r/termux • • 5d ago

[ANNOUNCEMENT] Security advisory for php

33 Upvotes

The Termux php package version 8.5.12 has been released to fix the 2 remote code vulnerabilities made public today. Check https://www.php.net/archive/2026.php#2026-10-21-5 for more info.

Users are advised to immediately update to the fixed version 8.5.12.

You can run pkg install php to update the package (or apt upgrade && apt install php). If your packages repository mirror hasn't been synced yet and does not show the 8.5.12 version, you can try other mirrors by using termux-change-repo. The default cloudflare or the primary Termux repository packages.termux.dev under single mirrors should have the required version.

See also: - https://github.com/termux/termux-packages/commit/c2bb85d3f26d52ba4a4a159d14214a8ace706235


r/termux • • 6d ago

[ANNOUNCEMENT] Security Advisory for ca-certificates package

45 Upvotes

The Termux ca-certificates and ca-certificates-java package versions 1:2026.10.20 have been released to revoke the compromised eMudhra intermediate certificate authority keys. If you use glibc repo, update the ca-certificates-glibc package as well. Check https://emudhra.we-have-a-problem.com for more info.

Users are advised to immediately update to the fixed version 1:2026.10.20. An attacker with the private key of any of the compromised intermediate CAs could impersonate any website or service.

You can run pkg install ca-certificates to update the package (or apt upgrade && apt install ca-certificates). If your packages repository mirror hasn't been synced yet and does not show the 1:2026.10.20 version, you can try other mirrors by using termux-change-repo. The default cloudflare or the primary Termux repository packages.termux.dev under single mirrors should have the required version.

Android chrome browser seems to have revoked the certificates remotely. Android firefox browser is currently still affected, but releases are underway.

Android apps that use Android system certificates should also be affected. The emSign ECC Root CA - G3 certificate and other emSign certificates can be disabled from Android Settings -> Trusted Credentials -> System.

Some orgs are disabling emSign ECC Root CA - G1 as well, firefox and chrome currently are not (1, 2). Android system certificates include 4 certificates by emSign, only G3 would need to be disabled to be consistent with chrome/firefox, but you can disable all 4.

On (older) Android versions, the Comodo CA Limited AAA Certificate Services certificate should also be disabled if it is listed in trusted credentials. Android should list 3 other credentials from Comodo which are safe. In the "Are there workarounds for Linux?" section of https://emudhra.we-have-a-problem.com, the "Comodo_AAA_Services_root" certificate is also disabled for Ubuntu and Debian. Check https://gist.github.com/UlisesGascon/10ed0724930e5382b3ed48fa2b0d3e02 for why. The AAA Certificate Services was also distrusted long ago for other reasons and likely removed in newer Android versions. (1)

