Coordinated Tor patch wave, audit fixes land

Patch board#

The week's patch activity split into two clusters: a coordinated Tor security update propagating through Tor Browser, Mullvad Browser, Tails, and haveno, and a set of independent audit-driven fixes in Bisq 2 and JoinMarket-NG, both flagged patch-now. Pi-hole closed a high-severity command-execution advisory (CVSS 7.8), and Paperless-ngx shipped a named GHSA fix recommended for all users. None of these were zero-days under active exploitation based on the available data, but the Pi-hole and P2P-exchange fixes warrant prompt action rather than routine scheduling.

• Bisq 2 2.1.14. This is a patch-now release bundling the latest Tor security update plus fixes from Bisq's recent security audit.
• JoinMarket-NG 0.41.0. Beyond the UTXO-bloat fix in maker coin selection, this release adds BIP39 passphrase support in the TUI and jmwalletd and includes security hardening.
• Pi-hole 6.5. Closes a high-severity (CVSS 7.8) command-execution advisory via a crafted PID, a patch-now issue for anyone running Pi-hole as a DNS sinkhole.
• Bitkey App 2026.16.0. Access the Bitkey release notes to view the features included in this release.

Weekly threads#

Tor stack synchronized patch wave#

Tor Browser 15.0.25, Mullvad Browser 15.0.25, Tails 7.15, and haveno 1.11.0 all shipped the same Tor security update within days of each other. Operators running any Tor-dependent stack should treat this as one coordinated fix rather than four separate events, and the 16.0a14 alpha already in testing signals the next cycle is close behind.

Audit-driven hardening in P2P exchange tools#

Bisq 2 2.1.14 and JoinMarket-NG 0.41.0 both shipped security fixes traced to recent audits, both flagged patch-now. The timing suggests coordinated or at least overlapping audit disclosure windows across decentralized exchange projects.

ntfy's rollback and repair#

ntfy 2.31.0 introduced a database load regression that forced an operator-visible rollback of ntfy.sh, fixed days later in 2.31.1. Self-hosted ntfy operators who updated early should confirm they are on 2.31.1, not the withdrawn 2.31.0.

Release board#

Privacy#

• IronFox 158.0. Ensure no-op uniffi-bindgen gets built if we're building Glean...
• Tails 7.15. Tails updates its bundled Tor Browser to 15.0.25, part of the same coordinated Tor security fix landing across the Tor-dependent stack this week.
• Tor Browser 15.0.25. Routine but non-optional Tor security update; operators distributing or bundling Tor Browser should sync to 15.0.25 since Tails, Mullvad Browser, and haveno have already picked up the same fix.
• haveno 1.11.0. Updates its embedded Tor to 0.4.9.14 carrying high-severity fixes, aligning with the broader Tor security sync this week.
• Mullvad Browser 15.0.25. Backports the same Tor Browser security fixes along with a NoScript bump, consistent with the week's cross-project Tor patch wave.
• OnionShare 2.7. Security prevent sharing a single file that is a symlink (to a potentially sensitive file).
• Vanadium 155.0.8059. Changes in version 155.0.8059.79.0: update to Chromium 155.0.8059.79 improve implementation of always displaying autofill settings A full list of changes from the previous release (version 155.0.8059.39.0) is available through the Git co...
• Session Android 1.33.7. Fix voice/audio playback broken 1.11.0, bump to 1.33.7 Release/1.33.6
• XSAs released on 2026-10-13. The Xen Project has released one or more Xen security advisories (XSAs).
• uBlock Origin 1.75. - Fix parsing of permissions filter option - Improve googlesyndication adsbygoogle.js shim - Use new publicSuffix API when available - Add trusted-edit-inbound-element sriptlet - Refactor scriptlet injection code - Improve jsonl-edit-fet...

