VSCodium 1.143.17183 dropped today, tracking VS Code 1.143.1 while deliberately stripping much of the Copilot integration Microsoft now defaults into the editor. The maintainer, Baptiste Augrain (daiyam), removed the Copilot API service and telemetry and dropped PR auto-generation from the agent host, though Claude, Codex, and BYOK access remain. Alongside that, the build turns the Modern UI off for a flat classic layout and extends rebranding to installer dialogs in over a dozen languages.
Strata 0.2.5, the viral open-source AI engine released October 25, 2026 by Slovenian developer Niko Veit, lets you run a 125-billion-parameter Qwen model on an ordinary gaming PC without a cloud account or telemetry. The update replaces the old per-GPU installers with a single download per OS that fetches the right engine on first launch, while bringing DeepSeek V4.1-Flash into the desktop app for the first time. A new "Speed" mode trades a barely noticeable quality drop for real speed gains, and a big fix lifts the RAM ceiling so all model experts can stay resident. The project has ballooned to roughly 32,000 GitHub stars, though it draws skepticism over heavy online promotion and the lack of a real minimum-spec benchmark.
The first release candidate for Mir 2.31.0 has been tagged, freezing the public API across all nine shared libraries. Between the 2.30.0 release and this RC, roughly 359 commits landed from nearly 20 contributors, including a new ext_foreign_buffer_v1 Wayland protocol for privacy-preserving screen capture. The release also wires up output configuration, supports libinput 1.32 circular scrolling, and continues hardening Mir's mandatory Rust build. It's a stabilization cycle rather than a disruptive one, so expect the final 2.31.0 to ship once testing confirms the API is solid.
Valve shipped SteamOS 3.9 to stable users, landing across the Steam Deck, Steam Machine, Steam Frame, and compatible third-party hardware. The update rebases the Linux kernel on version 7.2 and bumps KDE Plasma to 6.7.3 in Desktop Mode, while also improving idle battery life on the handheld. It adds early hibernation support (gated behind a driver bug on the Deck), fixes a wide range of WiFi, display, and game crashes, and improves Steam Frame wireless adapter support. A key part of the release also revokes the compromised eMudhra CA certificates tied to the late-October security scandal.
BakAndImgCD 53.0 shipped October 23, 2026 as the newest update to a tiny 4MLinux-based Linux backup-and-imaging distribution. At just 84.9 MB, it boots in BIOS or UEFI and does two things well: saving files and disk images, and rescuing failing drives, powered by tools like FSArchiver, GNU ddrescue, and Partclone. The version tracks the upstream 4MLinux release cycle and inherits its beta-era toolchain, though the announcement itself is deliberately terse with no changelog. It remains a niche tool with modest weekly downloads, competing against Clonezilla and friends by trading size and flexibility for a much smaller footprint.
Strata, the open-source local AI engine, released version 0.2.4 today, letting you run the 763-billion-parameter DeepSeek V4.1-Flash model on a PC with a single 12 GB graphics card and 46 to 64 GB of RAM. It does this by spreading the workload across your GPU, CPU, RAM and SSD, keeping the most-used parts in memory and streaming the rest from your drive. The model is Terminal-only in this release, comes in three heavily compressed sizes from 239 GB to 274 GB, and tops out at roughly 8 to 10 tokens per second on a mid-range RTX 3060. It's free under MIT with no telemetry, though output stays slow on 12 GB cards and the desktop app doesn't get DeepSeek until a later update.
OBS Studio 33.0.0 went stable on October 23, capping off a major milestone release that most users won't even notice directly. The biggest changes are a massive CEF browser-engine jump from version 127 to 150 and a complete redesign of how plugins load and install. Casual users get small-but-real perks like improved source snapping, better numeric input fields, and new audio-monitoring hotkeys, while plugin authors get a harder deadline since legacy plugins must be updated by 34.0.
MangoWM, the lightweight Wayland compositor built on dwl and wlroots, published its 0.18.3 patch release on October 24th. The update brings no new features or breaking changes, just two optimizations to multi-monitor animations and fullscreen blur, alongside three targeted bug fixes. Those fixes address scratchpad ratio sizing, drag-and-drop lag under global VRR, and a community-patched pointer enter issue that had broken slurp's crosshair. Buildable from source, MangoWM also ships packages through Arch, Fedora, Gentoo, Void, and Guix.
Samba 4.25.1 shipped today as a routine point release, but it fixes a genuine access-control bypass flagged as CVE-2026-109411. The team deliberately skipped a coordinated security embargo because the flaw lives only in vfs_ceph_rgw, a module that landed just last month in 4.25.0 and that most servers don't use. Beyond the CVE, the patch bundles twelve more fixes, including three CTDB clustering fixes and build regressions from 4.25.0. Anyone on 4.25.0 using vfs_ceph_rgw should upgrade now, while all 4.23, 4.24, and 4.25 users get the usual bugfix updates.
