Release 2026_043 (additional release, 2026-10-21)

Impact

26.05

  • Machines will reboot to activate a changed kernel.

NixOS 26.05 platform

  • Blacklist emSign ECC Root CA - G3, emSign Root CA - C1, emSign ECC Root CA - C3, Comodo AAA Services root certificate authorities (CVE-2026-111943, PL-135771) Leaked private key of mentioned emSign CAs, cross signed by Comodo AAA Services root.

  • Update PHP versions 7.4 to 8.5 to include fixes for CVE-2026-109618, CVE-2026-109619

  • Update Linux kernel to fix CVE-2026-99999

  • Pull upstream NixOS changes, security fixes, and package updates:

    • linuxKernelGPU: 6.18.56 -> 6.18.57

    • linuxKernelVerify: 6.18.56 -> 6.18.57

    • linuxKernelStable: 6.12.112 -> 6.12.113

    • php82: 8.2.34 -> 8.2.35

    • php83: 8.3.35 -> 8.3.36

    • php84: 8.4.26 -> 8.4.27

    • php85: 8.5.11 -> 8.5.12

NixOS 25.11 platform

  • Blacklist emSign ECC Root CA - G3, emSign Root CA - C1, emSign ECC Root CA - C3, Comodo AAA Services root certificate authorities (CVE-2026-111943, PL-135771) Leaked private key of mentioned emSign CAs, cross signed by Comodo AAA Services root.

  • Update PHP versions 7.4 to 8.5 to include fixes for CVE-2026-109618, CVE-2026-109619

  • Package updates cherry-picked by upstream NixOS:

    • php82: 8.2.31 -> 8.2.35

    • php83: 8.3.31 -> 8.3.36

    • php84: 8.4.22 -> 8.4.27

    • php85: 8.5.7 -> 8.5.12

Detailed Changes