Patch board
The week's patches split into two classes: direct CVE fixes (Taproot Assets, FreshRSS, Karakeep, Trilium, Tails) and a broader wave of releases responding to the eMudhra compromised-CA incident and the October Node.js security releases. The CA and Node issues were external dependency failures rather than project-specific bugs, which is why they surfaced simultaneously across Bitcoin mining firmware, Lightning tooling, and self-hosted apps. Operators should have already patched the named-CVE releases; the CA-related fixes are worth a sweep across any Node-based or TLS-terminating self-hosted service still pinned to an older build.
Bisq 1.10.10. This important security update includes the latest Tor security release
Tails 7.15.1. (CVE-2026-113470). This is an emergency release specifically to remove a compromised certificate authority, not a routine Tor sync
Taproot Assets 0.8.7. (CVE-2026-111943). Taproot Assets rebuilds tapd and tapcli against Go 1.27.3 to close a named CVE
FreshRSS 1.30.4. (CVE-2026-109618, CVE-2026-109619). This is the fourth security release in the 1.30.x line and specifically patches the Alpine Docker images; The Debian-based default images were already fixed in an earlier point release
Karakeep 0.34.1. (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-111497). Four CVEs closed in one release on top of 0.34.0
Trilium 0.106.1. (CVE-2026-111497). Trilium flags this explicitly as a server and Docker image security release
Bitkey App 2026.16.1. Access the Bitkey release notes to view the features included in this release
The Vulnerability Apocalypse and Why We Should Fund Open Source. If you use the internet at all, you may have noticed that a large percentage of sites suddenly went down earlier this week - and all your nerdiest friends were talking about "The Vulnerability Apoc- Computer Security Is About to Get a Lot Worse, Here’s What You Can Do. It is a commonly held truth among computer geeks that there is no such thing as bug free software, or a secure computer
Coolify 4.0.1. This backports v4.4.7 security fixes to the 4.0 line specifically, meaning operators who have not upgraded to the latest major version still get the fix without a forced migration- Coolify 4.1.3. Same backport as the 4.0.1 release but targeted at the 4.1 line
openclaw 2026.9.34. This is a gateway-only extended-stable release, which is our current equivalent to LTS
Uptime Kuma 2.5.7. Docker images now run Node.js 22.23.4 and reject the leaked eMudhra 384-bit CA, alongside a TCP monitor retry fix
DAVx5 4.5.22-beta.1-ose. Bug fixes Handle account creation security exceptions Dependencies Bump the app-dependencies group with 6 updates l10n Bump…
Weekly threads
The eMudhra CA compromise ripples across stacks
A single compromised intermediate certificate authority forced coordinated patches in wildly different projects: ESP-Miner, NodeGuard, Immich, ntfy, and Uptime Kuma all shipped fixes distrusting the same eMudhra chain. The breadth, from Bitcoin mining firmware to self-hosted photo management, shows how deep one shared trust-chain dependency reaches into operator infrastructure.
Node.js security releases force a parallel patch wave
The October Node.js security releases drove a second wave of unrelated updates: ThunderHub, Ride The Lightning, and openclaw all bumped required Node versions to reject TLS chains tied to the same compromised certificate keys. Operators running any Node-based Lightning tooling face the same minimum-version bump regardless of which app they use.
EFF names the week it is covering
EFF published two deeplinks pieces, The Vulnerability Apocalypse and Computer Security Is About to Get a Lot Worse, framing the same week that produced the FreshRSS, Karakeep, Trilium, and Tails patch-now releases. The policy commentary and the patch data point at the same underlying event rather than being separate threads.
Coolify's layered backport strategy
Coolify shipped three releases in the window, 4.0.1 and 4.1.3 both backporting the same v4.4.7 security fixes to older lines, alongside a forward-looking 4.5.0 adding beta server patching. Operators on older Coolify release lines get the security fix without a forced major-version jump.
