Most OS releases are marketing events. Qubes patch releases are the opposite: boring ISOs that exist so a fresh install doesn't land three weeks behind on security. Qubes OS 4.3.2, released yesterday, is exactly that — a consolidation release that pulls every security update and bug fix since the last stable release into one current image. But buried in its terse announcement are two security bulletins and an end-of-life that make "update normally" mean very different things depending on which version you're on.

The two bulletins this release absorbs

QSB-118 (published 2026-08-28) is the one that should make your eyebrows move. qvm-copy-to-vm — the tool that copies files from dom0 into a qube — builds its error-reporting dialog from a filename reported by the receiving qube. A sanitizer strips control characters and double quotes, but leaves shell metacharacters like semicolons and backticks untouched, and the result flows straight into a system() call. So: compromise one qube, wait for the user to copy a file from dom0 into it, and you get arbitrary command execution in dom0 — the one domain whose compromise ends the entire security model. The fix is in qubes-core-dom0-linux 4.3.22, delivered by the normal update channel.

QSB-119 (published 2026-09-15) is a potential attacker-controlled format string in qvm-open-in-vm, the tool behind "open this file in a disposable qube." Exploitation was considered impractical under realistic conditions — but the tool exists precisely to handle untrusted input, so the project patched it anyway. The lesson there is worth noting: this is what a mature security posture looks like. Fix the bug, not the exploit.

Neither bulletin demands heroics. The prescribed action for both is the same sentence Qubes uses for every bulletin: keep updating normally.

Which release are you on? That decides the playbook

On Qubes 4.3 already (4.3.0, 4.3.1, or the 4.3.2 RC)? You are in the easiest seat. Run the normal update flow — the Qubes Update tool — which also refreshes any end-of-life templates and standalones you still have. The project says this makes your system essentially equivalent to 4.3.2. No reinstall, no migration, no ceremony. The project's strong recommendation: take a full backup first anyway. Patch releases are boring; lost backups are not.

On Qubes 4.2? Your seat is not a seat anymore. Qubes 4.2 reached end of life on June 21, 2026 — it receives no security updates or bug fixes at all. The 4.3.2 announcement repeats the upgrade instruction explicitly, and it is worth treating as the deadline it is: every bulletin since June, including QSB-118 and QSB-119, has been landing on systems that will never see them while 4.2 keeps running. Upgrade from 4.2 to 4.3 now, following the official upgrade documentation, backup first.

Installing fresh? Grab the 4.3.2 ISO (with its signature files) and install normally — it is the most current starting point the project has ever shipped.

The one known issue to watch for

There is exactly one documented gotcha in 4.3.2: templates restored from a pre-4.3 backup can keep pointing at their original release repositories instead of the 4.3 ones (issue #8701). If that applies to you, run these two commands in a dom0 terminal:

sudo qubes-dom0-update -y qubes-dist-upgrade
sudo qubes-dist-upgrade --releasever=4.3 --template-standalone-upgrade -y

Templates get shut down during the process. Clean 4.3.2 installs and in-place 4.2-to-4.3 upgrades already include the fix, so most people will never see this.

The actual takeaway

Alongside the security consolidation, 4.3.2 quietly moves the default Fedora template to Fedora 44 and kernel-latest to Linux 7.2 — the kind of refresh that only ships inside these patch releases, and another reason fresh installs benefit most from them. If you are already on 4.3, this whole release is a reminder that your update channel is working as designed. If you are still on 4.2, it is the project's polite way of saying the channel has closed.

Sources: