Devolutions shipped UniGetUI v2026.3.0 on September 15, 2026, its biggest feature release under the company's ownership in a while. The headline updates let you schedule four heavy background tasks—update checks, auto-updates, and local and cloud backups, on independent schedules, plus mark individual packages for automatic updates instead of applying it globally. It also brings real zero-footprint portable mode, expanded Start Menu shortcut controls, and security hardening against PowerShell injection and path-traversal attacks. You can download it from the Microsoft Store, WinGet, Scoop, Chocolatey, or the GitHub Releases page, with Windows, Linux, and macOS builds compiled with NativeAOT.
DXVK 3.1.1 shipped today, about two weeks after the 3.1 update, bringing Adobe Creative Suite support back after a botched SetBackgroundColor call left After Effects 2024 with a blank window. The patch also fixes a shader-compiler crash from ENB shaders, deadlocks in SpellForce 2 and The Sims: Medieval, and a handful of regressions in games like Corpse Party and Rayman 3. There's a recurring warning that some anti-virus software will likely flag the 32-bit builds, though those are almost certainly false positives. At the moment, master is already 21 commits ahead, so this patch is just the latest trim of the ambitious 3.0 rewrite's fallout.
NGINX released nginx 1.30.5 (stable) and 1.31.6 (mainline) today, both fixing CVE-2026-90439, a CVSS 6.9 heap buffer overflow in the HTTP/3 module that occurs only with OpenSSL 3.5.0 and earlier. The vulnerability affects versions 1.29.2 through 1.31.5 and can cause worker-process crashes or limited data corruption, though exploitation is non-deterministic and poses no control-plane or remote-code-execution risk. The stable 1.30.5 is a focused security-and-hardening patch, while mainline 1.31.6 additionally bundles bugfixes and new features like the Control API, JSON module, and predicate locations. Sites serving QUIC on older OpenSSL should upgrade soon, while plain HTTP/2 deployments are unaffected by this CVE.
Oracle released VirtualBox 7.2.18 today as a bug-fix and stability maintenance update rather than a feature drop. The release resolves notable crashes, including blue-screen failures on Windows 11 on ARM after saved-state restores and VM-process crashes on Linux hosts with 3D acceleration. It also adds kernel support for Linux 7.3 and RHEL 10.3, fixes VDI differencing image corruption, and patches a Shared Clipboard filename bug. As a practical maintenance update, it is available now from Oracle's download site, though affected users benefit most over those without existing issues.
Mango Wayland Compositor 0.17.1 shipped today as a corrective patch for a few regressions plus better cursor capture in Wine-backed games. The release quietly bundled 15 commits of new functionality past the 0.17.0 milestone, including a systemd session target, monitor-cycling keybinds, virtual monitor naming, and a global fullscreen idle-inhibition toggle. A versioning quirk is also worth flagging: the meson.build string stayed at 0.17.0 through 14 of those commits, so many bug reports filed against "0.17.0" actually referenced code now part of 0.17.1. There are no prebuilt binaries, so Arch users can grab the rolling git build with yay -S mangowm-git while other distros lag slightly behind.
Systemd v262-RC3, the third release candidate for its v262 development series, is now live and leans hard into security hardening, reproducible builds, and confidential computing. Its headline changes pin TPM-sealed credentials to the TPM's Storage Root Key to block credential-theft attacks and harden LUKS/TPM2 enrollment PINs with Argon2id. The release also lets systemd be built as a single static PID 1 binary for tiny containers and adds Intel TDX support to systemd-vmspawn alongside AMD's SEV-SNP. It ships a long list of backward-incompatible changes operators should plan for, with two features already marked for removal in v263.
Valve pushed two SteamOS updates to its testing channels on September 14, 2026: the 3.8.27 Beta build and an early 3.9.1 Preview, signaling it is polishing the current 3.8 stable line while prepping the next major release. The 3.8.27 Beta takes a narrow scope, fixing a fan-speed bug that reverts to BIOS control until a reboot, which affects both Steam Deck and third-party hardware.
Floxlor released 2.3.14 today as a full security update, with all four changes tagged [Security] in the changelog. Maintainer Michael Kaufmann (d00p) shipped it as the newest entry in a coordinated hardening sweep across the 2.3.x branch, following similar fixes in 2.3.10, 2.3.11, and 2.3.13. The patches close authorization gaps on server-wide reads, an XSS theme vector, CRLF/FTP injection, and cross-admin mail exposure, alongside two regular bug-fixes. Operators should update sooner rather than later, since at least one fix invalidates active sessions and pushes API-key rotation.
Heroic Games Launcher has rolled out 2.22.2, the second emergency patch in its 2.22 series and the one that repairs the breakage the first hotfix left behind. The new release focuses on newly reported Rockstar and Ubisoft regressions while also patching a range of other issues. Its standout addition is umu-driven Steam Runtime support for Linux-native GOG games, alongside a Legendary upgrade to 0.21.1 and several stability and Sideload fixes.
Hestia Control Panel 1.10.5 launched today as a security-focused service release that hardens session integrity, closes read-only-mode bypasses, and reworks config parsing to prevent injection. The maintainer, Jaap Marcus, tagged it the fourth patch in the 1.10.x line, landing about three weeks after 1.10.4. It also ends Debian 11 support and bumps core dependencies like hestia-php to 8.5.10 and OpenSSL to 3.5.8. Admins can update via the default automatic updates or apt-get upgrade, with full changelog details on the project's GitHub page.
Ungoogled Chromium 153.0.8010.36-1 has arrived, catching up with Google's latest Chromium base. The update expands its privacy defenses by tightening domain substitutions for new telemetry endpoints, blocking WebRTC IP leaks, and disabling Federated Identity Management alongside the ongoing Privacy Sandbox initiatives. Maintainer Ahrotahn handled the rapid commit and GPG-verified build, with dozens of patched privacy and fingerprinting protections intact. Users relying on the project should update immediately to close the security gap, especially if they depend on specific JIT toggles or extension flags that shift between builds.
Zen Browser 1.22.1b has landed, bringing cross-device sync for custom workspaces and shareable links for Spaces, folders, and split views to the stable channel. Maintainer mr-cheffy has released the update, riding on Firefox 155.0 and delivering targeted performance tweaks that smooth out scrolling and cut battery drain during video playback. The new shareable links work across all browsers, turning Zen's tab organization into a genuine collaboration tool for teams and researchers.
MangoWM 0.17.0 has officially landed as a milestone release, marking the completion of the Wayland compositor's original feature roadmap. Built on dwl and wlroots, the update brings polish to existing tools like scratchpad animations, dwindle layout improvements, and a toggleable floating workspace while consolidating legacy input directives under a unified devicerule system. With the core feature set now locked down, maintainers confirm that future development will shift entirely toward bug fixes, performance refinements, and long-term stability.
GOverlay 1.9.2 delivering a critical fix for Gamescope compatibility just hours after the massive 1.9.1 feature release. The update targets a regression where the overlay's wrapper behavior could disrupt active sessions on Steam Deck and KDE Plasma Gaming Mode, ensuring stability for handheld users. This rapid turnaround highlights the project's active development cycle, with 13 commits already queued following the tag and a feature-heavy 1.9.1 update that introduced Lossless Scaling and frame generation support. Users can grab the patch via Flatpak, AppImage, or official repositories, as the overlay continues to consolidate Linux gaming performance tools into a unified interface.
YServer 1.5.1 shipped yesterday, delivering four critical bug fixes for the Rust-based X11 display server just two days after its major 1.5.0 update. The patch resolves a DRI3 buffer layout lie that scrambled Chrome's hardware-accelerated AV1 video, corrects a paint path bug that left Java text completely invisible, and stops phantom window drags in OpenBox alongside blank screens in KDE. Maintainer Jos Dehaes is driving the project using Anthropic's 1-million-token Claude model, applying AI-assisted verification to close gaps in Xorg parity without inheriting legacy C baggage. With binary packages ready for Arch, Fedora, Debian, and Alpine, the release proves the modern Rust display server is finally stable enough for daily desktop use.
Linux kernel 7.2.5 and 6.18.51 hit kernel.org on September 11, 2026, each packing roughly 550 commits under Greg Kroah-Hartman’s sign-off. The updates prioritize hardware and security fixes, with a heavy cluster of nouveau patches targeting the new NVIDIA Blackwell GB20x display pipeline alongside multiple ksmbd hardening measures. Memory management, BPF preemption handling, and DAMON subsystem race conditions also made the cut, while several commits this cycle explicitly credit AI coding assistants.
Godot 4.8 dev snapshot 5 has landed, headlining with the long-requested mip-level texture streaming system that loads only necessary mipmap levels to drastically cut VRAM usage in open-world titles. The build also ships a fix for alpha test coverage degradation on distant foliage and a streamlined redesign of the 2D editor toolbar. With feature freeze scheduled for later this month, snapshot 5 serves as one of the final development builds before 4.8 enters its release candidate phase. The update wraps up 78 contributors and 183 changes, continuing the rapid pace set by dev snapshot 4's massive feature dump.
Both systemd v261.3 and v20.5 are now available, delivering a curated batch of upstream fixes rather than new features. The updates bring proper recognition for Linux kernel 7.3's new failfs pseudo-filesystem, alongside updated kernel headers and a refreshed hardware database. Tagged by Luca Boccassi and cherry-picked primarily by Yu Watanabe, both releases are immutable and signed for security. Distributions tracking these branches should pull the patches now, though users seeking LUO/Kexec Handover or the cloud IMDS subsystem will need to upgrade to the full v261 feature set.
GOverlay 1.9.1 has arrived, bringing lsfg-vk 2.0 and MAKO frame generation to Linux gamers seeking lossless scaling without NVIDIA hardware. The update introduces a practical FSR version selector for AMD users, allowing them to switch between the latest builds and RDNA2-optimized variants for older GPUs.
Noctalia v5.1.0 shipped today, bringing a proper annotation-based screenshot editor and native cellular data toggles to the Wayland desktop shell. The update also finally adds WPA2 and WPA3 Enterprise Wi-Fi configuration directly in the control center, closing a long-standing gap for corporate and education environments. Built on a C++ rewrite that slashed memory usage by roughly 80 percent, this release focuses on workflow refinement rather than major architectural shifts. Community engagement sits noticeably lower than the v5.0.1 stable launch, which tells you the project has firmly settled into its maintenance phase.
