We have published Qubes Security Bulletin (QSB) 119: Potential attacker-controlled format string in qvm-open-in-vm. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 119 ---===[ Qubes Security Bulletin 119 ]===--- 2026-09-15 Potential attacker-contr…
We have published Qubes Canary 048. The text of this canary and its accompanying cryptographic signatures are reproduced below. For an explanation of this announcement and instructions for authenticating this canary, please see the end of this announcement. Qubes Canary 048 ---===[ Qubes Canary 048 ]===--- Statements ----------- The Qubes security team members who have digitally signed this file […
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is not affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: (none) XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: XSA-509: Denial of service only. XSA-…
We have published Qubes Security Bulletin (QSB) 118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 118 ---===[ Qubes Security Bulletin 118 ]===--- 2026-08-28 Dom0 arbitrary code ex…
We have published Qubes Security Bulletin (QSB) 117: Intel CPU firmware vulnerabilities. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 117 ---===[ Qubes Security Bulletin 117 ]===--- 2026-08-28 Intel CPU firmware vulnerabilities User action ----…
As previously announced, the call for proposals for Qubes OS Summit 2026 will end on 2026-08-31. If you’d like to present at the Summit, please submit your proposal soon! As a reminder: You may present either on site or virtually from anywhere in the world. If your proposal is accepted and you wish to present in person, you’ll be issued an on-site ticket free of charge, no purchase necessary. If y…
We have published Qubes Security Bulletin (QSB) 116: Multiple Xen issues (XSA-500, XSA-505, XSA-506, XSA-507). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 116 ---===[ Qubes Security Bulletin 116 ]===--- 2026-07-28 Multiple Xen issues (XSA-500,…
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: XSA-500: See QSB-116. XSA-505: See QSB-116. XSA-506: See QSB-116. XSA-507: See QSB-116. XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qub…
The following new Fedora 44 templates are now available for Qubes OS 4.3: fedora-44-xfce — default Fedora template with the Xfce desktop environment fedora-44-gnome — alternative Fedora template with the GNOME desktop environment fedora-44-minimal — minimal template for advanced users There are two ways to upgrade a template to a new Fedora release: Recommended: Install a fresh template to replace…
Qubes OS Summit 2026 is a three-day gathering of security enthusiasts, open-source developers, and digital privacy experts. When and where Friday, October 30 @ 9:30 AM — Sunday, November 1 @ 3:00 PM (GMT+1) (A more specific schedule will be published after the speaker lineup is finalized.) Refugio Berlin Lenaustraße 3-4 12047 Berlin View on OpenStreetMap Attend in person or online There are three…
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is not affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: (none) XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: XSA-498: Qubes OS does not use XAPI.…
As previously announced, Qubes OS User Survey 2026 will close on 2026-07-13. If you still wish to take the survey and haven’t completed it yet, please do so now. Whether you’re a long-time Qubes user or haven’t even installed it yet, we want to hear about your experiences and about what matters to you. Help us make Qubes the best reasonably secure operating system it can be. If you’ve ever wanted…
As previously announced, Qubes OS User Survey 2026 is currently live! The survey will remain open for two more weeks, until 2026-07-13. Whether you’re a long-time Qubes user or haven’t even installed it yet, we want to hear about your experiences and about what matters to you. Help us make Qubes the best reasonably secure operating system it can be. If you’ve ever wanted to influence the developme…
As previously announced, the Qubes OS 4.2 release series has officially reached end of life (EOL) as of today, 2026-06-21. We strongly urge all remaining Qubes 4.2 users to upgrade to Qubes 4.3 immediately. Recommended actions If you’re already using Qubes 4.3, then you don’t have to do anything. This announcement doesn’t apply to you. If you’re still using Qubes 4.2, then you should upgrade to Qu…
We’re pleased to announce the stable release of Qubes OS 4.3.1! This patch release aims to consolidate all the security updates and bug fixes that have occurred since the previous stable release. Our goal is to provide a secure and convenient way for users to install (or reinstall) the latest stable Qubes release with an up-to-date ISO. The ISO and associated verification files are available on th…
Whether you’re a long-time Qubes user or haven’t even installed it yet, we want to hear about your experiences and about what matters to you. Help us make Qubes the best reasonably secure operating system it can be. If you’ve ever wanted to influence the development of Qubes, now is your chance. Make your voice heard! Qubes OS User Survey 2026 This survey is fully anonymous. We do not collect any…
We have published Qubes Security Bulletin (QSB) 115: HVM I/O port list traversal (XSA-491). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 115 ---===[ Qubes Security Bulletin 115 ]===--- 2026-06-09 HVM I/O port list traversal (XSA-491) User actio…
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: XSA-491: See QSB-115. XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: XSA-492: Denial of service…
We have published Qubes Canary 047. The text of this canary and its accompanying cryptographic signatures are reproduced below. For an explanation of this announcement and instructions for authenticating this canary, please see the end of this announcement. Qubes Canary 047 ---===[ Qubes Canary 047 ]===--- Statements ----------- The Qubes security team members who have digitally signed this file […
The first release candidate (RC) for Qubes OS 4.3.1 is now available for testing. This patch release aims to consolidate all the security patches, bug fixes, and other updates that have occurred since the release of Qubes 4.3.0. What’s new in Qubes 4.3.1? Default Fedora template upgraded to Fedora 43. (Note: Fedora 42 has reached end of life.) Many bug fixes When is the stable release? That depend…
We have published Qubes Security Bulletin (QSB) 114: Intel CPU data exposure vulnerability. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 114 ---===[ Qubes Security Bulletin 114 ]===--- 2026-05-13 Intel CPU data exposure vulnerability User actio…
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: XSA-490 See QSB-113 XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: (none) About this announceme…