Nostr notes by QnA

#nevent1q…xa7l

2026-10-26T19:08:50Z

In reply to nevent1q…j3w9
_________________________

quoting nevent1q…xa7l
INVESTIGATION UPDATE 2

In our last update, we said we would share how many people had personal information exposed once we could confirm it. We can now share those numbers.

Across our old WooCommerce store and our current Shopify store, records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses, were held in systems the attackers were able to reach. We cannot say for certain whether the attackers accessed all of these records, so we are treating all of them as potentially exposed. These records are a subset of our total customers.

Why the data was still there:
In our last update, we explained that copies of orders remained in old database tables after past migrations. We have since found that the 60-day redaction also did not cover every type of order, and that some customer details were stored in other parts of the store, such as abandoned carts and contact forms, that redaction never reached.

Addresses not in our records:
More than 5,000 of the email addresses that received phishing emails do not appear in our WooCommerce or Shopify customer records. Some match our support and hiring inboxes. Together with reports of details that were never shared with us, this makes us confident the attackers also used data from outside Foundation. We are still tracing where these addresses came from.

What we are doing:
Out of an abundance of caution, we are rotating all keys and secrets across our systems, including those we have no evidence were accessed.We are keeping a single copy of the legacy WooCommerce data offline as evidence for the investigation. Once the investigation is complete, that data will be permanently deleted.

We have found no evidence that this incident compromised Passport devices or the private keys they hold.

Never enter your recovery phrase into a website or share it with anyone, including someone claiming to be Foundation.

We will continue sharing confirmed findings and publish our full report when the investigation is complete.

#nevent1q…xa7l

2026-10-26T19:08:36Z

In reply to nevent1q…jfvd
_________________________

quoting nevent1q…xa7l
INVESTIGATION UPDATE 2

In our last update, we said we would share how many people had personal information exposed once we could confirm it. We can now share those numbers.

Across our old WooCommerce store and our current Shopify store, records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses, were held in systems the attackers were able to reach. We cannot say for certain whether the attackers accessed all of these records, so we are treating all of them as potentially exposed. These records are a subset of our total customers.

Why the data was still there:
In our last update, we explained that copies of orders remained in old database tables after past migrations. We have since found that the 60-day redaction also did not cover every type of order, and that some customer details were stored in other parts of the store, such as abandoned carts and contact forms, that redaction never reached.

Addresses not in our records:
More than 5,000 of the email addresses that received phishing emails do not appear in our WooCommerce or Shopify customer records. Some match our support and hiring inboxes. Together with reports of details that were never shared with us, this makes us confident the attackers also used data from outside Foundation. We are still tracing where these addresses came from.

What we are doing:
Out of an abundance of caution, we are rotating all keys and secrets across our systems, including those we have no evidence were accessed.We are keeping a single copy of the legacy WooCommerce data offline as evidence for the investigation. Once the investigation is complete, that data will be permanently deleted.

We have found no evidence that this incident compromised Passport devices or the private keys they hold.

Never enter your recovery phrase into a website or share it with anyone, including someone claiming to be Foundation.

We will continue sharing confirmed findings and publish our full report when the investigation is complete.

ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME ...

2026-10-26T09:58:09Z

ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.

We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.

The malicious domain in the spam email has been taken down.

Funds stored on Passport are safe and Passport hardware is not compromised.

We are working nonstop to discover exactly what happened and will put out a report ASAP.

Missed anything this week? The freedom.tech recap has you covered ...

2026-10-25T18:32:59Z

Missed anything this week? The freedom.tech recap has you covered 👇

quoting
naddr1qv…ezt7

Patch board

The week's patches split into two classes: direct CVE fixes (Taproot Assets, FreshRSS, Karakeep, Trilium, Tails) and a broader wave of releases responding to the eMudhra compromised-CA incident and the October Node.js security releases. The CA and Node issues were external dependency failures rather than project-specific bugs, which is why they surfaced simultaneously across Bitcoin mining firmware, Lightning tooling, and self-hosted apps. Operators should have already patched the named-CVE releases; the CA-related fixes are worth a sweep across any Node-based or TLS-terminating self-hosted service still pinned to an older build.

Bisq 1.10.10. This important security update includes the latest Tor security release.

Tails 7.15.1 (CVE-2026-113470). This is an emergency release specifically to remove a compromised certificate authority, not a routine Tor sync.

Taproot Assets 0.8.7 (CVE-2026-111943). Taproot Assets rebuilds tapd and tapcli against Go 1.27.3 to close a named CVE.

FreshRSS 1.30.4 (CVE-2026-109618, CVE-2026-109619). This is the fourth security release in the 1.30.x line and specifically patches the Alpine Docker images; the Debian-based default images were already fixed in an earlier point release.

Karakeep 0.34.1 (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-111497). Four CVEs closed in one release on top of 0.34.0.

Trilium 0.106.1 (CVE-2026-111497). Trilium flags this explicitly as a server and Docker image security release.

Bitkey App 2026.16.1. Access the Bitkey release notes to view the features included in this release.

The Vulnerability Apocalypse and Why We Should Fund Open Source. If you use the internet at all, you may have noticed that a large percentage of sites suddenly went down earlier this week - and all your nerdiest friends were talking about "The Vulnerability Apoc...

Computer Security Is About to Get a Lot Worse, Here’s What You Can Do. It is a commonly held truth among computer geeks that there is no such thing as bug free software, or a secure computer.

Coolify 4.0.1. This backports v4.4.7 security fixes to the 4.0 line specifically, meaning operators who have not upgraded to the latest major version still get the fix without a forced migration.

Coolify 4.1.3. Same backport as the 4.0.1 release but targeted at the 4.1 line.

openclaw 2026.9.34. This is a gateway-only extended-stable release, which is our current equivalent to LTS.

Uptime Kuma 2.5.7. Docker images now run Node.js 22.23.4 and reject the leaked eMudhra 384-bit CA, alongside a TCP monitor retry fix.

DAVx5 4.5.22-beta.1-ose. Bug fixes Handle account creation security exceptions Dependencies Bump the app-dependencies group with 6 updates l10n Bump…

Weekly threads

The eMudhra CA compromise ripples across stacks

A single compromised intermediate certificate authority forced coordinated patches in wildly different projects: ESP-Miner, NodeGuard, Immich, ntfy, and Uptime Kuma all shipped fixes distrusting the same eMudhra chain. The breadth, from Bitcoin mining firmware to self-hosted photo management, shows how deep one shared trust-chain dependency reaches into operator infrastructure.

Node.js security releases force a parallel patch wave

The October Node.js security releases drove a second wave of unrelated updates: ThunderHub, Ride The Lightning, and openclaw all bumped required Node versions to reject TLS chains tied to the same compromised certificate keys. Operators running any Node-based Lightning tooling face the same minimum-version bump regardless of which app they use.

EFF names the week it is covering

EFF published two deeplinks pieces, The Vulnerability Apocalypse and Computer Security Is About to Get a Lot Worse, framing the same week that produced the FreshRSS, Karakeep, Trilium, and Tails patch-now releases. The policy commentary and the patch data point at the same underlying event rather than being separate threads.

Coolify's layered backport strategy

Coolify shipped three releases in the window, 4.0.1 and 4.1.3 both backporting the same v4.4.7 security fixes to older lines, alongside a forward-looking 4.5.0 adding beta server patching. Operators on older Coolify release lines get the security fix without a forced major-version jump.

Release board

Privacy

Cryptomator 1.19.4. For a comprehensive view of changes, read the CHANGELOG.

Mullvad Browser 16.0a14. All Platforms Updated Firefox to 153.5.0esr Updated NoScript to 13.6.36.90201984 Bug 585: Rebase Mullvad Browser onto 153.5.0esr mullvad-browser Bug 45382: Backport Security Fixes from 158 tor-browser Build System All Platforms Bug 41885...

Dangerzone 0.11.1. We're pleased to announce that Dangerzone 0.11.1 has been released.

Tor Browser 15.0.26. Tor Browser 15.0.26 is now available from the Tor Browser download page and also from our distribution directory.

Element Web 1.12.32. Security Remove support for NEB starter links in messages.

Tuta Drive 362.261020.0. Bugfixes and Improvements - fix exiting multiselect on mobile 11463 - increase replace-on-upload robustness 11457 - skip duplicate files while uploading 11572 - fix app restarting on foldable phones Milestone Asset…

Self-hosting

StartOS StartTunnel 1.4.1. StartTunnel restores readable action menus, clarifies local CLI authentication, and closes revoked sign-in streams promptly.

Paperless-ngx 3.3.3. Paperless-ngx 3.3.3 Bug Fixes - fix global search input layout shifting @shamoon - dont include doc content on global search results @shamoon - remove some redundant pagers @shamoon - prevent weird wrapping of dashboard widget…

Immich 3.3.5. Explicitly framed as a fix for the CA compromise rather than a feature release.

n8n beta. This beta and the parallel 2.45.1 stable release ship the same fixes, including a worker queue-locking race condition.

N8n 2.45.1. 2.45.1 (2026-10-21) Bug Fixes core: Claim an idle worker's next queue job and its lock in one step (5f0b562) editor: Center badge text when icons are absent (648fa2a) Microsoft Teams Trigger Node: Renew the Graph subscription via lifecyc...

Portainer 2.45.3. Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot Known issues with Podman support - Podman environments aren't supported script - It's not possible to add Podman environ...

ntfy 2.33.1. Builds against Go 1.27.3 specifically to reject the compromised eMudhra intermediate CAs, plus adds monitoring for the experimental cluster feature.

FreshRSS 1.30.2. Milestone This is a second security and bug-fixing release in the continuation of 1.30.x.

Syncthing-Fork Android 2.1.7. Other chore(build-release): minimize package size enhancement(custom http cert): Improved custom http certificate and key validation

AI

Claude Code Action GitHub 1.0. Claude Code GitHub Action v1.0 - Now Generally Available!

Qwen Code 0.25.3. Highlights See the complete change list below.

Qwen Code 0.26.0. Highlights See the complete change list below.

openclaw 2026.10.6. Now requires Node 24.22.1+ or 26.12.1+ because older runtimes accept TLS chains signed with the compromised certificate keys.

LocalAI 4.12.1. Patch release v4.12.1.

NanoClaw 2026.10.1-rc.2. NanoClaw 2026.10.1-rc.2 is the second release candidate for 2026.10.1.

Nostr

Alby JS SDK 8.1.1. Publish the NWC response even if the subscription was closed always apply a connection timeout when connecting to relays New…

Granary 12.0. Breaking changes: microformats2: Remove author display name, img, and maybe linked name.

