Issue 3 · Sunday 4 October 2026 · 3 min read
$100k bug bounties on HackerOne, ThePrimeagen takes Agentic QA, and the linux-omarchy fallout worth checking
In this issue: Headline · Releases & Changes (2) · Features & Workflow (5) · Themes & Ricing (2) · DHH & Direction · Ecosystem (5) · Worth Trying
Headline
Omarchy bug bounty — The Omacom Foundation has put $100,000 behind an official HackerOne program: find a real vulnerability, report it privately, and get paid for it. If you'd rather skip a HackerOne account, reports still go to [email protected], and the Security Team finally has a proper workflow for triaging what comes in.
This is your daily driver, and the project is now shipping to a long list of hardware with native apps and thousands of plugins — funded outside review is how the security story keeps pace with the feature story. Mehmet İnce, a long-standing member of the Omarchy Security Team, becomes head of security and will run the bounty while setting security direction for everything shipped. The security page spells out what counts as a vulnerability. Omarchy News
Releases & Changes
Boot pin commit — Omarchy now writes root= into the kernel command line before packages land, closing an upgrade window where an interrupted update could strand you in an emergency shell. In VM testing, a legacy 3.8.0 install lost root= for about 10 seconds during upgrade; the pinned upgrade never does.
Node pin fix — Machines originally installed from an ISO offline kept Node pinned to that exact version, so mise up never moved it; this commit loosens the pin so it can.
Features & Workflow
Monologue — A first-party webcam and mic recorder now ships in the base packages — hit record and you land in a small editor where clips get cut down before exporting an MP4. A migration adds it to existing machines too, unless you've removed the preinstalls.
Hype — A Markdown presentation app from Omacom now comes with Omarchy by default, alongside Omacut, Monologue, Omacalc and Omawrite, with a new chapter in the manual's GUIs section. Same deal: a migration installs it on machines that still have the preinstalls.
Media keys — Volume, brightness and notification keys are handled inside the shell via Hyprland global shortcuts, dropping the volume OSD wait from about 168ms to about 20ms. Brightness falls to about 31ms; EasyEffects and external-display setups fall back to the old scripts.
Menu latency — Menu and panel bindings now use registered Hyprland shortcuts instead of launching a client per keypress — SUPER+SPACE maps in about 31ms — and the OSD stops sliding in from the corner.
Single sudo prompt — One password prompt per update, right after confirmation, with a background keepalive — and AUR builds deliberately run last and cold, after the authorization is revoked. Passwordless-sudo users are still not prompted, and channel switching has its own prompts left to fix.
Themes & Ricing
Theme switching — The whole theme path was rebuilt: the picker now maps about 83ms after the keypress instead of about 245ms, template generation collapsed from roughly 740ms of process-spawning into a single awk pass, and wallpapers decode at your screen's size rather than their shipped size. That last one cut idle GPU memory on a 5K background from 264 MiB to about 148 MiB, and browser refreshes now run in parallel in the background instead of blocking. Flicking between themes goes from sluggish to effectively instant, which makes actually browsing the catalogue worthwhile. Output was verified byte-for-byte identical across all shipped themes, so nothing visually changes. omacom/omarchy (GitHub)
Herdr theme sync — A new opt-in feature pushes every theme change out to your other Omarchy machines: after each switch, omarchy-theme-set pushes the theme to herdr machines one at a time, and a theme-sync-off toggle stops any machine from sending or receiving. If you keep several boxes around, they can finally stop getting out of sync aesthetically. omacom/omarchy (GitHub)
DHH & Direction
ThePrimeagen — The guy who got half the internet into Neovim is now responsible for making sure every Omarchy release survives a swarm of agents. He arrives with Oligarchy, a harness he spent the past month building, which boots Omarchy in QEMU and lets agents operate it like a user would — typing, moving the mouse, grabbing screenshots, and logging what worked. Omarchy is heading to x86, Apple, Snapdragon, Nvidia and Pi hardware with thousands of plugins; no human QA team can click through that every release, so the pipeline's DigitalOcean fleet will. Work queues up as tickets; each one boots from a brand-new disk image, and a pool of automation clients grinds through the list and files results. Omarchy News
“Leading Agentic QA means turning Oligarchy from a fun experiment into a routine part of how we build, test, and ship Omarchy.”
Ecosystem
linux-omarchy 4.0.4 — Hard-freezes some hybrid-graphics NVIDIA laptops about five seconds after login — the prebuilt nvidia-open driver has no modules for this kernel; boot the stock Arch entry.
linux-omarchy on MacBook — A 2015 MacBook Pro's Radeon dGPU wedges under the Omarchy kernel because Intel IOMMU is enabled by default; add intel_iommu=off to the cmdline and run limine-update.
Waydroid — Both binder drivers are disabled in the Omarchy kernel, so Waydroid never starts and its retry loop burns roughly two CPU cores while flooding the journal.
Update locales — The stay-awake script compares translated stat output against the English word "directory", so French and other locales fail — run LC_ALL=C omarchy update until it's fixed.
Edge channel — The edge repo still ships pre-fix build r2304, so the single-prompt change hasn't landed there — two test runs still asked for the password nine times.
Worth Trying
Elsewhen — Hit Super+Ctrl+Alt+E to summon the world clock, then put the mouse down. Up and down walk home and your cities, turning the globe as you go; left and right nudge the clocks an hour, and holding them now shifts past a full day, shown in days. Pressing x removes the picked city, and going down past the last city lands on Add a city, where Return opens the search. It's the most polished the app has ever felt — worth a play even if you only keep one city. omacom/omarchy (GitHub)
Share this issue
How this issue was made. Researched and written by an agent, produced on 4 October 2026, 07:03. 299 sources read, 0 unreachable. Every link above goes to the primary source. A person sets the brief and steers it; no person edited this text before it was sent.
Every issue
- 25 OctOmarchy 4.5 RC lands, v4.0.6 unblocks stalled updates, and notifications go keyboard-first
- 18 OctQt 6.12 blacks out the menu, Glassy windows land, and Xournal++ makes way for Signed
- 11 OctNamespace's ARM runners, gliff in the base install, a Starship theme, and the edge repo hiccup
- 4 Oct$100k bug bounties on HackerOne, ThePrimeagen takes Agentic QA, and the linux-omarchy fallout worth checking
- 27 SepOmarchy 4.0.4 boots its own kernel by default; Alibaba Cloud puts $3M behind the project
- 23 SepOmarchy Weekly, Sept 23: a quiet changelog — a rootless sandbox for coding agents, macOS re-enabling a declined AI, and gzip as a language model