The Determinate Update (October 2026)

The Determinate Update

A newsletter from Determinate Systems covering Nix at work

Wow. Another dizzying week in the world of supply chain security. A whole slew of scary and wide-reaching vulnerabilities has gotten us all racing to catch up. But on our side, that has come with some highly positive results that we’re eager to share!

In this issue, you’ll find:

• Security updates for recent high-profile vulns. We are on it and you can read how here.

• A nice batch of product updates. OTel support for Determinate Nix, the beloved Native Linux Builder is now GA, and we have new LTS distributions of Determinate Secure Packages.

• A recap of NixCon 2026. Another very fun and productive global conference for us and Nixers from all over the world.

• Community links. Fun stuff happening in Nixworld more broadly.

🔐 Security updates

As for many of you, it’s been a stressful week on our side! But it’s also been exhilarating in its own way, because even though we’ve had to scramble to get fixes merged and packages cached as quickly as possible, we feel more convinced than ever that Determinate Secure Packages is an incredibly valuable offering for enterprises and that Nix provides the right paradigm-level constructs to rise to the security challenges of the present moment.

On that note, we’re pleased to report that fixes and cached packages for all the major issues from last week have landed for all packages in our covered package set across all three distributions of Determinate Secure Packages (secure-packages-rolling, secure-packages-26.05, secure-packages-25.11, plus FIPS variants of all three):

• The eMudhra intermediate CA compromise (which manifests as CVE-2026-111943 amongst others)

• So-called Node2Shell stemming from a remote code execution issue in Brotli (CVE-2026-111497)

• So-called PHP2Shell stemming from a remote code execution issue in the PHP runtime (CVE-2026-109618 and CVE-2026-109619)

• A whole bunch of others that you can track on our CVE dashboard.

Beyond getting fixes out, we’ve used these incidents to continue refining our internal processes and tools, and we’ve even decided to add an Emergency Legacy Extension for teams who are still on NixOS 25.05. That Nixpkgs distribution is now well past the EOL date for upstream support, but if you still depend on it for whatever reason, come talk to us.

🚀 Determinate product updates

The Determinate platform is moving along briskly as always!

Native Linux Builder is now generally available. This highly popular feature of Determinate Nix enables you to build Linux derivations on macOS without needing to resort to a local Docker image, a remote builder, or a long-running local VM. We released it as a developer preview back in 2025 but we are now so confident in it that we’re ready to open it up to everyone, with no need to request access.

OpenTelemetry support for Determinate Nix. We believe strongly in observability at Determinate Systems, and so we’re quite pleased to enable Determinate Nix to emit OTel traces to any compatible exporter, be it Honeycomb, Datadog, Grafana, or something else entirely. We’re already using it internally to hunt down performance bottlenecks and other undesirable things, and now teams using Determinate Nix have another powerful tool for answering questions like “Hmmm, why is this CI run slower than we’d expect?”

Determinate Secure Packages LTS. For teams in a variety of industries that need Long-Term Support (LTS) for Nix packages, we now offer 60 months of support for some Determinate Secure Packages distributions, beginning with secure-packages-26.05. And if that’s still not enough, there’s optional extended support beyond that. Non-LTS distributions continue to provide 12 months of support. We think that this system is well calibrated to the needs of our customers, and we’re excited to meet enterprises where they are.

🇵🇱 NixCon 2026 recap

NixCon 2026 was recently held in Kraków, Poland 🇵🇱 and we had an absolute blast there.

• The DetSys Happy Hour was a huge success, with over 60 attendees over the course of the evening.

• Two DetSys employees gave talks: Tristan Ross on declarative hardware architectures using Nix and Eelco Dolstra on scaling Nix. The videos for those talks sadly aren’t yet available online, but keep checking YouTube over the next few days, and surely they’ll pop up.

• Countless people from the community came to the DetSys booth to say hello, ask questions, and grab merch. We cherish these conversations and look forward to them every year.

The vibes were impeccable. NixCon just keeps getting bigger and badder and we’re thrilled to see it grow.

🌍 Community links

Nix is a big and bold universe and lots of folks are making major waves within it. Some things that caught our eye this month:

• Rebuilding a kernel exploit with Nix from Nick DeTello. Kernel exploits are super scary, but it turns out they’re much more tractable when you can build them reproducibly.

• Omnibin from Farid Zakaria. The Nix community’s resident mad scientist continues to push the boundaries of what’s possible with Nix, and we are here for it 👏.

• A RISC-V emulator in pure Nix from Mark Ruvald Pedersen. We’re big fans of RISC-V around here, and building an emulator in the Nix language is pretty wild 🤯.