PHP 8.6.0 RC4 shipped today, carrying a feature list frozen since the September hard freeze and roughly 50 bug fixes since RC3. It arrived the same morning the PHP team emergency-patched two critical, unauthenticated RCE flaws dubbed "php2shell," which affect every version from 5.4 through 8.5.11.
Zen Browser 1.23.4b as a security-critical stable release built on Firefox 158.0.1. Its most important move is baking Mozilla's OneCRL block directly into the browser, protecting users against the eMudhra certificate compromise even offline or under restrictive network policy. Alongside the security work, Zen adds a "Focus" mode to its per-site Boosts feature and a CSIR PGO performance bump for Windows users. It rounds out the update with a stack of smaller bug fixes and the full MFSA2026-111 advisory, which Mozilla rated high impact.
Strata 0.2.2 runs a 125-billion-parameter model on ordinary consumer hardware with a one-click installer. This update ports the memory-light "Gyro" variant onto Intel Arc and Apple Silicon for the first time, plus faster NVIDIA cards and a new per-GPU role system. The project has exploded in popularity, climbing from under 1,000 stars to roughly 29,600 since its September launch. It's free and MIT-licensed, runs entirely offline, and keeps its blunt honesty by flagging exactly what remains untested.
Visual Studio Code 1.143 makes the Copilot harness the default for new agent sessions, folding Microsoft's AI-agent strategy into the stable build. The release also adds side-by-side model comparison, on-device coding via MAI Code 1.1 Flash, and a tool to reclaim disk space from abandoned worktrees. A big chunk of the update targets IT admins, with managed model defaults, automatic plugin installs, and rules that can force Copilot while disabling Local, Claude, and Codex. Performance upgrades cut the time to open huge chats from up to 35 seconds down to single-digit seconds.
VirtualBox 7.2.22 shipped October 20, 2026, described by Oracle only as "a maintenance release with security-related fixes," with no CVE list published. It landed the same day as Oracle's October Critical Patch Update, strongly indicating it's Oracle's VirtualBox contribution to this quarter's security cycle. VirtualBox 7.1 has been unsupported since March 31, 2026, so those users should migrate to the still-supported 7.2 line. 7.2 users should jump to 7.2.22 to pick up the latest fixes, and ARM VM owners should shut down saved machines before upgrading due to a 7.1-to-7.2 snapshot incompatibility.
OBS Studio has shipped 33.0.0 Release Candidate 3 on October 20, 2026, the final test build before the stable release of this major version. The candidate is mostly bug fixes layered on top of two structural overhauls: a massive CEF/Chromium upgrade for browser sources and a complete rewrite of the plugin loading system. The plugin change is the most user-facing of the bunch, since third-party plugins installed in old locations get a "Legacy" flag and stop working entirely in OBS 34.0.
System76 has released COSMIC Epoch 1.11.0, the latest point release in the fast-launch cycle backing Pop!_OS, landing on October 20 just two weeks after 1.10. The headline change adds xdg-dialog-v1 Wayland protocol support so modal dialogs stop hiding behind other windows, paired with fixes that make the correct GPU get used on hybrid graphics systems. It's fundamentally a maintenance build, though, with three commits repointing dozens of submodules across roughly 15 projects to deliver touchpad gestures, smarter launcher search, and a batch of usability bugfixes. Not a reason to upgrade on principle, but Pop!_OS users will get it through the normal update path while Fedora and Arch users can pick it up separately.
Strata 0.2.1 letting you run Qwen3.8-Flash-Next, a 125-billion-parameter model, on an ordinary gaming PC. It fixes the crashes, stuck downloads, and settings-overwriting bugs from the beta while adding vision support for macOS and Intel Arc, faster downloads, and Docker images. The biggest move is a fixed, checksummed benchmark suite that lets users verify results instead of trusting author-only numbers. But speed and quality still depend heavily on your hardware, quantization tier, and workload, so independent reports range from enthusiastic to skeptical depending on the rig.
Floxlor 2.3.16 shipped today as a standard bugfix release in the project's 2.3 line. The update adds PHP 8.5 support, honors a customer's traffic-privacy setting in the listing endpoint, fixes symlink path handling, and bumps dependencies, but introduces no new features. It lands roughly a couple of weeks after 2.3.15 and nearly two months after 2.3.12, which closed most of the security holes Froxlor picked up in 2026. Those CVEs included a critical symlink-based root-escalation bug and triggered a warning from Germany's CERT-Bund agency.
BlueOnyx published fresh installation media for all three of its active releases, 5210R, 5211R and 5212R, on 19 October 2026. The update is a roll-up of all recent DNF maintenance packages combined with a targeted first-boot bug fix sweep the team called "Four Days of Chasing First-Boot Ghosts." The headline improvement is that fresh DHCP installs now flow straight into the setup wizard and GUI, dropping the old ritual of manually running network_settings.sh in the shell. The refreshed content ships as Netboot and Complete ISOs, VirtualBox and VMware appliance images, and Incus/LXC container images across a global mirror network.
GE-Proton 11-11 shipped as a "Hotfix Release" today, addressing a video playback deadlock, an Easy Anti-Cheat "Untrusted system file" block in Star Citizen and Hunt: Showdown, and a string of protonfixes nits. Tagging commit c0c2ee35, the patch touched three targeted areas within hours of the fuller 11-10 release, with @aderumier credited as the sole contributor. It follows the monumental 11-1 rebase that rebuilt the fork's video pipeline and sparked an AI-assisted-development controversy over CodeWeavers' no-AI-code policy. As always, the only supported build comes from GloriousEggroll's official GitHub repo, with both x86_64 and aarch64 archives available.