Self-hosting#

• Nextcloud Desktop 35.0.0. Research changes can shape future protocol, wallet, and infrastructure decisions.
• Paperless-ngx 3.3.2. Addresses a named security advisory (GHSA-c8f3-pqr2-rr24) and is recommended for all users, though it ships as a pre-release tag.
• StartOS Start SDK 3.0.6. A patch release: manifests, notifications and container addresses type-check as written for 3.0.4, and action results spell out every field.
• StartOS start-cli 2.4.1. Start-cli 2.4.1 packs services built on images with absolute or..
• Syncthing-Fork Android 2.1.7. Other chore(build-release): minimize package size enhancement(custom http cert): Improved custom http certificate and key validation

AI#

• Claude Code Action GitHub 1.0. Claude Code GitHub Action v1.0 - Now Generally Available!
• Qwen Code 0.25.2. Highlights See the complete change list below.
• Open WebUI 0.12.2. Added - MinerU 4.x servers.
• Ollama 0.40.7. Openai: allow Responses effort on non-thinking models llama-server: let llama-server infer the draft speculative type mlx: add PPLX Decider v1.2…
• Cline Desktop 0.0.48. - GPT-6 models (such as gpt-6-sol and gpt-6.1-sol ) work on OpenAI and Azure OpenAI-compatible endpoints.
• Cline CLI 3.0.73. - GPT-6 models (such as gpt-6-sol and gpt-6.1-sol ) work on OpenAI and Azure OpenAI-compatible endpoints.

Nostr#

• algia 0.0.137. Search: pass cli context to QueryEvents
• Rx Nostr 4.0.0-beta.2. Minor Changes - 32966a5: Separate forward and backward request input types, and accept nested filter arrays in backward as a finite sequence of REQ segments.

Bitcoin#

• ZEUS 13.2.3. V13.2.3 Highlights: - Embedded LND v0.21.4 - LDK Node v0.7.0-zeus-rl-0.2.7 (rust-lightning v0.2.7 security fixes) - Further security hardening measures - Miscellaneous bug fixes - Miscellaneous UI improvements never transferred correctly...
• Cashu CDK 0.18.2. 0.18.2 Summary Version 0.18.2 adds seed-based recovery of signing keys for known mint quotes and fixes persisted wallet quote state, LND payment validation and rounding, and legacy mint configuration imports.
• Alby Hub 1.24.3. This Alby Hub release we add a number of UX/UI refreshed payment status components and QR codes, transactions list filtering, improved Alby Hub Migration flow to support migration from postgres to sqlite, and many other minor improvement...
• Bull Bitcoin 6.14.0. Bull Bitcoin Mobile 6.14.0 - Release Notes New Features - Rebuilt Tor integration: Tor now runs as an isolated infrastructure package.
• Wasabi Wallet 2.8.4. Wasabi Wallet is an easy to use, privacy-focused, open-source, non-custodial, Bitcoin wallet.
• Keystone 3 3.1.4. Details Web3: Improvements 1.

Research, policy & news#

• New Alpha Release: Tor Browser 16.0a14. Alpha channel only; testers tracking the Tor Browser roadmap should expect this to eventually supersede the 15.0.25 stable fixes already deployed across Tails and Mullvad Browser.

What to watch#

• Tor Browser 16.0a14 alpha progression toward stable. The alpha is already public; given the week's pattern of Tails, Mullvad Browser, and haveno all syncing to 15.0.25, a future stable cut will likely trigger another round of downstream updates.
• ntfy.sh stability post-2.31.1. The 2.31.0 rollback was caused by a database load regression; operators should watch for any further patch releases confirming the fix holds under production load.
• Paperless-ngx security fix reaching a non-pre-release tag. 3.3.2 addresses a named GHSA advisory but is still tagged pre-release; a stable promotion is worth watching for operators who hold off on pre-release packages.

By the numbers#

• Stories tracked: 175
• Featured: 34
• Releases: 166
• Active sources: 208
• Security patches: 4
• Days covered: 7

Top beats this week

• AI: 61
• Privacy: 49
• Bitcoin: 24
• Self-hosting: 21
• Nostr: 16
• Unspecified: 4

---

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-18-weekly-recap/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.