We have published Qubes Security Bulletin (QSB) 121: Arbitrary read/write via grant copy (XSA-523). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 121 ---===[ Qubes Security Bulletin 121 ]===--- 2026-11-03 Arbitrary read/write via grant copy (XSA…
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: XSA-523: See QSB-121. XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: (none) About this announce…
Fedora 43 is currently scheduled to reach end of life (EOL) on 2026-12-09 (approximately one month from the date of this announcement). Please upgrade all of your Fedora templates and standalones by that date. For more information, see Upgrading to avoid EOL. There are two ways to upgrade a template to a new Fedora release: Recommended: Install a new template to replace an existing one. This optio…
Qubes OS Summit 2026 is finally here! Today, Friday, October 30, marks the first day of the Summit, which will begin at 9:30am CET (UTC+1) in Berlin, Germany. Whether you’re joining us in person at Refugio Berlin or online via the livestream, we’re excited for you to see the presentations our speakers have prepared for you! Still need a ticket, or not sure if you do? There are three ways to attend…
We’re proud to announce that Nitrokey has joined as a Qubes OS Summit 2026 Silver-tier sponsor! Nitrokey is a world leader in open-source security hardware. They develop hardware for data encryption, key management, user authentication, network devices, desktops, laptops, and smartphones. Several NitroPads and NitroPCs are officially certified for Qubes OS. In addition, with the conference nearly…
It is our pleasure to announce that the Star Labs StarBook Horizon is officially certified for Qubes OS Release 4! The Star Labs StarBook Horizon The Star Labs StarBook Horizon is a 13.4-inch laptop featuring open-source coreboot firmware, up to 32 GB of memory, Wi-Fi kill switch, integrated webcam cover, as well as extensive firmware controls for fan, power, security, boot behavior, and more. Qub…
It is our pleasure to announce that the Star Labs StarFighter is officially certified for Qubes OS Release 4! The Star Labs StarFighter The Star Labs StarFighter is a 16-inch laptop featuring open-source coreboot firmware, disabled Intel ME, up to 64 GB of memory, wireless kill switch, removable webcam, as well as extensive firmware controls for fan, power, security, boot behavior, and more. Qubes…
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is not affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: (none) XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: XSA-514: Affects only Xen 4.22 or hig…
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is not affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: (none) XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: XSA-522: Denial of service only. Abou…
We have published Qubes Security Bulletin (QSB) 120: Two CTAP proxy vulnerabilities. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 120 ---===[ Qubes Security Bulletin 120 ]===--- 2026-10-08 Two CTAP proxy vulnerabilities User action ------------…
We’re pleased to announce the stable release of Qubes OS 4.3.2! This patch release aims to consolidate all the security updates and bug fixes that have occurred since the previous stable release. Our goal is to provide a secure and convenient way for users to install (or reinstall) the latest stable Qubes release with an up-to-date ISO. The ISO and associated verification files are available on th…
We’re proud to announce two new Qubes OS Summit 2026 sponsorships: Freedom of the Press Foundation (FPF) as a Gold tier sponsor and NovaCustom as a Silver tier sponsor! The FPF is a long-standing Qubes Partner. As a nonprofit organization, it is dedicated to supporting and defending public interest journalism. It leads the development of SecureDrop, an open-source whistleblower submission platform…
The first release candidate (RC) for Qubes OS 4.3.2 is now available for testing. This patch release aims to consolidate all the security patches, bug fixes, and other updates that have occurred since the release of Qubes 4.3.1. What’s new in Qubes 4.3.2? Default Fedora template upgraded to Fedora 44 kernel-latest upgraded to Linux 7.2 Numerous bug fixes When is the stable release? That depends on…
We have published Qubes Security Bulletin (QSB) 119: Potential attacker-controlled format string in qvm-open-in-vm. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 119 ---===[ Qubes Security Bulletin 119 ]===--- 2026-09-15 Potential attacker-contr…
We have published Qubes Canary 048. The text of this canary and its accompanying cryptographic signatures are reproduced below. For an explanation of this announcement and instructions for authenticating this canary, please see the end of this announcement. Qubes Canary 048 ---===[ Qubes Canary 048 ]===--- Statements ----------- The Qubes security team members who have digitally signed this file […