Weston 16.0.1 just shipped as a bug-fix point release, restoring Intel's i915 GPU driver to its native DRM backend after a regression broke it on fairly recent Linux kernels. The update bundles about two months' worth of fixes across 17 commits from 8 contributors. It also brings back correct HDR detection for certain Samsung ATNA OLED panels via the libdisplay-info 0.4.0 bump, alongside quieter wins in tearing, tracing, and framebuffer lifecycle handling. There are no new features, and you can grab the tarball right now from the official GitLab release page.
Roundcube released two security updates today, version 1.6.20 for its LTS line and 1.7.5 for mainline, only a minute apart, each fixing 20 recently reported vulnerabilities. Both went out from lead developer Aleksander Machniak, who strongly recommends updating every production installation. The fixes center on email-sanitization bypasses, IMAP and header injection, SSRF, ImageMagick limits, session injection, CSRF and XSS, with a single collective (Squirt1e, Atum, N0b0dy, Gh0u1L5) credited on 8 of the 20. Roundcube says no CVEs are assigned yet but expects them soon, and urges admins to back up first then move to 1.6.20 on LTS or 1.7.5 on mainline.
GloriousEggroll released GE-Proton 11-10 today, a fix release that builds directly on GE-Proton 11-9. The update's Wine upgrade adds syscall emulation and native-syscall handling for Easy Anti-Cheat launchers, advancing the years-long effort to run anti-cheat-protected multiplayer games on Linux. It also repairs a controller regression that dragged Path of Exile down to roughly 50 FPS and cuts ntdll CPU time in Microsoft Flight Simulator 2024 from 24.5% to 19.1%. The community-maintained fork, run by a Red Hat engineer, remains a manual install that trades bleeding-edge fixes for a higher chance of regressions.
Amethyst Mod Manager v2.5.5, the fastest-growing native Linux mod tool, shipped today with a batch of correctness fixes that stop it from reporting failed installs as "successful." The update adds The Sims 3, Star Wars: Zero Company, and Grim Dawn to its supported titles, plus workflow tweaks like .nxm link forwarding and incremental zsync AppImage updates. Built as a native Linux hybrid of Mod Organizer 2 and Vortex, it has gathered roughly 1,300 GitHub stars and 700+ Nexus endorsements since its February 2026 debut.
Systemd maintainers issued four stable point releases, with the others landing yesterday and v258.12 arriving overnight to fold in a cluster of memory-safety corrections. The v258.12 update breaks down into 128 commits touching 188 files, with the bulk of changes landing in core subsystems like automount teardown, job cancellation, and specifier handling, while the memory-safety fixes cover an off-by-one buffer overflow in logind, an off-by-two write in the ndisc packet-builder, sd-bus append overflow protection, journal hash-loop rejection, and a DNS decompression jump limit. The v258 feature baseline behind this release dropped cgroup v1 support in favor of cgroup v2 only, raised the kernel baseline to 5.4, removed the old System V commands, and still carries a large active install base across servers and desktops. systemd runs a "latest version" model with no long-term-support branch, leaving operators to track the rolling point releases, with v262 currently the newest.
MangoWC 0.18.2, a patch release for the lightweight Wayland compositor, shipped today, with six commits all from maintainer DreamMaoMao. Its sole aim is to fix edge-case regressions from the feature-heavy 0.18 series, with no new features and no breaking changes. The fixes include routing stray status-bar clicks away from windows, handling fullscreen requests aimed at specific monitors, and correcting window sizing on startup. Since Mango is source-only software built on wlroots 0.20.2 and scenefx 0.5, users upgrade by rebuilding via their distro's package or the AUR.
Systemd published two stable point releases Saturday, v261.4 at 13:12 UTC and v260.6 at 15:18 UTC, landing within hours of each other. Both are automated, immutable builds that fold in memory-safety and seccomp hardening, though neither announces a brand-new CVE.
Faugus Launcher, the small open-source front-end that lets Linux users run Windows games through UMU-Launcher, released a pre-release on October 17 titled "GPU Selector Testing." It introduces a per-GPU picker that lets you choose a specific graphics chip for each game, replacing the older on/off "Discrete GPU" toggle used for NVIDIA Prime hybrid laptops. The maintainer removed the familiar option and is openly asking users with laptops or multiple GPUs to test the change and report results in GitHub issue #1033 before it reaches the stable branch. The downloadable packages are tiny, but the update matters because it retools GPU selection from scratch, which is a long-standing headache for Windows-game compatibility on Linux.
Valve released SteamOS 3.9.3 Beta, shipping its heaviest pre-release build yet for the Beta and Preview channels. The cumulative update brings Linux 7.2, KDE Plasma 6.7.3, and a switch to the wpa_supplicant WiFi backend, plus fixes for games like ELDEN RING on Intel Panther Lake and Forza Horizon 6 on the Legion Go 2. A quiet package rename from steamos- to holo- signals Valve's push to spread the OS beyond its own devices. The beta installs manually via Settings => System => System Update Channel, but it remains pre-release software aimed at early adopters.
