Dear Tumbleweed users and hackers,
This week saw the release of 5 snapshots (1016, 1017, 1018, 1020, and 1021).
Big desktop milestones and unblocked migrations took center stage across Tumbleweed this week. However, the biggest headlines in the broader tech landscape revolved around security—specifically the critical remote code execution vulnerabilities in PHP dubbed “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). Tumbleweed users were protected promptly when snapshot 1021 delivered PHP 8.5.12 addressing both flaws. Security was a prominent theme across other snapshots as well: snapshot 1016 rolled out curl 8.23.0 with multiple CVE fixes, snapshot 1020 brought Mozilla Firefox 158.0, and polkit 128 arrived to fix authentication-helper vulnerabilities while dropping previous temporary service memory caps.
Alongside security responses, major desktop and foundational transitions landed. Snapshot 1016 delivered KDE Plasma 6.8.0, accompanied by swift packaging adjustments in SDDM and the lockscreen footer to ensure smooth logins and proper virtual keyboard behavior. Complementing the desktop, snapshot 1018 rolled out both Qt 6.12.0 and Mesa 26.2.5. Snapshot 1018 also marked the completion of the containerd 2.x migration, shipping containerd 2.3.3 after an update to open-vm-tools resolved the build conflict tracked in boo#1284086.
Under the hood, Linux Kernel stepped up to 7.2.11 in snapshot 1017. Other notable deliveries included systemd 261.4, CUPS 2.4.20 (fixing an upstream mailto notification regression), SQLite 3.54.1, LVM2 2.03.43, and Memtest86+ 9.00, which adds native AArch64 (ARM64) support and Secure Boot signing.
These 5 snapshots delivered the following updates:
- 7zip 26.04
- containerd 2.3.3
- cups 2.4.20
- curl 8.23.0
- freetype2 2.15.0
- gedit 51.0
- GraphicsMagick 1.3.49
- KDE Plasma 6.8.0
- libaom 3.15.2
- Linux Kernel 7.2.11
- lvm2 2.03.43
- memtest86+ 9.00
- Mesa 26.2.5
- MozillaFirefox 158.0
- ntfs-3g_ntfsprogs 2026.9.28
- os-prober 1.85
- php8 8.5.12
- pipewire 1.6.9
- polkit 128
- poppler 26.10.0
- Qt 6.12.0
- sqlite3 3.54.1
- systemd 261.4
- tmux 3.8
- vim 9.2.1202
As we turn our focus to the upcoming days, here is a preview of what is currently making its way through the staging projects:
- GNOME 51.1: A comprehensive update across GNOME Shell, Mutter, and core desktop applications is currently undergoing integration testing.
- Linux Kernel 7.3.0
- Ollama 0.40.9
- HarfBuzz 15.0.0
- Ruby 4.0.9: Addressing multiple upstream regular expression CVEs.
- Go 1.27.3
- VirtualBox 7.2.22
- fmt 12.2.0
- kernel-source-longterm 6.18.55: Waiting on VirtualBox driver updates to adapt to kernel API changes.
- Swig 4.5.0: YaST integration issues remain under investigation, tracked under boo#1275515.
Leave a Reply