This Week in TUXEDO OS #30-2026 - TUXEDO Computers

Hello TUXEDO Fans and Open-Source Enthusiasts!

The use of artificial intelligence in software development continues to spark controversy – including within the Linux kernel project. After an AI-powered tool for reviewing kernel patches drew criticism, Linus Torvalds made his position clear, arguing against a blanket ban on the use of such tools.

For Torvalds, practical value is what matters most. AI can help maintainers review code changes, but it does not replace the responsibility of experienced developers. Why the creator of the Linux kernel considers AI a useful aid and why technical quality outweighs ideological debates can be found in this article.

In this edition of TWIX, we introduce mpz, a lightweight and flexible music player that uses your existing folder structure as the music library instead of relying on database indexing. Our Tips & Tricks section shows how Konsole Frame brings a fully featured terminal directly to the Plasma desktop. As always, the newsletter also covers the latest updates and changes in TUXEDO OS.

Enjoy reading,
The TUXEDO OS Team

Updates on TUXEDO OS based on Debian

With Btrfs and Snapper, TUXEDO OS makes system updates significantly safer. Automatic snapshots preserve the system state before updates and allow users to quickly return to a working setup if something goes wrong. This combination of modern filesystem technology and convenient management reduces risks and makes experimenting with the system much more relaxed. Read the full article here.

Updates in TUXEDO OS

tuxedo-theme-plasma 4.0.4~tux1

• Fixed an issue where a changed user avatar was not applied to the SDDM login screen after a fresh installation.

WebFAI 6.0.5–2.6.0

• Completely reimplemented menus and related scripts in Python.
• Removed outdated components related to the VirtualBox installation (vboxinstall).

tuxedo-calamares-configuration 4.5.1

• 4.5.0: Integrated VirtualBox installation into the Calamares installer.
• 4.5.1: Fixed an issue with encrypted Ubuntu 24.04 installations.

Firefox 153.0

• Updated to Firefox 153.0.
• More information is available in the official Release Notes.

Chromium 150.0.7871.181

• Updated to Chromium 150.0.7871.181.
• Fixes 12 high-severity security vulnerabilities (High CVEs).
• More information is available in the official Release Notes.

Updated TUXEDO OS ISO

• New installation image TUXEDO-OS-202607162005.iso released.
• Fixes an issue with the NVIDIA driver integration affecting the previously provided ISO.

KDE App of the Week: mpz – A Foobar2000-style Music Player

With mpz, we would like to introduce a music player that takes a different approach than many modern applications. Instead of first importing and indexing your music collection in a database, mpz directly uses your existing folder structure. If you already organize your music by artists, albums, or genres, you can start immediately – without library management or lengthy import processes.

The developer explicitly mentions Foobar2000 as an inspiration. However, mpz is not intended to be a clone. Instead, it adopts the folder-based workflow of the well-known Windows player and brings it to Linux, macOS, and Windows. If you are familiar with Foobar2000 and appreciate its concept of organizing music by folders, mpz offers an interesting alternative.

Manage your music collection without a database

The clearly structured, three- or four-pane interface consistently follows this workflow. On the left, you see the directory tree of your music collection, in the center your playlists, and on the right the tracks they contain. A middle-click on a folder is enough to turn it into a new playlist. This allows you to quickly switch between different albums, artists, or collections without changing your actual folder structure. Drag and drop for adding and sorting tracks is also supported.

mpz is developed in C++ and Qt 6. This allows the application to start quickly, remain responsive even with large music collections, and integrate seamlessly with the KDE Plasma desktop. On Linux, the player uses the audio codecs installed on your system via QtMultimedia and GStreamer or FFmpeg. Supported formats include FLAC, MP3, Ogg Vorbis, Opus, AAC, ALAC, M4A, WAV, WMA, APE, and DSD.

Extensive features and easy installation

mpz also offers a wide range of features. In addition to gapless playback for live albums or DJ mixes, the player supports CUE sheets, internet radio in M3U, M3U8, and PLS formats, as well as cover artwork and lyrics. Lyrics can come from the audio files themselves, separate LRC or TXT files, or online databases if desired. A built-in tag editor also allows you to modify metadata directly within the application.

The integration with the Linux desktop is also convenient. Through MPRIS, playback can be controlled using KDE Connect or other compatible applications. Media keys and special function keys are supported, as well as a system tray with playback controls. Experimentally, mpz can also act as a client for the Music Player Daemon (MPD), allowing music from a remote server to be integrated as if it were stored locally.

For Linux, the developer provides packages for numerous distributions. Users of Debian or Ubuntu can download the available DEB packages directly – these can also be installed on TUXEDO OS without any issues. If you prefer a distribution-independent option or do not want to install packages, you can alternatively use the available AppImage, which can be launched directly without installation.

