Shelly 3.0.0 has launched as a complete rewrite of the Arch Linux package manager, migrating the codebase from C#/.NET to native Zig to eliminate runtime overhead and deliver faster startup times. The release introduces a modular design with Flatpak support as an optional backend, alongside a refreshed GTK4 UI, simultaneous AUR search capabilities, and shell completions for the CLI. Users upgrading from the v2.x line should review migration notes regarding config handling and the renamed keyring tool before proceeding. Installation is available through CachyOS packages or the AUR, with Seafoam Labs already working on repository modification and offline update features for the post-v3 roadmap.
PHP tagged three releases in php/php-src on July 28, 2026, landing PHP 8.6.0alpha3 alongside security patches for both 8.5.9 and 8.2.33. Every active branch received the same synchronized patch set, addressing a stack-based out-of-bounds write in ext/bcmath, a pgsql SQL injection via backslash breakouts, a Phar circular symlink crash, and a libgd vulnerability. The 8.6 alpha cycle brings partial function application, a new clamp() function, and TAILCALL VM support on Windows, with the next snapshot expected around July 30. 8.5 users should watch php.net for the official bulletin, while 8.2 operators need to start planning a migration to 8.4 LTS or 8.5 before the maintenance branch hits end-of-life.
The Samba Team issued coordinated security updates for versions 4.24.5, 4.23.10, and 4.22.11 on July 28, 2026, addressing six vulnerabilities across all active maintenance branches. Two of these flaws, both rated CVSS 8.8 and discovered by OpenAI Security Research, allow low-privilege authenticated users to bypass LDAP access controls and fully compromise an Active Directory domain. Because no workarounds exist for the critical issues, administrators are strongly urged to apply the patches immediately to prevent domain takeover and cryptographic key extraction. The release also resolves additional medium-severity issues affecting DNS TSIG signing, KDC stability, and CTDB clustering protocol integrity.
PixiEditor 2.1.2.1 has officially dropped, bringing a major expansion to its open-source 2D graphics workflow just a year after a complete engine rewrite. The update pushes heavy procedural additions into the node graph, including a Color Ramp, Vector Math, and Random node, alongside long-requested tools like Find and Replace and a Gradient Brush. Built on C# and AvaloniaUI, the free app now ships native builds for Windows, macOS, and Linux, with a paid Steam tier funding ongoing development. It's fast becoming a legitimate alternative to commercial pixel art and vector editors, though the rapid release cadence means you should expect a few rough edges until 2.2 stabilizes.
Valve published Proton 11.0-1b and 10.0-4b on July 28 to add official compatibility for the newly released Steamworks SDK 1.65. Both builds include a networking patch that resolves a persistent 32-bit to 64-bit data alignment issue under WoW64 prefixes. The 10.0-4b drop also folds in a background optimization that trims unnecessary environment variable calls during Steamworks initialization. Linux gamers running either the stable 11.x stack or the older 10.x branch can grab the updates automatically through Steam's compatibility settings.
Hyprland 0.56.1 shipped on July 27, 2026, exactly one week after the massive 0.56.0 feature release, delivering 14 targeted fixes for regressions surfacing in real-world usage. The patch addresses critical stability issues including monitor rotation and mirroring failures, Lua environment corruption that broke third-party module paths, and renderer scale rounding artifacts on HiDPI displays. Developer Vaxry pushed the update rapidly after users reported animation slowdowns and browser crashes, with the team continuing aggressive development by adding 30 more commits to main within 24 hours. This seven-day turnaround highlights Hyprland Corp's active maintenance cadence and corporate sponsorship, leaving early adopters on stable ground as work accelerates toward 0.57.
Fwupd 2.1.7 is now live, closing a trust-boundary vulnerability that let unsigned metadata bypass authorization checks during firmware installations. The release pairs that security patch with a new systemd-pcrlock plugin for UEFI updates, expanded Hardware Security Index attributes for SPI flash and disk encryption, and fixes for several memory safety flaws in core plugins. Enterprise deployments should prioritize the OnlyTrusted metadata enforcement toggle, while desktop users will benefit from tighter D-Bus authorization and a cleaner HSI scoring report. Rolling out across all major Linux distributions starting today, the update is the latest in fwupd's accelerated mid-2026 hardening cycle driven by supply-chain pressure and AI-assisted static analysis.
Auto-Cpufreq 3.1.0 is now available, bringing long-overdue GTK interface parity to its Linux CPU power optimizer. The update introduces a live monitor mode, native Bluetooth boot toggles, and dynamic conservation mode scanning across IdeaPad and Legion hardware. Twelve targeted bug fixes round out the release, addressing security gaps, NVIDIA GPU wake-ups, and missing sysfs fallbacks. You can grab the new build via the AUR, NixOS flake, or Gentoo GURU, with the full changelog posted on GitHub.
GloriousEggroll has published GE-Proton11.3, a rapid-response hotfix for the popular Linux gaming compatibility layer that lands just hours after the massive 11.2 release. The drop contains three targeted patches, including a fix for a wine-wayland virtual device double-input bug, an ARM64 compilation break in the wineopenxr patch, and a second ARM64 failure from x86-only NVIDIA libraries. Those two ARM64-focused fixes signal that the project's build pipeline is actively prioritizing Apple Silicon and Linux ARM support alongside traditional x86_64 desktops. Users can grab the verified tarballs from the GitHub releases page and drop them into their Steam compatibility tools folder or feed them to frontends like Heroic and Lutris.
