From 6a391f3d0bacb90e8179ccca537f0ab11787331f Mon Sep 17 00:00:00 2001
From: Eli Bosley <11823237+elibosley@users.noreply.github.com>
Date: Fri, 23 Oct 2026 18:15:15 -0400
Subject: [PATCH] feat: add Unraid OS 7.2.9 release notes
---
docs/unraid-os/release-notes/7.2.9.md | 53 +++++++++++++++++++++++++++
1 file changed, 53 insertions(+)
create mode 100644 docs/unraid-os/release-notes/7.2.9.md
diff --git a/docs/unraid-os/release-notes/7.2.9.md b/docs/unraid-os/release-notes/7.2.9.md
new file mode 100644
index 0000000000..a32f72d57a
--- /dev/null
+++ b/docs/unraid-os/release-notes/7.2.9.md
@@ -0,0 +1,53 @@
+# Version 7.2.9 2026-10-23
+
+This maintenance release includes PHP security fixes, an Unraid API update from 4.36.1 to 4.37.7, and updates addressing the compromised CA certificates referenced in the [eMudhra certificate-compromise report](). The kernel version is unchanged from 7.2.8. **We recommend updating to the latest stable Unraid OS 7.3.x release** for its newer kernel and broader package security updates.
+
+## Upgrading
+
+For step-by-step instructions, see [Updating Unraid](/unraid-os/updating-unraid/). Questions about your license? Review the [License FAQ](/unraid-os/troubleshooting/licensing-faq/).
+
+## Known issues
+
+No new release-specific known issues are documented. See the [Unraid OS 7.2.8 release notes](/unraid-os/release-notes/7.2.8/) for issues that may still apply.
+
+## Rolling back
+
+No release-specific rollback warnings or compatibility limits are documented.
+
+## Changes vs. [Unraid OS 7.2.8](/unraid-os/release-notes/7.2.8/)
+
+### Security
+
+* Security: Updated PHP to address multiple CVEs.
+* Security: Addressed the compromised CA certificates referenced in the [Unit 42 report]().
+
+### Unraid API 4.37.7
+
+Updated from 4.36.1 to 4.37.7. Updated the API's bundled Node.js runtime to 22.23.4 - this resolves the Node certificate-compromise issue. See the [full API comparison]().
+
+### Security advisory: additional potential vulnerabilities
+
+**We recommend updating to the latest stable Unraid OS 7.3.x release** for its newer kernel and broader package security updates. Updating to 7.2.9 alone should **not be interpreted** as resolving every potential finding.
+
+Unraid OS 7.2.9 is a targeted maintenance release containing PHP security fixes, CA-certificate updates, and Unraid API fixes and security hardening. It **does not** include the broader distro-package or kernel security updates available in newer releases.
+
+As of October 23, 2026, upstream package advisories identify 115 potential CVEs associated with included package versions, grouped as follows:
+
+* **Network transfers and DNS — 42:** curl (30) and BIND (12).
+* **Encryption and secure connections — 25:** OpenSSL (23), libssh (1), and p11-kit (1).
+* **Graphical components — 29:** xorg-server (11), libXi (8), libX11 (4), libXfont2 (2), libXtst (2), libXpm (1), and libXrender (1).
+* **File sharing — 6:** Samba (6).
+* **Other libraries and system utilities — 10:** libpcap (5), util-linux (4), and libpng (1).
+
+Additional security advisories cover libarchive, libxml2, OpenSSH, PCRE2, rsync, wpa_supplicant, and xz without listing specific CVE identifiers. Separate vulnerability-database checks identify 55 potential package CVEs that may overlap with the 115 above; these totals must not be added together.
+
+Newer upstream kernel releases also contain security fixes not included in 7.2.9.
+
+## Base distro updates
+
+### Updated packages (4)
+
+* ca-certificates: version 20260717 -> 20261020
+* [dynamix.unraid.net]() (Unraid API): version 4.36.1 -> 4.37.7
+* libvirt-php: version 0.5.8-8.4.23_LT -> 0.5.8-8.4.27_LT
+* php: version 8.4.23-1_LT -> 8.4.27-1_LT (NVD: CVE-2026-6103, CVE-2026-7260, CVE-2026-17543, CVE-2026-17544, CVE-2026-17545, CVE-2026-91765, CVE-2026-91766, CVE-2026-91769, CVE-2026-109618, CVE-2026-109619)