eMudhra CA compromise forces fixes across three stacks

Four flagged security releases headline a 49-item day, but the more telling pattern runs underneath them: Immich, ESP-Miner, and NodeGuard all ship patches this cycle distrusting or replacing compromised eMudhra CA intermediates. That is a supply-chain trust issue touching self-hosted photo storage, Bitcoin mining firmware, and node infrastructure at once, independent of beat. Layer on the four CVE-driven patches in Taproot Assets, FreshRSS, Karakeep, and Coolify, and the day reads as cleanup, not capability. AI stays the single largest beat at 12 items, all routine SDK and CLI bumps with no model releases. Bitcoin and Self-hosting trail at 10 apiece, Privacy at 12. The operative move today is patching, not evaluating new features.

Bitcoin#

Taproot Assets 0.8.7. Patches CVE-2026-111943 via a Go 1.27.3 rebuild of tapd and tapcli.
Ride The Lightning 0.15.15-beta. Node.js security release; upgrade RTL instances on the beta track.
ThunderHub 0.19.1. Fixes hex-or-base64 credential handling for the tapd client alongside a Node security bump.
btcd 0.27.0. Protocol validation fixes plus a lower-allocation tx decoder and RPC reliability work.
Fedimint Web Rust SDK 0.1.0-beta.1. First Rust SDK release for Fedimint web integration, beta/testing only.
ESP-Miner 2.15.4. Replaces the embedded CA trust store after the eMudhra compromise.
lnd 0.20.6-beta.rc1. No database migrations in this release candidate, lowers upgrade friction for lnd operators.
Ledger Live Desktop 4.24.1. 4.24.1 Patch Changes - 23658 3c1702f Thanks @lewisd5!
Trezor Suite 26.10.2. Passphrase length extended to 128 characters; also adds sats-denominated trading and CSV trade export.
NodeGuard 0.33.2. Distrusts the compromised eMudhra intermediates.

Nostr#

Alby JS SDK 8.1.1. Publish the NWC response even if the subscription was closed; Always apply a connection timeout when connecting to relays.
Sidecar 1.16.1. The help guide opens with two buttons, Explore apps and Pick a wallet, and has sections on Allow all, why there is a Reject all and no Approve all, and on always allowing an event type.

Privacy#

Cryptomator 1.19.4. For a comprehensive view of changes, read the CHANGELOG.
Tor Browser 15.0.26. Tor Browser 15.0.26 is now available from the Tor Browser download page and also from our distribution directory; This version blocks compromised intermediate eMudhra certificates.
Tuta Drive 362.261020.0. Fix exiting multiselect on mobile 11463; Increase replace-on-upload robustness 11457.
KeePassXC 2.8.0. Adds remote database sync, configurable shortcuts, and expanded SSH agent key support.
Mullvad Browser 15.0.26. CA intermediate and settings updates tracking the upstream Tor Browser release.
IronFox 158.0.2. 158.0.2 Signed-off-by: celenity
Logseq Desktop app Nightly Release 20261021. This is a nightly release of the Logseq desktop app; It's unstable compared to the official releases, use it with caution !
Signal Android 8.33.0. A new and improved keyboard for emojis, stickers, and animated GIFs is our GIFt to you; For automatic updates, we recommend using Obtainium.
The Star Labs StarFighter is Qubes certified!. First-party hardware certification; relevant for anyone sourcing a Qubes-ready laptop.
XMRPod 0.1.24. Keep listening to live streams while browsing XMRPod, using another app, or with the screen off; Pause, resume, or stop live streams from Android media controls, and tap the notification to return to the player.
Element X iOS 26.10.6. Keep HDR gain maps when stripping location data from images; Keep spatial photos spatial and check every image for a location when sending in original quality.
Proton Pass CLI 2.5.1. Proton Pass CLI 2.5.1

Self-hosting#

FreshRSS 1.30.4. Fourth 1.30.x security release, closes severe PHP vulnerabilities and fixes the Alpine Docker image line specifically.
Karakeep 0.34.1. Security-only release on top of 0.34.0; apply directly, no feature changes to evaluate.
Coolify 4.0.1. Backports the 4.4.7 security fixes into the 4.0.x line.
Immich 3.3.5. Fixes exposure from the eMudhra CA compromise.
N8n 2.45.1. Core: Claim an idle worker's next queue job and its lock in one step (5f0b562); Editor: Center badge text when icons are absent (648fa2a).
CryptPad Autumn Release ( 2026.10.0. Full server rewrite for scalability; self-hosters should review migration notes before upgrading.
Nextcloud iOS Version 35.2.0. Add GRDB state for background auto upload; Dependabot groups.
Stirling-PDF Viewer improvements and bug fixes . Arrow key support for viewer; Dual page view to support cover pages.
authentik 2026.8.5. Endpoints: fix MultipleObjectsReturned (cherry-pick 26971 to version-2026.8); Enterprise/providers/microsoft entra: skip members already in the group (cherry-pick 26891 to version-2026.8).
Nextcloud Android 35.0.2. 35.0.2 RC1 (October 21, 2026) - Bugfixes and performance improvements Minimum: NC 22 Server, Android 9 Nougat For a full list, please see

AI#

Qwen Code 0.26.0. Support session-targeted Skill and Extension refresh; Session-create warm for Workspace-isolated bound Sessions.
Ollama 0.40.9. - llama.cpp update
Hermes Agent 0.22.4. Desktop no longer shows suggestion pills above the composer.
openclaw 2026.10.10-beta.3. Agent state: concurrent initialization can no longer let two agents claim ownership of the same agent database.
Qwen Code SDK TypeScript 0.1.22. Use resolved authType to initialize ACP agent; Add parentToolCallId and subagentType for ACP subagent tracking.
langchain== 1.4.7. Changes since langchain==1.4.6 chore(langchain): update lockfile release(langchain): 1.4.7 chore(deps): bump certifi from 2025.11.12 to 2026.10.19 in /libs/langchain v1 read tool-call-delta in stream consumers (...
langchain-core== 1.6.13. Changes since langchain-core==1.6.12 release(core): 1.6.13 chore(deps): bump certifi from 2025.11.12 to 2026.10.19 in /libs/core read tool-call-delta in stream consumers
How AT&T is rethinking in-house legal work with OpenAI. AT&T is working with OpenAI to make legal knowledge easier to access; Learn how its LegalEdge team is rethinking intake and scaling legal judgment.
llama.cpp b11808. MacOS Apple Silicon (arm64); MacOS Apple Silicon (arm64, KleidiAI enabled) DISABLED.
Claude Agent Sdk Python 0.2.172. Internal/Other Changes Updated bundled Claude CLI to version 2.1.308 PyPI: pip install claude-agent-sdk==0.2.172
Checkpoint Engine 0.4.3-rc0. Initialize buffer b before for-loop to prevent NameError; Rank=0 falsy-value in ParameterServer.
Packages React Native 1.2.32. Updated dependencies 3855a41 @elevenlabs/client@1.30.0; @elevenlabs/react@1.19.1.

Other#

Introducing Our New Surveillance Self-Defense Guide: Online Privacy for Parents and Youth. The internet is a vast and confusing place no matter your age; Trying to help youth engage with it safely and privately is a complicated topic that touches on many different skillsets and ideas.

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-22-bitcoin-daily-brief/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.