- CVE-2026-53783: harden the support/rrsync wrapper: refuse paths that resolve outside the restricted directory, refuse -L/-k/-K and --copy-unsafe-links there, hand the transfer arguments and the receiver's directory options to rsync as held directories, stop path arguments being parsed as options, open rrsync.log without following a symlink; add --drop-D so a restricted receiver does not create devices or special files, and --confine-root so rsync refuses names that leave the restricted directory, including --files-from lines and merge files - CVE-2026-53802: open the daemon secrets file, the client --password-file, --files-from and the --filter merge / per-directory merge files refusing attacker-planted symlinks -- confined beneath the module root on a daemon, owner-trust walk otherwise; secrets and password files are checked with fstat() of the opened fd; /dev/fd, /dev/stdin and <(...) keep working