Release board
Privacy
Cryptomator 1.19.4. For a comprehensive view of changes, read the CHANGELOG
Mullvad Browser 16.0a14. All Platforms Updated Firefox to 153.5.0esr Updated NoScript to 13.6.36. Bug 585: Rebase Mullvad Browser onto 153.5.0esr mullvad-browser Bug 45382: Backport Security Fixes from 158 tor-browser Build System All Platforms Bug 41885
Dangerzone 0.11.1. We're pleased to announce that Dangerzone 0.11.1 has been released- Tor Browser 15.0.26. Is now available from the Tor Browser download page and also from our distribution directory
Element Web 1.12.32. Security Remove support for NEB starter links in messages
Tuta Drive 362.261020.0. Bugfixes and Improvements - fix exiting multiselect on mobile 11463 - increase replace-on-upload robustness 11457 - skip duplicate files while uploading 11572 - fix app restarting on foldable phones Milestone Asset…
Self-hosting
StartOS StartTunnel 1.4.1. StartTunnel restores readable action menus, clarifies local CLI authentication, and closes revoked sign-in streams promptly
Paperless-ngx 3.3.3. Bug Fixes - fix global search input layout shifting @shamoon - dont include doc content on global search results @shamoon - remove some redundant pagers @shamoon - prevent weird wrapping of dashboard widget…
Immich 3.3.5. Explicitly framed as a fix for the CA compromise rather than a feature release
n8n beta. This beta and the parallel 2.45.1 stable release ship the same fixes, including a worker queue-locking race condition- N8n 2.45.1. 2.45.1 (2026-10-21) Bug Fixes core: Claim an idle worker's next queue job and its lock in one step editor: Center badge text when icons are absent Microsoft Teams Trigger Node: Renew the Graph subscription via lifecyc
Portainer 2.45.3. Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot Known issues with Podman support - Podman environments aren't supported script - It's not possible to add Podman environ
ntfy 2.33.1. Builds against Go 1.27.3 specifically to reject the compromised eMudhra intermediate CAs, plus adds monitoring for the experimental cluster feature- FreshRSS 1.30.2. Milestone This is a second security and bug-fixing release in the continuation of 1.30.x
Syncthing-Fork Android 2.1.7. Other
AI
Claude Code Action GitHub 1.0. Now Generally Available!
Qwen Code 0.25.3. See the complete change list below- Qwen Code 0.26.0. See the complete change list below
- openclaw 2026.10.6. Now requires Node 24.22.1+ or 26.12.1+ because older runtimes accept TLS chains signed with the compromised certificate keys
LocalAI 4.12.1. Patch release v4.12.1
NanoClaw 2026.10.1-rc.2. Is the second release candidate for 2026.10.1
Nostr
Alby JS SDK 8.1.1. Publish the NWC response even if the subscription was closed always apply a connection timeout when connecting to relays New…
Granary 12.0. Breaking changes: microformats2: Remove author display name, img, and maybe linked name
Zap Store 1.1.3. Changed - Comments, zaps, stacks, and saved apps still match an app after the catalog signing key changes - An installed file is found hash, which the next relay answers for - Comments, replies, and reports on an app name its app id…
cln-nip47 0.2.2. Changed - updated dependencies in response to 7 RUSTSEC security advisories: RUSTSEC-2026-0365, RUSTSEC-2026-0346, RUSTSEC-2026-0349, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0382…
Bitcoin
Ride The Lightning 0.15.15-beta. Flagged directly as a Node.js security release
Fedimint Web Android SDK 0.1.0-beta.2. Beta.2 Breaking - Onchain.receive() returns the address alone
Eclair 0.14.5. This is a patch release that contains security hardening fixes
Alby Hub 1.24.4. This Alby Hub release we add a number of UX/UI refreshed payment status components and QR codes, transactions list filtering, improved Alby Hub Migration flow to support migration from postgres to sqlite, and many other minor improvement
JoinMarket-NG 0.42.1. Awaiting signature quorum: this pre-release is promoted automatically once the required trusted signatures land on main
What to watch
- Coolify 4.5.0's beta server patching feature. The release adds automatic security updates per server with reboot and risky-package warnings, tagged beta; worth watching whether it graduates to stable given the backport pattern already seen in the 4.0.x and 4.1.x lines.
- Mullvad Browser 16.0 alpha channel (16.0a13, 16.0a14). Two alpha builds shipped in quick succession rebasing onto newer Firefox ESR and backporting tor-browser security fixes; the cadence suggests a 16.0 stable cut is approaching.
- Fedimint Web SDK beta series (Android, Rust, React Native). All three SDKs are at 0.1.0-beta with breaking changes still landing, including a changed Onchain.receive() return signature; integrators should expect further breaking revisions before a 0.1.0 stable.
- StartOS 0.4.0 and start-cli 2.5.0 signing scheme changes. start-cli 2.5.0 introduces an updated signing scheme for requests and registry assets plus gpg-agent key storage, shipped alongside StartOS 0.4.0 network-privacy hardening; operators managing StartOS fleets should track whether this requires a coordinated upgrade across both components.
