Xorg Server 26.0.99.902, the second release candidate for the standalone 26.1.0 branch, arrived today, alongside a coordinated launch of Xwayland RC2. The release breaks backward compatibility with video drivers and extensions, bumping the VIDEODRV ABI to 28.0 and the EXTENSION ABI to 11.0. Security receives notable hardening through Olivier Fourdan's request bounds checking for malformed X Input resolution data, while Lukáš Lipinský fixes critical byte-swapping bugs for big-endian architectures like PowerPC. On the usability front, the X server now includes a Proton 8 refresh rate workaround and drops autoconf support in favor of a strictly meson-based build system.
Zed Editor has released v1.19.2, a rapid patch build arriving just four days after the previous stable version with major IDE-parity features like LSP call hierarchy and multi-select in the Git panel. The update enables project search-on-type by default to mirror ripgrep --watch, though users can revert to explicit triggers by toggling search_on_type to false in their settings. AI integrations deepen with OpenRouter effort budgets, streaming fixes for OpenAI-compatible providers, an Ollama model detection correction, and a refreshed GPT Luna trial.
Jos Dehaes just released YServer 1.5.0, a Rust X11 server that jettisons 25 years of Xorg legacy code for a cleaner DRM/KMS-native approach. Direct compositor scanout cuts latency, while reverse-PRIME handles hybrid laptop GPUs. The project now builds binary packages for aarch64, adding Apple Silicon and Snapdragon support alongside x86_64. Installation is available via the AUR, Fedora, Debian, and Ubuntu, though you should treat this as an early-stage project given its ~559 stars and solo development.
Node.js just shipped v26.8.2 and v24.21.0 “Krypton” within 24 hours, both carrying the OpenSSL 3.5.8 upgrade and routine dependency bumps. The LTS release stands out with a new STORE loader for hardware security modules, an NSS root certificate update, and notable speedups for URL parsing and HTTP responses. Meanwhile, the current v26 line focuses on internal cleanup, deprecating Server.prototype._listen2, updating Undici to 8.10.2, and improving riscv64 build flags. If you run production workloads, upgrading to v24.21.0 is the smart move before the Maintenance LTS window closes in April 2028, while developers can grab v26.8.2 for the latest Undici behavior and build fixes.
System76 has tagged COSMIC Epoch 1.8.0, pinning the Rust-based desktop environment to its latest development commits across more than twenty submodules. The release centers on a major overhaul of the cosmic-comp compositor, adding tablet emulation support, libei pasteboard sharing, and a new corner radius protocol for rounded window borders. Outside the compositor, users will find improved Bluetooth alias handling, a fixed audio source volume slider, and multi-factor PAM login chaining in the greeter. While Pop!_OS ships these updates through its internal pipeline, the epoch tag provides Arch, Fedora, NixOS, and other distros with a reliable coordinated snapshot.
Olivier Fourdan has announced Xwayland 26.0.99.902, the second release candidate for the upcoming 26.1.0 stable release, targeting testers and packagers ahead of a September or October launch. The update modifies 17 files across 15 commits, featuring critical fixes from Jeremy Huddleston Sequoia that prevent server crashes caused by divide-by-zero errors and out-of-bounds reads in malformed keyboard keymaps. Lukáš Lipinský also addressed byte-swap issues in the X Input Extension that corrupt scroll and valuator data for cross-endian clients connecting over TCP, while additional patches resolve cursor warping null-dereferences and memory safety issues in the core server. As the standalone Xwayland build cadence continues to outpace the monolithic xorg-server tree, this RC2 signals the team is actively closing gaps based on RC1 feedback before the final stable release.
Visual Studio Code 1.137 launched today, introducing the Agent Host architecture and an open protocol to decouple AI sessions from workspaces so they can survive folder closures and run remotely over SSH. The update rolls out scheduled Automations for recurring tasks, an experimental Voice Mode for hands-free agent interaction, and tighter GitHub Issues and Pull Request integration directly inside the Agents window. While the heavy agent features target power users already running AI workflows daily, the new architecture provides the portable, protocol-defined lifecycle necessary to make autonomous coding agents practical.