Zap Store 1.1.3. Changed - Comments, zaps, stacks, and saved apps still match an app after the catalog signing key changes - An installed file is found hash, which the next relay answers for - Comments, replies, and reports on an app name its app id…

cln-nip47 0.2.2. Changed - updated dependencies in response to 7 RUSTSEC security advisories: RUSTSEC-2026-0365, RUSTSEC-2026-0346, RUSTSEC-2026-0349, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0382…

Bitcoin

Ride The Lightning 0.15.15-beta. Flagged directly as a Node.js security release.

Fedimint Web Android SDK 0.1.0-beta.2. Android SDK 0.1.0-beta.2 Breaking - Onchain.receive() returns the address alone.

Eclair 0.14.5. This is a patch release that contains security hardening fixes.

Alby Hub 1.24.4. This Alby Hub release we add a number of UX/UI refreshed payment status components and QR codes, transactions list filtering, improved Alby Hub Migration flow to support migration from postgres to sqlite, and many other minor improvement...

JoinMarket-NG 0.42.1. Awaiting signature quorum: this pre-release is promoted automatically once the required trusted signatures land on main.

What to watch

Coolify 4.5.0's beta server patching feature. The release adds automatic security updates per server with reboot and risky-package warnings, tagged beta; worth watching whether it graduates to stable given the backport pattern already seen in the 4.0.x and 4.1.x lines.

Mullvad Browser 16.0 alpha channel (16.0a13, 16.0a14). Two alpha builds shipped in quick succession rebasing onto newer Firefox ESR and backporting tor-browser security fixes; the cadence suggests a 16.0 stable cut is approaching.

Fedimint Web SDK beta series (Android, Rust, React Native). All three SDKs are at 0.1.0-beta with breaking changes still landing, including a changed Onchain.receive() return signature; integrators should expect further breaking revisions before a 0.1.0 stable.

StartOS 0.4.0 and start-cli 2.5.0 signing scheme changes. start-cli 2.5.0 introduces an updated signing scheme for requests and registry assets plus gpg-agent key storage, shipped alongside StartOS 0.4.0 network-privacy hardening; operators managing StartOS fleets should track whether this requires a coordinated upgrade across both components.

By the numbers

Stories tracked: 190

Featured: 44

Releases: 175

Active sources: 223

Security patches: 14

Days covered: 7

Top beats this week

AI: 53

Privacy: 46

Self-hosting: 38

Bitcoin: 30

Nostr: 13

Unspecified: 10

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-25-weekly-recap/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.

Thanks for sharing, will try and watch later on and share my ...

2026-10-25T17:53:51Z

In reply to nevent1q…mgx8
_________________________

Thanks for sharing, will try and watch later on and share my thoughts on the show. (Send a boost to the most recent BB so I remember).

Passport Prime already uses Shamir for our Master Key backup.

https://docs.foundation.xyz/backups/prime/

GM 🫡 Yesterday's #FREEDOMTECHFRIDAY had Pavol Lupták on ...

2026-10-24T06:28:31Z

GM 🫡

Yesterday's #FREEDOMTECHFRIDAY had Pavol Lupták on flag theory. He gave up his Slovak residency but kept citizenship, and now borrows euro stablecoins against Bitcoin on Aave and Morpho at under 1% instead of taking a salary. No income, no tax.

Worth a watch if you missed it.

Listen: https://fountain.fm/episode/ba2u4NnBTQ7yXvpghgGv
Show notes: https://ungovernable.network/shows/freedom-tech-friday/flag-theory-with-pavol-lupt-k/

MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890)

A new plugin lets you sell inference on Mesh LLM and get paid ...

2026-10-23T16:18:00Z

A new plugin lets you sell inference on Mesh LLM and get paid directly to your own Lightning wallet via NWC. No platform holds the funds, and no account is required.

https://github.com/getAlby/mesh-nwc-wallet

New episode out now: Flag Theory with Pavol Lupták Freedom Tech ...

2026-10-23T15:23:04Z

New episode out now: Flag Theory with Pavol Lupták

Freedom Tech Friday 62 with MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890)

Listen and boost on Fountain: https://fountain.fm/episode/ba2u4NnBTQ7yXvpghgGv
Show notes: https://ungovernable.network/shows/freedom-tech-friday/flag-theory-with-pavol-lupt-k/

Flag Theory with Pavol, live in 1 hour. 9AM EST / 2PM UK. Freedom ...

2026-10-23T12:00:00Z

Flag Theory with Pavol, live in 1 hour. 9AM EST / 2PM UK.

Freedom Tech Friday 62.

Wilder (npub15xk…krnh) co-founded Paralelní Polis and Nethemba, runs Liberation.Travel, and lives flag theory across nine jurisdictions with his tax base in Asunción. We get into how that works, non-CRS banking, living on borrowed euros instead of selling bitcoin, Europe's squeeze on cash and privacy, his privacy stack, and AI.

See you there.

MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890)

Cracking video on Passport Prime! https://youtu.be/ABsDvm8W9O8

2026-10-23T11:30:00Z

Cracking video on Passport Prime!

https://youtu.be/ABsDvm8W9O8

Researcher Joshua Michael says he pulled the 300,000+ Flock ...

2026-10-23T09:09:40Z

Researcher Joshua Michael says he pulled the 300,000+ Flock locations straight from Flock's own systems, using an authentication token that had been left exposed. No hacking involved, just an open credential.

quoting
nevent1q…acwc
⚡️‼️ NEW - Proton is hosting a map of 300,000+ Flock surveillance device locations that Flock tried to get taken down.

Researcher Joshua Michael says he pulled them from Flock's own systems via a token left open to anyone.

Proton calls the takedown "an attempt to suppress information."

GM. Today on #FREEDOMTECHFRIDAY we've got @npub15xk…krnh, ...

2026-10-23T04:15:00Z

GM. Today on #FREEDOMTECHFRIDAY we've got Wilder (npub15xk…krnh), co-founder of Paralelní Polis and Nethemba, and founder of Liberation.Travel.

Flag theory across nine jurisdictions, non-CRS banking, borrowing euros instead of selling bitcoin, Europe's squeeze on cash and privacy, his privacy stack, and AI.

Last call for questions, drop them below.

9AM EST / 2PM UK with MaxUM (npub1lqv…fx0r) and Seth For Privacy (npub1tr4…2y5g) on the Ungovernable (npub1jcy…2890) feeds.

Sent

2026-10-22T15:56:34Z

In reply to nevent1q…delx
_________________________

Sent

Just checked do not see it?

2026-10-22T15:54:36Z

In reply to nevent1q…4uyh
_________________________

Just checked do not see it?

Have you contacted support? We can't search orders by nostr ...

2026-10-22T13:46:42Z

In reply to nevent1q…hpp3
_________________________

Have you contacted support? We can't search orders by nostr usernames...

PHP2Shell uses AI to find critical vulnerabilities in PHP, which ...

2026-10-22T13:04:23Z

PHP2Shell uses AI to find critical vulnerabilities in PHP, which still runs a huge share of the web.

https://www.php2shell.com/

PHP runs roughly 70% of the web. Scanners have counted around ...

2026-10-22T11:00:00Z

PHP runs roughly 70% of the web. Scanners have counted around 884,000 internet facing hosts still on PHP 8.1 or older, plus 740,000 reporting no version at all. Researchers expect mass exploitation within 15 minutes of the patch going public. If you run anything on PHP, patch it now.

quoting
nevent1q…5vny
Good morning and pura vida, Nostr! 🫂🤙🏻💜

Heartbleed was bad, but the new PHP exploit (PHP2Shell) is wilder.

PHP powers ~70% of the web, and this flaw allows full server takeover + memory leaks going back to 2004.

Worse/Better: AI agents can now exploit or patch this at machine speed. It's a real time arms race. Stay safe out there.

GrapheneOS duress PIN wipes the device the moment it's ...

2026-10-22T09:02:55Z

GrapheneOS duress PIN wipes the device the moment it's entered, by design. Once triggered, you can't hand over a working phone, and the wipe can't be reversed or stopped.

quoting
nevent1q…s7fu
⚡️🚨 NEW - CBP officers told Stop Cop City activist Samuel Tunick they wanted his GrapheneOS phone to hunt for "kiddie porn".

Court records show the ICE alert on him cited only "suspected terrorist activities".

He faces up to 5 years for giving them a duress pin that wiped the phone.

GM. Tomorrow on #FREEDOMTECHFRIDAY we're joined by ...

2026-10-22T05:46:49Z

GM. Tomorrow on #FREEDOMTECHFRIDAY we're joined by Wilder (npub15xk…krnh), aka Wilder: cryptoanarchist, co-founder of Paralelní Polis and Nethemba, and founder of Liberation.Travel.

He practises flag theory across nine jurisdictions, with his tax base in Asunción. We'll get into Europe's squeeze on cash and privacy, non-CRS banking, borrowing euros instead of selling bitcoin, his privacy stack, and AI.

Got a question for Wilder? Drop it below.

Live Friday, 9AM EST / 2PM UK with MaxUM (npub1lqv…fx0r) and Seth For Privacy (npub1tr4…2y5g) on the Ungovernable (npub1jcy…2890) feeds.

https://opportunist.global

Obscura VPN 1.184 released. Revokes trust for the compromised ...

2026-10-21T11:56:59Z

Obscura VPN 1.184 released.

Revokes trust for the compromised eMudhra CAs, fixes Windows firewall blocking, makes Android builds reproducible.

Update for the eMudhra fix.

https://freedom.tech/posts/2026-10-20-obscura-vpn-1-184/

GM 🫡 SF from Noderunners Radio joined Friday's show. Their ...

2026-10-21T05:04:42Z

GM 🫡

SF from Noderunners Radio joined Friday's show. Their jukebox began as a Telegram bot driving his Spotify account, now it runs on self hosted LNbits with a 7.5 terabyte library and 21 sats a track.

He also walks through the FM broadcast plan and clears up what actually happened with Breez in September. Worth a listen.

Listen: https://fountain.fm/episode/XG93HcAnxfyhHYLAZhZ7
Show notes: https://ungovernable.network/shows/freedom-tech-friday/pirate-radio-with-sf/

MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890) #FREEDOMTECHFRIDAY

Cake has in app swaps

2026-10-20T12:17:46Z

In reply to nevent1q…896x
_________________________

Cake has in app swaps

EFF's Privacy Badger is now available for Safari on macOS. ...

2026-10-20T11:02:01Z

EFF's Privacy Badger is now available for Safari on macOS.

Needs Safari 26.5 or higher. Already used by more than 4 million people on other browsers.

If you're on Safari without a tracker blocker, grab this one.

https://www.eff.org/deeplinks/2026/10/announcing-privacy-badger-safari-macos

WHAT A TIME TO BE ALIVE #nevent1q…ml4t

2026-10-20T09:29:28Z

WHAT A TIME TO BE ALIVE

quoting
nevent1q…ml4t
Everything is open-source now and I love it

GM 🫡 Yesterday's Bitcoin Brief: a hardware hacker found a ...

