Anonymous
2025-08-15 09:51
2025-08-15 09:51
Product
Last Report
Anonymous
2024-07-07 07:01
2024-07-07 07:01
Anonymous
2024-02-07 19:23
2024-02-07 19:23
Anonymous
2026-09-01 09:28
2026-09-01 09:28
Anonymous
2026-07-19 18:49
2026-07-19 18:49
Anonymous
2026-06-11 07:27
2026-06-11 07:27
Anonymous
2019-11-27 17:19
2019-11-27 17:19
Anonymous
2019-11-11 09:02
2019-11-11 09:02
Anonymous
2019-07-21 13:03
2019-07-21 13:03
2026-10-03
Ubuntu shipped 101 CVEs in a single kernel update for its Google Container Engine image on 26.04 LTS, hitting 38 subsystems and pointing more to a cleared backlog than a fresh emergency. Red Hat and Rocky Linux both tagged freerdp Critical for version 10, making it the top fix for anyone running remote desktop protocols. Debian leads with a sprawling 62-CVE Firefox ESR patch alongside a redis advisory and a "fix for the fix" for webkit2gtk, while Fedora, SUSE, and the rest close out the day with notable items including Fedora's WordPress RCE and SUSE's high-rated python-anyio flaw. Patch the Critical and high-severity fixes first, then work through the Important and Moderate updates at your next maintenance window.
Strata v0.1.38 is an open-source inference engine that spreads the 125-billion-parameter Qwen3.8-Flash-Next model across your GPU, CPU, RAM, and SSD so it runs on an ordinary gaming PC with a 12 GB card. The release's biggest change is a security fix that blocks DNS-rebinding and cross-site attacks against its local server by rejecting requests from untrusted hosts. In hands-on testing on Debian with ROCm and a Radeon 7900 XTX, output reached up to 120 tokens per second with a realistic 75 per-second average. Everything runs locally and privately, with no cloud dependency and nothing charged per token after purchase.
Zen Browser 1.23b built on Firefox 157.0, with its headline feature being Library, a consolidated hub for history, media, downloads, and Spaces. It adds hardware-accelerated AV1 decoding for WebRTC video calls, a resizable auto-hiding sidebar, and faster startup with many tabs open. Most importantly, it patches more than 70 vulnerabilities from Mozilla's high-impact MFSA2026-97 advisory, making the upgrade strongly recommended.
The Linux kernel project just shipped seven stable releases in under twenty minutes, all landing today. Greg Kroah-Hartman signed off on 7.2.9 down to 5.10.271, a batch spanning the newest 7.x line all the way back to the oldest still-supported 5.10 LTS tree. Memory-safety fixes dominate the changelog, with use-after-free and out-of-bounds bugs found largely by fuzzers like syzbot and AI-assisted tooling. All seven are live now at kernel.org, so distro security updates should roll out over the coming days.
Six fresh reviews landed today, spanning an HP ZGX Nano G1n mini AI workstation running local coding models, a be quiet! AIO and ARCTIC fan controller that expose how software can make or break hardware, and value plays like the Asustor AS6702T v2 NAS. The standout is HP's tiny GB10-based "AI Station," where 128GB of unified memory and strong cooling let it run large models and image generation at home, though generated text still comes out as gibberish. Connectivity is climbing across the board, from dual 5GbE ports to USB4 motherboards, while design premiums at Gigabyte's Dark Wood board and Next Level Racing's MSFS cockpit ask whether themed touches are worth the extra cash. If you're chasing value, several reviewers note you can often skip the branded variant and grab the same frame or specs for less.
Valve released two beta builds timed to land a minute apart, signaling that it now treats the Steam Frame glasses and the PC's SteamVR runtime as a single connected system. The most concrete change targets the "Error 17" streaming connection fault, but Valve warns the fix only works if you update both SteamOS 0.4.3 and SteamVR 2.18.2, since an update on one side alone leaves the bug intact. Other highlights include up to 12% better battery life, eye-openness data exposed via OSC with a later OpenVR SDK upgrade, and a wireless adapter fix for users in certain countries. You can opt into either beta through the Steam client or the Frame's update settings, and should report issues in the SteamVR Bug Report forum rather than the news thread.