OpenSSL 4.1.0-alpha1 drops as the first preview of the next feature-heavy release, landing atop the hardened 4.0.2 base. The update finally delivers full DTLS 1.3 support, standardizes GREASE protocol handling, and expands the SSL listener API to cover DTLS alongside QUIC. Significant performance gains come from AVX-optimized post-quantum cryptography operations on x86_64, PowerPC, and s390x, alongside deprecated configure flags and removed legacy Windows build targets. Upgrading from the 4.0 line requires careful testing, as certificate validation defaults now favor SANs over CNs and EC key handling has been standardized per RFC guidelines.
Samba 4.24.7 is now available as a stability-focused point release addressing ten tracked bugs discovered since the previous update. The release primarily targets the internal DNS stack with fixes for UDP-to-TCP fallback failures, unwanted record scavenging on disabled zones, and EDNS negotiation issues. Additional patches resolve silent POSIX ACL errors on Windows shares, inactive cluster node recovery conflicts, and stream handle state corruption. While this release contains no new CVEs, it arrives shortly after Samba published 4.25.0rc2 for previewing the next development branch.
VSCodium 1.135.06055 is bringing the full VS Code 1.135 feature set to the open-source fork, including a new "Rubber Duck" AI experiment and an agent host architecture that lets multiple windows share a session. The release offers 164 build assets across eight CPU architectures while officially restoring 32-bit ARM support for older Linux devices. Four first-time contributors landed patches this cycle, including an "anylinux" AppImage variant and a critical fix for macOS sandboxing quirks. If you're running a locked-down enterprise environment, the build keeps auto-updates disabled by default and preserves the option to ship MSI installers without Microsoft telemetry.
Legendary has dropped version 0.21.1 "Lowlife (hotfix)," a focused September 8 release that backports several fixes from the Heroic Games Launcher fork into the upstream CLI client. The update shrinks standalone Linux binaries by roughly 75 percent, restores wrapper executable detection for Rockstar titles, and finally enables Flatpak sandbox compatibility for Ubisoft and EA App launchers.
Systemd v262 RC2 landed on September 8 with first-class support for Linux kernel Live Update Orchestration, allowing service file descriptors to persist straight through kexec reboots without dropping connections. The candidate also cements Varlink as the primary IPC mechanism across nearly every component, while introducing systemd-imdsd for local cloud metadata access and a lightweight new OS installer. Security gets a major boost with systemd-vmspawn supporting both AMD SEV-SNP and Intel TDX, plus a complete overhaul of the TPM subsystem for measured boot and credential sealing. The final v262 release tracks for late September, though the rate-limit clock switch to CLOCK_BOOTTIME means maintainers should test suspend/resume behavior before deploying to production.
ChrisDKN has released Amethyst Mod Manager v2.4.3, delivering a supply-chain-aware fix that resolves a critical breakdown in the Tales of Two Wastelands installer for Linux users. The patch replaces the previous release-only asset polling with a robust GitHub Actions artifact fallback that validates SHA-256 digests and enforces main-branch integrity checks. Built on PySide6, this Linux-native, MO2-style tool now supports roughly one hundred games and sits past 1,002 GitHub stars after just under eight months of development. Alongside the stable release, the developer dropped v2.5.0-beta.2, introducing Wabbajack modlist browsing, batched download optimizations, and a refreshed UI layout.
Microsoft released Visual Studio Code 1.136.2, delivering quick patches for two distinct issues introduced just days ago in the 1.136 feature drop. The update resolves a session state bug where Copilot Agent Host sessions would remain stuck in an "In Progress" state after subagent completion, alongside a regression fix for the tab close button that could accidentally trigger "Close Others." These refinements build on the 1.136 release's major architectural shift toward agent orchestration, which introduced the open Agent Host Protocol and experimental features like Agent Merge for automating pull request reviews. Developers can install the patch immediately via the auto-update mechanism or manually from the official downloads page to ensure their multi-root agent sessions behave correctly.
