Patch board
BitBox02 Firmware 9.26.2. Intermediate release to update the bootloader to v1.2.2- OpenAI mandates hardware-backed passkeys for Trusted Access Cyber members to log into ChatGPT accounts. The rapid advancement of AI is changing the global cybersecurity landscape
SecureDrop 2.16.1. Was released on July 8, 2026
Bisq 1.10.3. This is an important security update that closes several gaps in trade protocol validation, message authentication, and filter safety identified during our ongoing security audit
Pi-hole 6.4.3. Security Fixes - pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww - Local privilege escalation from pihole user to root via /etc/pihole/logrotate (High) reported Also hardcode the PID file l
Case Study Government of Alberta uses Claude to find and fix cybersecurity vulnerabilities across government systems. From Anthropic News
Weekly threads
Hardware-backed security enforcement across three ecosystems
OpenAI mandated hardware-backed passkeys for Trusted Access Cyber members logging into ChatGPT accounts, BitBox02 pushed a mandatory bootloader update to v1.2.2 via firmware 9.26.2, and Passport Prime shipped a 1.3.0 beta enabling external seed import and BIP85 password generation. All three enforce a hardware root-of-trust. Operators with deployed YubiKeys or BitBox02 devices must update firmware; Passport beta testers should verify seed-import flows before production use.
Privilege-escalation patches in self-hosted stacks
Pi-hole 6.4.3 closed a local privilege escalation from pihole user to root via /etc/pihole/logrotate, and SecureDrop 2.16.1 shipped unspecified fixes on the same day. Both projects protect high-value data on self-hosted infra. Operators running Pi-hole or SecureDrop instances should patch immediately; the Pi-hole advisory explicitly labels the issue high severity.
Bitcoin Core maintenance across three release branches
Bitcoin Core shipped three minor releases in 48 hours: 29.4, 30.3, and 31.1. No CVEs, no coordinated fix timeline. The clustering suggests backport discipline across supported branches rather than emergency response. Operators can follow their existing upgrade cadence; nothing in the notes demands immediate action.
Release board
Privacy
- BAT Roadmap 4.0. Evolves the Basic Attention Token, Brave Rewards, and Brave Creators for the transactional attention economy, introducing agentic payments, a unified Brave Wallet, the BravePay stablecoin protocol, a Brave Rewards Card, a
Immich 3.0.2. V3.0.2 This patch release addresses various bugs from v3 release and adds an additional filter to workflows Enhancements add ARIA label to ServerStatisticsCard hls variant co
uBlock Origin 1.72.2. Commits to master since this release Commits since last release To install the stable
Vanadium 150.0.7871. Changes in version 150.0.7871.114.0: update to Chromium 150.0.7871.114 stop disabling new kLoadNativeEarly feature flag
Cashu CDK 0.17.2. 0.17.2 Added - cdk-ffi: Expose NUT-27 mint backup through wallet repository bindings ( thesimplekid )
Bitwarden Server Version 2026.6.2. Overview Removed feature flag for organization features caching Removed feature flag for member controller refactor Removed feature flag for collections component refactor Added new 'staged' status for organization members Invited users
Tuta 354.260707.0. - Tuta One-Click Migration in beta: first beta release of Tuta's email migration feature - Sync improvements Bugfixes - Some imported mails do not render correctly 10975 Milestone Asset Checksums (
Duplicati 2.3.0. About this release This release patches version 2.3.0.3 with fixes for a number of issues that were discovered after the release
Home Assistant 2026.7.2. Store recovery HTTP config with the full trusted proxy network ( @agners - 176075 ) ( http docs ) - Trigger reauth on Teslemetry LoginRequired errors ( @Bre77 - 174255 ) ( teslemetry docs ) - Bump ical to 13.3.0 ( @FuNK3Y - 175090 ) (- Obtainium 1.6.2. Update ja.json: Guard onNewIntent against uninitialized plugin callResult Fallback to internal storage on custom ROMs where
Syncthing-Fork Android 2.1.2. Fixes bundleOf in DeviceIdDialogFragment bug(onboarding): fix state consistency in onboarding activity
DAVx5 4.5.17. 4.5.17.1 (hotfix): - Fix problem with Digest authentication - 2633 - Improve HTTP logging format - 2631 --- 4.5.17 Bug fixes Ktor Handle explicit Content-Encoding: identity Add validation and tests
1 more Privacy release tracked in the weekly totals.