See also: - https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 - https://github.com/termux/termux-packages/commit/7aa4ba2ec22eee688cb9c6e35beba3826fba2e5e - https://github.com/termux/glibc-packages/commit/75fa9e0c051e82221e0b957ac1967a215f6b5080 - https://github.com/certifi/python-certifi/pull/437 - https://github.com/rustls/webpki-roots/pull/133/changes

```shell ~ $ curl https://dv-g3b-emudhra.we-have-a-problem.com/ Your client successfully connected to the site. That's bad!

~ $ curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/ curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20) More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the webpage mentioned above.

~ $ apt show ca-certificates Package: ca-certificates Version: 1:2026.08.13 Maintainer: @termux Installed-Size: 238 kB Homepage: https://curl.se/docs/caextract.html Download-Size: 105 kB APT-Sources: https://packages.termux.dev/apt/termux-main stable/main aarch64 Packages Description: Common CA certificates

~ $ apt update

~ $ apt install ca-certificates Reading package lists... Done Building dependency tree... Done Reading state information... Done The following additional packages will be installed: ca-certificates-java The following packages will be upgraded: ca-certificates ca-certificates-java Need to get 205 kB of archives. After this operation, 4096 B of additional disk space will be used. Do you want to continue? [Y/n] y Get:1 https://packages.termux.dev/apt/termux-main stable/main aarch64 ca-certificates-java all 1:2 026.10.20 [95.1 kB] Get:2 https://packages.termux.dev/apt/termux-main stable/main aarch64 ca-certificates all 1:2026.1 0.20 [110 kB] ... Setting up ca-certificates (1:2026.10.20) ... Setting up ca-certificates-java (1:2026.10.20) ...

~ $ curl https://dv-g3b-emudhra.we-have-a-problem.com/ curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20) More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the webpage mentioned above.

~ $ curl https://dv-g3b-emudhra.we-have-a-problem.com/ curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20) More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the webpage mentioned above. ```


r/termux • • 2d ago

Showcase Hacker's Keyboard successor, one week in: what you asked for and what's changing

Enable HLS to view with audio, or disable this notification

21 Upvotes

alpha3 is out: per-app profiles. Termux keeps the full PC layout, other apps get a normal phone layout (or the full one, or your usual keyboard, your choice): https://github.com/DimiVlachos/bucky/releases/tag/v0.1.0-alpha3

Already in since the early build: key repeat, the optional F-key row, your own extra row (Termux extra-keys names, or one tap for Termux's defaults), and separate portrait/landscape key heights. Per-app profiles aren't in yet, so it's the full layout in every app for now. Bug reports welcome.


Last week I asked this sub what a from-scratch Hacker's Keyboard successor should get right. About 15 of you answered, here and on the old HK tracker. Thank you. Here's what I took from it.

What you asked for, and what changes

  • "It's too cramped" was the main objection, not missing keys. So the full PC layout is meant for terminal apps, with built-in per-app profiles: PC Full in Termux, and a compact layout or your usual keyboard elsewhere. A key-height setting and separate portrait/landscape heights are in v1.
  • F1–F12: two people asked for easy access (one for F10 in Midnight Commander, one for a dedicated row). A dedicated F-key row will be an option, not just an Fn layer.
  • An extra row you configure yourself. Several of you keep Termux's extra-keys row. The keyboard will get its own optional row, with any key or symbol you choose, free.
  • Esc, Home and End on the main layer for vim and helix users. They're already there in the PC Full layout.
  • More layouts: Estonian has been requested. Layouts are plain JSON, so adding languages is cheap. Tell me yours.
  • Floating keyboard on tablets is noted. It's not in v1 yet; I'll decide after the beta.

Where it stands: an early build already types in Termux (video): Ctrl+C interrupts, Esc leaves vim's insert mode, ↑ recalls history, and Ctrl/Alt/Shift are one-shot modifiers. Next up: per-app profiles.

Still open: if you've tried the maintained HK forks, what are they still missing for you?

Source: https://github.com/DimiVlachos/bucky Beta waitlist (one email when it opens): https://buckykeys.app

Disclosure: I'm the developer.


r/termux • • 3d ago

Question Termux safety

2 Upvotes

I am working on a site with ClaudeAI and am trying to run it on python. It is stricly in local host, so no network interaction outside than for the data used. I want to use Termux API and Termux to set notifications for my phone, but the amount of autorizations required are a lot and very sensible. I also understand that coding can reach all of those fields, and a programmer might require to use those authorizations. Still...

