| Date | Platform | Package | Version | Description |
|---|
| 2026-10-22 12:50:50 | x64 | jaccounting | 137 | invoice - dont list deleted invoices in default view |
| 2026-10-21 14:16:58 | x64 | php | 8.5.12 | CVE-2026-109618 - RCE via OOM corruption
CVE-2026-109619 - RCE via stale global state |
| 2026-10-21 09:11:56 | x64 | j | 308 | TLS - domain_add - dont populate map with domains that fail |
| 2026-10-21 08:33:08 | x64 | php | 8.5.11-20261021 | CVE-2026-109618, CVE-2026-109618 - Session upload progress RCE workaround |
| 2026-10-20 13:28:00 | x64 | jwebcdn | 41 | Policy - Support WAF for post-handlers in addition to existing WAF backend
WAF analytics - Support for multiple keys as utm (waf_analytics_referrer_key). Use first one that exists.
WAF analytics - Support for waf_analytics_referrer_only that will only log clicks if referrer exists.
WAF analytics - Support for waf_analytics_response_code_filter that will only log clicks matching major response code
Backend host - redirect policy validator cleanup.
|
| 2026-10-20 13:15:52 | x64 | jhttp | 82 | Remove support for fixed fallback certificate |
| 2026-10-20 12:35:06 | x64 | jocr | 200 | HTML converter - hard fail if page 1 is blank |
| 2026-10-20 11:34:55 | x64 | jdns | 32 | Remove support for fixed fallback certificate |
| 2026-10-20 11:32:06 | x64 | jid | 44 | Remove support for fixed fallback certificate |
| 2026-10-19 10:00:20 | x64 | kernel | 6.18.57 | CVE‑2026‑99999 ipv4: validate checksum_start before completing checksum (CAP_RAW privilege) |
| 2026-10-16 11:11:50 | x64 | j | 307 | distribution - mastercard - efaktura kombo api lookup fix |
| 2026-10-13 10:23:04 | x64 | jaccounting | 136 | skattemelding formuesverdi fix |
| 2026-10-12 13:16:22 | x64 | j | 306 | distribution - mastercard kombo fixes |
| 2026-10-12 08:57:34 | x64 | imagemagick | 7.1.2-33 | bugfixes, including libheif 1.23.6 |
| 2026-10-12 08:15:11 | x64 | kernel | 6.18.56 | several use-after-free fixes, in particular:
* io_uring during cleanup
* tcp_v4_syn_recv_sock race condition (IP_OPTIONS or BPF must be used)
Remote DoS not possible for JLinux software.
|
| 2026-10-11 18:04:08 | x64 | jcomsuite | 87 | gpt - fixes and improvements
skin - logo now changed to svg
skin - autumn |
| 2026-10-09 13:28:29 | x64 | radvd | 2.21-20261009 | Support for DNS-TLS name server DNR (RFC9463) |
| 2026-10-09 13:10:26 | x64 | jdhcp | 10 | Support for DNS-TLS name server option (RFC9463). ADN/CN is taken from config dns-tls_hostname |
| 2026-10-08 13:45:47 | x64 | sysklogd | 2.7.2 | logger - max message size changed from 512 to 16384
syslogd - max messages size can be specified |
| 2026-10-06 11:11:23 | x64 | jaccounting | 135 | skatteetaten - validation - use production endpoint |
| 2026-10-06 09:55:13 | x64 | jaccounting | 134 | skatteetaten - return receipt id for skattemelding so it can be logged in case of post-failures |
| 2026-10-05 18:11:26 | x64 | kernel | 6.18.55 | CVE-2026-80521 - af_unix container escape. JLinux is not affected by this vulnerability
|
| 2026-10-05 14:58:34 | x64 | j | 305 | buffer fix |
| 2026-10-04 15:03:17 | x64 | jwebapp | 160 | cert - zerossl is now primary. Buypass code removed
api - add delay on auth
companydb - fallback icon updated
dns - dns-doh added
as4 - edixml support
jlinux and jlinux_package - notification adjustments
llm - fixes |
| 2026-10-04 14:47:12 | x64 | jcomsuite | 86 | app gpt
accounting
relink |
| 2026-10-04 14:42:06 | x64 | oyawebapp | 53 | relink
minor fixes |
| 2026-10-04 14:39:46 | x64 | joyatel | 52 | relink |
| 2026-10-04 14:22:18 | x64 | jwebshop | 122 | relink
plugin mysql - native plugin cleanup
plugin usage - multitoken support |
| 2026-10-04 14:09:35 | x64 | jhttp | 81 | Minor header optimisations
Relink due to ABI/charmap change in Base64Reader |
| 2026-10-04 14:04:24 | x64 | j | 304 | distribution - EDIXML
tls - chain order fix
Base64Reader - ABI change due to charmap support |