Hello TUXEDO Fans and Open-Source Enthusiasts!
At the end of October, OpenAI CEO Sam Altman caused a stir on a podcast: memory is scarce worldwide, he said, and much of it sits unused in private PCs. The Linux community responded with the Bash script Ram Altman , which reads the available memory from /proc/meminfo and reports it to Altman by email at most once a day. That memory is not really idle, however: Linux uses free RAM as a file cache and releases it as soon as applications need it.
Things are less amusing on the Linux kernel mailing list. Lorenzo Stoakes, who has worked on the kernel since 2014, gave up several reviewer roles in memory management on November 10. Given the current flood of AI-generated patch series, he says he no longer has the time to review submitted changes outside his own areas. He keeps his maintainer roles. Linus Torvalds does not reject AI tools in principle, but he expects developers to understand their changes and take responsibility for them.
In this issue, we also introduce OptiImage, which shrinks PNG, JPEG, WebP, and SVG files. The tip of the week shows how KMail and Thunderbird can share their tags via IMAP so that markings look the same in both programs. As usual, you will also find the updates for TUXEDO OS and the latest security updates.
Enjoy reading,The TUXEDO OS Team
Note: With the TWIX series, we keep you up to date with the latest developments around TUXEDO OS. We also introduce interesting applications and share practical tips and tricks for the KDE desktop and TUXEDO OS. At the same time, TWIX thrives on your feedback. We always welcome your suggestions, topic ideas, and proposals for improvement. Feel free to join the discussion in our TWIX thread on Reddit , where you can reach us directly. Of course, you are also welcome to contact us via any of our other social media channels.
Updates in TUXEDO OS
firefox 2:160.0~tux1
Picture-in-Picture videos can now play at 0.25x to 2x speed. Also new is the Mini Window , which moves a tab or a selected part of a page into a small window that always stays on top.
If you copy a search term instead of an address, the address bar’s context menu offers Paste and Search . Sites that keep asking to handle links such as mailto: can now be blocked permanently. Firefox also plays MKV videos with FLAC, MP3, or PCM audio.
A first character typed quickly into the address or search bar is no longer lost, and signing in to intranet sites via NTLM or Kerberos no longer freezes Firefox for several seconds.
More in the security updates section and in the Firefox 160.0 release notes .
thunderbird 3:153.7.0esr~tux1
Fitting this week’s tip: changes to legacy IMAP tags reach the server again and are no longer lost after a refresh.
On Linux, signing in to the outgoing mail server via Kerberos with STARTTLS works again. Thunderbird also no longer crashes when opening a window, and MP4 attachments arrive complete when you forward a message.
More in the security updates section and in the Thunderbird 153.7.0esr release notes .
Kernel 7.0.0–113043.43~24.04.1tux1
The new kernel includes security fixes from the upstream kernel.
tuxedo-libasricore 0.0.43.1
The new package lays the groundwork for future fan control on the mini PCs of the TUXEDO Nano series. It ships a library that can address the fans and read temperatures on these devices.
Other Packages
Signal 8.34.0 and 8.35.0, Rocket.Chat Desktop 4.19.1 and 4.19.2, and Bitwarden 2026.10.4
Important Security Updates
firefox 2:160.0~tux1
Fixes 99 vulnerabilities, 57 of which Mozilla rates as high. They include numerous use-after-free bugs and several sandbox escapes, for example via WebGL (CVE-2026–124907) or inter-process communication (CVE-2026–124903). Mozilla does not mention any signs of exploitation.
Details in security advisory MFSA 2026–125 .
thunderbird 3:153.7.0esr~tux1
Fixes 86 vulnerabilities, 52 of them rated high. On Linux and Windows, .desktop attachments could be replaced with the content of the file they point to when a message was forwarded or edited. This could leak local files to recipients (CVE-2026–126132).
Many of the other bugs come from code shared with Firefox. According to Mozilla, they are hard to exploit when reading email, because Thunderbird does not run scripts there.
Details in security advisory MFSA 2026–129 .
KDE App of the Week: OptiImage – Shrink Images for the Web
Anyone who publishes an illustrated guide or a blog post often has one more step ahead after cropping the screenshots: the files should be as small as possible for the web. OptiImage takes care of this for PNG, JPEG, WebP, and SVG files and leaves the originals untouched if you want.
To do this, the application bundles four command-line programs under a graphical interface: oxipng for PNG, jpegoptim for JPEG, cwebp for WebP, and scour for SVG. OptiImage chooses the right tool based on the file format.
Sharp Text or Smaller Photos
OptiImage offers a lossless and a lossy mode. Lossless optimization is the right choice for screenshots with small text and fine lines. For web photos, lossy compression can pay off if a smaller file size matters more than preserving every detail. How much space you save depends on the source material. For images that are already optimized, the savings are often small.
The application can keep or remove metadata. If you publish photos whose EXIF data reveals the GPS location, for example, you can remove this information right during optimization. In safe mode, OptiImage writes the result to a new file and leaves the original untouched. This lets you check how much space the optimized file saves and how it looks before uploading it.
Usage
After installation, your first stop is the settings. There you decide whether OptiImage keeps the originals and the metadata. For each supported image format, you also set the compression level and whether the conversion is lossless or lossy.
After installation, you find OptiImage in the application menu. Among other things, the settings determine whether the originals are kept and whether compression is lossless.
