Anonymous
2025-08-15 09:51
2025-08-15 09:51
Product
Last Report
Anonymous
2024-07-07 07:01
2024-07-07 07:01
Anonymous
2024-02-07 19:23
2024-02-07 19:23
Anonymous
2026-09-01 09:28
2026-09-01 09:28
Anonymous
2026-07-19 18:49
2026-07-19 18:49
Anonymous
2026-06-11 07:27
2026-06-11 07:27
Anonymous
2019-11-27 17:19
2019-11-27 17:19
Anonymous
2019-11-11 09:02
2019-11-11 09:02
Anonymous
2019-07-21 13:03
2019-07-21 13:03
2026-09-22
A new version of the open-source Nginx CGI module is available, fixing a crash in the cgi_set_var directive caused by unterminated string values bleeding into adjacent memory. The bug produced silent 500 errors and only surfaced under AddressSanitizer, since the project's normal test harness masks the out-of-bounds read. The fix took shape across three GitHub accounts, friendlyanon reported it, and package maintainer dvershinin refined the patch against stock Nginx 1.30.0 after the initial version both failed to compile and introduced its own buffer overflow. The release also rides on the security-focused v0.15, which deprecated the REMOTE_USER variable, and it offers native CGI support across Linux, macOS, BSD, and Solaris without requiring a reverse proxy.
PHP shipped five coordinated releases on 22 September 2026, spanning every actively supported line plus the first candidate for the next major version. The headline is 8.6.0 RC1 from Matteo Beccati, a feature-frozen preview not meant for production. The other four are practical: 8.5.11 and 8.4.26 bundle bug fixes and security patches, while 8.3.35 and 8.2.34 are security-only updates. This cycle fixes a wide range of vulnerabilities, including a FastCGI ACL bypass, OpenSSL hostname-downgrade flaws, and a cross-origin credential leak, so running 8.2 through 8.5 should probably be on your list this week.
Systemd 262 released as the third major version of the year, led by release manager Luca Boccassi. Its biggest moves push trust down to the silicon, binding TPM credentials to the Supreme Root Key and hardening boot PINs with Argon2id to block boot-time interposer attacks. It also deepens kexec-based live updates for zero-downtime reboots and quietly lets systemd run as a lone static binary inside a tiny container. As usual, the release bundles a long list of breaking changes that will break scripts, so admins should check the notes before upgrading.
YServer 1.6.0 has been released today, adding TCP transport, session reset, and XDMCP negotiation so it can replace Xorg in shared, networked desktops. The three headline capabilities let a remote display manager drive a YServer display the way a thin client logs in through Xorg. Both new features ship off by default, with IPv6, host access control, and GLX over TCP left unimplemented for now. Alongside those gains, the release packs a batch of rendering and GLX fixes that improve compatibility with picom, awesome, i3, KDE Plasma, and QtWebEngine.
Node.js 26.10.0 has been released today. The headline additions put two long-requested utilities directly into the platform: util.debounce() and util.throttle(), so developers no longer need to pull them from npm. It also adds crypto.parsePKCS12() for pulling keys and certs out of .p12/.pfx bundles, extends the experimental Virtual File System into node:ffi, and rounds out the release with synchronous Blob support, socket transfers, and SQLite's undefined-to-NULL binding. Alongside these, the release bundles a wide sweep of correctness and crypto-hardening fixes, though it sits in the Current line rather than LTS, meaning you get the newest APIs but no long-term frozen stability.
Mango, the popular open-source Wayland compositor built on dwl and wlroots, just shipped version 0.17.3, its fourth release of the 0.17.x series in just ten days. The update adds a float_full_to_top global option so floating and fullscreen windows can finally share a layer, plus the ability to dim focused versus unfocused windows for clearer focus. Fixes this round cover keyboard keycode bindings, config hot-reload crashes, tag animations, and screen sharing in the Wemeet video app. The rapid cadence once again highlights how this one-maintainer project, led by DreamMaoMao, keeps moving quickly.
Flatpak 1.18.3 released today as a maintenance update focused on security dependency updates and regression repairs rather than new features. It bumps bubblewrap to 0.12.0 and xdg-dbus-proxy to 0.1.8 to close two known CVEs affecting Flatpak's sandboxing and D-Bus communication. The release also fixes a build regression on SELinux systems tracked as issue #6818, along with a flatpak-spawn subsandbox fix and a bundle install crash. Users can install it through their normal package manager or Flathub, though local runtime builders on SELinux systems get the most out of it.