2026-10-20T05:01:33Z

GM 🫡

Yesterday's Bitcoin Brief: a hardware hacker found a Trezor Model T bought on Facebook Marketplace with its microcontroller swapped out, rigged to only ever generate phrases the attacker already knew, plus a soldered microSD card to fool the integrity check.

It's counterfeit, not a Trezor supply chain issue. A good reminder to buy direct. The Ledger fallout is also in the full episode.

Listen: https://fountain.fm/episode/1fhZBKuTHgodW0oLByeb
Show notes: https://ungovernable.network/shows/bitcoin-brief/more-compromised-hardware/

MaxUM (npub1lqv…fx0r) Ungovernable (npub1jcy…2890)

Honestly I’m a little bit confused

2026-10-19T18:42:18Z

In reply to nevent1q…xr9f
_________________________

Honestly I’m a little bit confused

Wild #nevent1q…6lxl

2026-10-19T18:24:17Z

Wild

quoting
nevent1q…6lxl
⚡️🤖 NEW - A Mac user says Claude Code was building them a temperature monitor app when it found a cryptominer using 12 cores.

The readings looked too high, so it checked the CPU and found XMRig at ~1175%, with the chip at 112°C.

Caused what!? 👀

2026-10-19T18:23:53Z

In reply to nevent1q…wapp
_________________________

Caused what!? 👀

New episode out now: More Compromised Hardware!? The Bitcoin ...

2026-10-19T16:19:38Z

New episode out now: More Compromised Hardware!?

The Bitcoin Brief 95 with MaxUM (npub1lqv…fx0r) Ungovernable (npub1jcy…2890)

Listen and boost on Fountain: https://fountain.fm/episode/1fhZBKuTHgodW0oLByeb
Show notes: https://ungovernable.network/shows/bitcoin-brief/more-compromised-hardware/

More Compromised Hardware? The Bitcoin Brief 95 is live in 1 ...

2026-10-19T12:00:00Z

More Compromised Hardware? The Bitcoin Brief 95 is live in 1 hour, 9AM EST / 2PM UK.

Joe Grand found swapped microcontrollers in two off-channel Trezors, producing recovery phrases known in advance.

Ledger gives its full account of the CryptoBilis implants, blaming an organized crime group, and unveils Atom, a phone with a protected wallet mode.

Plus Lopp's wrench attack archive passes 700 cases.

MaxUM (npub1lqv…fx0r) Ungovernable (npub1jcy…2890)

GM 🫡 The Bitcoin Brief mailbag is open. Questions, hot takes, ...

2026-10-19T05:32:51Z

GM 🫡 The Bitcoin Brief mailbag is open. Questions, hot takes, things we might have missed: reply here and we'll read the best on today's show at 9AM EST / 2PM UK.

MaxUM (npub1lqv…fx0r) Ungovernable (npub1jcy…2890)

Everything worth knowing in freedom tech this week, in one recap ...

2026-10-18T17:53:11Z

Everything worth knowing in freedom tech this week, in one recap 👇

quoting
naddr1qv…k0e7

Patch board

The week's patch activity split into two clusters: a coordinated Tor security update propagating through Tor Browser, Mullvad Browser, Tails, and haveno, and a set of independent audit-driven fixes in Bisq 2 and JoinMarket-NG, both flagged patch-now. Pi-hole closed a high-severity command-execution advisory (CVSS 7.8), and Paperless-ngx shipped a named GHSA fix recommended for all users. None of these were zero-days under active exploitation based on the available data, but the Pi-hole and P2P-exchange fixes warrant prompt action rather than routine scheduling.

Bisq 2 2.1.14. This is a patch-now release bundling the latest Tor security update plus fixes from Bisq's recent security audit.

JoinMarket-NG 0.41.0. Beyond the UTXO-bloat fix in maker coin selection, this release adds BIP39 passphrase support in the TUI and jmwalletd and includes security hardening.

Pi-hole 6.5. Closes a high-severity (CVSS 7.8) command-execution advisory via a crafted PID, a patch-now issue for anyone running Pi-hole as a DNS sinkhole.

Bitkey App 2026.16.0. Access the Bitkey release notes to view the features included in this release.

Weekly threads

Tor stack synchronized patch wave

Tor Browser 15.0.25, Mullvad Browser 15.0.25, Tails 7.15, and haveno 1.11.0 all shipped the same Tor security update within days of each other. Operators running any Tor-dependent stack should treat this as one coordinated fix rather than four separate events, and the 16.0a14 alpha already in testing signals the next cycle is close behind.

Audit-driven hardening in P2P exchange tools

Bisq 2 2.1.14 and JoinMarket-NG 0.41.0 both shipped security fixes traced to recent audits, both flagged patch-now. The timing suggests coordinated or at least overlapping audit disclosure windows across decentralized exchange projects.

ntfy's rollback and repair

ntfy 2.31.0 introduced a database load regression that forced an operator-visible rollback of ntfy.sh, fixed days later in 2.31.1. Self-hosted ntfy operators who updated early should confirm they are on 2.31.1, not the withdrawn 2.31.0.

Release board

Privacy

IronFox 158.0. Ensure no-op uniffi-bindgen gets built if we're building Glean...

Tails 7.15. Tails updates its bundled Tor Browser to 15.0.25, part of the same coordinated Tor security fix landing across the Tor-dependent stack this week.

Tor Browser 15.0.25. Routine but non-optional Tor security update; operators distributing or bundling Tor Browser should sync to 15.0.25 since Tails, Mullvad Browser, and haveno have already picked up the same fix.

haveno 1.11.0. Updates its embedded Tor to 0.4.9.14 carrying high-severity fixes, aligning with the broader Tor security sync this week.

Mullvad Browser 15.0.25. Backports the same Tor Browser security fixes along with a NoScript bump, consistent with the week's cross-project Tor patch wave.

OnionShare 2.7. Security prevent sharing a single file that is a symlink (to a potentially sensitive file).

Vanadium 155.0.8059. Changes in version 155.0.8059.79.0: update to Chromium 155.0.8059.79 improve implementation of always displaying autofill settings A full list of changes from the previous release (version 155.0.8059.39.0) is available through the Git co...

Session Android 1.33.7. Fix voice/audio playback broken 1.11.0, bump to 1.33.7 Release/1.33.6

XSAs released on 2026-10-13. The Xen Project has released one or more Xen security advisories (XSAs).

uBlock Origin 1.75. - Fix parsing of permissions filter option - Improve googlesyndication adsbygoogle.js shim - Use new publicSuffix API when available - Add trusted-edit-inbound-element sriptlet - Refactor scriptlet injection code - Improve jsonl-edit-fet...

Self-hosting

Nextcloud Desktop 35.0.0. Research changes can shape future protocol, wallet, and infrastructure decisions.

Paperless-ngx 3.3.2. Addresses a named security advisory (GHSA-c8f3-pqr2-rr24) and is recommended for all users, though it ships as a pre-release tag.

StartOS Start SDK 3.0.6. A patch release: manifests, notifications and container addresses type-check as written for 3.0.4, and action results spell out every field.

StartOS start-cli 2.4.1. Start-cli 2.4.1 packs services built on images with absolute or..

Syncthing-Fork Android 2.1.7. Other chore(build-release): minimize package size enhancement(custom http cert): Improved custom http certificate and key validation

AI

Claude Code Action GitHub 1.0. Claude Code GitHub Action v1.0 - Now Generally Available!

Qwen Code 0.25.2. Highlights See the complete change list below.

Open WebUI 0.12.2. Added - MinerU 4.x servers.

Ollama 0.40.7. Openai: allow Responses effort on non-thinking models llama-server: let llama-server infer the draft speculative type mlx: add PPLX Decider v1.2…

Cline Desktop 0.0.48. - GPT-6 models (such as gpt-6-sol and gpt-6.1-sol ) work on OpenAI and Azure OpenAI-compatible endpoints.

Cline CLI 3.0.73. - GPT-6 models (such as gpt-6-sol and gpt-6.1-sol ) work on OpenAI and Azure OpenAI-compatible endpoints.

Nostr

algia 0.0.137. Search: pass cli context to QueryEvents

Rx Nostr 4.0.0-beta.2. Minor Changes - 32966a5: Separate forward and backward request input types, and accept nested filter arrays in backward as a finite sequence of REQ segments.

Bitcoin

ZEUS 13.2.3. V13.2.3 Highlights: - Embedded LND v0.21.4 - LDK Node v0.7.0-zeus-rl-0.2.7 (rust-lightning v0.2.7 security fixes) - Further security hardening measures - Miscellaneous bug fixes - Miscellaneous UI improvements never transferred correctly...

Cashu CDK 0.18.2. 0.18.2 Summary Version 0.18.2 adds seed-based recovery of signing keys for known mint quotes and fixes persisted wallet quote state, LND payment validation and rounding, and legacy mint configuration imports.

Alby Hub 1.24.3. This Alby Hub release we add a number of UX/UI refreshed payment status components and QR codes, transactions list filtering, improved Alby Hub Migration flow to support migration from postgres to sqlite, and many other minor improvement...

Bull Bitcoin 6.14.0. Bull Bitcoin Mobile 6.14.0 - Release Notes New Features - Rebuilt Tor integration: Tor now runs as an isolated infrastructure package.

Wasabi Wallet 2.8.4. Wasabi Wallet is an easy to use, privacy-focused, open-source, non-custodial, Bitcoin wallet.

Keystone 3 3.1.4. Details Web3: Improvements 1.

Research, policy & news

New Alpha Release: Tor Browser 16.0a14. Alpha channel only; testers tracking the Tor Browser roadmap should expect this to eventually supersede the 15.0.25 stable fixes already deployed across Tails and Mullvad Browser.

What to watch

Tor Browser 16.0a14 alpha progression toward stable. The alpha is already public; given the week's pattern of Tails, Mullvad Browser, and haveno all syncing to 15.0.25, a future stable cut will likely trigger another round of downstream updates.

ntfy.sh stability post-2.31.1. The 2.31.0 rollback was caused by a database load regression; operators should watch for any further patch releases confirming the fix holds under production load.

Paperless-ngx security fix reaching a non-pre-release tag. 3.3.2 addresses a named GHSA advisory but is still tagged pre-release; a stable promotion is worth watching for operators who hold off on pre-release packages.

By the numbers

Stories tracked: 175

Featured: 34

Releases: 166

Active sources: 208

Security patches: 4

Days covered: 7

Top beats this week

AI: 61

Privacy: 49

Bitcoin: 24

Self-hosting: 21

Nostr: 16

Unspecified: 4

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-18-weekly-recap/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.

GM 🫡 SF walked us through Noderunners Radio, a listener funded ...

2026-10-17T06:55:53Z

GM 🫡

SF walked us through Noderunners Radio, a listener funded station where song requests are paid in sats and most of a Wavlake request goes straight to the artist.