TUXEDO OS Tips & Tricks: A Terminal on Your Desktop

Terminal, terminal, terminal. People who are unfamiliar with Linux often assume that you need the command line for almost everything. In reality, many Linux users choose to use the terminal because it is often the fastest and most efficient way to get things done. If you would like to learn more about the history and inner workings of the command line, our article The Shell – The Unknown Black Hole provides a comprehensive introduction. With Konsole Frame, you can even keep a terminal permanently available on your desktop.

Konsole as a Desktop Widget

Before graphical user interfaces became the norm, computers were operated exclusively through terminals. Today, the terminal is simply an alternative way to interact with Linux and is no longer required for everyday use. Even so, many users still prefer it because countless tasks can be completed much more quickly from the command line.

In addition to the Konsole terminal application or a drop-down terminal such as Yakuake, Konsole Frame brings a fully functional KDE terminal directly onto your desktop. This lets you keep commands, log files, or system information in view at all times while giving you instant access to the command line.

Installing Konsole Frame

Like any other Plasma widget, Konsole Frame can be installed through the KDE Store. Enter Desktop Edit Mode, select Add or Manage Widgets…, then choose Get New… » Download New Plasma Widgets. Search for Konsole Frame and install it. On Debian-based systems, you may also need to install the qml6-module-qtwayland-compositor package.

sudo apt install qml6-module-qtwayland-compositor

Once installed, simply drag the widget onto your desktop and resize or reposition it as needed. In its settings, you can choose a different Konsole profile or specify a custom startup command such as konsole -e htop to launch the htop system monitor directly inside the widget.

Ubuntu Security Updates

The Ubuntu security updates listed here are generally incorporated directly into TUXEDO OS. Some updates are only available from Ubuntu for a fee and are therefore not made available to the community until a later date. Unfortunately, we have no control over this:

• USN-8601–1: PAM vulnerability: PAM could be made to expose sensitive information.
  IDs: CVE-2026–54411
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8600–1: libXpm vulnerability: libXpm could be made to crash if it opened a specially crafted file.
  IDs: CVE-2026–4367
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8599–1: HTTP-Date vulnerability: HTTP-Date could be made to crash if it received specially crafted input.
  IDs: CVE-2026–14741
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8598–1: rsyslog vulnerabilities: Several security issues were fixed in rsyslog.
  IDs: CVE-2026–61548
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8596–1: Linux kernel (NVIDIA) vulnerabilities: Several security issues were fixed in the Linux kernel.
  IDs: CVE-2026–43129, CVE-2026–31394, CVE-2026–31773 + 910 others
  Affects: Ubuntu 24.04, Ubuntu 22.04

• USN-8574–2: Linux kernel vulnerabilities: Several security issues were fixed in the Linux kernel.
  IDs: CVE-2026–46073, CVE-2026–46113, CVE-2026–46187 + 910 others
  Affects: Ubuntu 24.04, Ubuntu 22.04

• USN-8594–1: Linux kernel (OEM) vulnerabilities: Several security issues were fixed in the Linux kernel.
  IDs: CVE-2025–71190, CVE-2025–71163, CVE-2026–23160 + 200 others
  Affects: Ubuntu 24.04

• USN-8591–1: AIOHTTP vulnerabilities: Several security issues were fixed in AIOHTTP.
  IDs: CVE-2026–34513, CVE-2026–34514, CVE-2026–22815 + 1 other
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04, Ubuntu 20.04, Ubuntu 18.04, Ubuntu 16.04

• USN-8590–1: Exim vulnerabilities: Several security issues were fixed in Exim.
  IDs: —
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8588–1: Gawk vulnerabilities: Several security issues were fixed in Gawk.
  IDs: CVE-2026–40468, CVE-2026–40553, CVE-2026–40467 + 1 other
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04, Ubuntu 20.04, Ubuntu 18.04, Ubuntu 16.04, Ubuntu 14.04

• USN-8477–3: tar regression: USN-8477–1 introduced a regression in tar.
  IDs: CVE-2026–5704
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04, Ubuntu 20.04, Ubuntu 18.04, Ubuntu 16.04, Ubuntu 14.04