Zen Browser 1.21.9b has shipped, built on Firefox 153.0 and featuring HDR video playback for Windows, native multi-PDF merging, and EU QWAC/eIDAS compliance for enterprise authentication. The release inherits Mozilla’s massive MFSA2026-68 security advisory, patching 44 CVEs including critical sandbox escapes and use-after-free vulnerabilities. Beyond the underlying security sweep, users will also notice refined container management, Globe-F keyboard support on macOS, and fixes for Space Routing and essential menu friction. The build is available now across Windows, macOS, and Linux, offering a low-friction upgrade for those relying on the productivity-focused Firefox fork.
OBS Studio 32.2.1 landed on July 24, 2026, delivering a targeted hotfix that resolves a Windows game capture crash triggered by lingering hook DLLs after an update. Linux users can skip the DLL drama. You can grab the patched release straight from obsproject.com.
Wine Staging 11.14 has landed, tracking upstream Wine 11.14 and introducing a significant rebased vkd3d-latest patchset that adds descriptor heap support for World of Warcraft Classic and Retail. The release also removes the user32-rawinput-mouse patchset, as upstream Wine now handles absolute-mouse input natively through commit 08f7b746b00c07312a70d2f978d86bc80e6df88a. Alistair Leslie-Hughes tagged the build on July 25, 2026, which rounds out the release with 70+ patch sets and well over 500 individual patches maintained by volunteers. With Wine 12.0 stable slated for January 2027, users looking for improved shader model 6.9 support and fixes for titles like Sea of Thieves should upgrade immediately.
Wine 11.14 landed on July 24, 2026, bringing FreeBSD into the 32-bit Windows era, extending DirectSound to full 7.1 surround, and adding AES-GMAC support for modern TLS 1.3 cryptography. It's the third research release in the 11.x series, arriving exactly two weeks after 11.13 as the project maintains a strict biweekly cadence under Alexandre Julliard. Contributors also delivered a massive msxml3 overhaul, native WoW64 support on FreeBSD, and patchwork fixes for Age of Empires, Word 2016, and Falcon BMS across 21 notable bug reports. The source tarball is available for download now, and with the 14-day release cycle holding firm, Wine 11.15 is expected to land around August 7.
GloriousEggroll has published GE-Proton11-2, a targeted stabilization patch arriving weeks after the extensive media rework in version 11-1. The update introduces wired USB haptic feedback for DualShock 4, DualSense, and DualSense Edge controllers, routing audio through PulseAudio for improved trigger resistance and vibration support. Major game fixes include upstream Valve patches for Marvel Rivals and Diablo IV, alongside resolved audio stuttering in Cyberpunk 2077 and restored video playback in VRChat and GTA San Andreas.
The Document Foundation released LibreOffice 26.2.5 to force a migration off the end-of-life 25.8 branch, which lost security support this past June. While the update retains native Markdown import and export as a major competitive win, it rolls the Skia rendering engine back to experimental mode on Windows and macOS following widespread crash reports. The foundation's development ecosystem continues to grow, with corporate contributors supplying nearly half of the codebase and annual donations jumping 57% year over year. LibreOffice 26.8 RC1 enters testing in August, leaving organizations relying on the 26.2 branch with roughly a month before 26.2.6 closes out the current support line.
Ventoy 1.1.17 shipped on July 24, delivering targeted compatibility updates for embedded Linux workflows and enterprise distributions. The release patches a BusyBox fdisk detection regression, repairs a PATH resolution bug in the Linux installer, and adds explicit boot support for Athena OS, EulerOS, and Proxmox VE in grub2 mode. Contributors also resolved a latent 512-byte buffer shift in the FATFS disk_write callback that could theoretically corrupt sector-zero writes on specific partition layouts. You can grab the Linux tarball, Windows ZIP, or live ISO directly from the official GitHub release page.
GNU Emacs 31.0.91 is the second pretest release leading to 31.1, announced July 23, 2026, and it strips out the legacy unexec dumper while delivering a major completion system overhaul. The update brings a fleet of new window layout commands for rotating and flipping frames, a rewritten flex completion style, and finally enables mouse support by default in compatible terminals. Startup order changes now let site administrators load site-start.el before early-init.el, and native compilation adds a battery-aware option to stop your laptop fan from spinning up every time you save a buffer. Unicode 17.0 support expands internationalization coverage to Tifinagh and Northern Iroquoian scripts, so grab the tarball from alpha.gnu.org and report any bugs to bug-gnu-emacs before the stable release drops.
Apache NetBeans 31 RC2 dropped on July 23 with a deliberately narrow scope, packing only eight targeted fixes after the feature-heavy RC1 build shipped a week earlier. The release candidate stabilizes core subsystems by patching javac partial reparse issues, enabling Payara support on JDK 25, and silencing a flaky LSP test that kept breaking CI. Meanwhile, the broader RC1 update already brought the embedded compiler up to JDK 27b26, added PHP 8.4 Property Hooks, and upgraded Gradle and Maven tooling.
System76 has released COSMIC Epoch 1.4.0, the fifth incremental update to its Rust-native Wayland desktop, with stability fixes landing on July 22, 2026. The update introduces a dedicated cosmic-sound-theme package and delivers 13 patches to cosmic-comp, including fixes for game fullscreen modes, fractional scaling pointer accuracy, and artifact-causing redraws. User-facing improvements span the ecosystem, featuring an MTP fallback in cosmic-files, a search reset in the launcher, and crash prevention in the panel component.
Gear Lever 4.6.2 has been released to resolve a crash when importing AppImages containing literal percent signs like %F or %U in their metadata. The patch disables Python's configparser interpolation in ini_config.py by passing interpolation=None, preventing ValueError exceptions during the save process. Maintainer Lorenzo Paderi merged the one-line fix from PR #489 just ten hours after the issue was reported on Arch Linux. The update arrives during a rapid release cycle for the tool, following 4.6.0 and 4.6.1 earlier in July, and is available now via Flathub.