Self hosted, self custodial, built track by track. Catch yesterday's #FREEDOMTECHFRIDAY if you missed it.

Listen: https://fountain.fm/episode/XG93HcAnxfyhHYLAZhZ7
Show notes: https://ungovernable.network/shows/freedom-tech-friday/pirate-radio-with-sf/

MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890)

New episode out now: Pirate Radio with SF Freedom Tech Friday 61 ...

2026-10-16T15:29:49Z

New episode out now: Pirate Radio with SF

Freedom Tech Friday 61 with MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890)

Listen and boost on Fountain: https://fountain.fm/episode/XG93HcAnxfyhHYLAZhZ7
Show notes: https://ungovernable.network/shows/freedom-tech-friday/pirate-radio-with-sf/

Pirate Radio with SF, aka ...

2026-10-16T12:00:00Z

Pirate Radio with SF, aka @npub1cwzduskqu6yuxjs2a75uptj3vzfa84gv5q3xlkcpzs6usjfey24qvk70dv, live in 1 hour. 9AM EST / 2PM UK.

#FREEDOMTECHFRIDAY 61.

SF runs Noderunners Radio, where listeners pay sats to pick the songs, and splits payouts straight to Wavlake artists. We get into his manifesto for an FM/AM transmitter that broadcasts the Bitcoin network alongside the music, his Lightning tarot machine seeded from block hashes, and what happened when the infrastructure under his project vanished overnight.

See you there.

MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890)

GM. Today on #FREEDOMTECHFRIDAY we've got @npub1cwz…70dv ...

2026-10-16T04:00:00Z

GM. Today on #FREEDOMTECHFRIDAY we've got LePlebRoyale (npub1cwz…70dv) from Noderunners Radio, the Bitcoin pirate radio station where listeners pay 21 sats to pick the next song.

The Lightning jukebox, Madame Satoshi's tarot machine, Lightning fortune cookies, and the Noderunners crowd. Last call for questions, drop them below.

9AM EST / 2PM UK with MaxUM (npub1lqv…fx0r) and Seth For Privacy (npub1tr4…2y5g) on the Ungovernable (npub1jcy…2890) feeds.

https://noderunnersradio.com

On Omarchy Mobile, the new default camera app writes EXIF data to ...

2026-10-15T09:20:29Z

On Omarchy Mobile, the new default camera app writes EXIF data to every photo. Location tagging is off by default and has to be switched on. LOVE TO SEE IT!

quoting
nevent1q…c7g0
Omarchy Mobile update: a real camera app 📸

Linux camera apps were built for desktop and laptop webcams, not for a phone with four cameras. We can fix everything...

Camera (omacam) is now the default camera on Omarchy Mobile:

• All four Pixel 7 Pro cameras: ultrawide, main, selfie and 5× telephoto
• Zoom steps 0.5× / 1× / 2× / 5× that switch lenses for you, plus pinch-to-zoom
• Full-resolution photos, tap-to-focus and autofocus
• Volume keys as the shutter, and a shutter sound you can turn off
• A settings sheet like the ones on Android cameras
• EXIF data on every photo; location is off unless you turn it on
• Video recording (H.264 + Opus), early but working
• Follows your Omarchy theme

Rust + GTK4/libadwaita on mainline Linux and libcamera, with no Android underneath. GPL-3.0.

github.com/derekross/omacam

Will post real photos and videos shortly. I need to go touch (and mow) my grass.

Tomorrow on #FREEDOMTECHFRIDAY we're joined by ...

2026-10-15T05:23:49Z

Tomorrow on #FREEDOMTECHFRIDAY we're joined by LePlebRoyale (npub1cwz…70dv) from Noderunners Radio, the Bitcoin pirate radio station where listeners pay 21 sats to pick the next song.

We'll get into the Lightning jukebox, Madame Satoshi (a Bitcoin tarot reader that takes sats), his art and design work, and the Noderunners crowd.

Got a question for SF? Drop it below.

Live Friday, 9AM EST / 2PM UK with MaxUM (npub1lqv…fx0r) and Seth For Privacy (npub1tr4…2y5g) on the Ungovernable (npub1jcy…2890) feeds.

https://noderunnersradio.com

LOVE TO SEE IT #nevent1q…hm28

2026-10-14T15:13:42Z

LOVE TO SEE IT

quoting
nevent1q…hm28
Omandroid has a new name: Omarchy Mobile 📱

It was never Android. It's native Omarchy (Arch Linux ARM, Hyprland, Omarchy's own packages) on a mainline Linux kernel, right on a Pixel 7 Pro. No Android underneath.

New repos (old links redirect):
https://github.com/derekross/omarchy-mobile
https://github.com/derekross/linux-omarchy-mobile

Hardware: display at 120 Hz, GPU, touch, Wi-Fi, Bluetooth audio, battery, haptics, torch, sensors and auto-rotate, GPS, NFC (read/write tags) and fingerprint unlock (opt-in) all work. Speakers work but are still quiet. Ultrawide camera works; main and front are in progress. The modem now boots and talks to the phone; calls, SMS and data need a SIM, that's next. Sleep is in progress.

The last two days in software:
• swipeable home screens with ~50 built-in widgets, from @simonschubert's Omalauncher
• "Create with AI": describe a widget, Omarchy's default agent builds it
• editable quick settings
• one app per screen
• mirror the phone's screen to your laptop over USB

And an installer! I'm super happy to annonce this. It can all be done with a few commands. GUI/website later. Build the root image on your laptop, then tools/install-phone asks for your user name, password and Wi-Fi, checks the phone, and writes only slot B and userdata. Stock Android stays on slot A as your way back. First boot sets everything up, and tools/phone-provision pulls the phone-specific firmware from your own Pixel factory image (no Google files redistributed). The first clean install with it is happening on my phone as I write this. Steps are in the README.

Fair warning: this is EXPERIMENTAL! Unlocking the bootloader wipes the phone, expect rough edges, Pixel 7 Pro only for now. Pixel 6 and 8a ports are starting via contributors. Addtional contributors welcome 🤙

Before a standup call I'll ask my agents to 'remind me ...

2026-10-14T14:01:19Z

Before a standup call I'll ask my agents to 'remind me what we did in the past 7 days' and I'm constantly dumbfounded.

The output level a single individual can achieve these days while constantly spinning a few agents is absolutely insane.

What a time to be alive.

GM 🫡 Friday's show had Roy from Breez. He said Lightning ...

2026-10-14T05:30:32Z

GM 🫡

Friday's show had Roy from Breez. He said Lightning was never a privacy tool, and around nine nodes handle 80-90% of network volume.

We got into why Breez moved from Liquid to Spark after Boltz suspended swaps over AI-assisted attacks, and why Roy picked Spark over Ark. Worth a listen.

Listen: https://fountain.fm/episode/8fyR0elRodlztsU2eWeF
Show notes: https://ungovernable.network/shows/freedom-tech-friday/bitcoin-in-every-app/

MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890) #FREEDOMTECHFRIDAY

You still have two single points of failure

2026-10-13T20:49:05Z

In reply to nevent1q…tx6r
_________________________

You still have two single points of failure

The Anthropic paper this is from tested a 9B model across 9 ...

2026-10-13T13:04:02Z

The Anthropic paper this is from tested a 9B model across 9 hardware types, getting inference running on 8. A 26B model ran distributed across 15 off-brand Android TV boxes bought for $55 each. Read it in full.

quoting
nevent1q…4aqr
New Anthropic research warns that "small AI models may be months away from being capable enough to self-replicate on commercial IoT devices" like smart ovens and TV boxes.

In testing, a 9B parameter model got inference running on 8 of 9 hardware types. Researchers ran a 26B model distributed across 15 off-brand Android TV boxes bought for $55 each.

"Unlike non-AI malware, it could figure out unfamiliar devices on its own."

https://www.anthropic.com/research/self-replicating-ai

Thanks for sharing, and yes, very testing times indeed!

2026-10-13T12:34:08Z

In reply to nevent1q…uecs
_________________________

Thanks for sharing, and yes, very testing times indeed!

Worth adding that the Nano X implant in our story tapped the ...

2026-10-13T09:12:20Z

In reply to nevent1q…zc9r
_________________________

Worth adding that the Nano X implant in our story tapped the screen's data lines without adding bulk. A device can be implanted and still weigh in spec, so this is a weak signal at best, as you say.

GM 🫡 A hidden board inside a tampered Nano X read the seed ...

2026-10-13T05:01:58Z

GM 🫡

A hidden board inside a tampered Nano X read the seed words straight off the screen's data lines and sent them out over its own cellular modem. It never touched the secure element, so the device still passed Ledger's genuine check.

From yesterday's Bitcoin Brief.

Listen: https://fountain.fm/episode/tuuUDrhS9RZg9h9Dulha
Show notes: https://ungovernable.network/shows/bitcoin-brief/93m-drained-from-tampered-ledger-devices/

MaxUM (npub1lqv…fx0r) Ungovernable (npub1jcy…2890)

Tuta and Nextcloud are integrating bidirectionally. Save mail ...

2026-10-12T18:10:08Z

Tuta and Nextcloud are integrating bidirectionally. Save mail attachments to your own Nextcloud, add Nextcloud Talk links from Tuta Calendar, access Tuta from Nextcloud too.

Account-wide, not device-based. Short Techlore interview, worth four minutes.

https://www.youtube.com/watch?v=Q7RZ2J3Dqro

New episode out now: $93M Drained From Tampered Ledger Devices ...

2026-10-12T16:35:01Z

New episode out now: $93M Drained From Tampered Ledger Devices

The Bitcoin Brief 94 with MaxUM (npub1lqv…fx0r) Ungovernable (npub1jcy…2890)

Listen and boost on Fountain: https://fountain.fm/episode/tuuUDrhS9RZg9h9Dulha
Show notes: https://ungovernable.network/shows/bitcoin-brief/93m-drained-from-tampered-ledger-devices/

The Bitcoin Brief 94 is live in 1 hour, 9AM EST / 2PM UK. Ledger ...

2026-10-12T12:00:00Z

The Bitcoin Brief 94 is live in 1 hour, 9AM EST / 2PM UK.

Ledger has confirmed a hidden hardware implant inside a device bought through its Southeast Asia reseller CryptoBilis, after reported losses up to $93M.

Coldcard's official X account posted a phishing link this week before it was deleted.

Also on: FinCEN withdraws its unhosted wallet and mixer surveillance rules, and Justin Drake's call to move coins to fresh addresses before quantum breaks ECDSA.

MaxUM (npub1lqv…fx0r) Ungovernable (npub1jcy…2890)

Anthropic disclosed that its AI agents made unintended requests ...