PHP 8.6.0 Beta 3 has been tagged, locking in the feature set for the upcoming stable release with automatic closure optimizations taking center stage. The update delivers measurable performance gains through stateless closure caching and static inference, alongside quality-of-life additions like a new clamp() function, #[\Override] for constants, and stricter stream error handling. Infrastructure requirements are raising the floor to autoconf 2.71 and modern database servers, while officially marking the end-of-life for PHP's bundled Oniguruma regex engine. The team is already exploring aggressive additions for 8.7, including primary constructors, function autoloading, and native JSX-style markup syntax.
PHP 8.5.11 RC1 and PHP 8.4.26 RC1 have been released for testing, delivering maintenance fixes including security hardening and memory safety improvements since the August 27 stable releases. The PHP 8.4 branch features a notable buffer overflow fix in hash_pbkdf2() that could allow heap corruption. PHP 8.5.11 addresses extensive use-after-free and double-free bugs across DOM, Phar, and Intl extensions, alongside Opcache race conditions and JIT crash resolutions. While no new CVEs are reported, users are urged to test these candidates promptly, with the 8.4 patch particularly important for key derivation safety as the branch winds down.
Postfix has released version 3.11.7, addressing medium-severity security flaws including two distinct SMTP smuggling vectors and critical memory corruption bugs. The vulnerabilities were independently uncovered by OpenAI Security and Qualys using Anthropic's Claude, surfacing defects that have lingered in the codebase for up to 27 years. While the patches are especially important for administrators running smtpd_proxy_filter or Oracle MySQL 8, legacy branches 3.5 through 3.7 will require separate application of earlier June 2026 advisories. Organizations relying on Postfix should update immediately to close remote denial-of-service and data interception risks.
FEX 2609, the September 2026 release of the open-source x86-to-ARM64 emulator by FEX-Emu, introduces a major disk caching subsystem that stores JIT-generated code to disk to eliminate stutter during initial game and application launches. The update also delivers measurable speedups, including a 2x performance uplift on specific SIMD code paths and reduced lock contention, while hardening Wine compatibility by removing risky Unixlib fallbacks and improving exception handling for WoW64 builds. Developers shipped roughly 257 commits from eleven contributors in a single month, reflecting an accelerated pace driven by the complexity of the new caching architecture and stability improvements. Users can enable the experimental disk cache by setting the FEX_DISKCACHE=1 environment variable, though the team warns that applications using self-modifying code may cause the cache to grow unbounded until eviction logic is implemented.
Mirko Brombin released Bottles 67.4, delivering a targeted bug-fix update for the open-source Wine manager on Linux. The changelog ships Soda 11.0-10 and resolves a persistent crash in Blizzard's Battle.net launcher alongside a video playback glitch for KiriKiri visual novels. Flatpak users running version 67.3 will receive the new component bundle automatically through the Components catalog without needing a full app upgrade. With five commits and eight files changed, the release keeps the underlying gaming stack healthy while smoothing over the quirks that actually get in users' way.
Samba 4.25.0rc2 introducing experimental SMB3 Persistent Handles designed to enable transparent failover and continuous availability for clustered Linux file servers. Enabling the feature forces SMB-exclusive share access and disables POSIX interop, so it remains strictly reserved for workloads like clustered databases where application-level reopen times are unacceptable. The release also hardens the Kerberos KDC to AES-only encryption by default for domains at functional level 2008 or higher to close CVE-2026-20833, while bundling new cluster functional levels for controlled rolling upgrades and a raft of DNS and audit logging fixes. It remains a testing candidate rather than a production build, so you will want to verify the tarballs with GnuPG and track blocking bugs on the Samba wiki before the final 4.25 ships.