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is not affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: (none) XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: XSA-509: Denial of service only. XSA-…
We have published Qubes Security Bulletin (QSB) 118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 118 ---===[ Qubes Security Bulletin 118 ]===--- 2026-08-28 Dom0 arbitrary code ex…
We have published Qubes Security Bulletin (QSB) 117: Intel CPU firmware vulnerabilities. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 117 ---===[ Qubes Security Bulletin 117 ]===--- 2026-08-28 Intel CPU firmware vulnerabilities User action ----…
As previously announced, the call for proposals for Qubes OS Summit 2026 will end on 2026-08-31. If you’d like to present at the Summit, please submit your proposal soon! As a reminder: You may present either on site or virtually from anywhere in the world. If your proposal is accepted and you wish to present in person, you’ll be issued an on-site ticket free of charge, no purchase necessary. If y…
We have published Qubes Security Bulletin (QSB) 116: Multiple Xen issues (XSA-500, XSA-505, XSA-506, XSA-507). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 116 ---===[ Qubes Security Bulletin 116 ]===--- 2026-07-28 Multiple Xen issues (XSA-500,…
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: XSA-500: See QSB-116. XSA-505: See QSB-116. XSA-506: See QSB-116. XSA-507: See QSB-116. XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qub…
The following new Fedora 44 templates are now available for Qubes OS 4.3: fedora-44-xfce — default Fedora template with the Xfce desktop environment fedora-44-gnome — alternative Fedora template with the GNOME desktop environment fedora-44-minimal — minimal template for advanced users There are two ways to upgrade a template to a new Fedora release: Recommended: Install a fresh template to replace…
Qubes OS Summit 2026 is a three-day gathering of security enthusiasts, open-source developers, and digital privacy experts. When and where Friday, October 30 @ 9:30 AM — Sunday, November 1 @ 3:00 PM (GMT+1) (A more specific schedule will be published after the speaker lineup is finalized.) Refugio Berlin Lenaustraße 3-4 12047 Berlin View on OpenStreetMap Attend in person or online There are three…
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is not affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: (none) XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: XSA-498: Qubes OS does not use XAPI.…
As previously announced, Qubes OS User Survey 2026 will close on 2026-07-13. If you still wish to take the survey and haven’t completed it yet, please do so now. Whether you’re a long-time Qubes user or haven’t even installed it yet, we want to hear about your experiences and about what matters to you. Help us make Qubes the best reasonably secure operating system it can be. If you’ve ever wanted…
As previously announced, Qubes OS User Survey 2026 is currently live! The survey will remain open for two more weeks, until 2026-07-13. Whether you’re a long-time Qubes user or haven’t even installed it yet, we want to hear about your experiences and about what matters to you. Help us make Qubes the best reasonably secure operating system it can be. If you’ve ever wanted to influence the developme…
As previously announced, the Qubes OS 4.2 release series has officially reached end of life (EOL) as of today, 2026-06-21. We strongly urge all remaining Qubes 4.2 users to upgrade to Qubes 4.3 immediately. Recommended actions If you’re already using Qubes 4.3, then you don’t have to do anything. This announcement doesn’t apply to you. If you’re still using Qubes 4.2, then you should upgrade to Qu…
We’re pleased to announce the stable release of Qubes OS 4.3.1! This patch release aims to consolidate all the security updates and bug fixes that have occurred since the previous stable release. Our goal is to provide a secure and convenient way for users to install (or reinstall) the latest stable Qubes release with an up-to-date ISO. The ISO and associated verification files are available on th…
Whether you’re a long-time Qubes user or haven’t even installed it yet, we want to hear about your experiences and about what matters to you. Help us make Qubes the best reasonably secure operating system it can be. If you’ve ever wanted to influence the development of Qubes, now is your chance. Make your voice heard! Qubes OS User Survey 2026 This survey is fully anonymous. We do not collect any…
We have published Qubes Security Bulletin (QSB) 115: HVM I/O port list traversal (XSA-491). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 115 ---===[ Qubes Security Bulletin 115 ]===--- 2026-06-09 HVM I/O port list traversal (XSA-491) User actio…