Totara 2.2.7 is a "security" release, because it includes important fixes for two potential security vulnerabilities. We recommend upgrading your site to this release. Here's the 2.2.7 changelog:

Release 2.2.7 (11 October 2012):
==================================================

Security fixes:
    T-9998      Fix open redirect security issues
    T-9998      Enforce file size and quota limits in user private files

Improvements:
    T-9927      Improve layout of program assignment time allowance dialog

Bug fixes:
    T-10011     Fix hardcoded, English-only date formats in certificates
    T-10010     Rename column 'delete' to 'deleted' in totara_sync
    T-9999      Fixed the syncing of hierarchy descriptions in totara_sync
    T-10008     Fix mySQL duplicate temporary table problem in totara_sync
    T-9992      Fix completion duplicate records issue by applying MDL-32107
    T-9945      Fix cell padding styles in html tables
    T-10013     Fix layout and fonts of 'My Team' and related embedded reports
    T-10001     Fix CLI (command line) upgrades
    T-9978      Fix storage and display of Hierarchy textarea & file custom fields
    T-9674      Fix link in Facetoface manager request task
    T-10000     Fix MSSQL error when submitting Learning Plan for approval

Also released today is a "snapshot" release of Totara 1.0.39. There are no critical security fixes in this release, just a normal collection of bug fixes and improvements. Here's the 1.0.39 changelog:

Release 1.0.39 (11 October 2012):
==================================================

Database upgrades:
    T-9963      Fix to ensure oninfo field is added to database in totara_msg module

Improvements:
    T-9796      Reportbuilder: Support defaultuserrole in report access restrictions

Bug fixes:
    MDL-35201   Backport course reset capability fix from 2.x to 1.9
    T-10011     Fix hardcoded, English-only date formats in certificates
    T-9793      Fix SCORM activity completion when using view criteria
    T-9539      Remove unnecessary image files from mod/certificate
    T-9942      Fix html appearing in page titles
    T-9933      Fix bug when language string contains quote in hierarchies
    T-9908      Fix cron sending messages to deleted users
    T-9909      Fixes for the basic hierarchy filters
    T-9756      Remove facetoface custom field as default column option in Reportbuilder
    T-9902      Fix logic error in hierarchy filters
    T-9767      Fix date filters in Course Completions report
    T-9787      Fix SCORM popup display issues