OpenSSL 4.1.0 shipped today as a feature release that stays API- and ABI-compatible with the OpenSSL 4.0 line, so existing users can upgrade without recompiling. The headline addition is full DTLS 1.3 support (RFC 9147), including a rebuilt listener API and tunables for pending connections and datagram sizes. But the release also documents four known DTLS bugs and had earlier gone to a beta-as-final after two DTLS security issues forced a pause. Alongside that, it adds post-quantum optimizations, GREASE and IKEv2 KDF support, new MSVC 2013 build targets, and drops Windows Itanium and CE builds.
fwupd 2.1.9 has been released from lead developer Richard Hughes, closing a near-monthly feature-release cycle. Of its 54 commits, the bulk are defensive memory-safety fixes aimed at fuzzed device protocol parsers, continuing fwupd's long hardening push. The public-facing changes are modest, adding server telemetry, per-device Redfish instance IDs, a libusb 1.0.27 build floor, and a single PixArt touchpad.
Strata 0.2.3 shipped today, giving the open-source engine that runs a roughly 125-billion-parameter model on a gaming PC a genuine Intel Arc package plus a 6% to 19% speed boost on AMD's Strix Halo chips. The update also tames coding agents choking on oversized contexts, with a scripted 64K test keeping peak prompt usage at 61% of the window versus 83%, while a new opt-in DFlash2 drafter nominally trades a 1.6 to 1.8x speedup the maintainers still treat cautiously. Minimum specs remain steep at 32 GB of combined RAM and VRAM, though 64 GB unlocks every model size and quantization. It's MIT-licensed with no telemetry and local-only storage, but there's still no external security audit and the Windows installer isn't code-signed.
Faugus Launcher 2.5.1 released today, adding a refined GPU selector and dropping two abandoned Proton backends. The update replaces the old "Discrete GPU" toggle with a more accurate per-device picker, which matters most for hybrid-graphics laptops running NVIDIA Prime offload. Faugus also retired Proton-EM and UMU-Proton because neither has been maintained in months, steering users toward GE-Proton and custom builds. Developed almost entirely by one person, the lightweight launcher sits alongside Lutris and Heroic by favoring a simple, fast, attractive interface over raw features.
NetBeans 32 IDE RC2 dropped today as the second of several weekly release candidates, carrying just four maintenance pull requests and a JDK 27 API warning. The real feature set lives in RC1, which shipped on the October 15 feature-freeze with Gradle 9.8.0, SSH-signed Git commits, a new JavaFX FXML library, and Tomcat jumping to 11.x. If the community vote passes cleanly in the November 7 to 15 window, the final GA release is slated for November 15 to 30. It's a textbook example of the project's quarterly cadence, and it's still free under the Apache License 2.0 with nothing feature-gated.
Valve shipped SteamOS 3.9.4 Beta today, primarily to repair regressions that crept into the feature-heavy 3.9 release. The update fixes several genuinely annoying issues, including apps hidden behind Steam's loading screen, screenshots captured at 720p, and a timezone bug that blocked access to Desktop Mode without a reboot. It also adds a security patch revoking certificates tied to the eMudhra private-key compromise, where the breached keys happened to be single-digit numbers like "4." Hibernation work continues but stays disabled on the Steam Deck, and the update points toward 3.9's eventual move to the Stable channel.
Wireshark 5.0.0rc1 is the first major version bump for the packet analyzer in years. The release candidate drops Qt 5 support, ends the odd/even numbering scheme, and adds a new theme engine alongside Zstandard-compressed captures and per-packet process attribution. Deep HTTP/3 dissection rounds out the headline features, though some of it has been available since 4.7.2. The team expects a final 5.0.0 date after SharkFest EU (November 2–6), and packagers should note several breaking changes worth tracking.
Zed 1.25.2 landed on the Stable channel on October 21, 2026, leading with a big cut to executable size that trims 33% on macOS, 28% on Windows, and 7% on Linux. The Rust-based editor strips debug symbols to hit those numbers, quietly answering years of complaints about bloated 220 MB installers on macOS. Security gets real attention too, with a fix that stops secrets like API keys from leaking into your local process list when passed to external agents. On top of the size and safety wins, the patch adds double-clickable inlay hints, faster SSH connections, and compaction for long-running agent sessions.
Node.js shipped a coordinated security release on October 21, 2026, patching ten vulnerabilities across all three supported lines at once, v26.12.1, v24.22.1, and v22.23.4. Four of those are rated High, headlined by a Brotli decompression flaw (CVE-2026-111497) that enables remote code execution and is easy to trigger since fetch() and Express 5 auto-decompress Brotli responses. The release also carries a second meaning, landing the day Node abandons its two-majors-a-year model in favor of one annual, year-numbered release starting with Node 27. With Node 20 and Node 25 already end-of-life and no fixes coming, teams are urged to upgrade to 22.23.4, 24.22.1, or 26.12.1 and rebuild any container or snapshot that embeds the runtime.
Matomo 5.14.2 is core release shipped today, in response to two critical, actively exploited PHP vulnerabilities collectively nicknamed "php2shell." The release closed just two tickets, one flagging vulnerable PHP inside the Matomo UI and another hardening a certificate dependency.
Python pushed three expedited security releases today, 3.15.1, 3.14.9, and 3.13.17, all designed to swap in pip 26.2.2 with certifi 2026.10.19, dropping trust in eMudhra's compromised certificate authority. The CA's eight intermediate keys were useless, generated with private values small enough to guess, which lets attackers forge any website's HTTPS identity. Updating your OS won't fix it, since pip ships its own bundled certificate store, so upgrading pip or one of these releases is the only real defense. If you're on a pip older than 26.2.2, install the update from a pinned checksum URL and rebuild any container images that pin old versions.
