Weekly Recap - Jul 5 to Jul 12, 2026

• Patch board
• Weekly threads
  • Hardware-backed security enforcement across three ecosystems
  • Privilege-escalation patches in self-hosted stacks
  • Bitcoin Core maintenance across three release branches
• Release board
  • Privacy
  • AI
  • Nostr
  • Bitcoin
  • Lightning
  • Freedom Tech
• Research, policy & news
• What to watch
• By the numbers

§Patch board

• BitBox02 Firmware 9.26.2. - Intermediate release to update the bootloader to v1.2.2.
• OpenAI mandates hardware-backed passkeys for Trusted Access Cyber members to log into ChatGPT accounts. The rapid advancement of AI is changing the global cybersecurity landscape.
• SecureDrop 2.16.1. SecureDrop 2.16.1 was released on July 8, 2026.
• Bisq 1.10.3. This is an important security update that closes several gaps in trade protocol validation, message authentication, and filter safety identified during our ongoing security audit.
• Pi-hole 6.4.3. Security Fixes - pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww - Local privilege escalation from pihole user to root via /etc/pihole/logrotate (High) reported Also hardcode the PID file l…
• Case Study Government of Alberta uses Claude to find and fix cybersecurity vulnerabilities across government systems. Case Study Government of Alberta uses Claude to find and fix cybersecurity vulnerabilities across government systems from Anthropic News.

§Weekly threads

§Hardware-backed security enforcement across three ecosystems

OpenAI mandated hardware-backed passkeys for Trusted Access Cyber members logging into ChatGPT accounts, BitBox02 pushed a mandatory bootloader update to v1.2.2 via firmware 9.26.2, and Passport Prime shipped a 1.3.0 beta enabling external seed import and BIP85 password generation. All three enforce a hardware root-of-trust. Operators with deployed YubiKeys or BitBox02 devices must update firmware; Passport beta testers should verify seed-import flows before production use.

§Privilege-escalation patches in self-hosted stacks

Pi-hole 6.4.3 closed a local privilege escalation from pihole user to root via /etc/pihole/logrotate, and SecureDrop 2.16.1 shipped unspecified fixes on the same day. Both projects protect high-value data on self-hosted infra. Operators running Pi-hole or SecureDrop instances should patch immediately; the Pi-hole advisory explicitly labels the issue high severity.

§Bitcoin Core maintenance across three release branches

Bitcoin Core shipped three minor releases in 48 hours: 29.4, 30.3, and 31.1. No CVEs, no coordinated fix timeline. The clustering suggests backport discipline across supported branches rather than emergency response. Operators can follow their existing upgrade cadence; nothing in the notes demands immediate action.