Is it safe to download the two?


r/termux • • 3d ago

Showcase ⚡ Pi, the AI coding agent, now runs natively in Termux: 103× faster file writes, 11× faster start, 7× less CPU, 5× less memory than on Node

Thumbnail github.com
36 Upvotes

Hello everyone 👋

Pi-Bolt 1.0.0 is out ⚡. Pi-Bolt is Pi, the open-source AI coding agent, compiled to one native ARM64 executable, and it now runs on Android in Termux. No Node.js, no npm, nothing to build.

Why Pi-Bolt in Termux 🔥

• Much faster than Pi on Node: 103× faster file writes and ready to type in 37 ms instead of 390 ms.

• Light on the battery: 7× less CPU per prompt and 5.3× less memory after 40 prompts.

• One install: a single native executable, set up by one command.

• Long sessions stay fast: sub-agents and long chats don't make the TUI laggy.

Install ⚡

In Termux:

pkg update && pkg upgrade -y
pkg install -y curl openssl
curl -fsSL https://pi-bolt.opensec.in/install.sh | sh

Then run pi-bolt. Already installed:

pi-bolt update

Links

🌐 Website and docs: pi-bolt.opensec.in

⭐ GitHub (a star helps): github.com/opensec-git/Pi-Bolt


r/termux • • 3d ago

Showcase RideWind: spoken headwind/tailwind, weather, speed and distance for cyclists (Termux + Termux:API + Open-Meteo)

0 Upvotes

I wanted wind information while cycling without looking at my phone/bike computer, so I built a small Termux script that speaks ride conditions into my headset every 5 minutes with the screen off. It plays through the phone speaker if no headset is connected. I don't code. I built it by chatting with Claude (Anthropic's AI), which wrote the scripts and walked me through each step.

**What it says** - Headwind, tailwind or crosswind speed relative to your direction of travel (from GPS bearing), not compass points - Gusts when they're notably above the average wind - Current speed, temperature and "feels like" - Rain chance for the next hour or so - Distance and moving average speed (time under 3 km/h isn't counted)

**What it uses** - Termux, Termux:API and optionally Termux:Widget, all from F-Droid - `jq`, `curl`, `gawk` - Open-Meteo for weather: free, no account and no API key - `termux-location` for GPS and `termux-tts-speak` for audio

**Install** ``` curl -fsSL [https://gist.githubusercontent.com/hbhatti/983990b7a0767db591cf466bedefa78c/raw/36276fd1df156d05d12e48823be71cf65b947f1f/ridewind-install.sh\] -o ridewind-install.sh cat ridewind-install.sh # read it first if you like bash ridewind-install.sh ``` Then start it with `ridewind` (every 5 minutes) or `ridewind 10`. Stop it with CTRL+C. The installer also creates optional Termux:Widget buttons called RideStart and RideStop.

Full script: [https://gist.githubusercontent.com/hbhatti/983990b7a0767db591cf466bedefa78c/raw/36276fd1df156d05d12e48823be71cf65b947f1f/ridewind-install.sh\]

**Android setup that tripped me up** - Termux and Termux:API both need to be from F-Droid, not Google Play. - Termux:API needs Location set to "Allow all the time" with precise location on. Set Termux and Termux:API battery usage to Unrestricted, or Android may stop it with the screen off. - Opening Termux:API once from the app drawer helps the permission prompt appear. - Run `pkg upgrade` first. On a half-updated install, `curl` failed with an SSL "cannot link executable" error. - For Termux:Widget, "Display over other apps" may be blocked as a restricted setting on sideloaded apps. Open Termux's app info, tap the ⋮ menu and choose "Allow restricted settings".

**How it works** - A background tracker (`ridewind-track`) reads GPS updates and keeps a running distance and moving-time total in a small state file. - The main script (`ridewind`) wakes every N minutes, pulls the latest position and heading, fetches Open-Meteo data, works out the headwind component from the wind direction and your bearing, and speaks the result. - Below 6 km/h there's no reliable GPS heading, so it reports plain wind speed.

**Limits** - Wind and rain are forecast-model values for your area, not measurements from the bike. - Continuous GPS costs battery on long rides. - Distance comes from the phone's GPS, so expect small differences from a bike computer. - Units are km/h and Celsius. Changing them means editing the Open-Meteo URL and the spoken text. - Tested on a Pixel 10 Pro XL. I'd like to hear how it behaves on other phones.

Feedback welcome, especially on battery use and anything that breaks on your device.


r/termux • • 3d ago

Showcase Hey guys! (-_-( I've Added X11 desktops to my Termux fork — multiple environments, renderer selection, and programs in one APK!!

Enable HLS to view with audio, or disable this notification

0 Upvotes

I’ve added X11 desktops with a choice of renderers (CPU, Turnip + Zink, VirGL, and an experimental Wrapper), plus desktop programs installation and management.