Ubuntu 26.10 "Stonking Stingray" has entered Beta Freeze, with the release team targeting Beta images for Thursday, September 24 and the final release for October 15. The interim release swaps the 22-year default dbus-daemon for dbus-broker, ships the Linux kernel 7.3, and makes coreutils 100% Rust-based. It also adds GNOME 51, a local-first AI speech tool called Myna, and a package-agnostic App Center, though its redesigned installer won't fully land until Ubuntu 28.04 LTS. Beta testers can pull an image from the Test Observer, but several experimental features remain unconfirmed as of the September 22 announcement.
BlueOnyx refreshed installation media for its three active server releases, 5210R, 5211R, and 5212R. The images bundle every DNF update available to date and ship as bootable ISOs, virtual appliance images (VDI/VMDK), and Incus/LXC containers. Highlights include an Easy-Migrate fix, relaxed CLI PHP limits, consistent Opcache defaults, and self-healing Jailkit integrity checks.
Six hardware reviews landed today, spanning Apple's M5 Ultra Mac Studio and M6 Mac mini, ROG audio and motherboards, a Lian Li power supply, and a Vantrue thermal camera. The day's central story is Apple's Mac mini, which jumped $300 to $899 as Tom's Hardware points to AI-driven demand spiking RAM and component costs. Performance keeps climbing across the board, with the M5 Ultra's local AI beating Nvidia's DGX Spark and the M6 delivering a 2nm generational leap. Value, though, is getting thinner, so price-conscious shoppers should hold for end-of-year sales especially on winding platforms like the Z890-I.
Matomo released version 5.14.0 with its headline feature being aggregated real-time counters that keep live dashboards running even when the Visits Log is disabled for privacy compliance. The update also improves the AI chatbot, adds period-level forecasting, fixes long-broken pie charts, and rolls out Tag Manager refinements. Since it contains no major database upgrade, moving from 5.13.x should be low-risk. The stable release arrives just days before the Matomo 6.0 beta, so it stands as the safe line while the team pushes toward the next major version.
XanMod released new stable kernel builds with the main branch at 7.2.7 and the LTS line jumping to 6.18.53. The real-time variant, 6.18.52-rt-xanmod1, landed earlier on 14 September running RT scheduling over the same 6.18 base. These performance-tuned kernels ship LLVM compiler optimizations, memory and scheduler tuning, and a pile of third-party patchsets like Cloudflare's TCP collapse fix and Google's BBRv3. Install them via the official APT repo at deb.xanmod.org, though note that NVIDIA, OpenZFS, VirtualBox, and VMware DKMS modules may lag the latest kernel.
Red Hat shipped 42 security errata across RHEL in a single round, nearly all graded Important, while Ubuntu's Raspberry Pi kernel fix alone tracked more than 200 vulnerabilities. The batch spans the major distros, with Oracle Linux kernels resolving up to 31 CVEs each, OpenSSH leading AlmaLinux's updates, and Fedora flagging a cross-site scripting hole in perl-HTML-FormHandler. A few issues stand out for urgency, especially strongSwan's authentication bypass in Ubuntu and a leaked file descriptor in Slackware's nsenter tool. If any of these packages run on hardware you manage, apply the updates, reboot where required, and check Extended Update Support channels before assuming you're already covered.
2026-09-21
AnduinOS 2.0.3 adding a centralized Control Panel, fully offline voice typing, and a Dracut boot switch to the project's "Resolute Raccoon" LTS line. The Control Panel tidies up the distro's scattered system tools, while the optional whisper.cpp-based voice typing runs entirely locally with no cloud or telemetry. A guarded NTFS-shrinking installer path makes Windows dual-booting safer, and a staged Dracut migration quietly consolidates the Live media and installed boot onto a single stack.