2026-10-12T10:56:37Z

Anthropic disclosed that its AI agents made unintended requests to federal, state and local government websites during internal testing, including attempts to retrieve data using access tokens and one attempt to get state agency data without paying the required fee.

Scope permissions before you grant them to agents.

https://www.engadget.com/2283091/anthropic-says-its-ai-agents-tried-to-break-into-government-websites/

https://kagiproxy.com/img/GaeLgj5hYPWC2WV9iyUn3Y-CyjWSVPiepAeyU_K8OQHVNAENn3lz5hzxOkogP3Or6-_cb4pm9aaz63QeBs0SkBLq81BMdT0hYz4pnBtBAzYpuId1piutHsZbdFfrJRTxCeDzGabghPEcX1ET73tEJ9c7Ct6iDQ

GM 🫡 The Bitcoin Brief mailbag is open. Questions, hot takes, ...

2026-10-12T05:21:50Z

🤣 #nevent1q…a0ua

2026-10-11T18:59:12Z

🤣

quoting
nevent1q…a0ua
AGI 🤣

nevent1q…3gun

This week in freedom tech, all in one place 👇 #naddr1qv…d49s

2026-10-11T18:14:26Z

This week in freedom tech, all in one place 👇

quoting
naddr1qv…d49s

Patch board

The week's patch activity concentrated in the self-hosted application layer rather than infrastructure or hardware. Duplicati, Radicale, Vaultwarden, and FreshRSS all shipped "Patch now" releases within a three-day span, none carrying assigned CVEs but each addressing disclosed security issues, including a named Radicale auth flaw (FO-RAD-2026-001). On the Bitcoin side, Fedimint's gateway fund-loss fix and Core Lightning's responsibly-disclosed vulnerability patches were the most consequential items, both already shipped as stable point releases. Operators running any of these six projects should have already updated; nothing in this set is still pending a deadline.

Duplicati 2.4.0. This is a stable-channel patch rolled out as a pre-release tag, fixing issues discovered after 2.4.0.0 shipped.

Radicale 3.8.3. Fixes an auth bug where rights and user groups were not cleared before a conditional set depending on group/auth type, tracked as FO-RAD-2026-001.

Vaultwarden 1.37.4. Contains security fixes for disclosed advisories without CVE numbers attached in the release notes.

FreshRSS 1.30.1. Continuation of the 1.30.0 security line with several patches bundled together.

Bitkey App 2026.13.0. Access the Bitkey release notes to view the features included in this release.

ZEUS 13.2.3-rc1. Release candidate embeds LND v0.21.4 and LDK Node with rust-lightning v0.2.7 security fixes alongside further hardening.

Uptime Kuma 2.5.6. Bug Fixes - 7886 use UptimeCalculator for avg-response badge endpoint Security Fixes - 7858 chore: Update dependencies

Weekly threads

Self-hosted app layer patches in lockstep

Duplicati, Radicale, Vaultwarden, and FreshRSS all shipped security-driven point releases within three days of each other. None disclosed CVEs, but the clustering across backup, CalDAV, password-vault, and RSS tooling suggests operators running a typical self-hosted stack had four separate update obligations in one week rather than one.

Fedimint hardens gateway payment paths across two release lines

Fedimint 0.12.2 fixed a bug in LNv2 payment handling that could cause a gateway to lose funds, then 0.11.4 backported the same hardening rather than forcing operators onto the newer line. Fedimint also pushed 0.13.0-beta.1 the same week, signaling active parallel development across stable, maintenance, and pre-release tracks.

Bitcoin hardware wallets ship parallel firmware lines

Keystone 3 published both 3.1.2 (with Core Extension wallet migration) and 2.9.9 in the same week, mirroring the dual-firmware-line pattern seen elsewhere in Bitcoin hardware. Ledger Live Mobile and Desktop also moved in lockstep at 4.23.1, underscoring how hardware wallet vendors now treat mobile and desktop clients as a single coordinated release unit.

Release board

Privacy

Thunderbird for Android K-9 Mail 24.0. Signatures can be formatted as HTML for individual identities - Reply prompts users to choose Reply or Reply All when both are applicable Long account names are resized to fit within two lines in the account drawer Selected…

Thunderbird for Android 24.0. Signatures can be formatted as HTML for individual identities - Reply prompts users to choose Reply or Reply All when both are applicable Long account names are resized to fit within two lines in the account drawer Selected…

haveno 1.9.0. Highlights - Redesigned Receive, Send, and trade screens, a new startup wizard, and wallet restore from seed.

IVPN Desktop 3.16.1. Drops support for macOS versions before Monterey 12.

NetNewsWire 7.2. - Fixed bug where Add Feed lost the typed URL and title after choosing a folder - Offered Update Credentials in the account error alert for all username and password accounts…

Session iOS 2.15.5. Bind Apple Pro payments to the master key via appAccountToken Fixed dependency race condition…

Orbot for Android 17.9.7. 1bf1722f4 (HEAD - master) update bridges!

XSAs released on 2026-10-09. The Xen Project has released one or more Xen security advisories (XSAs).

uBlock Origin 1.75. - Fix parsing of permissions filter option - Improve googlesyndication adsbygoogle.js shim - Use new publicSuffix API when available - Add trusted-edit-inbound-element sriptlet - Refactor scriptlet injection code - Improve jsonl-edit-fet...

Self-hosting

Coolify 4.4.6. Fixes - Fixed self-hosted startup failures caused incompatible PHP base image it to a stable version.

Home Assistant 2026.10. - Fix certain device variants failing during setup of lunatone (@MoonDevLT - 182396) - Fix lutron caseta warm dim level and transition not sent to bridge (@cb2206 - 182995) - Fix PostgreSQL prerelease version detection in recorder (@Drag...

n8n beta. 2.43.3 (2026-10-09) Features core: Block create/update of workflows with deprecated nodes (3c4f6e3) Google Gemini Node: Show Nano Banana 2.1 and 2 Lite in the image model list (1830ccf)

N8n 2.43.3. 2.43.3 (2026-10-09) Features core: Block create/update of workflows with deprecated nodes (3c4f6e3) Google Gemini Node: Show Nano Banana 2.1 and 2 Lite in the image model list (1830ccf)

Immich 3.3.0. V3.3.0 !NOTE We're collecting feedback related to people sharing in this discussion: Welcome to Immich v3.3.0 !

Nextcloud Desktop 35.0.0. Upgrading from previous release candidates on Windows requires running the installer twice, using repair mode the second time.

StartOS Start SDK 3.0.2. A one-fix patch release: a package's migrations run after a flavor switch.

StartOS start-registry 1.1.1. Start-registry 1.1.1 keeps every package revision in the index while showing clients only the ones they need, and brings shared dependencies up to date with their security fixes.

AI

Claude Code Action GitHub 1.0. Claude Code GitHub Action v1.0 - Now Generally Available!

Qwen Code 0.24.7-nightly.20261004.9915c7ff8f. Align Code Mode text with lazy tool discovery honor approved cross-directory tool calls stop swallowing Enter while completion suggestions load…

Qwen Code 0.25.0-nightly.20261009.085a44f336. Replace selected remote Hosts without losing bindings test(core): close 12693 post-merge review test and hygiene gaps test(integration): make the /hooks dialog E2E witness the rendered dialog by…

Open Interpreter 0.0.56. Open Interpreter 0.0.56 Models - Add GPT-6.1 Sol ( gpt-6.1-sol ) metadata and refresh the maintained provider catalog and model documentation.

Cli mistral 0.8.0. Breaking The binaries no longer load.env or bunfig.toml from the working directory.

Client Python 3.1.0. It may change practical decisions for Bitcoin users, operators, builders, or privacy-focused readers.

Ollama 0.40.3. Ollama launch claude no longer shows a warning about Claude connectors ollama launch codex no longer warns about service tiers Paused background…

Nostr

Grain 0.8.0. GRAIN v0.8.0 A Nostr client, the library it's built on, and a relay hardened in production Release 10.4.2026

Amber 6.6.7. Amber 6.6.7 - Fix relays staying disconnected until the app was force closed: relays marked dead after a stretch of bad connectivity now get another chance after a 15 minute cooldown…

Sprout Buzz Desktop 0.5.27. Desktop and shared changes - offer Claude effort levels in agent edit and create ( 9c6fa14aa03358b4188f2ce0a92a9e435a3cb41b ) - use object-scale-down for inline markdown images ( fcf5f044b3af56f3855a417e61e4389fa925c1bd ) -…

Bitcoin

Payjoin Dev Kit Release payjoin-cli 1.0.0. The first stable payjoin-cli release, tracking payjoin 1.2.0.

Keystone 3 3.1.2. Adds wallet migration via USB connection to Core Extension, a workflow change rather than a security fix.

Fedimint 0.12.2. Fixes a bug in the Lightning gateway's LNv2 payment handling that could cause a gateway to lose funds, plus further hardening of payment paths.

Fedimint 0.11.4. Backports the 0.12.2 gateway hardening to the 0.11 line for operators who have not migrated to 0.12.

Minibits 0.4.5-beta. This is a bugfix release that finally resolves some annoying NFC issues.

BTCPay Server 2.4.5. Breaking change blocks outbound HTTP requests to private-network destinations by default for Lightning connections, LNURL, invoice webhooks, and notification URLs, closing an SSRF vector.

Alby Hub 1.24.1. This Alby Hub release we add a number of UX/UI refreshed payment status components and QR codes, transactions list filtering, improved Alby Hub Migration flow to support migration from postgres to sqlite, and many other minor improvement...

Core Lightning 26.06.9. Fixes vulnerabilities responsibly reported by multiple sources plus a gossip regression introduced in the prior point release.

Nunchuk Desktop 2.9.1. Fix mac M opening problem Bug fixes and improvements macOS Apple Silicon (M1, M2, M3, M4, etc.): Download nunchuk-macos-v2.9.1-arm64.dmg Intel Macs: Download nunchuk-macos-v2.9.1-x86 64.dmg Windows Windows 64-bit (Intel / AMD): Installer...

What to watch

ZEUS 13.2.3 stable tag. The rc1 build embeds LND v0.21.4 and rust-lightning v0.2.7 security fixes; the stable release is the one production wallet operators should wait for before upgrading.

Fedimint 0.13.0 stable release. The beta.1 pre-release is explicitly marked unstable and not recommended for mainnet; watch for the stable tag before federation operators migrate off 0.12.x.

InvokeAI 7.0.0 database migration path. The alpha.2 release warns that pointing v7 at an existing root directory upgrades the database irreversibly for v6; operators should watch for the final 7.0.0 release notes before migrating production instances.

By the numbers

Stories tracked: 173

Featured: 43

Releases: 164

Active sources: 206

Security patches: 7

Days covered: 7

Top beats this week

AI: 63

Privacy: 38

Self-hosting: 33

Bitcoin: 26

Nostr: 10

Unspecified: 3

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-11-weekly-recap/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.

