diff --git a/replica-releases/0c121276f3156e97de98151d5f6bec6b73695f9f.md b/replica-releases/0c121276f3156e97de98151d5f6bec6b73695f9f.md
new file mode 100644
index 000000000..71b03552e
--- /dev/null
+++ b/replica-releases/0c121276f3156e97de98151d5f6bec6b73695f9f.md
@@ -0,0 +1,113 @@
+Release Notes for [release-2026-07-23\_04-21-security-hotfix](https://github.com/dfinity/ic/tree/release-2026-07-23_04-21-security-hotfix) (`0c121276f3156e97de98151d5f6bec6b73695f9f`)
+=======================================================================================================================================================================================
+
+This release is based on changes since [release-2026-07-17\_04-19-base](https://dashboard.internetcomputer.org/release/a268b428dde2317819a15f5ab9123ffa3b9719e9) (`a268b428dde2317819a15f5ab9123ffa3b9719e9`).
+
+Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image.
+Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.
+
+To see a full list of commits added since last release, compare the revisions on [GitHub](https://github.com/dfinity/ic/compare/release-2026-07-17_04-19-base...release-2026-07-23_04-21-security-hotfix).
+
+Features:
+---------
+
+* [`badfe77fe`](https://github.com/dfinity/ic/commit/badfe77fe) Core Protocol: Add canister creation timestamp to state tree ([#10846](https://github.com/dfinity/ic/pull/10846))
+* [`b3369fa04`](https://github.com/dfinity/ic/commit/b3369fa04) Core Protocol(orchestrator): Make Orchestrator's `get_replica_version` method a thin wrapper... ([#10857](https://github.com/dfinity/ic/pull/10857))
+* [`4f207632b`](https://github.com/dfinity/ic/commit/4f207632b) Core Protocol: Enable flexible HTTP outcalls on free and system subnets ([#10829](https://github.com/dfinity/ic/pull/10829))
+* [`c0c7b29a6`](https://github.com/dfinity/ic/commit/c0c7b29a6) Core Protocol: Consult the standard engine replica version. ([#10840](https://github.com/dfinity/ic/pull/10840))
+* [`06ef48cbe`](https://github.com/dfinity/ic/commit/06ef48cbe) Core Protocol: Migrate HTTP/ECDSA outcall cycles in SubnetMetrics from scaler to per-use-case map ([#10844](https://github.com/dfinity/ic/pull/10844))
+* [`f3102e547`](https://github.com/dfinity/ic/commit/f3102e547) Core Protocol: Set subnet size and cost schedule of HTTP outcalls context ([#10761](https://github.com/dfinity/ic/pull/10761))
+* [`b2a723e03`](https://github.com/dfinity/ic/commit/b2a723e03) Core Protocol: migrate hpke 0.12 -> 0.13 ([#10833](https://github.com/dfinity/ic/pull/10833))
+* [`cd72dfed4`](https://github.com/dfinity/ic/commit/cd72dfed4) Core Protocol: Free subnets can spend more than their allowance on HTTPS outcalls ([#10692](https://github.com/dfinity/ic/pull/10692))
+* [`a4eb8fc54`](https://github.com/dfinity/ic/commit/a4eb8fc54) Core Protocol: new canister setting status\_visibility ([#10667](https://github.com/dfinity/ic/pull/10667))
+
+Bugfixes:
+---------
+
+* [`05ffe2bd5`](https://github.com/dfinity/ic/commit/05ffe2bd5) Core Protocol: Populate file group chunks cache correctly ([#10861](https://github.com/dfinity/ic/pull/10861))
+* [`09b80e8fa`](https://github.com/dfinity/ic/commit/09b80e8fa) Core Protocol: Validate summary blocks while halted ([#10860](https://github.com/dfinity/ic/pull/10860))
