--- title: Tumbleweed Monthly Update - September 2026 | daily.dev description: September delivered a dense set of openSUSE Tumbleweed snapshot updates spanning desktop environments, developer tooling, and security. KDE Plasma 6.7.5,... canonical: https://daily.dev/posts/tumbleweed-monthly-update---september-2026-z5ynzypu5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Tumbleweed Monthly Update - September 2026 | daily.dev og:description: September delivered a dense set of openSUSE Tumbleweed snapshot updates spanning desktop environments, developer tooling, and security. KDE Plasma 6.7.5,... og:url: https://daily.dev/posts/tumbleweed-monthly-update---september-2026-z5ynzypu5 og:image: https://api.daily.dev/og/posts/Z5yNZYPu5.png og:image:alt: Tumbleweed Monthly Update - September 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Tumbleweed Monthly Update - September 2026 **[openSUSE](https://daily.dev/sources/opensuse)** · 30 min read · 0 upvotes · 0 comments ## Summary September delivered a dense set of openSUSE Tumbleweed snapshot updates spanning desktop environments, developer tooling, and security. KDE Plasma 6.7.5, Frameworks 6.30.0, and Gear 26.08.1 shipped alongside GNOME Shell/mutter 50.5, GIMP 3.2.6, and Shotwell 33.0 completing its GTK 4 port. Core system packages advanced too: glibc 2.44 added THP tunables and optimized math functions plus two security fixes, LLVM 23.1.1 arrived as an ABI-compatible bugfix release, and the Linux kernel moved through 7.2.2-7.2.7 with heavy security and stability work. The month's standout item is rsync 3.5.1, which underwent a sweeping security audit fixing 33 issues including restricted-directory escapes, daemon chroot escapes, and an unauthenticated TLS connection in rsync-ssl. Other major security updates covered curl (seven CVEs), ffmpeg 8 (20+ CVEs), util-linux, python313, tesseract-ocr, hplip, freeipmi, gvfs, flatpak, libsoup, p11-kit, sssd, PackageKit, NetworkManager, exiv2, dracut, libpcap, 389-ds, and xen. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What security vulnerabilities were fixed in rsync 3.5.1? rsync 3.5.1 fixed 33 security issues found through a focused audit of path handling and the daemon protocol plus fuzzing and external reports. These include restricted-directory escapes in rrsync, daemon module-root chdir escapes under use chroot = no, --relative implied-parent creation escaping the destination tree, an unauthenticated TLS connection in rsync-ssl, and a hosts deny rule that failed open when a hostname could not be resolved. _Teams patching rsync deployments can track vulnerability writeups like this one on daily.dev._ ### What does glibc 2.44 change for developers relying on wordexp? glibc 2.44 fixes two security issues in wordexp: a stack-based buffer clash during tilde expansion (CVE-2026-6791) and an invalid free() call when used with WRDE_APPEND (CVE-2026-6368). The release also adds system-wide tunables via /etc/tunables.conf, a glibc.elf.thp tunable for Transparent Huge Pages, and CORE-MATH optimized math functions with AArch64 SVE/AdvSIMD and RISC-V vector extension acceleration. _Developers tracking glibc upgrades and their security fixes can follow releases like this on daily.dev._ ### How many CVEs did ffmpeg 8 fix and what areas were affected? ffmpeg 8 shipped a massive security update patching more than 20 CVEs across demuxers, decoders, muxers, and filters. Affected components include HEVC, CineForm, TIFF, Screenpresso, and DVB subtitle parsers, plus bounds checks added to the RTP muxer for AV1, VC-2, and ASF objects and a fix rejecting overflowing stream counts in the MPEG muxer. _Anyone processing untrusted media files can keep up with ffmpeg security patches via daily.dev._ ## Similar posts on daily.dev - [Tumbleweed Monthly Update - May 2026](https://daily.dev/posts/tumbleweed-monthly-update---may-2026-y2ltzu25b) · openSUSE · 0 upvotes · 0 comments - [Tumbleweed Monthly Update - August 