OptiImage converts images you load into it right away according to these settings. A check mark to the right of each image shows that the optimization is complete. Below the file name, OptiImage shows the original and the new file size as well as the savings in percent.
With our PNG test screenshots, OptiImage saved between 7 and 20 percent losslessly, about 12 percent on average.
Installation
OptiImage was inspired by the GNOME app Curtail and is developed on the KDE project’s GitLab. The application is available as a Flatpak on Flathub and can be installed on TUXEDO OS via Discover.
Info: Are you interested in Plasma development and want to know what new features are planned and which programs have been recently updated? You can find a detailed overview in the weekly column This week in Plasma by KDE developer Nate Graham.
TUXEDO OS Tips & Tricks: Share Tags Between KMail and Thunderbird
If you access your mailbox via IMAP with several programs, for example KMail on one computer and Thunderbird on another, you expect to see the same state everywhere. IMAP reliably syncs read messages and folders, but tags are a different story: a message marked as an Action Item in KMail shows up in Thunderbird without any marking. On his blog , Matija Šuklje describes a simple trick that fixes this.
Why the Markings Get Lost
IMAP stores so-called flags for each message on the server. Some are predefined, for example for read or flagged messages, and the protocol also allows freely named keywords. KMail stores Important as the standard flag \Flagged and Action Item as the keyword $TODO . Thunderbird displays \Flagged as a star, so this part syncs without any extra steps. Thunderbird’s own tags such as Important or To Do , however, are stored as $label1 to $label5 , which KMail cannot do anything with.
In KMail, you find both markings in the context menu under Mark Message. An action item ends up on the server as the keyword $TODO.
Create the $TODO Tag in Thunderbird
When you create a new tag in Thunderbird, the program also uses its name as the keyword on the server. Open Settings from the menu in the top right and type Tags into the search field. Clicking New… opens the New Tag dialog. Enter exactly $TODO there and confirm with OK . From now on, Thunderbird shows the new tag on all messages that you marked as action items in KMail.
The name $TODO must match exactly, because Thunderbird uses it as the keyword on the IMAP server.
Next, give the tag a readable name. Select $TODO in the list, click Edit… , and change the name to Action Item , for example. Green is a good color to match KMail. Thunderbird keeps the original keyword and only changes the label.
Syncing also works the other way around: if you tag a message in Thunderbird via right-click and Tag | Action Item , it also appears as an action item in KMail. In our tests on TUXEDO OS with KMail 25.12.3 and Thunderbird 153.4.0esr, syncing worked in both directions.
Thunderbird now shows the messages marked as action items in KMail in green. Messages marked as important carry a star.
Limitations
Only these two markings work when switching between the programs. KMail does not display any other Thunderbird tags. According to Šuklje, custom tags created in KMail stay in the local KDE database Akonadi and never reach the server. He also recommends deleting Thunderbird’s Important tag and using the star instead. Otherwise, you end up with two different important markings that do not sync.
KMail is not preinstalled on TUXEDO OS, but you can install it via Discover if needed.
Ubuntu Security Updates
The Ubuntu security updates listed here are generally incorporated directly into TUXEDO OS. Some updates are only available from Ubuntu for a fee and are therefore not made available to the community until a later date. Unfortunately, we have no control over this:
USN-9018–2: linux-hwe-7.0 vulnerabilities
USN-9059–1: ruby-jwt vulnerability
USN-9046–1: mysql-8.0, mysql-8.4, mysql-9.7 vulnerabilities
USN-9042–1: dotnet8, dotnet10, dotnet11 vulnerabilities
USN-9045–1: linux-nvidia-7.0 vulnerability
USN-9040–1: linux-nvidia-lowlatency vulnerabilities
USN-9039–1: linux-azure-fde vulnerabilities
USN-9037–1: hplip vulnerabilities
USN-9036–1: ca-certificates-java update
USN-9022–1: linux, linux-aws, linux-azure, linux-azure-fips, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oracle, linux-vmware vulnerabilities
USN-9024–1: linux-aws-6.8, linux-gcp-6.8, linux-ibm-6.8, linux-lowlatency-hwe-6.8, linux-nvidia, linux-realtime-6.8 vulnerabilities
USN-9025–1: linux-oracle-6.8, linux-raspi, linux-raspi-realtime vulnerabilities
USN-9023–1: linux-aws-fips, linux-gcp-fips, linux-gkeop, linux-realtime vulnerabilities
USN-9020–1: linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0, linux-gcp-7.0, linux-gke, linux-oracle-7.0, linux-realtime vulnerabilities
USN-9017–1: libgphoto2 vulnerabilities
USN-9016–1: apache2 vulnerabilities
USN-9015–1: openjdk-21 vulnerabilities
USN-9014–1: openjdk-17 vulnerabilities
USN-9013–1: fetchmail vulnerabilities
USN-9011–1: pyasn1 vulnerabilities
USN-9009–1: openjdk-8 vulnerabilities
USN-9010–1: openjdk-lts vulnerabilities
USN-9008–1: libnfs vulnerability
USN-9007–1: freerdp3 vulnerabilities
USN-9006–1: perl vulnerability
USN-9004–1: openjdk-25 vulnerabilities
USN-9003–1: linux-nvidia-7.0, linux-nvidia-bos vulnerabilities
USN-9002–1: linux-nvidia-tegra vulnerabilities