+* [`54f381972`](https://github.com/dfinity/ic/commit/54f381972) Core Protocol: account for Schnorr/VetKd/dropped-message cycles in consumed\_cycles gauge ([#10794](https://github.com/dfinity/ic/pull/10794))
+* [`de1a21039`](https://github.com/dfinity/ic/commit/de1a21039) Core Protocol: avoid double counting deleted canisters in SubnetMetrics::consumed\_cycles\_total ([#10842](https://github.com/dfinity/ic/pull/10842))
+
+Performance improvements:
+-------------------------
+
+* [`8ddc7ab1b`](https://github.com/dfinity/ic/commit/8ddc7ab1b) Core Protocol(state\_manager): Compute the manifest concurrently with validation ([#10798](https://github.com/dfinity/ic/pull/10798))
+* [`5566840e5`](https://github.com/dfinity/ic/commit/5566840e5) Core Protocol(state\_manager): Flush large writes from background `syncfs` thread ([#10777](https://github.com/dfinity/ic/pull/10777))
+
+Chores:
+-------
+
+* [`1153c70d9`](https://github.com/dfinity/ic/commit/1153c70d9) Core Protocol: Add `cost_http_request_v2` parameter sanity check ([#10866](https://github.com/dfinity/ic/pull/10866))
+* [`937e5ff41`](https://github.com/dfinity/ic/commit/937e5ff41) Core Protocol: replace deprecated backoff with backon ([#10848](https://github.com/dfinity/ic/pull/10848))
+* [`543f2998d`](https://github.com/dfinity/ic/commit/543f2998d) Core Protocol(Core): Limit wasm locals #2 ([#10816](https://github.com/dfinity/ic/pull/10816))
+* [`9d676829a`](https://github.com/dfinity/ic/commit/9d676829a) Core Protocol: deduplicate prost crates ([#10804](https://github.com/dfinity/ic/pull/10804))
+* [`3050e83ae`](https://github.com/dfinity/ic/commit/3050e83ae) Core Protocol: bump rust to 1.97.1 ([#10796](https://github.com/dfinity/ic/pull/10796))
+* [`7e30e51b6`](https://github.com/dfinity/ic/commit/7e30e51b6) Node: Clean up guest\_disk migrations ([#10856](https://github.com/dfinity/ic/pull/10856))
+* [`5a56f047c`](https://github.com/dfinity/ic/commit/5a56f047c) Node: Update Base Image Refs [2026-07-21-0146] ([#10841](https://github.com/dfinity/ic/pull/10841))
+* [`addcfc77b`](https://github.com/dfinity/ic/commit/addcfc77b) Node: Update Base Image Refs [2026-07-18-0144] ([#10820](https://github.com/dfinity/ic/pull/10820))
+
+Refactoring:
+------------
+
+* [`8416bac23`](https://github.com/dfinity/ic/commit/8416bac23) Core Protocol: applying ingress induction debit after cleanup callback execution ([#10858](https://github.com/dfinity/ic/pull/10858))
+
+Tests:
+------
+
+* [`6c54d25d5`](https://github.com/dfinity/ic/commit/6c54d25d5) Core Protocol: extract loopback accept-queue-saturation helper into ic-test-utilities-net ([#10814](https://github.com/dfinity/ic/pull/10814))
+* [`b2ec0e0ea`](https://github.com/dfinity/ic/commit/b2ec0e0ea) Core Protocol(nns\_delegation\_manager): make CloudEngine API BN test hermetic ([#10805](https://github.com/dfinity/ic/pull/10805))
+
+Other changes:
+--------------
+
+* [`0c121276f`](https://github.com/dfinity/ic/commit/0c121276f) Core Protocol: bump libflate
+
+---------------------------------------
+
+## Excluded Changes
+
+### Changed files are excluded by file path filter
+* [`5cc543166`](https://github.com/dfinity/ic/commit/5cc543166) Core Protocol: Add `max_response_bytes` to flexible HTTP args ([#10690](https://github.com/dfinity/ic/pull/10690))
