A signing-device vulnerability puts hardware wallets in the spotlight

• Patch board
• Weekly threads
  • COLDCARD firmware divergence across hardware generations
  • Vaultwarden breakage and rapid patch cycle
  • Security-audit patch wave across Bitcoin and self-hosting
• Release board
  • Privacy
  • Self-hosting
  • AI
  • Nostr
  • Bitcoin
  • Policy
• By the numbers

§Patch board

• AdGuard Home 0.108.0-b.90. Changes compared to the previous beta, v0.108.0-b.89.
• Bitcoin Optech Newsletter #416. This week’s newsletter warns about a severe vulnerability affecting wallets generated signing devices, summarizes the disclosure of two denial-of-service vulnerabilities in Core Lightning, and desc…
• Dify 1.16.1. New Features Tool Multi-Select Input - Workflow tool nodes now support multi-select dropdown inputs, allowing users to choose multiple values from a predefined list when configuring tool parameters.
• Vaultwarden 1.37.1. Note This patch release resolves the issues with invites.
• OpenWrt 24.10.8. Hi, The OpenWrt community is proud to announce the newest stable release of the OpenWrt 24.10 stable series.
• Bisq 1.10.4. This is an important security update that fixes vulnerabilities identified during our recent security audit.
• n8n beta. 2.33.3 (2026-07-31) Bug Fixes core: Import security audit risk reporters with a file extension (6a71142) MCP Server Trigger Node: Save execution data only after tool call completes (77271fa) —
• N8n 2.33.3. 2.33.3 (2026-07-31) Bug Fixes core: Import security audit risk reporters with a file extension (6a71142) MCP Server Trigger Node: Save execution data only after tool call completes (77271fa) —

§Weekly threads

§COLDCARD firmware divergence across hardware generations

Coinkite shipped three distinct firmware releases on 31 July: v6.6.0X for current hardware, v5.6.0 for prior-generation devices, and v1.5.0Q for the oldest supported line. Operators managing fleets spanning multiple COLDCARD generations must now track three parallel firmware trains. The Bitcoin Optech Newsletter 416 severe wallet-generation vulnerability notice underscores the risk of version skew in mixed-hardware environments.

§Vaultwarden breakage and rapid patch cycle

Vaultwarden 1.37.1 arrived two days after the implicit 1.37.0 tag to fix broken invitation flows. The patch window was narrow and required immediate operator action for any instance onboarding new users. Self-hosters running companion Bitwarden clients also faced forced upgrade pressure as client 2026.7.0 required matching server-side protocol support.

§Security-audit patch wave across Bitcoin and self-hosting

Bisq 1.10.4 shipped fixes for vulnerabilities surfaced in a recent audit. N8n 2.33.3 imported security-audit risk reporters with corrected file extensions. The cluster suggests ongoing third-party review activity in the Bitcoin privacy and workflow-automation spaces, with results landing in production within weeks of disclosure.

§Release board

§Privacy

• SimpleX Chat 7.0.0. New in v7.0.
• Session iOS 2.15.4. Automated Update fallback static snode list Fix community images failing to download on iOS Removed synchr…
• Delta Chat Desktop 2.57.0. Removed - Remove hints about email providers on login (such as “Gmail requires you to create an app-specific password”) ( Fixed - Relay list not syncing to devices with Delta Chat versions older than 2.55.0.
• XSAs released on 2026-07-28. The Xen Project has released one or more Xen security advisories (XSAs).
• Yattee 2.0.0-beta.268. New Features Show missing-credentials indicator for remote server sources Bug Fixes Fix black video, freezes, autoplay and clock on Apple TV HD (A8) - thanks @rswilem Fix crash in CAOpenGLLayer shadow-copy init on macOS 27 beta Fix trans…
• Matrix Synapse 1.157.2. Synapse 1.157.2 (2026-07-28) This security release addresses several vulnerabilities.
• Thunderbird for Android Thunderbird Beta 22.0b2. Could not empty the Trash folder using the Empty Trash action ( 11255, 11256)
• Signal Android 8.21.1. Now you can easily add an Android tablet as a linked device and bring your chats to the big screen.

§Self-hosting

• Duplicati 2.3.1. This release is a Beta release intended to be used for testing to identify any issues before releasing the next stable version.
• Gitea 1.27.1. SECURITY enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints API align Swagger schemas for UserSettings and TopicListResponse ENHANCEMENTS enhance: improve diff contrast in light and dark themes (…
• Home Assistant 2026.8. - daikin: map Empty values exception to cannot connect in config flow (@Rodrigorm33 - 174243) - Correct description of “shopping list.complete item” action (@jamesmyatt - 175534) - Catch missing restore keys for template cover, device tr…
• DAVx5 4.5.19-rc.2. Bug fixes (rc.2): Fix Digest auth Include correct tasks provider package in PRODID jtx Don’t crash when main component is missing in https…