KDE Plasma 6.8 is set to launch on 14 October 2026, deliberately timed to land on KDE's 30th anniversary. The star of the release is the "Union" theming system, which now extends styling to classic QtWidgets apps like Dolphin and Kate. At the same time, 6.9 has already entered early development with no beta and only a handful of features merged so far. Plasma 6.8 also closes out KDE's transition to a Wayland-only desktop, while the 6.6 LTS line remains supported until 2029 for stability-focused users.
Wine Staging 11.19 dropped today, maintained by Alistair Leslie-Hughes and built on the freshest version of Wine's development branch. It's a maintenance rebase rather than a feature drop, shipping an identical set of 119 patch-sets with none added or removed. A couple of stages did get refreshed, most notably vkd3d-latest and odbc32-fixes. Source code and pre-built packages are live on WineHQ, separate from the standalone Wine 11.19 release.
Wine 11.19 has been released and adding vertical text rendering to GDIPlus, a DNS query cache, Unicode 18.0.0 tables, and fixes to the VBScript parser. The release also closed 23 bugs, including crashes in ArcGIS Pro, Final Fantasy XI, and Paint.net, plus fixes for .NET rounding and slow wineboot startups. About 48 contributors made roughly 350 commits since the previous version, with Alex Henrie, Rémi Bernon, and Conor McCarthy leading the pack. The 44.6 MiB source tarball is available on the WineHQ servers now, though production users may want to wait for the next stable release.
Amethyst Mod Manager v2.5.3 shipped today, broadening its native Linux support to nearly 90 games with titles like Voices of the Void, The Witcher 3: Remastered, and Balatro. The update introduces mod-update rollbacks and a script-extender version warning, plus privacy hardening that redacts system usernames from generated logs. A long-standing LOOT sorting bug that stalled large lists for minutes has been fixed alongside Wabbajack and Oblivion crashes. Maintained by a single developer, the free GPL-3.0 tool installs via AppImage, Flatpak, AUR, and distro repos, though its one-person backing remains a notable risk.
Python's core team dropped a surprise third release candidate, 3.15.0rc3, moving the stable build to October 9, 2026. The late candidate folds in last-minute lazy-import fixes, and the team stresses there will be no ABI changes from here on so existing binary wheels stay compatible. Highlights include explicit lazy imports, new frozendict and sentinel types, UTF-8 as the default encoding, a faster JIT, and a new Tachyon sampling profiler. Maintainers are urged to test on CI ahead of launch, though macOS 27.0 users should hold off as tkinter apps like IDLE can hang.
2026-10-02
The OWASP Core Rule Set released v4.30.0 and v4.25.2 (LTS) within thirteen minutes of each other on 2 October 2026, pushing three security bypass fixes to both its newest feature line and its older LTS branch. The fixes close a path-based command injection gap in the RCE rules (GHSA-575j-qr6p-9763), a case-sensitivity bug that left the charset allow-list inert at default paranoia levels (GHSA-89h9-2j8h-9gp2), and a multipart _charset_ shadowing trick that let attackers bypass encoding checks (GHSA-qmx4-jfcv-fgww). Beyond security, v4.30.0 adds detections for Active Directory ds tools, Velocity/FreeMarker SSTI, and SELinux commands, while repairing the response-skipping flag. Operators on any v4.x between 4.0.0 and 4.29.x should upgrade to v4.30.0 or v4.25.2 LTS, or apply the advisories' targeted workarounds.
Qubes OS 4.3.2 as a patch build folding in all security fixes and bugs since 4.3.1. It bumps the default Fedora template to Fedora 44 and the rolling kernel-latest to Linux 7.2. Two code-execution bulletins lead the package: QSB-119 in qvm-open-in-vm and QSB-118, the more serious dom0 flaw in qvm-copy-to-vm. If you're still on 4.2, upgrade now since it reached end of life on June 21, 2026.
Simple Taskbar released version 66, codenamed "Advanced Panel Customization." Rather than a new GNOME Shell version, the "V66" tag marks the extension's own 66th major release, which still targets GNOME Shell 48 through 51. The update adds dozens of granular tweaks—like custom app-grid row and column counts, icon progress bars, configurable dock thickness, and pressure-based auto-hide reveal, alongside polish and bug fixes for tray, sleep, and secondary-monitor issues. It's free on GNOME Extensions or Extension Manager, though expect a steep learning curve given how many knobs it puts in your hands.
