Hello TUXEDO Fans and Open-Source Enthusiasts!
This week, a security flaw hit like a thunderclap: On Wednesday, October 21, the PHP team released emergency updates for two critical vulnerabilities in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The flaws, known as PHP2Shell (CVE-2026–109618 and CVE-2026–109619), allow attackers to run code on a web server without logging in. The cause lies in how PHP handles running out of memory: when PHP runs out of RAM, it leaves behind a corrupted internal state that a later request on the same process goes on to reuse. Researchers at Wiz demonstrated the attack against current container images of WordPress, Drupal, and Joomla. Since PHP powers around 70 percent of all websites, according to Wiz, the number of affected sites is large.
What stands out is how the attack came about. According to Wiz, parts of the flaw go back to PHP 5.4, but it took modern AI models to lower the barrier for building a working attack chain from it. Time to react was short: Amazon observed a first attack attempt on October 17, four days before the release. The UK’s National Cyber Security Centre (NCSC) advises taking systems offline if they cannot be updated right away. We at TUXEDO Computers, too, briefly took the shop and some services offline. Notebooks running TUXEDO OS usually don’t run a web server with PHP, so most of you are not directly affected. If you develop web projects locally or run PHP on a home server, you should update now. For Ubuntu 24.04, the basis of TUXEDO OS, php8.3 is available in version 8.3.6–0ubuntu0.24.04.13 (USN-8948–1 ). Ubuntu 22.04 with PHP 8.1, which PHP itself no longer maintains, also receives a fix.
The rest of This Week in TUXEDO OS is considerably calmer. In keeping with the end of daylight saving time on October 25, the tip of the week shows how Plasma warms up the screen in the evening with Night Light and switches between a light and a dark theme on its own. As KDE App of the Week, we introduce Audex, which rips audio CDs and saves them to your hard drive as FLAC, MP3, or Opus. We summarize everything else that happened around TUXEDO OS in the update overview.
Enjoy reading,The TUXEDO OS Team
Note: With the TWIX series, we keep you up to date with the latest developments around TUXEDO OS. We also introduce interesting applications and share practical tips and tricks for the KDE desktop and TUXEDO OS. At the same time, TWIX thrives on your feedback. We always welcome your suggestions, topic ideas, and proposals for improvement. Feel free to join the discussion in our TWIX thread on Reddit , where you can reach us directly. Of course, you are also welcome to contact us via any of our other social media channels.
Updates in TUXEDO OS
firefox 2:158.0.1~tux1
Bug fixes: Pages no longer jump back to the top when you select text, windows on Linux multi-monitor setups no longer open on the wrong display, and the built-in VPN can be turned on again for some users.
The updated block list for compromised eMudhra intermediate certificates is now part of the browser itself. More on this in the section on security updates.
Further information in the release notes for Firefox 158.0.1 .
thunderbird 3:153.5.1esr~tux1
Fixes a problem during account setup: After a failed attempt, incoming servers were left behind that blocked further setup attempts.
Further information in the release notes for Thunderbird 153.5.1esr .
tuxedo-firefox-config 3.0.0 and tuxedo-thunderbird-config 3.0.1
The new configuration packages provide the existing TUXEDO customizations for Firefox and Thunderbird in a separate package. They were first released on October 13.
tuxedo-thunderbird-config 3.0.1: Corrects the value of the widget.use-xdg-desktop-portal.file-picker setting.
tuxedo-drivers 4.25.0
Fixes the lightbar behavior on Stellaris Gen5 and Gen6 when the device goes to sleep.
New: Support for Stellaris Gen8 Intel.
Changelog
TUXEDO Control Center 3.1.1
3.1.0: The color and brightness of the lightbar can now be selected in the lighting settings under Tools . The package structure has been reworked.3.1.0: Fixed: TCC autostart in combination with a FAI installation, a workaround for global shortcuts on KDE (without the user having to confirm the shortcut manually), the missing dependency on pkexec for deb packages, and various warnings and errors when installing deb and rpm packages.3.1.1: Fixes the migration of the TCC GUI autostart, where one case was missing.Changelog
tuxedo-yt6801 1.0.32
The initramfs is now updated correctly after the driver is installed.
tuxedo-base-files 4.0.10~24.04.5~tux1
Raises the Ubuntu version to 24.04.5 and removes neofetch from the login welcome message (motd).
