Patch board
The week's patch activity split into two clusters: a coordinated Tor security update propagating through Tor Browser, Mullvad Browser, Tails, and haveno, and a set of independent audit-driven fixes in Bisq 2 and JoinMarket-NG, both flagged patch-now. Pi-hole closed a high-severity command-execution advisory (CVSS 7.8), and Paperless-ngx shipped a named GHSA fix recommended for all users. None of these were zero-days under active exploitation based on the available data, but the Pi-hole and P2P-exchange fixes warrant prompt action rather than routine scheduling.
Bisq 2 2.1.14. This is a patch-now release bundling the latest Tor security update plus fixes from Bisq's recent security audit
JoinMarket-NG 0.41.0. Beyond the UTXO-bloat fix in maker coin selection, this release adds BIP39 passphrase support in the TUI and jmwalletd and includes security hardening
Pi-hole 6.5. Closes a high-severity (CVSS 7.8) command-execution advisory via a crafted PID, a patch-now issue for anyone running Pi-hole as a DNS sinkhole
Bitkey App 2026.16.0. Access the Bitkey release notes to view the features included in this release
Weekly threads
Tor stack synchronized patch wave
Tor Browser 15.0.25, Mullvad Browser 15.0.25, Tails 7.15, and haveno 1.11.0 all shipped the same Tor security update within days of each other. Operators running any Tor-dependent stack should treat this as one coordinated fix rather than four separate events, and the 16.0a14 alpha already in testing signals the next cycle is close behind.
Audit-driven hardening in P2P exchange tools
Bisq 2 2.1.14 and JoinMarket-NG 0.41.0 both shipped security fixes traced to recent audits, both flagged patch-now. The timing suggests coordinated or at least overlapping audit disclosure windows across decentralized exchange projects.
ntfy's rollback and repair
ntfy 2.31.0 introduced a database load regression that forced an operator-visible rollback of ntfy.sh, fixed days later in 2.31.1. Self-hosted ntfy operators who updated early should confirm they are on 2.31.1, not the withdrawn 2.31.0.
Release board
Privacy
IronFox 158.0. Ensure no-op uniffi-bindgen gets built if we're building Glean
Tails 7.15. Tails updates its bundled Tor Browser to 15.0.25, part of the same coordinated Tor security fix landing across the Tor-dependent stack this week
Tor Browser 15.0.25. Routine but non-optional Tor security update; Operators distributing or bundling Tor Browser should sync to 15.0.25 since Tails, Mullvad Browser, and haveno have already picked up the same fix
haveno 1.11.0. Updates its embedded Tor to 0.4.9.14 carrying high-severity fixes, aligning with the broader Tor security sync this week
Mullvad Browser 15.0.25. Backports the same Tor Browser security fixes along with a NoScript bump, consistent with the week's cross-project Tor patch wave
OnionShare 2.7. Security prevent sharing a single file that is a symlink (to a potentially sensitive file)
Vanadium 155.0.8059. Changes in version 155.0.8059.79.0: update to Chromium 155.0.8059.79 improve implementation of always displaying autofill settings
Session Android 1.33.7. Fix voice/audio playback broken 1.11.0, bump to 1.33.7 Release/1.33.6
XSAs released on 2026-10-13. The Xen Project has released one or more Xen security advisories (XSAs)
uBlock Origin 1.75. Fix parsing of permissions filter option - Improve googlesyndication adsbygoogle.js shim - Use new publicSuffix API when available - Add trusted-edit-inbound-element sriptlet - Refactor scriptlet injection code - Improve jsonl-edit-fet
Self-hosting
Nextcloud Desktop 35.0.0. Research changes can shape future protocol, wallet, and infrastructure decisions
Paperless-ngx 3.3.2. Addresses a named security advisory (GHSA-c8f3-pqr2-rr24) and is recommended for all users, though it ships as a pre-release tag
StartOS Start SDK 3.0.6. A patch release: manifests, notifications and container addresses type-check as written for 3.0.4, and action results spell out every field- StartOS start-cli 2.4.1. Start-cli 2.4.1 packs services built on images with absolute or
Syncthing-Fork Android 2.1.7. Other
AI
Claude Code Action GitHub 1.0. Now Generally Available!
Qwen Code 0.25.2. See the complete change list below
Open WebUI 0.12.2. Added - MinerU 4.x servers
Ollama 0.40.7. Openai: allow Responses effort on non-thinking models llama-server: let llama-server infer the draft speculative type mlx: add PPLX Decider v1.2…
Cline Desktop 0.0.48. GPT-6 models (such as gpt-6-sol and gpt-6.1-sol ) work on OpenAI and Azure OpenAI-compatible endpoints- Cline CLI 3.0.73. GPT-6 models (such as gpt-6-sol and gpt-6.1-sol ) work on OpenAI and Azure OpenAI-compatible endpoints
Nostr
algia 0.0.137. Search: pass cli context to QueryEvents
Rx Nostr 4.0.0-beta.2. Minor Changes -: Separate forward and backward request input types, and accept nested filter arrays in backward as a finite sequence of REQ segments
Bitcoin
ZEUS 13.2.3. V13.2.3 Highlights: - Embedded LND v0.21.4 - LDK Node v0.7.0-zeus-rl-0.2.7 (rust-lightning v0.2.7 security fixes) - Further security hardening measures - Miscellaneous bug fixes - Miscellaneous UI improvements never transferred correctly
Cashu CDK 0.18.2. 0.18.2 Summary Version 0.18.2 adds seed-based recovery of signing keys for known mint quotes and fixes persisted wallet quote state, LND payment validation and rounding, and legacy mint configuration imports
Alby Hub 1.24.3. This Alby Hub release we add a number of UX/UI refreshed payment status components and QR codes, transactions list filtering, improved Alby Hub Migration flow to support migration from postgres to sqlite, and many other minor improvement
Bull Bitcoin 6.14.0. Release Notes New Features - Rebuilt Tor integration: Tor now runs as an isolated infrastructure package
Wasabi Wallet 2.8.4. Wasabi Wallet is an easy to use, privacy-focused, open-source, non-custodial, Bitcoin wallet
Keystone 3 3.1.4. Details Web3: Improvements 1
Research, policy & news
- New Alpha Release: Tor Browser 16.0a14. Alpha channel only; Testers tracking the Tor Browser roadmap should expect this to eventually supersede the 15.0.25 stable fixes already deployed across Tails and Mullvad Browser
What to watch
- Tor Browser 16.0a14 alpha progression toward stable. The alpha is already public; given the week's pattern of Tails, Mullvad Browser, and haveno all syncing to 15.0.25, a future stable cut will likely trigger another round of downstream updates.
- ntfy.sh stability post-2.31.1. The 2.31.0 rollback was caused by a database load regression; operators should watch for any further patch releases confirming the fix holds under production load.
- Paperless-ngx security fix reaching a non-pre-release tag. 3.3.2 addresses a named GHSA advisory but is still tagged pre-release; a stable promotion is worth watching for operators who hold off on pre-release packages.