openSUSE Tumbleweed releases 5 snapshots with KDE Plasma 6.8.0 and PHP security fixes
Key Takeaway
openSUSE Tumbleweed released five snapshots featuring major desktop updates and critical security patches for PHP and curl.
Summary
The latest openSUSE Tumbleweed weekly review covers five snapshots (1016 to 1021) that introduced KDE Plasma 6.8.0, Qt 6.12.0, and Mesa 26.2.5. Crucially, the updates address the "PHP2Shell" remote code execution vulnerabilities via PHP 8.5.12. Other significant updates include Linux Kernel 7.2.11, systemd 261.4, and the completion of the containerd 2.x migration.
Key updates in Tumbleweed snapshots
- Security: Patched PHP2Shell (CVE-2026-109618, CVE-2026-109619) with PHP 8.5.12 and addressed curl CVEs with version 8.23.0.
- Desktop: Integrated KDE Plasma 6.8.0 with SDDM and lockscreen adjustments; updated Qt to 6.12.0 and Mesa to 26.2.5.
- Infrastructure: Completed containerd 2.x migration (shipping version 2.3.3) and updated polkit 128 to fix authentication-helper vulnerabilities.
- Kernel & Core: Linux Kernel updated to 7.2.11 and systemd to 261.4.
- Hardware Support: Memtest86+ 9.00 now includes native AArch64 (ARM64) support and Secure Boot signing.
Why it matters
The rapid deployment of PHP and curl security patches demonstrates Tumbleweed's role in providing timely defense against critical remote execution vulnerabilities.
Original reference: dominique.leuenberger.net →