LibreOffice 26.8.1 shipped on 2 October 2026 as the first minor maintenance release in the 26.8 cycle, bundling roughly 40 bug fixes with no new features. Most of the work targets reading Microsoft Office files more faithfully, fixing DOCX table-of-content links and text alignment, XLSX drawing objects and database ranges, and a PPTX crash that shut Impress shut entirely. The release also steadies text and CSV import across encodings like UTF-16, ISO Latin 1, Chinese and Japanese.
IPFire 2.29 Core Update 204 has reached the testing stage, headlined by a fix for a DNS regression that Core Update's Knot Resolver migration left for VPN users. The build repairs broken name resolution for IPsec, WireGuard, and OpenVPN clients and adds Julio Lira's preemptive anti-phishing ruleset to the Suricata IPS. It's also a routine maintenance pass, rebasing the kernel to Linux 6.18.54, fixing a WireGuard multi-subnet import bug, and sweeping dozens of packages. As always, IPFire wants testers to verify VPN DNS resolution on non-production systems and report findings through its Bugzilla tracker.
Chizhong Jin released v0.15.2 of Nginx CGI, fixing two bugs that could leave requests hung or leak memory. The hang fix resolves an issue where request bodies larger than client_body_buffer_size would stall indefinitely once the in-memory buffer was drained. The memory-safety patch closes a missing null-termination gap in constant cgi_set_var values, a follow-up to work from the previous release. Admins running CGI in production, especially those handling large POST bodies or constant config variables, should upgrade to close both gaps.
Gears of War: E-Day launches October 6, 2026, and early reviews praise its stunning Unreal Engine 5 visuals while flagging a punishing hardware appetite, with only seven GPUs clear 60 FPS at 1080p on Ludicrous settings. TechPowerUp's 35-GPU benchmark shows upscaling and frame generation are effectively required, and NVIDIA's RTX Mega Geometry option excludes much of the installed base by needing 12 GB of VRAM. On the hardware side, the ASRock Challenger 360 Digital AIO earns an 8.9/10 as a standout $89.99 value that tops pricier coolers at moderate noise levels. Finally, the Thrustmaster HOTAS WARTHOG MKII scores a 96% Editor's Award as a polished evolutionary upgrade, though it drops force feedback and twist rudder support.
Noctalia's team released version 5.2.1 as a deliberate step back from the feature sprint, focusing instead on stabilizing a shell that's gone through a fast v5 cycle. The patch lands a small batch of tweaks, notably usage-aware emoji handling and readline-style editing across the launcher, settings, and lock screen. It also ships an extensive fix list covering window-switcher glitches, startup deadlocks, audio suspension, and rendering artifacts worth the update. Two caveats apply: Triad support is dropped and palette JSON now requires the mHover and mOnHover colors, with builds available on most major distros.
MangoWC 0.17.5 has been released as a focused bug-fix release from maintainer DreamMaoMao rather than a feature update. It clears two regressions introduced by 0.17.4: abnormal game mouse behavior when the cursor crosses between monitors, and an inability to exit the compositor when run as a service. These fixes restore the multi-monitor gaming and service-based workflows that 0.17.4 had strengthened through rules like confine_pointer.
Samba Team member Björn Jacke announced 4.23.13 on Thursday, Oct. 1, 2026, as the latest point release of the maintained 4.23 stable branch. The update bundles seven bug fixes spanning file services, SMB3 signing, winbind, CTDB clustering, and Python tooling, including one that closes an out-of-bounds read. It also flagged that the 4.22 series is now end-of-life after 4.25.0 launched on September 24, though 4.23 keeps receiving security backports. Administrators on 4.22 should upgrade, while 4.23 users can safely install the release as-is.
Today's Linux security roundups from eight distros push a wave of updates where browser engines take the biggest hit, led by Debian stuffing 232 CVEs into a single webkit2gtk advisory and SUSE claiming 302 in a kernel update that turns out to be just build headers. Chromium, Thunderbird, and Firefox show up across nearly every bulletin, meaning a hostile webpage or email stays executable until you apply the fix. The real Criticals worth a reboot window include SUSE's Tomcat/libtcnative smuggling patch, Red Hat's Satellite 6.19.5 entry, and Oracle's eight-hole FreeIPA roll on OL10. Most of the hundreds-of-CVE counts are just upstream releases backported and inflated by design, so patch the WebKit and Chromium entries first, then clear the Important items during normal maintenance.
[ Archive ]