+* [`a4f75d6b0`](https://github.com/dfinity/ic/commit/a4f75d6b0) Node: Restructure guest\_disk tests ([#10811](https://github.com/dfinity/ic/pull/10811))
+
+### Not modifying GuestOS
+* [`935c65d4b`](https://github.com/dfinity/ic/commit/935c65d4b) Defi(cketh): TimedSizedMap bounded, time-expiring map ([#10705](https://github.com/dfinity/ic/pull/10705))
+* [`3b4a53db4`](https://github.com/dfinity/ic/commit/3b4a53db4) Governance(registry): Allow Cloud Engines to have blank replica\_version\_id (in their SubnetRecord). ([#10865](https://github.com/dfinity/ic/pull/10865))
+* [`f9db609ab`](https://github.com/dfinity/ic/commit/f9db609ab) IDX: increase cargo build concurrency on CI ([#10834](https://github.com/dfinity/ic/pull/10834))
+* [`bcd98e2fe`](https://github.com/dfinity/ic/commit/bcd98e2fe) IDX: add check-bazel-files skill ([#10808](https://github.com/dfinity/ic/pull/10808))
+* [`adf55819c`](https://github.com/dfinity/ic/commit/adf55819c) Core Protocol(test-utils): make nobody temp base reachable under sandboxed RBE ([#10845](https://github.com/dfinity/ic/pull/10845))
+* [`64ec65696`](https://github.com/dfinity/ic/commit/64ec65696) Core Protocol: //packages/pocket-ic:canister\_snapshots on RBE @ Namespace ([#10823](https://github.com/dfinity/ic/pull/10823))
+* [`3eb22ffcb`](https://github.com/dfinity/ic/commit/3eb22ffcb) Defi: correct block IDs returned by get\_blocks when start is non-zero ([#10738](https://github.com/dfinity/ic/pull/10738))
+* [`6ff7ece6f`](https://github.com/dfinity/ic/commit/6ff7ece6f) Governance(nervous-system): log GitHub API status/body on failure in sync-with-released-nervous-system-wasms ([#10802](https://github.com/dfinity/ic/pull/10802))
+* [`2568fa0df`](https://github.com/dfinity/ic/commit/2568fa0df) IDX: drop unused in slack-workflow-run ([#10853](https://github.com/dfinity/ic/pull/10853))
+* [`0df786c41`](https://github.com/dfinity/ic/commit/0df786c41) IDX: set skip\_buf\_checks config ([#10854](https://github.com/dfinity/ic/pull/10854))
+* [`17b6e7604`](https://github.com/dfinity/ic/commit/17b6e7604) IDX: correctly mark GPG\_PASSPHRASE as optional ([#10855](https://github.com/dfinity/ic/pull/10855))
+* [`c68dcb353`](https://github.com/dfinity/ic/commit/c68dcb353) IDX: use correct team name for governance ([#10850](https://github.com/dfinity/ic/pull/10850))
+* [`6688a7e79`](https://github.com/dfinity/ic/commit/6688a7e79) IDX: avoid Too many open files ([#10827](https://github.com/dfinity/ic/pull/10827))
+* [`dbb3f2d21`](https://github.com/dfinity/ic/commit/dbb3f2d21) IDX(devcontainer): auto-install pinned rust toolchain in rust-analyzer ([#10822](https://github.com/dfinity/ic/pull/10822))
+* [`d35580bc3`](https://github.com/dfinity/ic/commit/d35580bc3) Owners(deps): remove unused ansible dependency ([#10837](https://github.com/dfinity/ic/pull/10837))
+* [`910a9ce6f`](https://github.com/dfinity/ic/commit/910a9ce6f) Owners: Update Mainnet ICOS revisions file ([#10835](https://github.com/dfinity/ic/pull/10835))
+* [`3e865c143`](https://github.com/dfinity/ic/commit/3e865c143) Owners: Update Mainnet ICOS revisions file ([#10831](https://github.com/dfinity/ic/pull/10831))
