diff --git a/content/en/docs/releasenotes/studio-pro/9/9.24.md b/content/en/docs/releasenotes/studio-pro/9/9.24.md
index fe70d8fda77..5ea4d9f9bf5 100644
--- a/content/en/docs/releasenotes/studio-pro/9/9.24.md
+++ b/content/en/docs/releasenotes/studio-pro/9/9.24.md
@@ -13,6 +13,40 @@ lts: true
 This is the [LTS](/releasenotes/studio-pro/lts-mts/#lts) version 9 release for apps in production.
 {{% /alert %}}
 
+## 9.24.44
+
+**Release date: August 19, 2026**
+
+{{% button color="info" href="https://marketplace.mendix.com/link/studiopro/9.24.44" text="Go to Marketplace" title="Download version 9.24.44 from the Marketplace" %}}
+
+### Improvements
+
+* We improved the security of the module import process by validating the file paths declared in an MPK package before extraction. Packages containing paths that traverse outside the app directory or target protected directories (such as `.git`, `deployment`, or `releases`) are now rejected with an error.
+* We fixed a bypass in the extraction-time path filter where non-canonical ZIP entry names (for example, paths containing `..` segments) evaded the protected-subtree check. Entry names are now canonicalized before filtering.
+* We added support for the following database versions:
+    * MariaDB 12.3
+    * MySQL 9.7
+* We updated the .NET Runtime to version 10.0.7.
+* We added a confirmation dialog when enabling anonymous user access in App Security, warning that unrestricted anonymous roles may expose data unintentionally.
+* We now delete the log files generated by Studio Pro that are older than seven days.
+
+### Fixes
+    
+* We upgraded Jetty dependencies to fix CVE-2026-2332. (Tickets 277670, 281968)
+* We upgraded Netty dependencies to fix CVE-2026-42578, CVE-2026-42583, CVE-2026-42587, CVE-2026-42585, CVE-2026-42584, CVE-2026-42581, CVE-2026-42580, CVE-2026-41417, CVE-2026-42577, CVE-2026-42579. (Tickets 278202, 278290, 277691, 278290)
+* We fixed an issue where files with `%` in the filename could not be downloaded, which caused incorrect *File could not be found* errors. (Ticket 281292)
+* On SQL Server, when a unique constraint or foreign key constraint is dropped, we now use `IF EXISTS`. This avoids an automatic rollback of the synchronization transaction in case the constraint does not exist. (Ticket 279545)
+* We fixed an issue in the **Call web service** activity and in consumed OData services that consume services using OData version 3. The XML parser now rejects DTD declarations and external entities because a compromised server might exploit those features.
+* We fixed an issue where publishing a microflow in a new a REST service allowed adding that service to read-only modules such as the System module.
+* We fixed an issue where local file storage does not use optimal directory structure.
+
+
+### Deprecations
+    
+* We dropped support for the following database versions that are no longer supported by the vendors:
+    * PostgreSQL 13
+    * MariaDB 10.6
+
 ## 9.24.43
 
 **Release date: May 13, 2026**