§Release board

§Privacy

• BAT Roadmap 4.0. BAT Roadmap 4.0 evolves the Basic Attention Token, Brave Rewards, and Brave Creators for the transactional attention economy, introducing agentic payments, a unified Brave Wallet, the BravePay stablecoin protocol, a Brave Rewards Card, a…
• Immich 3.0.2. V3.0.2 This patch release addresses various bugs from v3 release and adds an additional filter to workflows Enhancements add ARIA label to ServerStatisticsCard hls variant co…
• uBlock Origin 1.72.2. Commits to master since this release Commits since last release To install the stable build: - Firefox: Install from AMO: uBO works best on Firefox - Chromium: Install from the Chrome store: - About Google Chrome’s “This extension may so…
• Vanadium 150.0.7871. Changes in version 150.0.7871.114.0: update to Chromium 150.0.7871.114 stop disabling new kLoadNativeEarly feature flag A full list of changes from the previous release (version 150.0.7871.63.1) is available through the Git commit log be…
• Cashu CDK 0.17.2. 0.17.2 Added - cdk-ffi: Expose NUT-27 mint backup through wallet repository bindings ( thesimplekid ).
• Bitwarden Server Version 2026.6.2. Overview Removed feature flag for organization features caching Removed feature flag for member controller refactor Removed feature flag for collections component refactor Added new ‘staged’ status for organization members Invited users…
• Tuta 354.260707.0. What’s new - Tuta One-Click Migration in beta: first beta release of Tuta’s email migration feature - Sync improvements Bugfixes - Some imported mails do not render correctly 10975 Milestone Asset Checksums (SHA256) tuta…
• Duplicati 2.3.0. About this release This release patches version 2.3.0.3 with fixes for a number of issues that were discovered after the release.
• Home Assistant 2026.7.2. - Store recovery HTTP config with the full trusted proxy network ( @agners - 176075 ) ( http docs ) - Trigger reauth on Teslemetry LoginRequired errors ( @Bre77 - 174255 ) ( teslemetry docs ) - Bump ical to 13.3.0 ( @FuNK3Y - 175090 ) (…
• Obtainium 1.6.2. Update ja.json: Guard onNewIntent against uninitialized plugin callResult Fallback to internal storage on custom ROMs where…
• Syncthing-Fork Android 2.1.2. Fixes bundleOf in DeviceIdDialogFragment bug(onboarding): fix state consistency in onboarding activity…
• DAVx5 4.5.17. 4.5.17.1 (hotfix): - Fix problem with Digest authentication - 2633 - Improve HTTP logging format - 2631 — 4.5.17 Bug fixes Ktor Handle explicit Content-Encoding: identity Add validation and tests…

1 more Privacy release tracked in the weekly totals.

§AI

• Cline CLI 3.0.39. - You can now select Cline free models on the ClinePass provider in the model picker - Removed the retired ClinePass GLM 5.1 model - Fixed OpenAI Codex model metadata under the GPT Subscription provider - str replace edits now report acc…
• Qwen Code 0.19.9. Stop repeated subagent tool-call loops detect and mark broken history chains instead of silently truncating prefer command name match over alias match regardless of recentScore…
• Ollama 0.32.0. Create: select the qwen3.5 parser and renderer for Qwen3.5/Next launch: warn before old agent models cmd: agent UI in htt…
• Ollama 0.31.2. Enabled flash attention on older NVIDIA GPUs (compute capability 6.x) iGPU can now offload vision models with padding to fit available memory Fixed structured output for thinking models when thinking is disabled Hardened GGUF model creat…
• InvokeAI 6.13.6. This is a patch release.
• HelixML 2.11.47. Stop rewriting anthropic model ids to -latest for zed agent Add Goose and Zed Agent to the README harness list s…

§Nostr

• Lightning.Pub 0.0.30. Lightning.Pub v0.0.30 API No changes to the public gRPC/HTTP API.
• Sprout Buzz Desktop 0.3.44. - keep thread-summary badges mounted through scrollback prepends ( 6abf614fd ) - drop bundled PortableGit, add BUZZ SHELL override + dialect hint ( cfa208983 ) - NIP-AM durable encrypted agent turn metrics (k…
• Vector 0.4.0. The new era of communication begins.
• Divine 1.0.16. Divine 1.0.16 - Life in Loops This one’s all about creation.

