UptimeMag

News

USN-8957-1: authd, bug permette di ereditare file di un altro utenteNews

USN-8957-1: authd bug allows inheriting another user's files

CVE-2026-102631: authd before 0.7.1 can assign UID and home directory of an old account to a new IdP user. Fix available in Ubuntu 26.10.

Ruby: quattro CVE nel motore regex, CloudLinux aggiorna i pacchetti alt-rubyNews

Ruby: four CVE in regex engine, CloudLinux updates alt-ruby packages

Four memory corruption bugs in Ruby's regex engine exploitable for RCE on GitLab. CloudLinux releases patched alt-ruby packages.

PHP aggiorna le build Windows per una falla critica in Brotli (CVE-2026-111497)News

PHP Updates Windows Builds for Critical Brotli Flaw (CVE-2026-111497)

New Windows builds for PHP 8.2–8.5 include Brotli 1.2.1 and fix a critical flaw (CVSS 9.2) exploitable via cURL.

Falla de sitio web Pompidou por incendio en OVHNews

OpenTofu encrypts state and plans with OVHcloud KMS managed keys

OVHcloud releases an external key provider for OpenTofu that uses OVHcloud KMS to encrypt state and plan files. Requires OpenTofu 1.13+.

Wordfence apre un nuovo canale per segnalare minacce attive su WordPressNews

Wordfence launches new channel for reporting active WordPress threats

Wordfence establishes the Threat Response Team: a dedicated email address for reporting ongoing threats in the WordPress ecosystem, separate from existing channels.

USN-8955-1: Ubuntu corregge cinque falle in nginx, una bypassa i certificati clientNews

USN-8955-1: Ubuntu patches five nginx flaws, one bypasses client certificates

Ubuntu releases USN-8955-1: five vulnerabilities in nginx across 22.04, 24.04, 26.04 and 26.10, one allows circumventing client certificate verification.

PHP2Shell: cPanel pubblica le versioni esatte di WHM ed EasyApache da installareNews

PHP2Shell: cPanel publishes exact WHM and EasyApache versions to install

cPanel lists precise builds of WHM, EasyApache 4 and WP Squared that fix CVE-2026-109618 and -109619, plus mitigation to maintain even after patching.

OVHcloud ottiene SecNumCloud per il cloud pubblico: cosa cambia per chi rivende hosting in ItaliaNews

OVHcloud gains SecNumCloud for public cloud: what changes for hosting resellers in Italy

ANSSI qualifies OVHcloud's SNC Cloud Platform. Coming to Italy too. What it means for hosting vendors, even without public sector clients.

Patch della settimana: RabbitMQ, Bind, Go e tre plugin WordPress da aggiornareNews

Week's patches: RabbitMQ, Bind, Go and three WordPress plugins to update

Between 14 and 18 October 2026, Ubuntu released three security advisories covering RabbitMQ, Bind and Go. Here are the commands to check and update.

TAF: il framework open source che confronta MariaDB, MySQL e PostgreSQLNews

TAF: open source framework comparing MariaDB, MySQL and PostgreSQL

MariaDB Foundation introduces TAF, the open source tool for reproducible benchmarks across MariaDB, MySQL and PostgreSQL: 400 downloads within two weeks of version 4.0 release.

USN-8952-1: Ubuntu corregge sei falle DoS in Tornado, libreria web PythonNews

USN-8952-1: Ubuntu patches six DoS vulnerabilities in Tornado, Python web library

Ubuntu releases update for python3-tornado: six vulnerabilities can cause denial of service or expose data. Patches available for all supported releases.

CVE-2026-115560: PHP segnala un'altra RCE in session upload progress, diversa da PHP2ShellNews

CVE-2026-115560: PHP reports another RCE in session upload progress, distinct from PHP2Shell

PHP urges disabling session.upload_progress.enabled until the next release. Those who already did so for PHP2Shell need not change anything.

ZDI-CAN-33367: zero-day root nel kernel Linux, mitigazione per CloudLinuxNews

ZDI-CAN-33367: zero-day Linux kernel root in CloudLinux, mitigation

CVE-less flaw in Linux kernel network stack grants local root access. Public exploit exists; livepatch available only for CloudLinux 10.

LiteSpeed Cache per WordPress: tre falle corrette nella versione 7.9.2News

LiteSpeed Cache for WordPress: three flaws patched in version 7.9.2

LiteSpeed has fixed two XSS vulnerabilities and one missing authorisation flaw in LiteSpeed Cache for WordPress. Update to 7.9.2 or later.

Cloudflare introduce il profiling CPU e memoria per Workers in produzioneNews

Cloudflare adds CPU and memory profiling for Workers in production

On-demand flamegraphs from dashboard or CLI to identify CPU and memory consumption before error 1102 strikes. Official announcement from 9 October 2026.

PHP: terzo avviso su session upload progress, CVE-2026-115560 senza patchNews

PHP: Third alert on session upload progress, CVE-2026-115560 unpatched

The PHP project reports a third RCE flaw in session handling, not covered by the 21 October updates. Mitigation remains the same as previously known.

Node.js: RCE critica nel decoder Brotli, CloudLinux aggiorna i pacchetti alt-nodejsNews

Node.js: Critical RCE in Brotli decoder, CloudLinux updates alt-nodejs

Node.js fixes 10 vulnerabilities, the most severe being an RCE in the Brotli decoder. CloudLinux releases updated alt-nodejs packages: how to verify and update.

USN-8953-1: Ubuntu corregge in OpenVPN una falla che permette di impersonare utentiNews

USN-8953-1: Ubuntu patches OpenVPN user impersonation vulnerability

Ubuntu releases OpenVPN security updates for CVE-2026-84790: a malformed certificate subject field can enable impersonation of another authenticated user.

PHP2Shell: Docker aggiorna le immagini Official e Hardened per le due RCENews

PHP2Shell: Docker updates Official and Hardened images for two RCE

Docker has updated Official Images and Hardened Images on Hub to address RCE vulnerabilities CVE-2026-109618 and -109619. Versions and commands to verify your containers.

USN-8954-1: Ubuntu corregge un buffer overflow in zlib su 24.04, 26.04 e 26.10News

USN-8954-1: Ubuntu patches zlib buffer overflow on 24.04, 26.04 and 26.10

Canonical releases patch for heap buffer overflow vulnerability in zlib affecting Ubuntu 24.04, 26.04 and 26.10 LTS.