Other Packages
chromium 2:155.0.8059.84–1tux1 (security update, see below)
Signal 8.31.0 and 8.32.0, Heroic 2.22.4, Bitwarden 2026.10.0, draw.io 32.5.5, and Rocket.Chat Desktop 4.18.4
Updates in TUXEDO OS Based on Debian
The mirror for Debian Testing was synchronized with the test state and released on October 19.
tuxedo-base-files 1.0.8~tux2: The hook for Unified Kernel Images (UKI) now works as an initramfs-tools hook instead of a kernel hook. The package now only changes the crypttab file if leftovers of the Calamares installer are present. Version 1.0.8~tux2 corrects this change.Firefox 158.0.1, tuxedo-drivers 4.25.0, TUXEDO Control Center 3.1.1, and the new configuration packages for Firefox and Thunderbird are also available for Debian.
Important Security Updates
firefox 2:158.0.1~tux1
Mozilla rates the update as high overall and fixes four vulnerabilities: Two are rated high, namely incorrect boundary conditions in SVG (CVE-2026–113399) and the block list for compromised eMudhra intermediate certificates (CVE-2026–113470). In addition, there is a moderate vulnerability caused by uninitialized memory in the audio and video library cubeb and a low one that could crash the PDF viewer.
Details in the security advisory MFSA 2026–111 .
thunderbird 3:153.5.1esr~tux1
chromium 2:155.0.8059.84–1tux1
Fixes ten security vulnerabilities, including one critical use-after-free in Prerender (CVE-2026–110922). According to Google, there are no indications of exploitation.
Details on the Chrome Releases blog.
KDE App of the Week: Audex – Digitizing Audio CDs on Linux
Even in the age of streaming, many households still have numerous music CDs sitting on their shelves. Anyone looking to digitize their collection and play their music on a computer, smartphone, or other devices will find Audex a useful tool for the job. The KDE application rips audio CDs and saves the tracks to the hard drive in various audio formats.
Audex supports FLAC, MP3, Ogg Vorbis, Opus, and AAC, among other formats. While FLAC preserves audio without any loss of quality, making it particularly suitable for archiving, compressed formats such as MP3 or Opus are well suited for mobile devices. Custom encoders can also be integrated using user-defined profiles. To extract audio from CDs, Audex uses the libcdio-paranoia library, which can detect read errors and correct them where possible.
Audex lists all tracks of the inserted CD. At the top, you choose the profile, here lossless FLAC, and start the process with Rip.
Metadata and Cover Art from the Internet
To save users from having to manually tag their digitized music collection, Audex accesses the CDDB and MusicBrainz databases. These provide information about artists, albums, and individual tracks, as well as matching cover art. Missing or incorrect information can be edited directly in the application.
In the settings, you decide whether Audex fetches titles and cover art automatically and which folder the music files end up in.
While ripping and encoding, Audex shows the overall progress, here track 5 of 13 at 29 percent.
The configurable profiles and file naming schemes are particularly useful. They determine the audio format in which the music is saved and how Audex organizes the directory structure. The application can also generate playlists and rip entire CDs into a single audio file accompanied by a CUE sheet.
Audex has officially been part of the KDE Gear collection since May 2024 and receives regular updates. The current version, 26.08.2, was released on October 8, 2026, and can be installed on TUXEDO OS as a Flatpak through the Discover software center.
Info: Are you interested in Plasma development and want to know what new features are planned and which programs have been recently updated? You can find a detailed overview in the weekly column This week in Plasma by KDE developer Nate Graham.
TUXEDO OS Tips & Tricks: Automatic Light and Dark Mode with Night Light
In Europe, daylight saving time ends on Sunday, October 25, and it gets dark an hour earlier in the evening. If you are still working on your notebook by then, a bright desktop can quickly feel glaring. KDE Plasma can handle this on its own: Night Light gives the screen a warmer tint in the evening, and since Plasma 6.5 the desktop can also switch automatically between a light and a dark theme. TUXEDO OS ships both features with Plasma 6.6, so there is nothing to install.
