isn't aware of active exploitation and urges operators on branch 9.18 to migrate to 9.20.
Strata 0.2.2 runs a 125-billion-parameter model on ordinary consumer hardware with a one-click installer. This update ports the memory-light "Gyro" variant onto Intel Arc and Apple Silicon for the first time, plus faster NVIDIA cards and a new per-GPU role system. The project has exploded in popularity, climbing from under 1,000 stars to roughly 29,600 since its September launch. It's free and MIT-licensed, runs entirely offline, and keeps its blunt honesty by flagging exactly what remains untested.
Visual Studio Code 1.143 makes the Copilot harness the default for new agent sessions, folding Microsoft's AI-agent strategy into the stable build. The release also adds side-by-side model comparison, on-device coding via MAI Code 1.1 Flash, and a tool to reclaim disk space from abandoned worktrees. A big chunk of the update targets IT admins, with managed model defaults, automatic plugin installs, and rules that can force Copilot while disabling Local, Claude, and Codex. Performance upgrades cut the time to open huge chats from up to 35 seconds down to single-digit seconds.
The second release candidate for Fedora Linux 45 has been released for testing today as make-or-break media after the project hit a NO-GO on October 15. The candidate must pass release-validation with no blocker bugs at Thursday's Go/No-Go if Fedora 45 is to hit its October 27 ship date. Highlights include the kmscon console overhaul, GNOME 51, KDE Plasma 6.7, kernel 7.2, fully reproducible builds, and default RPM signature enforcement. Testing is mostly green so far, with only image-size threshold flags and pending Security Lab results holding things up.
The Linux kernel project is finalizing four stable releases this week, 7.2.12, 6.18.58, 6.12.114, and 6.6.160, each on a different maintenance track from newest mainline to oldest LTS. All four inherit the fix for CVE-2026-99999, a critical guest-to-host VM escape nicknamed "PwnEscape" that dated back to Linux 2.6.27. Patch volume is staggering, with 6.6.160 carrying 1,674 fixes after nearly three years of backporting while the fresh 7.2.12 needs just 10. Linus Torvalds calls this volume "the new normal," driven by AI-assisted review, and operators' best move is simply to update to the newest point release for their branch and reboot.
VirtualBox 7.2.22 shipped October 20, 2026, described by Oracle only as "a maintenance release with security-related fixes," with no CVE list published. It landed the same day as Oracle's October Critical Patch Update, strongly indicating it's Oracle's VirtualBox contribution to this quarter's security cycle. VirtualBox 7.1 has been unsupported since March 31, 2026, so those users should migrate to the still-supported 7.2 line. 7.2 users should jump to 7.2.22 to pick up the latest fixes, and ARM VM owners should shut down saved machines before upgrading due to a 7.1-to-7.2 snapshot incompatibility.
Eight reviews landed between 20 and 21 October 2026, spanning audio cards, PC cases, an AI laptop, a desk lamp, a gaming mouse, DDR5 memory, a power supply, and a JRPG. The recurring theme was that "smart" features often didn't pay off, from Corsair's underwhelming PureVector aim calibration to NVIDIA's software-dependent unified-memory laptop. Meanwhile a few genuine standouts emerged, including record-breaking Patriot DDR5-9200 RAM and the quiet, monster-cooling Cooler Master HAF II 500 case. Buyers are advised to favor value and verified performance over marketing claims.
A wave of Linux security updates landed across the major distros today, with compromised CA certificates appearing simultaneously in Gentoo, Debian, and Ubuntu. AlmaLinux led with twenty advisories featuring a dangerous X11 display-server release, while RHEL handed out nine Critical fixes that all target .NET. Several distros also patched widely used libraries including libssh, BIND, XZ Utils, and sudo-rs for remote and local code execution. The clear priorities are refreshing your certificate trust anchors and chasing the Critical-rated patches before rebooting.
OBS Studio has shipped 33.0.0 Release Candidate 3 on October 20, 2026, the final test build before the stable release of this major version. The candidate is mostly bug fixes layered on top of two structural overhauls: a massive CEF/Chromium upgrade for browser sources and a complete rewrite of the plugin loading system. The plugin change is the most user-facing of the bunch, since third-party plugins installed in old locations get a "Legacy" flag and stop working entirely in OBS 34.0.
System76 has released COSMIC Epoch 1.11.0, the latest point release in the fast-launch cycle backing Pop!_OS, landing on October 20 just two weeks after 1.10. The headline change adds xdg-dialog-v1 Wayland protocol support so modal dialogs stop hiding behind other windows, paired with fixes that make the correct GPU get used on hybrid graphics systems. It's fundamentally a maintenance build, though, with three commits repointing dozens of submodules across roughly 15 projects to deliver touchpad gestures, smarter launcher search, and a batch of usability bugfixes. Not a reason to upgrade on principle, but Pop!_OS users will get it through the normal update path while Fedora and Arch users can pick it up separately.
[ Archive ]
