Prusa Research emailed customers about 15 printer models on Oct. 30, asking them to install firmware 7.0.0 “as soon as possible” after a responsible security report. The email is genuine, and any newer build counts, including the 8.0.0 release that has been on Prusa’s firmware download page since Oct. 22.
The Prusa firmware 7.0.0 security update covers the CORE One family including INDX, the XL and XL+, the MK4/MK4S, the MK3.9 and MK3.5 upgrades, and the MINI. Prusa says it is not aware of any real-world exploitation, and a detailed security advisory plus the full source code are due on Nov. 2.
Table of Contents
- Prusa Firmware Versions That Include the Security Fix, by Model
- Is the Prusa “PRUSA PRO” Firmware Email a Phishing Scam?
- What Prusa Firmware 7.0.0 Means for MK4, CORE One, XL and MINI Owners
- Why Prusa Is Holding Back the Firmware 7.0.0 Source Code
- Prusa Firmware 7.0.0 Security Update FAQ
- What We Still Don’t Know About the Prusa Firmware 7.0.0 Vulnerability
Prusa Firmware Versions That Include the Security Fix, by Model
The fix shipped quietly weeks before the email. Each listed model already has two patched builds to choose from.
| Prusa security firmware (as of Oct. 31, 2026) | First patched build | Newest build |
|---|---|---|
| CORE One, CORE One+ (Gen 2) | 7.0.0, Oct. 5 | 8.0.0, Oct. 22 |
| CORE One L, CORE One L+ | 7.0.0, Oct. 5 | 8.0.0, Oct. 22 |
| CORE One INDX, CORE One+ (Gen 2) INDX | 7.0.0, Oct. 15 (7.0.1 on Oct. 19) | 8.0.0, Oct. 22 |
| XL, XL+ | 7.0.0, Oct. 15 | 8.0.0, Oct. 22 |
| MK4, MK4S, MK3.9, MK3.9S | 7.0.0, Oct. 15 | 8.0.0, Oct. 22 |
| MK3.5, MK3.5S | 7.0.0, Oct. 15 | 8.0.0, Oct. 22 |
| MINI, MINI+ | 7.0.0, Oct. 15 | 8.0.0, Oct. 22 |
| Not on the list | MK3S+ (separate firmware line, newest 3.14.1 from Nov. 28, 2024) | — |
| Advisory and source code | Promised for Nov. 2, 2026 | — |
The CORE One INDX changelog for 7.0.0 never says “security fix” outright. The only hint is one line under Fixes: “Improved security and robustness.”
Is the Prusa “PRUSA PRO” Firmware Email a Phishing Scam?
No. Several r/prusa3d readers flagged it as malware bait, and the red flags were real:
- A PRUSA PRO banner, even though the MK4 and MINI are consumer machines.
- A download button routed through a HubSpot tracking link (one reader posted the dkjnv004.eu1.hubspotlinks.com domain).
- It pushed 7.0.0 when 8.0.0 was already out.
- One reader got it at an address that was never registered with Prusa.
A Prusa staff member confirmed the email on Reddit as “legitimate but not well executed from our side.” The PRO template likely came from business mailings, the tracking link “appears very scammy,” and the text “should have said 7.0.0 or newer.”
My advice is the boring one. Skip the email button and type prusa3d.com into your browser yourself. Treat the next “urgent firmware” email the same way, because this real one looked a lot like a fake.
What Prusa Firmware 7.0.0 Means for MK4, CORE One, XL and MINI Owners
Already on 8.0.0? You’re covered. No action needed.
Still on 6.x? 7.0.0 is the minimum, but it’s a big feature release too. On the CORE One INDX, the 7.0.0 changelog adds filament color support, tool mapping presets, a Runout Reaction setting and a “new versioning policy.”
One XL owner in the thread said their machines misbehave on anything newer than 6.2.6 and they can’t afford the downtime. If you run printers for income, update one machine first and watch it for a day.
CORE One INDX owners: skip plain 7.0.0. Version 7.0.1 fixed a freeze on the “Tool offset sensor: ready” startup screen, so pick 7.0.1 or later.
LAN-only PrusaLink users: one owner asked if a printer that only talks to the local network is safe without the update. Prusa hasn’t said which interface the bug sits in, so nobody outside the company can answer that yet. My read: if the printer is on any network, update now. Waiting for the advisory is a bet.
MK3S+ owners: your printer isn’t on the list. It runs a separate firmware line that last updated in November 2024.
Shopping for a CORE One? Prusa shipped the patch first and promised a public advisory, which is the right order. If you’re weighing it against Bambu, our Prusa CORE One vs Bambu Lab P2S comparison covers the bigger trade-offs. Black Friday offers on both brands are collected in our Black Friday 3D printer deals roundup.
Why Prusa Is Holding Back the Firmware 7.0.0 Source Code
For many owners, open firmware is part of the appeal of paying Prusa prices, alongside upgrades like the new HT hotend for the CORE One. That’s why the gap stings.
As of Oct. 31, the newest code on Prusa’s GitHub releases page is 6.10.3 for the XL and 6.9.2 for the INDX. Neither 7.0.0 nor 8.0.0 has been published there, even though 7.0.0 binaries have been out since Oct. 5.
Prusa staff say all pending source drops land Monday, Nov. 2. Beyond tying the source release to the Nov. 2 advisory, Prusa hasn’t explained the delay. The usual community explanation is that it buys owners time to patch before the bug becomes public.
Some owners don’t buy it. One commenter pointed out that attackers can compare old and new binaries (“patch diffing”) just as fast as they can read source. My read: they have a point, and the email made it worse. A vague, scam-looking notice that didn’t explain the risk gave owners little reason to update quickly.
Prusa Firmware 7.0.0 Security Update FAQ
Do I need firmware 7.0.0 if I already have 8.0.0?
No. A Prusa staff member said any version from 7.0.0 up is fine, and 8.0.0 is now listed for every printer on the list, with files dated from Oct. 22.
What happens if I don’t update my Prusa firmware?
There are no known attacks so far, according to the company. The specific risk stays private until the advisory goes public on Nov. 2.
How do I check if my Prusa firmware is up to date?
Compare the version on your printer with your model’s entry on Prusa’s official download page. Anything at 7.0.0 or above, including 8.0.0, has the fix.
What We Still Don’t Know About the Prusa Firmware 7.0.0 Vulnerability
- What the bug is, and whether it’s reachable over PrusaLink, Prusa Connect, Wi-Fi or a USB file.
- How severe it is, and whether it will get a CVE number.
- Whether Prusa will backport the fix to anyone who has to stay on 6.x.
- Why the MK3S+ is left off: different code, or simply out of scope.
The advisory due Monday should answer most of these. Until then, updating is the cheap insurance.
