I thought I put new builds on the download page but it looks like I didn't. I will say there has been no security related changes in 2.5.2, 2.5.3 or 2.5.4 that I can remember which is probably why I didn't update the d/l page.
That said, there is bad news for us as Apache 2.4.26 will not build with LibreSSL. It looks like getting Apache & Apr-util compatible with OpenSSL 1.1.0 has broken the option of using LibreSSL. So come tomorrow (Friday my time) or Saturday (unless a problem is found before then) we will be seeing Apache 2.4.26/OpenSSL 1.1.0f instead.
I will post to the dev list about the LibreSSL breakage after 2.4.26 is released. Do not expect any fix to this problem as LibreSSL has never been a "supported" encryption library by the Apache project but we could get lucky.
That said, my initial tests of Apache/OpenSSL 1.1.0 look good and we can continue to do the cha-cha
