Security
OpenSSL 4.1.0-beta2 is for testers, not for production
OpenSSL published 4.1.0-beta2 on 9 October. Supported release lines remain on the 29 September security updates.
Go 1.26.9 patches the toolchain, TLS, and HTTP
Go 1.26.9, released 8 October, includes security fixes in the go command, crypto/tls, html/template, net/http, net/textproto, and os.
Node.js 26.11.0 refreshes OpenSSL, certificates, and undici
Node.js 26.11.0, published 7 October, bundles OpenSSL 3.5.9, NSS 3.129 root certificates, and undici 8.11.2.
Python 3.10 is finished, and a tarfile bug is fixed
Python shipped 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 on 1 October. 3.10 will get no further security fixes.
OpenSSL 3.5.9 closes a high-severity hole and a stack of QUIC bugs
OpenSSL’s 29 September advisory patches 3.5.9, 3.6.5, 4.0.3, and 3.4.8. The highest severity fix in 3.5.9 is rated High.