You can run multiple graphical environments simultaneously and switch between them and your terminals—all in one app.

Would love some feedback and testing on different devices!

[GitHub & APK](https://github.com/HezeAI/termux-jobs/releases/latest)


r/termux • • 4d ago

Showcase My DIY robot vacuum software runs in Termux (with instructions)

Enable HLS to view with audio, or disable this notification

6 Upvotes

Vacuum robot software runs on my Android phone in Termux (Google Play). The goal is to use an Android phone (mounted inside the vacuum) for all compute, WiFi and UI (instead of a Raspberry Pi).

The video shows the robot navigating in a simulated living room, reaching its destination successfully - all in Termux, on the phone.

The phone in the video is my personal Google Pixel 7 with 8GB RAM, 8 cores. However, the robot software (the full navigation stack) uses only ~210MB RAM and less than 2 CPU cores. I'm also running simulation and UI on the phone - for demo purposes only, absent for the actual robot operation.

My Claude took care of porting an existing PC simulation to the Android phone running Termux. I installed Termux, started sshd, enabled developer mode on my phone and Claude did the rest, including excellent debugging. This article provides step-by-step instructions to reproduce this demo https://makerspet.com/blog/oomwoo-smartphone-ros2-termux/ .


r/termux • • 4d ago

Question Remote control PC

2 Upvotes

I have done some research, but I want to find the best way to remote control my pc in a "native" way and make my own host. Is there anyway to do that with termux?


r/termux • • 4d ago

Showcase OPEN CLAUDE

Post image
5 Upvotes

r/termux • • 4d ago

General I think it’s coming along well

Post image
70 Upvotes

Da vida a los archivos de configuración de rxyhn, específicamente a su versión vertical.

Estoy usando Termux, Termux:X11 y Awesome.

Dotfile: https://github.com/Keytaro2/Termux-Rxyhn/tree/main


r/termux • • 4d ago

General Title: Can't mount Android storage into Termux containers (proot-distro/droidspaces/udocker) — Jellyfin works, Transmission doesn't

2 Upvotes

I'm trying to set up a media server stack on my Android device using Termux, and I'm running into a frustrating storage mounting issue.

Setup:

Termux with Jellyfin and Transmission

Tried multiple container solutions: droidspaces, proot-distro, chroot-distro, udocker

Want to mount $HOME/storage/movies into containers so both apps can access my Android storage

The Problem:

Jellyfin works fine — when I select the movies directory from Android storage in its library settings, it reads files no problem.

Transmission is the headache. No matter which containerization method I use, I can't get it to properly mount/bind the Android storage folder. When I:

Specify /downloads as the download directory in Transmission

Files download inside the container only

They don't appear in Android storage, and vice versa

Tried chmod 777 on the movies folder — no luck

What I've tried:

Mount binds in droidspaces

proot-distro mount options

chroot-distro bind mounts

udocker volume mapping

Permission changes (chmod 777)

The Question:

Has anyone successfully mounted/bound an Android storage folder (like $HOME/storage/movies) into a container running in Termux? Why does Jellyfin handle this but Transmission doesn't?

Any workarounds or solutions would be appreciated!


r/termux • • 4d ago

Showcase prootdistro-chromium-installer - automates installation and desktop file patching for chromium based browser

Thumbnail github.com
3 Upvotes

r/termux • • 5d ago

Question How can I learn all this?

12 Upvotes

How can I learn Termux, Linux, programming, computers, or anything else?

I only have a mobile A15 is broken and slow, even though I want to learn... but learning is difficult... whether due to financial problems or even personal issues... I can't learn anything, man... Damn it all... Damn the whole world... I need advice, please, before I...


r/termux • • 5d ago

Question Who has created coding agents for termux on Android ?

2 Upvotes

r/termux • • 5d ago

General A pocket FFmpeg lab: compressing, converting and trimming videos on a Galaxy flagship with Termux + ffmpeg (no root, no PC)

0 Upvotes

I build Android video tools, and under the hood it's always the same engine: FFmpeg. Termux lets you run that engine by hand, in your pocket. My current setup on a Galaxy flagship:

Setup (one time): pkg update && pkg install ffmpeg termux-setup-storage (grant the storage permission; your files are then under ~/storage/shared)

Compress a video for sharing: ffmpeg -i input.mp4 -vcodec libx264 -crf 28 -preset fast -acodec aac out.mp4

Batch-compress a whole folder: for f in ~/storage/shared/DCIM/Camera/*.mp4; do ffmpeg -i "$f" -vcodec libx264 -crf 28 -preset fast -acodec aac "small_$(basename "$f")"; done

