diff --git a/.gitignore b/.gitignore
index b39a62a..339e281 100644
--- a/.gitignore
+++ b/.gitignore
@@ -131,3 +131,5 @@ samba-3.6.0pre1.tar.gz
 /samba-4.9.0rc1.tar.asc
 /samba-4.9.0rc2.tar.xz
 /samba-4.9.0rc2.tar.asc
+/samba-4.9.0rc3.tar.xz
+/samba-4.9.0rc3.tar.asc
diff --git a/samba-4.9.0-test_tldap.patch b/samba-4.9.0-test_tldap.patch
deleted file mode 100644
index 5dba368..0000000
--- a/samba-4.9.0-test_tldap.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 7c19caf31cd139ded15f634de20d95589253c49e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
-Date: Thu, 12 Jul 2018 23:32:36 +0200
-Subject: [PATCH] s3-tldap: do not install test_tldap
-
-Guenther
-
-Signed-off-by: Guenther Deschner <gd@samba.org>
----
- source3/wscript_build | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/source3/wscript_build b/source3/wscript_build
-index 03d5724ee11..becaffe61c4 100644
---- a/source3/wscript_build
-+++ b/source3/wscript_build
-@@ -114,7 +114,8 @@ bld.SAMBA3_BINARY('test_tldap',
-                        samba3util
-                        smbconf
-                        cmocka
--                       ''')
-+                       ''',
-+                  install=False)
- 
- # libpdb.so should not expose internal symbols that are only usable
- # to the statically linked modules that are merged into libpdb.
--- 
-2.17.1
-
diff --git a/samba.spec b/samba.spec
index 03ad2f8..1b6a763 100644
--- a/samba.spec
+++ b/samba.spec
@@ -12,9 +12,9 @@
 %define talloc_version 2.1.14
 %define tdb_version 1.3.16
 %define tevent_version 0.9.37
-%define ldb_version 1.4.1
+%define ldb_version 1.4.2
 # This should be rc1 or nil
-%define pre_release rc2
+%define pre_release rc3
 
 %if "x%{?pre_release}" != "x"
 %define samba_release 0.%{main_release}.%{pre_release}%{?dist}
@@ -122,7 +122,6 @@ Source14:       samba.pamd
 Source200:      README.dc
 Source201:      README.downgrade
 
-Patch0:         samba-4.9.0-test_tldap.patch
 Patch1:         samba-4.8.3-vscript.local.patch
 
 Requires(pre): /usr/sbin/groupadd
@@ -922,6 +921,7 @@ done
 filenames=$(echo "
     tests/dcerpc/integer.py
     tests/dcerpc/unix.py
+    tests/dns_invalid.py
 ")
 for file in $filenames; do
     filename="%{buildroot}/%{python3_sitearch}/samba/$file"
@@ -1314,7 +1314,7 @@ fi
 %doc examples/printer-accounting examples/printing
 %doc packaging/README.downgrade
 %{_bindir}/smbstatus
-%{_bindir}/eventlogadm
+%{_sbindir}/eventlogadm
 %{_sbindir}/nmbd
 %{_sbindir}/smbd
 %if %{with_dc}
@@ -2213,6 +2213,7 @@ fi
 %dir %{python2_sitearch}/samba/tests/dns_forwarder_helpers
 %{python2_sitearch}/samba/tests/dns_forwarder_helpers/server.py*
 %{python2_sitearch}/samba/tests/dns_tkey.py*
+%{python2_sitearch}/samba/tests/dns_invalid.py*
 %{python2_sitearch}/samba/tests/dns_wildcard.py*
 %{python2_sitearch}/samba/tests/docs.py*
 %{python2_sitearch}/samba/tests/domain_backup.py*
@@ -3825,6 +3826,14 @@ fi
 %endif # with_clustering_support
 
 %changelog
+* Wed Aug 15 2018 Guenther Deschner <gdeschner@redhat.com> - 4.9.0rc3-2
+- Update to Samba 4.9.0rc3
+- resolves: #1589651, #1617916 - Security fixes for CVE-2018-1139
+- resolves: #1580230, #1618613 - Security fixes for CVE-2018-1140
+- resolves: #1612805, #1618697 - Security fixes for CVE-2018-10858
+- resolves: #1610640, #1617910 - Security fixes for CVE-2018-10918
+- resolves: #1610645, #1617911 - Security fixes for CVE-2018-10919
+
 * Wed Aug 01 2018 Andreas Schneider <asn@redhat.com> - 4.9.0rc2-2
 - Add some spec file cleanups
 
diff --git a/sources b/sources
index 7de41e3..ac6517e 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.9.0rc2.tar.xz) = 0c80b2d24fce0b52ba8983e60def2ff783084abba30e2aa51829a277791faf6005f856abd4cffd34a83b209ecdd00a49194e7161a5ca0267abb2b057d9619113
-SHA512 (samba-4.9.0rc2.tar.asc) = c0706f4f41bd671cb0a4902b4b38b0a5166b5a01ee55659fb4f68646b10e71e838853f841d716bcb8a0ea8f9bfc1dd4ac7d1a7a7ad61d78a1eaf15eba0a9ba80
+SHA512 (samba-4.9.0rc3.tar.xz) = 42164fda5f7d75754893a0d66f2909608ca006c968e6031d4f68797ab9a07502330e96977f553c452f24737f4deddb9cc8cb836ab70d4909d1eb102bd14457fb
+SHA512 (samba-4.9.0rc3.tar.asc) = 0b405e77d7e3a824916880f5f32716e69e94158dd519b6dac66fd2109f5e70e32a55ee827274d31f500b6ddf0aafd00efa54b58b6dfdc6a26ab46d3acb04a286