The video is what?

2026-10-11T13:37:13Z

In reply to nevent1q…4nky
_________________________

The video is what?

GM 🫡 https://youtu.be/dAzs_rU6080?is=Kh5qkG6HRO17c08k ...

2026-10-11T07:12:48Z

GM 🫡

https://youtu.be/dAzs_rU6080?is=Kh5qkG6HRO17c08k

quoting
nevent1q…n9vz
The open source renaissance is upon us.

People do not care enough to go the extra route.

2026-10-11T06:45:07Z

In reply to nevent1q…jwn2
_________________________

People do not care enough to go the extra route.

The open source renaissance is upon us. ...

2026-10-10T18:44:58Z

The open source renaissance is upon us.

If you think holding bitcoin is a wild ride, check out Redbull ...

2026-10-10T15:09:33Z

If you think holding bitcoin is a wild ride, check out Redbull Rampage. 🤯

It’s becoming more obvious by the day. ...

2026-10-10T14:57:52Z

It’s becoming more obvious by the day.

Nostr event nevent1qqsf2weujf33592qrrqmfwszxfez4jvdm0jsa4fnmj2usrt3gqxq90czyznqu70qakk4zqxh2sakd8j38k7pcgtsar5mwn7m36t34lg7pe5px266j43

2026-10-10T08:56:00Z

JFC

GM 🫡 Roy from Breez was on yesterday's show and didn't ...

2026-10-10T05:39:12Z

GM 🫡

Roy from Breez was on yesterday's show and didn't mince words: Lightning was never a privacy tool, and around nine nodes handle 80 to 90% of network volume.

We got into why Breez picked Spark over Ark, building their own open source SSP, and stablecoins on the SDK. Worth a watch if you missed it.

Listen: https://fountain.fm/episode/8fyR0elRodlztsU2eWeF
Show notes: https://ungovernable.network/shows/freedom-tech-friday/bitcoin-in-every-app/

MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890) #FREEDOMTECHFRIDAY

Privacy Guides tier-listed email aliasing tools: Addy.io, ...

2026-10-10T04:00:00Z

Privacy Guides tier-listed email aliasing tools: Addy.io, SimpleLogin, Firefox Relay and others.

Criteria include custom domains, source availability and lock-in.

Addy.io came out on top, mainly for openness and no lock-in.

https://www.youtube.com/watch?v=rXPyenCc9K4

Cosmic (System76) now bans LLM-generated code in pull requests. ...

2026-10-09T19:00:00Z

Cosmic (System76) now bans LLM-generated code in pull requests.

The reason given is review burden, not ideology. The acceptance rate on AI submissions was low enough that it was burying genuine contributors.

Brodie Robertson walks through the policy and the pushback.

https://www.youtube.com/watch?v=qWyUF_vMUWM

@nprofile…l2qt ❤️ #naddr1qq…0sap

2026-10-09T18:59:49Z

Freedom.Tech (nprofile…l2qt) ❤️

quoting
naddr1qq…0sap

Bitcoin

Minibits 0.4.4-beta. Rolls up five months of OTA updates plus a zap-processing fix; worth updating if running on an older build.

Nunchuk Desktop 2.9.0. Adds hardware-signer-as-inheritance-key support for off-chain timelock plans, useful for inheritance setups without a dedicated key.

Fedimint 0.13.0-beta.0. Pre-release only, features may be unstable and not upgrade-safe.

BDK FFI 3.1.1. Bdk wallet 3.1.0; Bdk electrum 0.24.0.

Arkade TS SDK Swap 0.0.25. Updates scure crypto libs to 2.4.x and fixes a swap URI amount-conflict bug; relevant for anyone integrating Arkade swaps.

Arkade TS SDK 0.4.79. Same scure 2.4.x bump and swap-URI fix as the companion Swap SDK release; update both together.

Nostr

Divine 1.0.24-beta.production.0671f8fdc91b6b33a64d4e166d62a6468e11ea01. Divine beta An early build for testing; Things may break.

Privacy

IVPN Desktop 3.16.1. Breaking change: drops support for macOS below Monterey (12).

Am I Exposed 0.42.1. Am I Exposed v0.42.1

Signal Android 8.31.1. A new and improved keyboard for emojis, stickers, and animated GIFs is our GIFt to you; For automatic updates, we recommend using Obtainium.

Vanadium 155.0.8059. Changes in version 155.0.8059.39.0: update to Chromium 155.0.8059.39 A full list of changes from the previous release (version 154.0.8037.126.0) is available through the Git commit log between the releases.

Notesnook Android 3.4.14. Read about what's new in Notesnook Mobile v3.4.14 on Notesnook's blog

Standard Notes Desktop 3.202.9. Version bump only for package @standardnotes/web; Version bump only for package @standardnotes/desktop.

Standard Notes Mobile 3.202.9. Version bump only for package @standardnotes/mobile

Element Web 1.12.31-rc.1. RC removes the default option to skip device verification, tightening the out-of-box E2E security posture.

Self-hosting

Immich 3.3.1. Shared person indicator; Keep memories full screen while swiping.

Syncthing 2.1.7-rc.1. Devices and folders can now be grouped in the GUI by setting the new group attribute.

Coolify 4.4.3. Fixed static-site pull request previews that failed with a missing Dockerfile error; Fixed the empty terminal container picker for resources with multiple containers.

N8n 1.123.84. 1.123.84 (2026-10-08)

AI

Ollama 0.40.2. Ollama list no longer shows duplicate entries for upgraded models; Ollama launch claude uses the model's full context length.

Qwen Code 0.25.1-preview.1. Replace selected remote Hosts without losing bindings; Wait 60s before the E2E build artifact download retry.

openclaw 2026.9.9. - formatted for people, with expandable sections; Changelog - plain Markdown for AI agents and tools.

Jan 0.8.5. MacOS and Linux: a jan that v0.8.4 installed (in /usr/local/bin or /.local/bin) is left in place but stays at v0.8.4.

langchain-openai== 1.7.0. Changes since langchain-openai==1.6.7 release(openai): 1.7.0 support decisions api chore(deps): bump langgraph-sdk from 0.4.4 to 0.4.6 in /libs/partners/openai chore(deps): bump langgraph-sdk from 0.4.2 to 0.4.4 in…

Hermes Agent 0.21.6. Docker / Hermes Cloud: nousresearch/hermes-agent:stable (or:latest).; CLI (git installs): hermes update, or re-run the installer one-liner.

langchain== 1.4.4. Changes since langchain==1.4.3 release(langchain): 1.4.4 (SummarizationMiddleware) retry summary step on context overflow chore(deps): bump fsspec from 2026.6.0 to 2026.9.0 in /libs/langchain v1 chore(deps): bump…

llama.cpp b11515. SYCL backend gets Q5 K reorder-layout MMVQ and fused GLU; relevant mainly for Intel GPU inference setups.

Claude Agent Sdk Python 0.2.165. Updated bundled Claude CLI to version 2.1.294.

MiniMax Code 0.6.5. Built from public source commit 309e285.

Rslearn 0.1.17. Fix image formatting in FindStadium; Add ECOSTRESS.

Claude Code 2.1.295. Added onFailure: "block" for command and HTTP hooks: a hook that can't start, times out, or exits with an unexpected code blocks the action instead of letting it through.

Pollo AI turns creative ideas into campaigns with OpenAI. With GPT-5.6, GPT-6 Astra, and GPTImage2.5, Pollo AI helps creators turn bold ideas into detailed images and cinematic video ads.

Other

Cassis, a new simple scheme for generic multi-layer multi-hop HTLC routing. Proposes a generic scheme for routing HTLCs across multiple Bitcoin layers, addressing the lack of a standard cross-layer payment method.

When No ID Means No Internet: Age Verification and the Right to Access Information. This post was co-authored by Sheila B.

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-09-bitcoin-daily-brief/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.

Oh shit! #nevent1q…uns9

2026-10-09T18:33:11Z

Oh shit!

quoting
nevent1q…uns9
It's finally getting ready. Full Amethyst running on the Desktop.

New episode out now: Bitcoin in Every App Freedom Tech Friday 60 ...

2026-10-09T18:00:44Z

New episode out now: Bitcoin in Every App

Freedom Tech Friday 60 with MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890)

Listen and boost on Fountain: https://fountain.fm/episode/8fyR0elRodlztsU2eWeF
Show notes: https://ungovernable.network/shows/freedom-tech-friday/bitcoin-in-every-app/

WILD times #nevent1q…8jjd

2026-10-09T14:10:03Z

WILD times

quoting
nevent1q…8jjd
⚡️🤖 TECH - AI is now being used to recreate Adobe’s software, a developer has released seven free, open-source apps as clean-room alternatives to Adobe’s main tools:

- PhotoCraft → Photoshop
- VectorCraft → Illustrator
- FilmCraft → Premiere Pro
- LightCraft → Lightroom
- EffectCraft → After Effects
- DesignCraft → InDesign
- PrintCraft → Acrobat Pro

Built in Rust with help from Claude Opus 5.5, they run on Windows, Linux, and macOS under MIT/Apache licenses without using Adobe’s source code.

Yeah first three

2026-10-09T13:14:41Z

In reply to nevent1q…26kd
_________________________

Yeah first three

Bitcoin in Every App is live in 1 hour: 9AM EST / 2PM UK on the ...

2026-10-09T12:00:00Z

Bitcoin in Every App is live in 1 hour: 9AM EST / 2PM UK on the Ungovernable Misfits feed.

Freedom Tech Friday 60 with Roy (npub1ey6…szvp) from Breez.

Breez went from a Lightning wallet to the SDK behind bitcoin in apps like Cake Wallet, BitBox and Radar Chat. We get into the move from Liquid to Spark, why stablecoins shipped on top of bitcoin, and what it means for Breez to be a Spark operator.

MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890)

There will never be a day where I tire of watching Fast and ...

2026-10-09T11:01:05Z

There will never be a day where I tire of watching Fast and Furious.

#ForgetAboutItCuh

GM. Today on #FREEDOMTECHFRIDAY we've got @npub1ey6…szvp ...

2026-10-09T04:00:00Z

GM. Today on #FREEDOMTECHFRIDAY we've got Roy (npub1ey6…szvp) from Breez.

Liquid to Spark, stablecoins, and the future of Spark. Last call for questions, drop them below.

9AM EST / 2PM UK on the Ungovernable (npub1jcy…2890) feeds.

MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g)

Nostr, we want to hear from you! 🫵🏼 #nevent1q…nzhl

2026-10-08T16:27:26Z

Nostr, we want to hear from you! 🫵🏼

quoting
nevent1q…nzhl
Help shape what we build next! 📝

A short survey on how you use AI, privacy, and running a node or server at home. Passport owners and non-owners welcome.