AI
Cline CLI 3.0.39. You can now select Cline free models on the ClinePass provider in the model picker - Removed the retired ClinePass GLM 5.1 model - Fixed OpenAI Codex model metadata under the GPT Subscription provider - str replace edits now report acc
Qwen Code 0.19.9. Stop repeated subagent tool-call loops detect and mark broken history chains instead of silently truncating prefer command name match over alias match regardless of recentScore
Ollama 0.32.0. Create: select the qwen3.5 parser and renderer for Qwen3.5/Next launch: warn before old agent models cmd: agent UI in htt- Ollama 0.31.2. Enabled flash attention on older NVIDIA GPUs (compute capability 6.x) iGPU can now offload vision models with padding to fit available memory Fixed structured output for thinking models when thinking is disabled Hardened GGUF model creat
InvokeAI 6.13.6. This is a patch release
HelixML 2.11.47. Stop rewriting anthropic model ids to -latest for zed agent Add Goose and Zed Agent to the README harness list s
Nostr
Lightning.Pub 0.0.30. Lightning.Pub v0.0.30 API No changes to the public gRPC/HTTP API
Sprout Buzz Desktop 0.3.44. Keep thread-summary badges mounted through scrollback prepends ( ) - drop bundled PortableGit, add BUZZ SHELL override + dialect hint ( ) - NIP-AM durable encrypted agent turn metrics (k- Vector 0.4.0. The new era of communication begins
Divine 1.0.16. Life in Loops This one's all about creation
Bitcoin
StartOS start-wrt 1.0.0. First stable release of StartWRT - Start9's OpenWrt-based router OS for home self-hosting, built around per-device Security Profiles (assigned port, WiFi password, or inbound VPN), with inbound/outbound WireGuard VPNs and VPN chaining, W
BitBoxApp 4.51.3. Bundle BitBox02 firmware version v9.26.4
Foundation Envoy 2.3.0. Is a major release packed with new features
Passport Prime 1.3.0-beta. Headlines the ability to import external bitcoin seeds and nostr keys into the Vault, plus BIP85 password generation and mass-importing 2FA codes from Google Authenticator
Bitcoin Core 31.1. Bitcoin Core version 31.1 is now available from: For the release notes please see the git repository: Do not use the links provided
Stratum v2 SRI 1.11.0. General release information Highlights of this release: This release focuses on binary sv2 reliability and cleanup, safer Sv1 parsing and conversion APIs, improved Sv1 difficulty handling, and expanded fuzz-testing coverage
Payjoin Dev Kit Release 1.0.0-rc.4. Attach --no-run to the feature gated test runs just to ensure compilation Fix commented test assert Employ new fallback tx- Bitcoin Core 29.4. Bitcoin Core version 29.4 is now available from: For the release notes please see the git repository: Do not use the links provided
- Bitcoin Core 30.3. Bitcoin Core version 30.3 is now available from: For the release notes please see the git repository: Do not use the links provided
SeedSigner The "Summer of SeedSigner" Release. The "Summer of SeedSigner" Release v0.8.7 includes 80 PRs from 20- StartOS start-sdk 2.0.3. Fixed - A dependency-gated daemon no longer wedges permanently after its dependency's readiness flaps
umbrelOS 1.7.4. Fixes an issue where remote access over Tor and apps that use Tor could fail to connect
Lightning
Arkade 0.9.12. Vtxo chain pagination Whitelist channelz endpoints in permissions fix two bugs in client-lib (send on closed channel panic and dep
Blink Mobile 3.0.5. Documentation - Add PR review guide distilled from recent review history
lnd 0.20.2-beta. Has no database migrations
LNbits 1.5.5. A pretty big release: LNbits v1.5.5 adds Revolut and Square as a fiat funding methods, and improves payment reliability across multiple backends
Privacy
SimpleX Chat 7.0.0-beta.3. Beta.3: - SimpleX names for channels and businesses: - register the name at (requires SimpleX NFT for the next week)
1 lower-priority release omitted from the board but counted below.
Research, policy & news
- Building Our Future Together. In my first weeks as Executive Director of EFF, I've been reminded every day how consequential this moment is in determining what kind of future we will have
What to watch
- SimpleX Chat 7.0 stable release after beta.3 name-registration shakeout, SimpleX Chat 7.0.0-beta.3 introduced SimpleX names for channels and businesses with a testing-names registration dependency and NFT gate. The beta tag and experimental infrastructure suggest a stable 7.0 will follow once the name-registration flow is proven. Operators on 6.x should watch for the stable tag before upgrading production instances.
- Payjoin Dev Kit 1.0.0 stable after rc.4 fallback-tx validation, Payjoin Dev Kit shipped 1.0.0-rc.4 with new fallback transaction logic. The RC label and the fallback-tx change suggest a 1.0.0 stable is imminent. Wallet integrators testing payjoin should validate rc.4 in staging and watch for the stable tag before merging to production.
- Bitcoin Core 29.5, 30.4, or 31.2 if the three-branch release cadence continues, Bitcoin Core shipped three minor releases across supported branches (29.4, 30.3, 31.1) in 48 hours with no CVEs. The clustering suggests active backport discipline. Operators should watch for the next round of minor releases if this cadence holds; the pattern implies ongoing maintenance rather than one-off fixes.