The Day-Night Cycle Sets the Pace
You define when Plasma considers it day or night in one central place: System Settings » Language & Time » Day-Night Cycle . Night Light, the automatic theme switch, and dynamic wallpapers all follow this cycle. By default, Plasma calculates sunrise and sunset from your location and thus takes the time change into account automatically.
For automatic location detection, Plasma uses the GeoClue2 service. If no GPS is available, it sends the computer’s IP address to a GeoIP service. If you don’t want that, select Use manual location and either click your hometown on the map or enter latitude and longitude. Alternatively, set Determine sunrise and sunset times to Using custom times and enter fixed times. Further down, the Transition duration determines how long the change takes; the default is 30 minutes.
In the Day-Night Cycle settings, you define when Plasma considers it day or night. In this example, the entered location results in sunrise at 7:48 and sunset at 18:13.
Night Light: Warmer Colors in the Evening
Night Light is a blue light filter that lowers the color temperature of the screen in the evening. You can find it under System Settings » Input & Output » Display & Monitor » Night Light . Under Switching times , choose Sunrise and sunset , and the filter follows the day-night cycle. Always off turns it off, Always on night light keeps it on permanently. The Day light temperature and Night light temperature sliders determine how strong the filter is. At night, Plasma uses 4,500 Kelvin by default; lower values look warmer.
On the Night Light page, the filter follows the day-night cycle. The orange area shows when Night Light is active, and the two sliders set the color temperature.
For photo editing or video editing, altered colors get in the way. In that case, click Brightness and Color in the system tray and temporarily pause Night Light with Suspend . A middle click on the icon is even faster. You can also assign a keyboard shortcut; the action is called Suspend/Resume Night Light .
Brightness and Color in the system tray shows when the transition to night begins. Suspend pauses Night Light.
The Theme Changes with the Time of Day
You enable the automatic switch between light and dark under System Settings » Appearance & Style » Colors & Themes » Global Theme . Turn on Switch to Dark Mode at Night in the header bar. Then choose one Global Theme each under Light and Dark . Breeze and Breeze Dark are preselected. If you want to keep the TUXEDO look, pick TUXEDO and TUXEDO Dark . The light theme is used during the day, the dark one at night. Configure Day/Night Cycle… takes you straight to the times.
The option Wait until idleness before switching is already enabled. Plasma then only swaps the theme once you haven’t touched the mouse or keyboard for five seconds, so the interface doesn’t change while you are typing. The switch only affects the appearance, meaning colors, Plasma style, icons, and window decorations. Your panels and widgets stay where they are.
Under Global Theme, you choose a light and a dark theme. Plasma then switches between the two on its own.
You can also find the switch on the first page of System Settings, Quick Settings : there, the entry Automatic appears next to the themes. If you also use a wallpaper with a light and a dark variant, set Switch dynamic wallpapers to Based on the day-night cycle in its settings. We showed how this works in TWIX #33–2026 .
Ubuntu Security Updates
The Ubuntu security updates listed here are generally incorporated directly into TUXEDO OS. Some updates are only available from Ubuntu for a fee and are therefore not made available to the community until a later date. Unfortunately, we have no control over this:
USN-8954–1: zlib vulnerability
USN-8953–1: openvpn vulnerability
USN-8952–1: python-tornado vulnerabilities
USN-8951–1: c-ares vulnerabilities
USN-8947–1: nss update
USN-8950–1: poppler vulnerability
USN-8949–1: ghostscript vulnerabilities
USN-8948–1: php8.1, php8.3, php8.5 vulnerabilities
USN-8946–1: unbound vulnerabilities
USN-8945–1: xz-utils vulnerability
USN-8944–1: ca-certificates update
USN-8942–1: dotnet8, dotnet10, dotnet11 vulnerabilities
USN-8943–1: protobuf vulnerability
USN-8941–1: squid, squid3 vulnerabilities
USN-8934–1: pyjwt vulnerabilities
USN-8939–1: libxtst vulnerabilities
USN-8938–1: cifs-utils vulnerability
USN-8936–1: php8.5, php8.3, php8.1, php7.4, php7.2, php7.0, php5 vulnerabilities
USN-8935–1: golang-1.22 vulnerabilities