Optional prize draw: a Passport Prime and two $50 store credits. Closes Oct 16, 11:59 p.m. ET.

https://foundation.xyz/community-survey?source=nostr

🎯 #nevent1q…6sh3

2026-10-08T13:06:41Z

🎯

quoting
nevent1q…6sh3
Both anthropic and openAI absolutely will rug you. Don't be a retard: build your systems on top of open weight models.

Nostr event nevent1qqsyzywquqc5f7u5fxzsq483sgec8pjm0pp45jgtj9spk9ze2j4z4cgzyznqu70qakk4zqxh2sakd8j38k7pcgtsar5mwn7m36t34lg7pe5pxa69n0r

2026-10-08T12:22:45Z

WANT

https://x.com/iamlukethedev/status/2107765448343261506/video/1

https://github.com/iamlukethedev/Herald-OS

Samsung Wallet is adding USDC transfers. Bastion and Coinbase ...

2026-10-08T12:00:00Z

Samsung Wallet is adding USDC transfers. Bastion and Coinbase Prime hold the funds, not the user. It's custodial stablecoin rails with a bank-grade KYC trail attached.

quoting
nevent1q…tqzv
⚡️🚨 NEW - Samsung will integrate stablecoins directly into Samsung Wallet on 82 million Galaxy devices in the United States, using Solana as the underlying infrastructure.

Starting in the last week of October, eligible users will be able to send USDC from Samsung Wallet to compatible wallets abroad, without having to install an additional crypto app or manage their private keys themselves.

Transfers to bank accounts will also be available in more than 60 countries.

Solana will be among the blockchain infrastructures used for these transfers, alongside other technical partners.
USDC funds will be secured via Bastion and Coinbase Prime, while Samsung clarifies that it will not directly hold users’ assets.

ICANN published Wiz's application for a .bitcoin domain. ...

2026-10-08T10:23:54Z

ICANN published Wiz's application for a .bitcoin domain. Registration requires proof of work: run a node, operate a DNS seed, ship code, or teach. 21% of revenue funds open source.

https://wiz.biz/bitcoin-tld-application.pdf

GM 🫡 #FREEDOMTECHFRIDAY is back tomorrow, 9AM EST / 2PM UK. ...

2026-10-08T06:11:43Z

GM 🫡 #FREEDOMTECHFRIDAY is back tomorrow, 9AM EST / 2PM UK. Got a question for Roy from Breez? Drop em down below!

MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890)

🎯

2026-10-07T19:06:34Z

In reply to nevent1q…tlel
_________________________

🎯

Like the sound of this!

2026-10-07T19:01:49Z

In reply to nevent1q…2uuy
_________________________

Like the sound of this!

Agreed. What does that look like to you?

2026-10-07T19:01:30Z

In reply to nevent1q…cepf
_________________________

Agreed. What does that look like to you?

What did we miss?

2026-10-07T18:53:29Z

In reply to nevent1q…dwdg
_________________________

What did we miss?

Sharing your data with third parties is fine and dandy until ...

2026-10-07T18:51:00Z

In reply to nevent1q…c448
_________________________

Sharing your data with third parties is fine and dandy until something leaks.

Rob Braxman Tech builds a homelab server for about $1000 using ...

2026-10-07T18:22:41Z

Rob Braxman Tech builds a homelab server for about $1000 using Tailscale.

Your data lives at home instead of a provider's cloud. It doesn't cross a border sitting on your phone.

Worth a watch if you're looking to get off managed storage.

https://www.youtube.com/watch?v=Tquyga4fkCY

Mistral Large 4 is open weight in theory. The API is live today, ...

2026-10-07T13:02:03Z

Mistral Large 4 is open weight in theory. The API is live today, but the weights are not due until late October. Until they land, it is a closed model with an open-weight press release.

quoting
nevent1q…u0vz
⚡️🇫🇷🤖 NEW - Mistral unveils Large 4, nicknamed “Le Chonk,” with 1,000 billion parameters, 49 billion of which are active.

The multimodal model claims to deliver the best performance among American and European open-weight models on aggregated benchmarks.

In particular, it is said to be at the forefront in cybersecurity, industry, and finance, and to outperform leading closed models in visual understanding.

Developed entirely in Europe, it is available today via API on Mistral Cloud. The open weights are scheduled to be released in late October.

Another breach. 3,615 people's names, addresses and order ...

2026-10-07T09:11:47Z

Another breach. 3,615 people's names, addresses and order details, leaked by the company that held them, with no one assigned to deal with it. Mandatory data collection schemes keep producing this outcome.

quoting
nevent1q…ws3q
⚡️🇺🇸‼️ NEW - Trump Mobile customers have had their personal data leaked by ransomware gang BYOD. The dump covers 3,615 people and includes names, emails, phone numbers, home addresses and order details.

The gang says the company answered news of the breach with "We have no team to handle this."

The leak includes the Trump Organization's own CIO, who oversees its information security.

People listed in the data confirmed their details are accurate and BYOD claims it still has access to Trump Mobile's backend, Straight Arrow News reports.

GM 🫡 Nathan Day joined Friday's show and pointed out that ...

2026-10-07T06:34:28Z

GM 🫡

Nathan Day joined Friday's show and pointed out that putting your business on BTC Map can paint a target on your back for a wrench attack.

We also covered his off grid camper mining bitcoin on solar and the new Freedom Fest running alongside Bitfest in Manchester.

Full episode is up if you missed it.

Listen: https://fountain.fm/episode/pGQrRQiAtELC4mwjsjOh
Show notes: https://ungovernable.network/shows/freedom-tech-friday/freedom-fest-uk-with-nathan-day/

MaxUM (npub1lqv…fx0r) Seth For Privacy (npub1tr4…2y5g) Ungovernable (npub1jcy…2890) #FREEDOMTECHFRIDAY

Remain vigilant folks #nevent1q…ucar

2026-10-06T19:28:57Z

Remain vigilant folks

quoting
nevent1q…ucar
FML, just fell victim to a fake tech interview. Asked me to build and run a github repo which installed a trojan on my machine. Figured some of the questions the guy was asking sounded a bit suspect, but by the time I figured it out, it had already taken my wallet files and drained them before I could do anything. Probably a quarter of my stack gone😭
Keep bitcoin separate from other stuff and trust no one

You think there is no subsidy?

2026-10-06T17:23:33Z

In reply to nevent1q…ek3z
_________________________

You think there is no subsidy?

How long does the subsidy era have left? ...

2026-10-06T17:19:33Z

How long does the subsidy era have left?

https://fountain.fm/episode/vdSx2gU4gnEFgPVmxPRG

Discord's age check leaked government IDs within months of ...

2026-10-06T09:20:12Z

Discord's age check leaked government IDs within months of launch. The UK scheme will produce the same database, just bigger and mandatory. There's no such thing as a verification system that doesn't become a breach eventually.

quoting
nevent1q…tz08
The UK government wants a passport, a driving license or a face scan before you can open a new social media account. This is the same country that arrests people over tweets. Britain has jailed people for what they posted online and now the state wants to know exactly who is behind every account before the first post goes up.

The ban covers Instagram, YouTube, TikTok, Snapchat, Facebook and X, and it is expected to start in spring 2027.

Discord already leaked government IDs after it introduced age checks. There is no reliable, privacy-preserving way to verify the age of every internet user. A pile of faces and passports linked to social media accounts is a gift to a government that prosecutes speech.

https://reclaimthenet.org/uk-social-media-passport-facial-age-checks

GM 🫡 The National Crime Agency officer who stole 50 BTC from ...

2026-10-06T05:03:03Z

GM 🫡

The National Crime Agency officer who stole 50 BTC from seized Silk Road coins back in 2017 has finally been ordered to repay it, and part of that money is now paying off the original Silk Road admin's own debt to the state.

Full breakdown on yesterday's Bitcoin Brief, worth a listen.

Listen: https://fountain.fm/episode/JOA6bcNfCdfSUbwCwMl6
Show notes: https://ungovernable.network/shows/bitcoin-brief/the-cop-who-robbed-silk-road/

MaxUM (npub1lqv…fx0r) Ungovernable (npub1jcy…2890)

🔥

2026-10-05T18:35:14Z

In reply to nevent1q…ztvh
_________________________

🔥

New episode out now: The Cop Who Robbed Silk Road The Bitcoin ...

2026-10-05T16:49:40Z

New episode out now: The Cop Who Robbed Silk Road

The Bitcoin Brief 93 with MaxUM (npub1lqv…fx0r) Ungovernable (npub1jcy…2890)

Listen and boost on Fountain: https://fountain.fm/episode/JOA6bcNfCdfSUbwCwMl6
Show notes: https://ungovernable.network/shows/bitcoin-brief/the-cop-who-robbed-silk-road/

Going LIVE with @npub1lqv…fx0r on the @npub1jcy…2890 network ...

2026-10-05T12:00:00Z

Going LIVE with MaxUM (npub1lqv…fx0r) on the Ungovernable (npub1jcy…2890) network in one hour for The Bitcoin Brief. See you there!

https://blossom.primal.net/6c9ee898aa176ade76db00b9cf751ecba4aa029c3049a0d0438f392927353d3b

Busy week! GM 🫡 #naddr1qq…s7mc

2026-10-05T07:30:52Z

Busy week! GM 🫡

quoting
naddr1qq…s7mc

Patch board

Four releases carried Patch now severity this week, covering distinct attack surfaces rather than one shared vulnerability class: a Lightning gateway (openclaw), a router admin interface (StartWRT), an audited DEX client bundling a Tor update (Bisq), and a multi-device Lightning wallet warning (ZEUS). None listed CVEs directly, but the Bisq release stems from a formal security audit. Operators running any of these four should not treat this as a single coordinated wave; each needs independent verification against its own release notes.

OpenAI Daybreak signals a new era for AI security and the critical role of hardware security keys. The race to build increasingly powerful AI models is accelerating.

openclaw 2026.8.34. This is a gateway-only extended-stable patch, the project's LTS-equivalent track.

StartOS StartWRT 1.2.1. Fixes security issues specifically in the router's management interface, the part of the stack exposed to local admin access.

Bisq 1.10.9. Addresses vulnerabilities identified in a recent security audit and bundles the latest Tor security release, meaning two independent hardening tracks landed together.

ZEUS 13.2.2. Carries an explicit warning for iOS users running ZEUS across more than one device; this is not a routine bug-fix note.

Weekly threads

Patch-now cluster spans four trust layers

openclaw 2026.8.34, StartOS StartWRT 1.2.1, Bisq 1.10.9, and ZEUS 13.2.2 all carried Patch now severity in the same week, but they protect different things: a gateway, a router admin panel, a DEX client, and a multi-device Lightning wallet. Operators running more than one of these should not assume a single update pass covers the stack; each requires its own verification step.

Hardware wallet firmware moves on two tracks at once

Coldcard shipped firmware 1.5.3Q and 5.6.3 on the same day, continuing to maintain parallel release lines rather than a single current build. Ledger Live also pushed two point releases (4.22.0, 4.23.0) across mobile and desktop within the week, suggesting active parity work between its client surfaces.

Self-hosting's quiet volume hides two major-version shifts

Self-hosting logged only 17 stories, the lowest major beat, but BorgBackup 2.0 and Gitea 28.0.0 both crossed major-version lines with breaking changes: Gitea now routes git network operations through an internal proxy and rejects invalid push objects. Low story count this beat does not mean low operator workload.

Release board

Privacy

IronFox 157.0.0. 157.0.0.1 Signed-off-by: celenity

Orbot for Android 17.9.6. 68ea5d856 (HEAD - master, tag: 17.9.6-RC-1-tor-0.4.9.13) update to tor 0.4.9.13 and version 1796300100 7b2bb2571 (origin/master, origin/HEAD) update bridges b3259f357 update ssl libs 158223e54 (tag: 17.9.6-BETA-1-tor-0.4.9.12) update to...

Nostr VPN 4.1.17. Reliability across every platform This release hardens macOS background service installation and local file handling, and improves upgrades from older app versions.

Mullvad Browser 15.0.24. All Platforms Updated Firefox to 140.17.0esr Updated NoScript to 13.6.35.1984 Updated uBlock Origin to 1.75.0 Bug 583: Rebase Mullvad Browser stable onto 140.17.0esr mullvad-browser Bug 45366: Backport Security Fixes from Firefox 157 tor...

Vanadium 154.0.8037. Changes in version 154.0.8037.92.0: update to Chromium 154.0.8037.92 A full list of changes from the previous release (version 154.0.8037.57.1) is available through the Git commit log between the releases.

Tor Browser 15.0.24. Tor Browser 15.0.24 is now available from the Tor Browser download page and also from our distribution directory.

Arti 2.7.0. Arti is our ongoing project to create a next-generation Tor implementation in Rust.

Tails 7.14. Changes and updates Update Tor Browser to 15.0.24.

Nitrokey 3 Firmware 1.9.1. - Fix USB descriptor for compatibility with Windows when using CCID

Qubes OS 4.3.2. We're pleased to announce the stable release of Qubes OS 4.3.2!

Bitwarden Clients Browser 2026.9.1. Bug fixes PM-43928 Revert core-js bump from 3.50 to 3.49 Maintenance Bumped browser client version

Bitwarden Clients CLI 2026.9.1. - Various under-the-hood improvements and minor shipit: Feature Development - PM-43249 Model changes to support temporary item sharing - Auth/PM-43265 - Password Prelogin - Adopt new SDK LoginClient Constructor by…

Also shipped: Signal Android 8.29.2, GopenPGP 3.5.2, SimpleX Chat 7.1.0-beta.6.

Self-hosting

BorgBackup 2.0. A major version release after an extended beta cycle.

Gitea 28.0.0. Marked breaking: git network operations now route through an internal proxy with updated egress settings, and invalid or duplicate git objects are rejected on push.

Nextcloud Desktop 35.0.0. Research changes can shape future protocol, wallet, and infrastructure decisions.

Immich 3.3.0-rc.1. V3.3.0-rc.1 \ !WARNING\ Disclaimer This is a release candidate, not a stable release.

AdGuardHome 1.0.0-b.1. Changes compared to the previous beta, v0.108.0-b.91.

AdGuardHome 0.108.0-b.91. Changes compared to the previous beta, v0.108.0-b.90.

N8n 2.42.0. 2.42.0 (2026-09-29) Bug Fixes AI Agent Node: Let an AI Agent Tool use its own tools under a pre-v3 parent agent (60d0598) Align MCP workflow headings and remove outdated notice (b096147) API: Accept workflow descriptions on creation (6c1...

Duplicati 2.4.0. This release is a canary release intended to be used for testing.

Syncthing-Fork Android 2.1.6. Fixes - add requestRawExternalStorageAccess - Add local network permission in onboarding @researchxxl Other - Target sdk is now Android 17 - ndk version is now 30 - go version is now 1.27.1

AI

Qwen Code 0.24.7. Highlights See the complete change list below.

Hermes Plugin Byterover 1.0.1. Superseded (drops the empty pyproject.toml so unattended migration installs without a dependency prompt).

Client Python 3.0.0. Generated SDK baseline differences The published SDK or generator baseline differs from the baseline used OpenAPI changelog.

opencode 1.18.33. Core Bugfixes - Cloudflare AI Gateway models now honor provider response and stream timeouts.

AnythingLLM 1.17.0. Read spreadsheet dates as dates, not serial numbers Drop temp param for Anthropic models Allow Generic…

Open Interpreter 0.0.55. Open Interpreter 0.0.55 Models Fix offline model listing for configured non-OpenAI providers.

Cline CLI 3.0.68. - Agent teams stay fast in long sessions and while teammates are streaming.

openclaw 2026.9.8. OpenClaw v2026.9.8 58 commits 43 pull requests 21

Nostr

YakiHonne Mobile 2.0.9. 2.0.9 - 2026-09-28 Changed - Updated QR code scanning for more reliable camera lifecycle handling.

YakiHonne Web 6.0.3. Fixed profiles mention preview in the article page Fixed reactions extended window when the editor is neer the window viewport Fix the return from notes overlay when component behind it could not be clicked

Sidecar 1.15.1. Sidecar 1.15.1 is a fix release.

Amber 6.6.6. Changelog Amber 6.6.6 - Fix the nostrconnect parser corrupting connect-param values that contain = (such as base64-padded secrets): the connect response returned mangled values instead of the original secret…

Sprout Buzz Desktop 0.5.26. Desktop and shared changes - correct Grok Build setup guide URL ( 7ebf1beb44139264e9c5c7fee6970429ff66f934 ) - implement NIP-AR channel artifacts ( 12670bd0f037c66a682272bb81c46c3f254fad74 ) - resolve unlisted project…

Grain 0.8.0-rc5. GRAIN v0.8.0-rc5 Fixes from rc4's first production run Release candidate 10.1.2026

Bitcoin

Ride The Lightning 0.15.13-beta. 0.15.13 is primarily a request-validation and clean-up release: RTL now checks the values it forwards to LND, Core Lightning, Eclair and Loop before they leave, the Boltz integration is removed, and two first-login problems are fixed.

Flint 1.2.1. Verify before you install Every artifact here is signed with GitHub build provenance - a Sigstore attestation binding the file's digest to this repository, this workflow, and the commit that built it.

Phoenix 2.8.4. This version is a bug fix release.

Payjoin Dev Kit Release 1.2.0. This release adds a non-blocking interface to the receiver state machine.

Krux Version 26.09.0. New maintainer took over the project this cycle.

Blockstream Green iOS 5.7.0. Added - Manual coin selection for Bitcoin and Liquid transactions - Bitcoin price chart to the wallet list - Transaction actions to the Home screen - Status page link when login takes longer than expected - Learn More guidance to the BIP...

Bitcoin Keeper 2.5.16. Changes - Fixed an issue that could leave Ask Keeper content visible over another tab or prevent switching tabs.

Fedimint Web android-sdk 0.1.0-beta.1. Android SDK 0.1.0-beta.1 The first release of the Android SDK, for testing.

Policy

EFF 38.17. With the launch of iOS 27, Apple is rolling out a variety of new AI features to its familiar voice assistant, Siri.

Research, policy & news

Ola Bini Ordered to Leave Ecuador Under Obscure Accusations. In a new blow to Ola Bini's legal guarantees, Ecuadorean authorities retained the free software developer and security expert yesterday in Quito and ordered his immediate deportation from the country.

New Alpha Release: Tor Browser 16.0a13. Tor Browser 16.0a13 is now available from the Tor Browser download page and also from our distribution directory.

What to watch

BorgBackup 2.0 stable graduation. The project has been in beta (2.0.0b25 this week) for an extended cycle; operators should watch for the first non-beta tag before migrating production backup repositories.

Gitea 28.0.0 breaking-change fallout. The internal proxy routing and egress setting changes are tagged breaking in the release notes; issue trackers and follow-up patch releases are worth watching for self-hosters who upgrade early.

AdGuard Home 1.0.0 stabilization. AdGuard Home shipped both 0.108.0-b.91 and 1.0.0-b.1 betas this week, suggesting a version-line transition in progress toward a 1.0 stable.

By the numbers

Stories tracked: 154

Featured: 54

Releases: 142

Active sources: 187

Security patches: 5

Days covered: 7

Top beats this week

AI: 48

Privacy: 42

Bitcoin: 26

Self-hosting: 17

Nostr: 16

Unspecified: 5

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-04-weekly-recap/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.

@npub1cn6…wt8a

2026-10-04T08:22:03Z

In reply to nevent1q…ffpa
_________________________

Nathan Day (npub1cn6…wt8a)

GOOD MORNING FELLOW FREEDOM TECH LOVERS ☕️🫡 ...

2026-10-03T04:40:48Z

GOOD MORNING FELLOW FREEDOM TECH LOVERS ☕️🫡

https://ungovernable.network/shows/freedom-tech-friday/freedom-fest-uk-with-nathan-day/

Now live on the feed! ...

2026-10-02T16:14:41Z

Now live on the feed!

https://fountain.fm/episode/pGQrRQiAtELC4mwjsjOh

quoting
nevent1q…arvt
I sat down with the Ungovernable (npub1jcy…2890) crew ( Seth For Privacy (npub1tr4…2y5g), QnA (npub15c8…ssvx) and Max) for a chat about all things freedom - Bitfest (npub1r9z…q8lx), Nostrshire (npub14mu…r84r), Freedom Fest, BTC Map (npub1864…t2tq) and #Omarchy!

https://ungovernable.network/shows/freedom-tech-friday/freedom-fest-uk-with-nathan-day/

LIVE IN ONE HOUR #FREEDOMTECHFRIDAY 59 with @npub1cn6…wt8a ...

2026-10-02T12:00:00Z

LIVE IN ONE HOUR

#FREEDOMTECHFRIDAY 59 with Nathan Day (npub1cn6…wt8a)

Freedom Fest, BTC Map, and what happens when you start shipping code with AI.

9AM EST / 2PM UK on the Ungovernable (npub1jcy…2890) feeds with MaxUM (npub1lqv…fx0r) and Seth For Privacy (npub1tr4…2y5g). See you there.

GOOD MORNING! #FreedomTechFriday with @npub1cn6…wt8a later, ...

2026-10-02T05:01:00Z

GOOD MORNING!

#FreedomTechFriday with Nathan Day (npub1cn6…wt8a) later, LFG!

9AM EST/ 2PM UK on the Ungovernable (npub1jcy…2890) feed. 🫡