• USN-8587–1: HTML-Parser vulnerability: HTML-Parser could be made to expose sensitive information.
  IDs: CVE-2026–8829
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8586–1: libgphoto2 vulnerabilities: Several security issues were fixed in libgphoto2.
  IDs: CVE-2026–40339, CVE-2026–40336, CVE-2026–40338 + 5 others
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8585–1: Kerberos vulnerabilities: Several security issues were fixed in Kerberos.
  IDs: CVE-2026–40356, CVE-2026–40355, CVE-2026–11850
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8584–1: GStreamer Good Plugins vulnerabilities: Several security issues were fixed in GStreamer Good Plugins.
  IDs: CVE-2026–53705, CVE-2026–39044, CVE-2026–39043
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8583–1: GIFLIB vulnerabilities: GIFLIB could be made to crash or run programs if it opened a specially crafted file.
  IDs: CVE-2026–26740, CVE-2026–23868
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8582–1: jbig2dec vulnerabilities: Several security issues were fixed in jbig2dec.
  IDs: CVE-2023–46361, CVE-2026–38076
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8581–1: libarchive vulnerabilities: Several security issues were fixed in libarchive.
  IDs: CVE-2026–14164, CVE-2026–15028, CVE-2026–5745
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04, Ubuntu 20.04

• USN-8580–1: AccountsService vulnerabilities: AccountsService could be made to run programs as an administrator if it opened a specially crafted file.
  IDs: CVE-2026–61897, CVE-2026–61898
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8579–1: snapd vulnerabilities: Several security issues were fixed in snapd.
  IDs: CVE-2026–15226, CVE-2024–5300, CVE-2026–8933
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04, Ubuntu 20.04, Ubuntu 18.04, Ubuntu 16.04

• USN-8574–1: Linux kernel (GCP FIPS) vulnerabilities: Several security issues were fixed in the Linux kernel.
  IDs: CVE-2026–46073, CVE-2026–46113, CVE-2026–46187 + 910 others
  Affects: Ubuntu 24.04

• USN-8558–1: ImageMagick vulnerabilities: Several security issues were fixed in ImageMagick.
  IDs: CVE-2026–33905, CVE-2026–33900, CVE-2025–68950 + 1 other
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04, Ubuntu 20.04, Ubuntu 18.04, Ubuntu 16.04, Ubuntu 14.04

• USN-8563–2: nginx regression: USN-8563–1 introduced a regression in nginx.
  IDs: —
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8573–1: libde265 vulnerabilities: Several security issues were fixed in libde265.
  IDs: CVE-2026–45382, CVE-2026–54241, CVE-2026–49346 + 9 others
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04, Ubuntu 20.04, Ubuntu 18.04, Ubuntu 16.04

• USN-8572–1: Wget vulnerability: Wget could be made to connect to unintended network resources.
  IDs: CVE-2026–15146
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04, Ubuntu 20.04, Ubuntu 18.04, Ubuntu 16.04, Ubuntu 14.04

• USN-8569–1: Linux kernel (HWE) vulnerabilities: Several security issues were fixed in the Linux kernel.
  IDs: CVE-2026–46073, CVE-2026–46113, CVE-2026–46187 + 695 others
  Affects: Ubuntu 24.04

• USN-8570–1: Linux kernel vulnerabilities: Several security issues were fixed in the Linux kernel.
  IDs: CVE-2025–71190, CVE-2025–71163, CVE-2026–23160 + 200 others
  Affects: Ubuntu 24.04

• USN-8567–1: Linux kernel vulnerabilities: Several security issues were fixed in the Linux kernel.
  IDs: CVE-2026–46073, CVE-2026–46113, CVE-2026–46187 + 888 others
  Affects: Ubuntu 24.04, Ubuntu 22.04

• USN-8565–1: SQLite vulnerabilities: Several security issues were fixed in SQLite.
  IDs: CVE-2026–50813, CVE-2026–50812
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8564–1: PHP vulnerabilities: Several security issues were fixed in PHP.
  IDs: CVE-2026–14355, CVE-2026–12184
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8560–1: libXfont vulnerabilities: Several security issues were fixed in libXfont.
  IDs: CVE-2026–56003, CVE-2026–56002, CVE-2017–16611 + 1 other
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04, Ubuntu 20.04, Ubuntu 18.04, Ubuntu 16.04, Ubuntu 14.04

• USN-8559–1: rlottie vulnerabilities: rlottie could be made to crash if it received specially crafted input.
  IDs: CVE-2026–8916, CVE-2026–47306, CVE-2026–47319 + 3 others
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04, Ubuntu 20.04

• USN-8563–1: nginx vulnerabilities: Several security issues were fixed in nginx.
  IDs: CVE-2026–56434, CVE-2026–42533, CVE-2026–60005
  Affects: Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04

• USN-8561–1: FreeRDP vulnerabilities: Several security issues were fixed in FreeRDP.
  IDs: CVE-2026–33995, CVE-2026–57157, CVE-2026–33952 + 31 others
  Affects: Ubuntu 26.04, Ubuntu 24.04

Current BIOS/EC Versions

An EC/BIOS update affects key system components. Please ensure that you follow the instructions carefully and take your time. The process is usually completed quickly. If you have any doubts, our support team is happy to assist you. The following devices have BIOS/EC updates available: