メインコンテンツへスキップ

Version 7.2.9 2026-10-23

This maintenance release includes PHP security fixes, an Unraid API update from 4.36.1 to 4.37.7, and updates addressing the compromised CA certificates referenced in the eMudhra certificate-compromise report. The kernel version is unchanged from 7.2.8. We recommend updating to the latest stable Unraid OS 7.3.x release for its newer kernel and broader package security updates.

Upgrading​

For step-by-step instructions, see Updating Unraid. Questions about your license? Review the License FAQ.

Known issues​

GUI-mode Firefox has not been patched against compromised CA certificates. Please do not use this browser for anything other than WebGUI setup.

See the Unraid OS 7.2.8 release notes for other issues that may still apply.

Rolling back​

No release-specific rollback warnings or compatibility limits are documented.

Changes vs. Unraid OS 7.2.8​

Security​

  • Security: Updated PHP to address multiple CVEs.
  • Security: Addressed the compromised CA certificates referenced in the Unit 42 report.

Unraid API 4.37.7​

Updated from 4.36.1 to 4.37.7. Updated the API's bundled Node.js runtime to 22.23.4 - this resolves the Node certificate-compromise issue. See the full API comparison.

Security advisory: additional potential vulnerabilities​

We recommend updating to the latest stable Unraid OS 7.3.x release for its newer kernel and broader package security updates. Updating to 7.2.9 alone should not be interpreted as resolving every potential finding.

Unraid OS 7.2.9 is a targeted maintenance release containing PHP security fixes, CA-certificate updates, and Unraid API fixes and security hardening. It does not include the broader distro-package or kernel security updates available in newer releases.

As of October 23, 2026, upstream package advisories identify 115 potential CVEs associated with included package versions, grouped as follows:

  • Network transfers and DNS — 42: curl (30) and BIND (12).
  • Encryption and secure connections — 25: OpenSSL (23), libssh (1), and p11-kit (1).
  • Graphical components — 29: xorg-server (11), libXi (8), libX11 (4), libXfont2 (2), libXtst (2), libXpm (1), and libXrender (1).
  • File sharing — 6: Samba (6).
  • Other libraries and system utilities — 10: libpcap (5), util-linux (4), and libpng (1).

Additional security advisories cover libarchive, libxml2, OpenSSH, PCRE2, rsync, wpa_supplicant, and xz without listing specific CVE identifiers. Separate vulnerability-database checks identify 55 potential package CVEs that may overlap with the 115 above; these totals must not be added together.

Newer upstream kernel releases also contain security fixes not included in 7.2.9.

Base distro updates​

Updated packages (4)​

  • ca-certificates: version 20260717 -> 20261020
  • dynamix.unraid.net (Unraid API): version 4.36.1 -> 4.37.7
  • libvirt-php: version 0.5.8-8.4.23_LT -> 0.5.8-8.4.27_LT
  • php: version 8.4.23-1_LT -> 8.4.27-1_LT (NVD: CVE-2026-6103, CVE-2026-7260, CVE-2026-17543, CVE-2026-17544, CVE-2026-17545, CVE-2026-91765, CVE-2026-91766, CVE-2026-91769, CVE-2026-109618, CVE-2026-109619)