2026](https://daily.dev/posts/tumbleweed-monthly-update---august-2026-rhnq0fgtn) · openSUSE · 0 upvotes · 0 comments - [Tumbleweed Monthly Update - October 2025](https://daily.dev/posts/tumbleweed-monthly-update---october-2025-xixy8va3l) · openSUSE · 0 upvotes · 0 comments - [Tumbleweed Monthly Update - April 2026](https://daily.dev/posts/tumbleweed-monthly-update---april-2026-gshli6egc) · openSUSE · 0 upvotes · 0 comments - [Tumbleweed Monthly Update - January 2026](https://daily.dev/posts/tumbleweed-monthly-update---january-2026-u85wtxppg) · openSUSE · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/tumbleweed-monthly-update---september-2026-z5ynzypu5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Tumbleweed Monthly Update - September 2026","url":"https://daily.dev/posts/tumbleweed-monthly-update---september-2026-z5ynzypu5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tumbleweed-monthly-update---september-2026-z5ynzypu5"},"datePublished":"2026-10-01T08:06:46.166Z","dateModified":"2026-10-01T08:07:12.243Z","description":"September delivered a dense set of openSUSE Tumbleweed snapshot updates spanning desktop environments, developer tooling, and security. KDE Plasma 6.7.5,...","image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","thumbnailUrl":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","isAccessibleForFree":true,"articleSection":"openSUSE","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"openSUSE","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/4d81d0e92717435b876f92aaa9c95d07","url":"https://daily.dev/sources/opensuse"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tumbleweed-monthly-update---september-2026-z5ynzypu5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux","timeRequired":"PT30M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"openSUSE","item":"https://daily.dev/sources/opensuse"},{"@type":"ListItem","position":3,"name":"Tumbleweed Monthly Update - September 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tumbleweed-monthly-update---september-2026-z5ynzypu5#faq","mainEntity":[{"@type":"Question","name":"What security vulnerabilities were fixed in rsync 3.5.1?","acceptedAnswer":{"@type":"Answer","text":"rsync 3.5.1 fixed 33 security issues found through a focused audit of path handling and the daemon protocol plus fuzzing and external reports. These include restricted-directory escapes in rrsync, daemon module-root chdir escapes under use chroot = no, --relative implied-parent creation escaping the destination tree, an unauthenticated TLS connection in rsync-ssl, and a hosts deny rule that failed open when a hostname could not be resolved. Teams patching rsync deployments can track vulnerability writeups like this one on daily.dev."}},{"@type":"Question","name":"What does glibc 2.44 change for developers relying on wordexp?","acceptedAnswer":{"@type":"Answer","text":"glibc 2.44 fixes two security issues in wordexp: a stack-based buffer clash during tilde expansion (CVE-2026-6791) and an invalid free() call when used with WRDE_APPEND (CVE-2026-6368). The release also adds system-wide tunables via /etc/tunables.conf, a glibc.elf.thp tunable for Transparent Huge Pages, and CORE-MATH optimized math functions with AArch64 SVE/AdvSIMD and RISC-V vector extension acceleration. Developers tracking glibc upgrades and their security fixes can follow releases like this on daily.dev."}},{"@type":"Question","name":"How many CVEs did ffmpeg 8 fix and what areas were affected?","acceptedAnswer":{"@type":"Answer","text":"ffmpeg 8 shipped a massive security update patching more than 20 CVEs across demuxers, decoders, muxers, and filters. Affected components include HEVC, CineForm, TIFF, Screenpresso, and DVB subtitle parsers, plus bounds checks added to the RTP muxer for AV1, VC-2, and ASF objects and a fix rejecting overflowing stream counts in the MPEG muxer. Anyone processing untrusted media files can keep up with ffmpeg security patches via daily.dev."}}]} ```