§Bitcoin

• StartOS start-wrt 1.0.0. First stable release of StartWRT - Start9’s OpenWrt-based router OS for home self-hosting, built around per-device Security Profiles (assigned port, WiFi password, or inbound VPN), with inbound/outbound WireGuard VPNs and VPN chaining, W…
• BitBoxApp 4.51.3. - Bundle BitBox02 firmware version v9.26.4 Verifying the release ch with fingerprint DD09 E413 0975 0EBF AE0D EF63 5092 49B0 68D2 15AE: curl | gpg –im…
• Foundation Envoy 2.3.0. Foundation Envoy 2.3.0 is a major release packed with new features.
• Passport Prime 1.3.0-beta. Passport Prime 1.3.0-beta headlines the ability to import external bitcoin seeds and nostr keys into the Vault, plus BIP85 password generation and mass-importing 2FA codes from Google Authenticator.
• Bitcoin Core 31.1. Bitcoin Core version 31.1 is now available from: For the release notes please see the git repository: Do not use the links provided.
• Stratum v2 SRI 1.11.0. General release information Highlights of this release: This release focuses on binary sv2 reliability and cleanup, safer Sv1 parsing and conversion APIs, improved Sv1 difficulty handling, and expanded fuzz-testing coverage.
• Payjoin Dev Kit Release 1.0.0-rc.4. Attach –no-run to the feature gated test runs just to ensure compilation Fix commented test assert Employ new fallback tx…
• Bitcoin Core 29.4. Bitcoin Core version 29.4 is now available from: For the release notes please see the git repository: Do not use the links provided,…
• Bitcoin Core 30.3. Bitcoin Core version 30.3 is now available from: For the release notes please see the git repository: Do not use the links provided,…
• SeedSigner The “Summer of SeedSigner” Release. The “Summer of SeedSigner” Release v0.8.7 includes 80 PRs from 20
• StartOS start-sdk 2.0.3. Fixed - A dependency-gated daemon no longer wedges permanently after its dependency’s readiness flaps.
• umbrelOS 1.7.4. UmbrelOS 1.7.4 fixes an issue where remote access over Tor and apps that use Tor could fail to connect.

§Lightning

• Arkade 0.9.12. Vtxo chain pagination Whitelist channelz endpoints in permissions fix two bugs in client-lib (send on closed channel panic and dep…
• Blink Mobile 3.0.5. Documentation - Add PR review guide distilled from recent review history
• lnd 0.20.2-beta. lnd 0.20.2-beta has no database migrations.
• LNbits 1.5.5. A pretty big release: LNbits v1.5.5 adds Revolut and Square as a fiat funding methods, and improves payment reliability across multiple backends.

§Freedom Tech

• SimpleX Chat 7.0.0-beta.3. New in v7.0-beta.3: - SimpleX names for channels and businesses: - register the name at (requires SimpleX NFT for the next week).

1 lower-priority release omitted from the board but counted below.

§Research, policy & news

• Building Our Future Together. In my first weeks as Executive Director of EFF, I’ve been reminded every day how consequential this moment is in determining what kind of future we will have.

§What to watch

• SimpleX Chat 7.0 stable release after beta.3 name-registration shakeout — SimpleX Chat 7.0.0-beta.3 introduced SimpleX names for channels and businesses with a testing-names registration dependency and NFT gate. The beta tag and experimental infrastructure suggest a stable 7.0 will follow once the name-registration flow is proven. Operators on 6.x should watch for the stable tag before upgrading production instances.
• Payjoin Dev Kit 1.0.0 stable after rc.4 fallback-tx validation — Payjoin Dev Kit shipped 1.0.0-rc.4 with new fallback transaction logic. The RC label and the fallback-tx change suggest a 1.0.0 stable is imminent. Wallet integrators testing payjoin should validate rc.4 in staging and watch for the stable tag before merging to production.
• Bitcoin Core 29.5, 30.4, or 31.2 if the three-branch release cadence continues — Bitcoin Core shipped three minor releases across supported branches (29.4, 30.3, 31.1) in 48 hours with no CVEs. The clustering suggests active backport discipline. Operators should watch for the next round of minor releases if this cadence holds; the pattern implies ongoing maintenance rather than one-off fixes.

§By the numbers

• Stories tracked: 141
• Featured: 47
• Releases: 129
• Active sources: 166
• Security patches: 6
• Days covered: 7

Top beats this week

• Privacy: 51
• AI: 48
• Bitcoin: 19
• Nostr: 12
• Lightning: 5
• Freedom Tech: 4
• Unspecified: 2

Read on Freedom.Tech: https://freedom.tech/posts/2026-07-12-weekly-recap/
Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation.
Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.