Releases · Unraid

Unraid 7.2.9 carries the PHP2Shell fixes and the eMudhra CA update

Unraid OS 7.2.9 is a targeted security patch for the 7.2 branch: PHP 8.4.27 covering ten CVEs including the PHP2Shell pair, a CA bundle that addresses the eMudhra compromise, and an API update whose bundled Node 22.23.4 resolves the certificate issue. Unraid still points 7.2 users at 7.3.4 for the newer kernel.

By BoneFriday 23 October 20263 min readReleases

entryread only

filedFriday 23 October 2026

length3 min

sectionReleases

subjectUnraid

sourceson the page

Unraid published OS 7.2.9 with a summary that needs no decoding: “a targeted security update for the 7.2 branch, with PHP security fixes, CA certificate updates addressing the eMudhra compromise, and an Unraid API update to 4.37.7.” The release post also says the Linux kernel version is “unchanged from 7.2.8”, so this is package work, not a new kernel. The same opening block adds: “We highly recommend updating to the latest stable release, Unraid OS 7.3.4, for its newer kernel and broader package security updates.”

The PHP fixes include the PHP2Shell pair

Unraid’s bundled PHP moves from 8.4.23 to 8.4.27, which the post says “addresses multiple CVEs” and then lists: CVE-2026-6103, CVE-2026-7260, CVE-2026-17543, CVE-2026-17544, CVE-2026-17545, CVE-2026-91765, CVE-2026-91766, CVE-2026-91769, CVE-2026-109618 and CVE-2026-109619.

The last two are PHP2Shell, the unauthenticated RCE pair covered here on 21 October, and 8.4.27 is the release that carried those fixes for PHP’s 8.4 branch. Unraid boxes have been waiting for that patch through their own update path; this is it arriving.

The other eight identifiers are listed and nothing more. The post does not describe them, so neither does this piece.

Trust store and API runtime

The CA bundle goes from 20260717 to 20261020 and “addresses the compromised CA certificates referenced in the Unit 42 report”, which is the eMudhra compromise reaching Unraid’s own trust store. That is the same removal distributions and applications have shipped this week, now in the NAS platform quite a few homelabs run.

The Unraid API moves from 4.36.1 to 4.37.7, and its “bundled Node.js runtime is updated to 22.23.4, which resolves the Node.js certificate-compromise issue”. That is the v22.23.4 release line covered here on 22 October, arriving inside the API component rather than as a system Node install.

7.2.9 or 7.3.4

The post’s security-advisory section qualifies the patch rather than selling it: “Updating to 7.2.9 alone should not be interpreted as resolving every potential open security issue.” It says the release “does not include broader distro-package or kernel security updates available in newer releases on the 7.3.x branch”, and it puts a number on the gap: “As of October 23, 2026, upstream package advisories identify 115 potential CVEs associated with package versions included in this release”. The post’s own breakdown is 42 in network transfers and DNS, 25 in encryption and secure connections, 29 in graphical components, 6 in file sharing and 10 in other libraries and system utilities, with further advisories for libarchive, libxml2, OpenSSH, PCRE2, rsync, wpa_supplicant and xz that carry no identifiers. A separate vulnerability-database check finds 55 more that may overlap, and the post warns those totals “should not be added together”.

The advisory restates a recommendation the post has already made twice, once in the opening block quoted above and once in a section of its own headed “Upgrade to Unraid 7.3.4”. Its wording drops the intensifier: “We recommend updating to the latest stable release, Unraid OS 7.3.4, for its newer kernel and broader package security updates.” Those two properties are all this piece will claim for 7.3.4, because its release notes were not part of the source material.

So the honest reading has two steps. 7.2.9 is the patch for the three items above, and taking it does not clear the package backlog behind them. The 7.3.x branch is where Unraid points for kernel and distro updates, and the advisory adds that newer upstream kernels carry fixes 7.2.9 does not. The post does not reproduce updating steps; it links its own under “Upgrading”, and this piece follows that lead rather than inventing a walkthrough.

Sources: the Unraid OS 7.2.9 release post.

ReleasesHomebridge 2.5.0 is a Matter release: new device types, and fixes for identity and cacheHomebridge 2.5.0 adds Matter device types for solar, battery, EV chargers, meters, tariffs and water heaters, and spends the rest of its list on behaviour that used to go wrong: air quality reporting only two levels, thermostats registering late, restored accessories losing their uniqueId or owner, and cache reads that took the accessory with them. It also bumps @matter/main to v0.18.0 and @homebridge/hap-nodejs to v2.3.0.

ReleasesMealie 3.30.0 lets you own the AI prompt, time each step, and plan a whole weekMealie 3.30.0 moves AI prompt control into the app, so prompts can be appended to, replaced or extended with global instructions, and it retires the OPENAI_CUSTOM_PROMPT_DIR variable while importing existing prompts automatically. Instruction steps gain individual durations, meal plan entries can cover a full week, and a batch of fixes tightens import scoping, locale lookup and the permissions needed to manage units, tools, labels and recipe actions.

ReleasesMemos 26.10.0 signs API clients out, stops reading /etc/secrets and makes export an admin jobMemos 26.10.0 is the first release under calendar versioning, and its upgrade notes matter more than its features: old installs need a 0.31.0 waypoint, cached access tokens expire on upgrade, the /etc/secrets files from 0.31.0 are no longer read, member export disappears, and the old upload and memo-length settings are replaced without migration. The features are a rich editor by default, per-user usage limits and declarative configuration.