openSUSE Tumbleweed ships Linux 7.2.11, Plasma 6.8.0, PHP 8.5.12 security fix

openSUSE Tumbleweed published five rolling snapshots during week 43 of 2026, bringing major component updates to the distribution. The snapshots (1016, 1017, 1018, 1020 and 1021) included KDE Plasma 6.8.0, Qt 6.12.0, Linux Kernel 7.2.11, Mesa 26.2.5 and PHP 8.5.12, the latter addressing critical PHP2Shell remote code execution flaws. Additional packages reaching stable included curl 8.23.0, Mozilla Firefox 158.0, polkit 128, containerd 2.3.3, systemd 261.4 and Memtest86+ 9.00.

The project also released Agama 25, the first installer update following openSUSE Leap 16.1, adding a web-interface terminal, pre-installation exit option and searchable multi-select port configuration. Staging work is underway on GNOME 51.1, Linux Kernel 7.3.0, Ruby 4.0.9, Go 1.27.3 and VirtualBox 7.2.22. Community activity included the start of the 2026 openSUSE Board Election with three seats contested, and a GNU/Linux València workshop on Linux gaming covering Wine, Proton and Steam Deck compatibility challenges.

What changed in Tumbleweed week 43 and Agama 25

• Kernel and graphics stack: Linux Kernel 7.2.11 and Mesa 26.2.5 arrived in stable snapshots, with Kernel 7.3.0 and GNOME 51.1 in staging.
• Desktop environment: KDE Plasma 6.8.0 and Qt 6.12.0 shipped, followed by Plasma 6.8.2 bugfix release on October 27; Plasma 6.9 work includes Wayland Picture-in-Picture by default in KWin and per-screen-layout window memory.
• Security-critical package: PHP 8.5.12 fixes the PHP2Shell remote code execution vulnerabilities, a named critical flaw set.
• Installer evolution: Agama 25 adds a terminal in the web UI, an exit-before-install option, searchable multi-select port selection and reduced YaST package dependencies as it begins targeting Tumbleweed, Slowroll and Leap 16.2.

Why it matters

The PHP2Shell fix in PHP 8.5.12 removes a critical attack surface for web servers and application stacks running on openSUSE, while the rapid delivery through Tumbleweed's rolling model demonstrates the distribution's security responsiveness. Agama's decoupling from YaST and expansion toward Tumbleweed and Slowroll signals a long-term architectural shift in openSUSE installer tooling that will affect system administrators and derivative distributions.