+* [`968709c8f`](https://github.com/dfinity/ic/commit/968709c8f) Owners: Update Mainnet IC revisions canisters file ([#10828](https://github.com/dfinity/ic/pull/10828))
+* [`71c27a75d`](https://github.com/dfinity/ic/commit/71c27a75d) Owners: Update Mainnet ICOS revisions file ([#10826](https://github.com/dfinity/ic/pull/10826))
+* [`6ed011632`](https://github.com/dfinity/ic/commit/6ed011632) Owners: move all crate definitions into workspace ([#10812](https://github.com/dfinity/ic/pull/10812))
+* [`f245d740f`](https://github.com/dfinity/ic/commit/f245d740f) Owners: use workspace crates everywhere ([#10809](https://github.com/dfinity/ic/pull/10809))
+* [`729f5fa92`](https://github.com/dfinity/ic/commit/729f5fa92) IDX: remove outdated feat-ai-on-engines TODO ([#10849](https://github.com/dfinity/ic/pull/10849))
+* [`431c0cc13`](https://github.com/dfinity/ic/commit/431c0cc13) Core Protocol(execution): reject mgmt canister /call under queries-only delegation ([#10782](https://github.com/dfinity/ic/pull/10782))
+* [`637401a9d`](https://github.com/dfinity/ic/commit/637401a9d) Core Protocol(xnet): exercise silently dropped responses on subnet deletion ([#10793](https://github.com/dfinity/ic/pull/10793))
+* [`ba3472e3b`](https://github.com/dfinity/ic/commit/ba3472e3b) Core Protocol(subnet\_splitting): make load estimate assertions orientation-invariant ([#10815](https://github.com/dfinity/ic/pull/10815))
+* [`11abe0221`](https://github.com/dfinity/ic/commit/11abe0221) Core Protocol(http\_utils): run resuming\_download\_test without network ([#10806](https://github.com/dfinity/ic/pull/10806))
+* [`1cb7aeb80`](https://github.com/dfinity/ic/commit/1cb7aeb80) Core Protocol(https-outcalls): remove requires-network from adapter integration tests ([#10803](https://github.com/dfinity/ic/pull/10803))
+* [`e3e607575`](https://github.com/dfinity/ic/commit/e3e607575) Governance(nns): Updated changelogs for Cycles Minting, Governance, and Registry. ([#10819](https://github.com/dfinity/ic/pull/10819))
+
+### Scope of the change (registry) is not related to the artifact
+* [`19a3d012a`](https://github.com/dfinity/ic/commit/19a3d012a) Core Protocol(registry): Handle ReplicaVersion conversion errors. ([#10851](https://github.com/dfinity/ic/pull/10851))
+
+### The change is not owned by any replica or HostOS team
+* [`8047a456f`](https://github.com/dfinity/ic/commit/8047a456f) IDX: avoid rustc LTO warnings ([#10818](https://github.com/dfinity/ic/pull/10818))
+* [`279208883`](https://github.com/dfinity/ic/commit/279208883) IDX: bump ic-wasm ([#10847](https://github.com/dfinity/ic/pull/10847))
+* [`59716f431`](https://github.com/dfinity/ic/commit/59716f431) IDX(deps): bump serde\_with to 3.21.0 ([#10838](https://github.com/dfinity/ic/pull/10838))
+* [`59074a9b1`](https://github.com/dfinity/ic/commit/59074a9b1) IDX(Core): Upgrade wasmtime to 46 ([#10715](https://github.com/dfinity/ic/pull/10715))
+* [`ee15e160b`](https://github.com/dfinity/ic/commit/ee15e160b) Defi(btc-adapter): remove requires-network tag from adapter\_test ([#10813](https://github.com/dfinity/ic/pull/10813))
+* [`a8d582a62`](https://github.com/dfinity/ic/commit/a8d582a62) Defi(Ledger\_suite): Replace cddl crate in the block-schema test ([#10799](https://github.com/dfinity/ic/pull/10799))