FEX-2609.1 is a three-commit hotfix released today that repairs a Linux syscall regression 2609 itself introduced, restoring the syscall/int 0x80 instructions as proper block ends. The same patch rescues the RDPID instruction on Win32 hosts lacking the TPIDRRO register, and bumps the disk-cache format to version 20 to match the altered codegen. It's a small but meaningful correctness update for the open-source x86 emulator that runs PC software on ARM64 Linux. The patch is available now on the project's GitHub releases page, with the next mainline tag expected within a month.
Greg Kroah-Hartman released two large stable LTS Linux kernels: the 6.18.53 branch and the 6.12.111 branch. Both LTS releases carrying an explicit "must upgrade" message due to important security and bug fixes scattered across virtualization, cryptography, filesystems, networking, and storage drivers. The release sizes are substantial, with roughly 1,250 patches for 6.18.53 and about 1,102 for 6.12.111. Both kernels are available now from the standard stable git tree, and LTS support for 6.12 and 6.18 was extended to December 2028 earlier this year.
Linux Kernel 7.2.7 is the latest stable point release, dropping September 21 with roughly 737 bug-fix commits and no new features. Networking leads the way at about a third of the changes, but the headline items are remotely exploitable security patches covering SMB heap overflows, IPv6 routing races, and an x86 page-table use-after-free. The release also quietly documents the kernel's growing reliance on AI tools, with roughly one in five commits now carrying an Assisted-by: tag. Sysadmins on the 7.2 series should treat it as the recommended update, available now from the official Linux Kernel Archives.
Debian and Freexian released a wave of advisories topped by unbound's 30 CVEs and a 6.12 kernel patch for bookworm, while Chromium's LTS build ballooned to nearly 300 fixes. Fedora 43 and 44 shipped updates headlined by doctl's nine CVEs plus GIMP, FreeIPA, and opkssh fixes. Red Hat pushed a sprawling 32-advisory RHSA-2026 batch covering kernel, openssh, and rust, though several packages sit on niche channels. SUSE closed the roundup with a 153-vulnerability kernel-devel package and important libsoup fixes aimed at older SUSE Linux Enterprise systems.
Garuda Linux has rebranded its "Nix subsystem" into Garuda Nix, a standalone, installable NixOS, according to an announcement by lead maintainer Alexander Reichle-Maschek (dr460nf1r3). The project, which began in May 2023 as a dual-boot add-on using BTRFS subvolumes, now offers full NixOS installations through both a Calamares GUI installer and an install-garuda-nix command-line tool. Two desktop editions ship: the vibrant "Dr460nized" and the dark Catppuccin Mocha "Mokka" built from Garuda's signature opinionated dotfiles.
Bazzite Linux 44.20260921 shipped as a rolling incremental update from the previous build 44.20260919, pushed today. The standout fix resolves an Intel AX200/AX210 WiFi D3cold segfault that caused glitches on handhelds like the Ayaneo Air Series and GPD Win 5. It also restores a missing Broadcom wl kernel module and adds community tweaks for Intel Ethernet and AMD PCIe power management. Gamescope jumped to 3.16.28, and existing users can rebase with the bazzite-rollback-helper command.
Acer's Nitro XV273U F5 leads today's batch as one of the fastest LCDs available, hitting 540 Hz at QHD and 1,000 Hz at 720p for $699.99 while mimicking an OLED's speed. Thermaltake's 3,200W AX tops the power supply charts but only runs on 230–240V, leaving North American readers out in the cold. Prusa and Bondtech's CORE One+ INDX toolchanger earned Editor's Choice as a near-waste-free multicolor printer that beat the Bambu Lab H2C on speed and material savings. The rest of the day's reviews round out with a value ASRock AM5 board, a nostalgic Thrustmaster WARTHOG Mk. II, and a Dell 4K webcam that excels on audio but struggles in low light.
MX Linux 25.3 "Infinity" shipped on September 20, 2026 as the third point release of its Debian 13.7-based series, following 25.1 and 25.2. The update refreshes the Xfce, KDE Plasma, and Fluxbox editions with Debian's 6.12.107 LTS kernel, while the Xfce AHS build gains a Liquorix 7.2.6 kernel and Mesa 26.1.4 graphics stack. New MX-specific tools include Verify-iso-sig for cross-distribution ISO signature checks, MX-Theme-Colors, and GUI access to Siduction 7.x kernels, though existing users can pull in all changes through a simple apt full-upgrade.
[ Archive ]
