Self-hosted patch cluster, Bitcoin funds-loss fixes land

Four self-hosting staples shipped "patch now" security fixes in a tight three-day window: Duplicati 2.4.0.1, Radicale 3.8.3, Vaultwarden 1.37.4, and FreshRSS 1.30.1. That is a different shape than last week's cross-stack patch wave. This time the cluster sits entirely inside the self-hosted application layer, backup, calendar/contacts, password manager, RSS reader, the tools operators run behind their own reverse proxies. AI again led on raw volume at 63 stories, with llama.cpp cutting four backend-specific builds and the LangChain family pushing five dependency-bump releases, a pattern now familiar enough to treat as background noise rather than signal. Bitcoin's 26 stories were notably thin on headline drama but carried real substance underneath: Fedimint shipped a gateway security release addressing a fund-loss bug in LNv2 payment handling, then backported the same hardening to its 0.11 line, while Core Lightning's 26.06.9 fixed vulnerabilities from responsible disclosure alongside a gossip regression. Nostr stayed quiet at 10 stories, mostly routine client patches. Policy coverage from EFF continued at a steady clip, tracking age verification and donor-advised-fund transparency rather than any acute enforcement action.

Freedom.Tech

October 11, 2026 · 8 min read

Patch board#

The week's patch activity concentrated in the self-hosted application layer rather than infrastructure or hardware. Duplicati, Radicale, Vaultwarden, and FreshRSS all shipped "Patch now" releases within a three-day span, none carrying assigned CVEs but each addressing disclosed security issues, including a named Radicale auth flaw (FO-RAD-2026-001). On the Bitcoin side, Fedimint's gateway fund-loss fix and Core Lightning's responsibly-disclosed vulnerability patches were the most consequential items, both already shipped as stable point releases. Operators running any of these six projects should have already updated; nothing in this set is still pending a deadline.

Weekly threads#

Self-hosted app layer patches in lockstep#

Duplicati, Radicale, Vaultwarden, and FreshRSS all shipped security-driven point releases within three days of each other. None disclosed CVEs, but the clustering across backup, CalDAV, password-vault, and RSS tooling suggests operators running a typical self-hosted stack had four separate update obligations in one week rather than one.

Fedimint hardens gateway payment paths across two release lines#

Fedimint 0.12.2 fixed a bug in LNv2 payment handling that could cause a gateway to lose funds, then 0.11.4 backported the same hardening rather than forcing operators onto the newer line. Fedimint also pushed 0.13.0-beta.1 the same week, signaling active parallel development across stable, maintenance, and pre-release tracks.

Bitcoin hardware wallets ship parallel firmware lines#

Keystone 3 published both 3.1.2 (with Core Extension wallet migration) and 2.9.9 in the same week, mirroring the dual-firmware-line pattern seen elsewhere in Bitcoin hardware. Ledger Live Mobile and Desktop also moved in lockstep at 4.23.1, underscoring how hardware wallet vendors now treat mobile and desktop clients as a single coordinated release unit.

Release board#

Privacy#

Self-hosting#

AI#

Nostr#

Bitcoin#

What to watch#

By the numbers#

Top beats this week

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-11-weekly-recap/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.

#foundation#freedomtech
0

Written by

Freedom.Tech

A daily intelligence desk for practical freedom technology. Bitcoin, Lightning, Nostr, privacy, AI, self-hosting, open hardware, and security updates. Powered by foundation.xyz

_@freedom.tech

Comments0

No comments yet. Start the conversation.