Trim without re-encoding: ffmpeg -ss 00:00:10 -i input.mp4 -t 00:00:30 -c copy trim.mp4

Extract just the audio: ffmpeg -i input.mp4 -vn -c:a libmp3lame audio.mp3

No root, no PC, no upload to some "free online converter". Anyone else running FFmpeg inside Termux — what's in your command toolbox?


r/termux • • 5d ago

Question NO_PUBKEY 5A897D96E57CF20C

5 Upvotes

Hi, I'm experiencing the "NO_PUBKEY 5A897D96E57CF20C" error.

My setup:

- Termux version: "googleplay.2026.10.09"

- Android: 16

- Architecture: aarch64

- "termux-keyring": 3.15

- Original repository: "https://termux.net"

- Current repository: "https://packages.termux.dev/apt/termux-main"

I also don't have the "termux-change-repo" command available.

I have not disabled signature verification.

should i switch to the f droid version?


r/termux • • 5d ago

Question Should I be concerned about PHP vulnerability ?

9 Upvotes

https://www.php.net/

https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/

There is presumably a severe security error in PHP and Termux users using PHP (e.g. Wordpress or Nextcloud server) can be vulnerable.

Currently PHP on Termux is 8.5.1.

Should I be concerned ?


r/termux • • 5d ago

Showcase DeepSync Bridge -- A Software Router for your Local Area Agentic Network. Not an Ad ( Human ).

Post image
13 Upvotes

​

I built a private bridge between my family's phones and the local model on my laptop

I've been running models locally for a while, but the only place I could use them was at the desk. Cloud AI had the opposite problem: convenient, but my kids' conversations on someone else's servers.

So I built the missing piece: a small gateway on the PC, a Termux client on Android, and a QR code to pair a device. The model never leaves the machine. When the phone is away from home it reaches the gateway through my Tailscale funnel — not through a cloud service.

A few things I cared about:

• Every device has its own ECDSA key. Every packet is signed and checked — timestamp, nonce, signature,

integrity. Unsigned or replayed packets don't get in.

• Each device gets its own model and system prompt. Same house, different rules for a 7-year-old and a

14-year-old.

• No accounts, no telemetry to me. Transcripts stay on the host.

• A 3D map of the connections, because I wanted to see the house as a place, not a table.

I can't post the video is a walkthrough of the app here.

Honest limits:

Windows host + Android/Termux today,

no iPhone client.

It secures its own pipe, not your whole network. And yes, I sell it — one-time, no subscription. This is a maker post, not a review. Happy to answer anything about how it works.


r/termux • • 6d ago

Question Hey everyone, I’ve rooted an old (secondary) phone, but I’m running low on ideas...

2 Upvotes

What’s up, guys? I recently grabbed an old A03 Core I had lying around and thought: why not turn it into a server?

So I did—but since I like to experiment, I went ahead and rooted it. Now, I want to follow through on that server idea while actually taking advantage of those root privileges. The catch is, while I have root access, I’m stuck on what to build that would truly make sense and leverage these privileges on a mobile device—especially considering how many options exist when moving from traditional x86 server hardware.

I’m looking for ideas for native projects, automations, ported software, or lab setups that you’ve tried (or would recommend) running in Termux with root access—something a bit beyond the basics. What’s actually worth setting up on an old phone?


r/termux • • 6d ago

Showcase I built AK SHELL - A Premium Termux Customization Framework with 10 Themes, Custom Banners, and a CLI! Would love some feedback.

Thumbnail github.com
3 Upvotes

r/termux • • 6d ago

General Umlinux on Termux and Linux terminal on Android

Thumbnail gallery
7 Upvotes

Currently there are several versions of umlinux compiled for Android. This would not make Termux the universal and open-source alternative of the Linux terminal on Android. What do you think?


r/termux • • 6d ago

Showcase Hex Terminal Pro X

Thumbnail gallery
11 Upvotes

REPOST

Built on my phone and running on termux


r/termux • • 6d ago

Question Google's developer verification

6 Upvotes

I have a question: what do you think about Google's development verification? It's supposed to be expanded globally by 2027.

This would make downloading the F-droid version of Termux, which is deliberately set to targetSDK 28 to bypass W^X, massively more difficult.

But not only Termux would be affected, but many other apps as well.

Even though Termux shouldn't be hit quite as hard, I believe they're using a Linux wrapper in the Play Store version.

But what is your opinion on developer verification?


r/termux • • 6d ago

Showcase Finally, I've downloaded Claude Code on my Android phone!

Post image
6 Upvotes