Go 1.26.9 patches the toolchain, TLS, and HTTP

Go 1.26.9 was released on 8 October 2026. The Go team’s release history describes it as a security update for the go command and for crypto/tls, html/template, net/http, net/textproto, and os. It also carries bug fixes in the compiler, the linker, the runtime, vet, and the crypto/mlkem, net/http, and os packages.

That list is the whole point of a patch release. Go 1.26 itself came out in February. The .9 build does not ask you to adopt a new language version. It asks you to replace the toolchain and rebuild, because several of the fixes sit in libraries almost every server imports. net/http and crypto/tls are not optional for a service that terminates HTTPS. html/template matters anywhere HTML is rendered from data. The go command matters on the machines that build those services, not only on the ones that run them.

The release notes point at the 1.26.9 milestone for the individual issues. That is the right place to match a scanner finding to a fix. The announcement itself is enough to justify a rebuild: if you are on 1.26 and you are not on 1.26.9, you are behind the current security fixes for that line.

A few of the same packages appear on both the security list and the bug-fix list. That usually means one change closes a vulnerability and another changes behavior that was simply wrong. Read the milestone before you assume a test failure is unrelated. Then ship the toolchain. Patch releases in Go are the boring kind of emergency, which is the kind worth doing the same day.