Shelly ALPM v3.0.4 shipped today, introducing the project's first dedicated terminal interface alongside a completely redesigned unified search flow for the AUR, official repositories, and Flatpak. The drop arrives just five days after v3.0.3, continuing a breakneck six-release cadence in two weeks following the July 29 Zig rewrite that completely eliminated the .NET runtime. Flatpak users get end-of-life detection, remote branch resolution, and a cleaner uninstall workflow, while polished shell completions and new CLI man pages target terminal power users who prefer direct libalpm integration. The update is live now for CachyOS via sudo pacman -S shelly and is also available through the AUR or as standalone tarballs on GitHub.
Zed Editor v1.15.0 ships with self-hosted sweep-next-edit model support for private AI inference, a new git.diff_base setting to toggle diff baselines against default branches, and Wayland drag-and-drop for Linux. The update brings linked editing for custom JSX/TSX elements, Emmet completions in arrow functions, and 11 contributions from the Zed Guild community. Copilot users must re-authenticate as Zed decouples session management for chat and edit predictions to reduce credential blast radius. The release underscores Zed's continued sprint toward production parity, combining tighter Git workflows with expanded private inference options.
Bazaar 0.9.3 is a maintenance update for the Flatpak-first app store, arriving just seven days after the feature-heavy 0.9.2 release to stabilize the newly introduced background daemon. The update brings Flathub's curated topic sections to the home page for improved discovery, alongside significant accessibility improvements led by contributor Alexander Vanhee, such as fixing screen reader button double-reading. Released on August 12, 2026, this rapid iteration addresses post-launch bugs in the auto-update system and autostart services, reflecting the project's active development cycle. Users can upgrade immediately via Flathub, GitHub Actions, or Debian and Arch repositories, keeping their alternative to GNOME Software and KDE Discover up to date.
Mango Wayland Compositor 0.16.0 has been released, adding native touch input and improved XWayland scaling to its dwl-inspired design. Key features include real-time overview updates, xdg_activation_v1 support to stop focus stealing, and a force_render rule for smoother animations. The update also addresses critical stability issues, fixing crashes after system suspend and increasing buffer limits for XWayland clients. Available for Arch, NixOS, and other distributions, the project now sits at roughly 3,456 stars and continues to grow its community ecosystem.
Visual Studio Code 1.133 introduces a dedicated Agent Host process that decouples AI agents from the editor, enabling shared multi-window sessions and remote execution. Microsoft pairs this architectural shift with an open Agent Host Protocol (AHP) spec, positioning the communication layer alongside LSP and DAP to support extensible third-party tooling. The update also delivers developer-friendly features like mixed Anthropic and Copilot model switching in Claude sessions, an experimental toggle to skip GitHub sign-in, and auto-reloading HTML in the integrated browser. The update is now rolling out to Windows, macOS, and Linux, with early testing available through the Insiders build.
Open-source Linux gaming tool Bottles released version 66.1, just hours after its major v66.0 launch. The initial release shipped with two critical regressions that broke game launching inside Flatpak sandboxes and crashed the custom UMU prefix picker. Lead developer Mirko Brombin addressed both issues with a two-commit emergency patch that adjusts Flatpak path resolution and corrects a mismatched method reference in the UMU integration code. The rapid sub-two-hour turnaround highlights both the responsiveness of the single-maintainer project and the ongoing friction of shipping major gaming features to a sandboxed Linux ecosystem.
LACT 0.10.0 has been released, delivering major Nvidia GPU support to the open-source Linux controller tool with new overclocking features including PowerMizer Mode and a Voltage Boost slider comparable to MSI Afterburner. The update brings first-class monitoring for NVIDIA's Blackwell architecture, resolving bogus temperature readings and enabling per-chip memory temperature sensors for GDDR6x and GDDR7 modules on RTX 50-series cards. Usability receives a boost through an interactive setup wizard, Polkit integration for standard authentication, and a new CLI command allowing GPUs to be detached and reattached for virtual machine passthrough workflows. Now available on major Linux distributions and Flathub, this release significantly expands LACT from an AMD-focused utility into a comprehensive multi-vendor GPU management application.
QEMU 11.1.0 has officially landed, wrapping up roughly 3,500 commits and over 111,000 lines of code from 285 contributors. The release is squarely focused on hardening host-mode QEMU, patching at least 12 assigned CVEs across virtio, 9pfs, the dmg parser, and NVMe subsystems. Beyond the security work, you can now hotplug NVMe namespaces at runtime, enable the new sp-mem device for Intel accelerator workloads, and dynamically manage QMP monitors without restarting the daemon. While the new RISC-V IOMMU and VT100 terminal emulator round out the feature set, production deployments should prioritize this update immediately to close out-of-bounds access and memory exhaustion vulnerabilities.
Microsoft released Visual Studio Code 1.132.1 on Tuesday to address seven security vulnerabilities across the Chat, Terminal, Electron, and network subsystems. The patch arrives just six days after the feature-rich 1.132 release, which introduced a major architectural shift via the new Agent Host Protocol. Critical remote code execution flaws were patched in the integrated browser and web URL payloads, while four additional fixes target the expanding AI agent attack surface. Users should force a check for updates immediately to secure their development environment.
Bottles 66.0 drops on Linux desktops with native UMU integration that finally removes the need for external game launchers and separate Wine scripts. The update swaps in ProtoSoda as the default runtime for UMU launches and adds an adaptive launch feature that auto-tunes performance parameters based on the detected application. A new experimental cpak package format offers a lightweight, self-contained alternative to Flatpak without breaking existing sandboxed installations. Flatpak users get quiet but important fixes for NVK detection, SOCKS proxy downloads, and Proton 11 compatibility alongside cleaner onboarding flows and official runner branding.