§AI

• opencode 1.18.8. Core Improvements - Improved compatibility with newer MCP servers and OAuth flows.
• Qwen Code 0.21.1. Highlights See the complete change list below.
• koboldcpp 1.118.1. Koboldcpp-1.118.1 - Row Split has been removed, selecting it will now default to tensor split.
• vLLM 0.26.0. VLLM v0.26.0 Release Notes Highlights This release features 411 commits from 212
• llama.cpp b10215. Vulkan: Introduce driver version check for Windows Intel GPU to mitigate crashing Removed crash guard for Intel Crash fixed from driver 32.0.101.8860 Added driver version check for windows Change to convert from driverVersion rather than…
• Maple 3.3.1. Highlights Maple 3.3.1 introduces private Voxtral text-to-speech through OpenSecret, smoother chat and Agent Mode continuity, stronger authentication and Local Proxy protections, and platform reliability improvements including restored A…
• Cline SDK 0.0.67. - Reasoning controls (effort, budget, on/off) are now driven models.dev catalog and normalized once before provider encoding, so requests match what each provider actually advertises; Anthropic’s mandatory and impossible thinking modes a…
• NanoClaw 2.1.54. Rollup release covering v2.1.18 through v2.1.54 - everything merged since the v2.1.17 tag.

§Nostr

• Sprout Buzz Desktop 0.5.2. - mirror Desktop mention delivery ( 7adc46268 ) - deduplicate relay outage notification ( 66e705492 ) - reconcile thread arrivals at bottom ( b42a8d447 ) - Improve emoji autocomplete matching ( 259de6afb )…
• Amethyst 1.13.1. Refactor parameter names for clarity and update Material3 API Fix keyboard state tracking and back handler races Fix…
• Sidecar 1.7.0. Comment on any webpage, quick-start a Lightning wallet, and a wallet backup that tells the truth.

§Bitcoin

• Keystone 3 3.0.2. Details Cypherpunk: Notes This release is intended solely to support the Zcash Ironwood upgrade and is only compatible with the Cypherpunk edition.
• Arkade TS SDK 0.4.54. Security hardening ahead of the Swap entity migration modular payment router (ark/onchain/lightning/chain-swap rails)…
• Arkade TS SDK Boltz Swap 0.3.59. Security hardening ahead of the Swap entity migration modular payment router (ark/onchain/lightning/chain-swap rails)…
• ZEUS 13.1.3. V13.1.3 Highlights: - LND v0.21.1-beta support (Embedded node + remote) - Bug fixes chore(deps): bump js-yaml from 3.14.2 to 3.15.0 in /zeus modules/@lightninglabs/lnc-core deps: patch ws, js-yaml, a…
• Blink Mobile 3.0.17. Bug Fixes - Give notification card titles the themed bold preset - Treat user@domain input as lightning address, not phone number - Note/label field in receive and send flows - Add crashlytics log to merchant-selection mock - BitcoinPric…
• JoinMarket-NG 0.35.0. Automatic histroy reconstruction on import, network fee estimation for neutrino, UTXO selector with all mixdepths, CLI alphabetic sorting of subcommands and options, security hardening, neutrino taker flow improvements, and bug fixes.
• Trezor Suite 26.7.3. New features - Added support for Robinhood Chain network - Tron (TRX) staking is now available directly in Trezor Suite - Users can now cancel pending EVM transactions - Option added to view and edit nonce in the EVM send form - A new pr…
• Bisq 1.9.22. This is a hotfix release that applies the upstream BitcoinJ fix for the chainwork bug.
• Sparrow Wallet 2.5.3. - Add opt-in XDG base directory support on macOS and Linux, resolved independently per category - Add support for the ERA hardware wallet - Add an option to ignore dust on private key sweeps (@nroktib) - Verify that scanned or loaded tra…
• NodeGuard 0.27.2. Refactor DeleteByManagedNodePubKey to return boolean Enhance dry-run logging in ChannelFeeOptimizerJob Add derivation feature option to…
• Coldcard Firmware 6.6. Coldcard Firmware v6.6.0X
• Ledger Live gh-attach attachments. This is a dummy release used as storage for attachment files linked from issues and pull requests.

1 more Bitcoin release tracked in the weekly totals.

§Policy

• EFF 38.14. Watches, bands, and rings-if you want to digitally monitor your fitness, more companies than ever are selling devices to do it.

1 lower-priority release omitted from the board but counted below.

§By the numbers

• Stories tracked: 123
• Featured: 45
• Releases: 114
• Active sources: 148
• Security patches: 8
• Days covered: 7

Top beats this week

• AI: 44
• Privacy: 26
• Bitcoin: 24
• Self-hosting: 18
• Nostr: 8
• Unspecified: 3

Read on Freedom.Tech: https://freedom.tech/posts/2026-08-02-weekly-recap/
Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation.
Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.