The PHP project released PHP 8.4.25 RC1 and PHP 8.5.10 RC1 for testing, introducing substantial security hardening across both active branches. The patch sets focus heavily on preventing stack overflows in recursive functions like array_walk_recursive() and DOM operations, while also resolving critical use-after-free vulnerabilities in core extensions. Additional fixes address JIT deoptimizer register corruption, session heap corruption in mod_mm, and various edge cases in PDO_PGSQL, PCRE, and Reflection that previously caused silent memory issues.
PHP 8.6.0 Beta 1 was tagged on August 11, 2025, introducing Partial Function Application, a native Io\Poll I/O API, and a dedicated Time\Duration class. The release enforces stricter error handling across the standard library, replacing silent truncation with ValueError and TypeError exceptions while validating NUL bytes in string arguments. Session security defaults now enable use_strict_mode and cookie_httponly by default, and dozens of legacy functions are officially deprecated ahead of PHP 9.0.
Samba 4.25.0rc1 has arrived as the first release candidate for the next major version of the Samba file server, bringing a significant suite of new features for clustering and security. The headline addition is experimental SMB3 Persistent Handles, which enable transparent failover for high-availability workloads, alongside a mandatory shift to AES-only domain encryption to address CVE-2026-20833. Clustering receives a new functional level mechanism to facilitate controlled rolling upgrades, while global rate limiting and improved CTDB path management further enhance infrastructure reliability. Keep in mind that the persistent handles feature enforces SMB-exclusive access and disables local POSIX client support on affected shares, so administrators should test these changes carefully before deploying to production.
Flatpak released version 1.18.1, a critical security patch addressing ten CVEs that include full sandbox escapes and arbitrary root privilege escalation. The update closes vulnerabilities ranging from symlink attacks on app data directories to an anti-downgrade policy bypass, making an immediate upgrade essential for anyone running OCI images or untrusted apps. Bundled alongside the stability fix, the 1.19.0 pre-release introduces Polkit-authenticated system-wide downgrades, a new coredump listing command for debugging, and a bytes-per-second progress API for UI development. While the 1.18.1 build should be applied across all distributions immediately, developers should test the 1.19.0 candidate in isolated environments before adopting it for production workloads.
GloriousEggroll released GE-Proton11-5 as a rapid hotfix to resolve a critical Easy Anti-Cheat loading regression introduced by the GE-Proton11-4 build. Rebased on Valve's upstream Proton 11 branch, the update restores compatibility for kernel-level anti-cheat middleware required by multiplayer titles such as Monster Hunter Wilds and Hunt: Showdown. The patch arrived just three hours after the previous release and has already accumulated nearly 4,000 downloads on x86_64 systems. Users can update immediately through the protonup utility or by manually placing the archives into their Steam runtime directory.
OpenSSH 10.5 drops just five weeks after 10.4, with the team explicitly crediting a surge of AI-discovered vulnerabilities for triggering faster, on-demand release cycles. The update patches three security flaws, including a critical ssh-agent locking bypass, a realloc use-after-free bug in remote forwarding, and a tunnel restriction gap in authorized_keys. New features include FIDO key usability improvements, an ssh -Z debugging flag, and a hard requirement for NIST P-521 ECC support in default builds. Operators should patch immediately to close active exploitation paths and audit legacy PermitTunnel configurations that previously bypassed restrict keywords.
GloriousEggroll released GE-Proton11-4, a community Proton build for Linux gaming with a focus on controller support. The Controller fixup adds three environment variable modes to use DualShock 4, DualSense and DualSense Edge outside Steam Input, including DS4 spoof, XInput conversion and Steam Input fallback. The build updates Wine, DXVK, VKD3D-Proton and adds Wayland patches, plus video and audio fixes that resolve Street Fighter 6 cutscene crashes and improve Monster Hunter Wilds controller handling. Game-specific patches for Star Citizen, Assassin’s Creed titles, Cyberpunk 2077 and others are included, with ARM64X support and PipeWire ALSA plugin packaging for broader Linux compatibility.
Postfix maintainer Wietse Venema has released Postfix 3.11.6, a stable update addressing medium-impact vulnerabilities including remote denial of service and SMTP policy bypass flaws across the current stable branch and six legacy versions. More than half of the patched defects date back twenty or more years, with several vulnerabilities traced directly to the project's initial alpha release in 1997. The security issues were uncovered by Qualys using Anthropic's Claude Mythos Preview and by OpenAI Security, highlighting a growing trend of AI-assisted auditing in mature C codebases. Administrators are strongly advised to update immediately, while those still running out-of-support branches must also manually apply prior patches for large SMTP inputs and TLSA parsing.
HestiaCP has pushed version 1.10.0-rc1 to its beta repositories, bringing support for Debian 13 "Trixie" and Ubuntu 26.04 "Resolute" to the open-source control panel. Lead developer "eris" confirmed a stable release is targeting the end of this week, provided testers don't uncover major regressions. Upgrading users will need to jump MariaDB to 11.8 first and migrate Ubuntu environments from the deprecated Ondřej Surý PPAs to the new Sury APT layout. The release also formalizes ARM64 cross-compilation support and wraps up the security and backup improvements introduced across the 1.9.x series.
Roundcube has released emergency updates for both its LTS and current stable branches, scrubbing eleven distinct security flaws from versions 1.6.18 and 1.7.3. The patch closes critical attack paths including unauthenticated RCE via the markasjunk plugin, pre-authentication IMAP command injection, Sieve and LDAP filter injection, plus multiple SSRF and persistent XSS bypasses. Security researchers note that the recurring HTML sanitization failures point to a deeper architectural flaw that incremental patches can no longer contain. Administrators should update immediately and disable the markasjunk plugin if it isn't actively needed.
