News
NewsUSN-8942-1: Ubuntu patches .NET 8, 10 and 11 just 20 days before .NET 8 EOL
Ubuntu updates .NET 8, 10 and 11 packages across all supported releases. .NET 8 reaches end of support on 10 November 2026.
NewsUbuntu removes compromised emSign CA: update ca-certificates on all releases
USN-8944-1 removes the emSign ECC G3 root after eight eMudhra intermediate CAs had keys stolen, and updates the Mozilla certificate bundle to version 2.90.
NewsUSN-8945-1: Ubuntu patches XZ Utils across all supported releases
Ubuntu has released an update for xz-utils across all supported releases: a malicious compressed file can cause crashes or arbitrary code execution.
NewsPHP: security release today at 14:00 UTC for two critical CVSS 9.2 flaws
The PHP security team releases patches today at 14:00 UTC for two critical vulnerabilities rated CVSS v4.0 9.2. Details and affected versions with the release.
NewseMudhra: eight intermediate TLS certificate private keys compromised, what to update
Weak private keys on eight eMudhra TLS/code-signing intermediates: risk of forged certificates. Cloudflare has already patched WARP and cloudflared, now sysadmins must check their origins.
NewsDuplicator: critical unauthenticated vulnerability, update to 5.0.0+ now
Wordfence discloses an unauthenticated PHP Object Injection in Duplicator and Duplicator Pro (CVSS 8.8). Over 1 million sites affected.
Newssudo-rs: sudoedit vulnerability patched for Ubuntu 26.10
Canonical extends the fix for a time-of-check/time-of-use vulnerability in sudoedit to Ubuntu 26.10, following the patch released for 26.04 LTS in September.
NewsSquid: six vulnerabilities patched on Ubuntu, critical flaw enables request smuggling
Ubuntu addresses six vulnerabilities in Squid. The most severe (CVSS 7.7) enables cache poisoning through HTTP/1.1 request smuggling.
NewsUbuntu Fixes Crash in Perl XS::Parse::Keyword Module (USN-8940-1)
Canonical has released a patch for CVE-2026-85644: on 26.10 and 26.04 LTS, malformed input can crash Perl processes using the module.
NewsUpdraftCentral: stolen keys used to install backdoors on WordPress sites
TeamUpdraft confirms unauthorised access to its website: UpdraftCentral connection keys stolen and used to install malicious plugins on connected sites.
NewsUbuntu patches libXtst: DoS flaw in X11 RECORD extension
Canonical has released advisory USN-8939-1: updates libxtst across all supported releases, from 16.04 to 26.10.
NewsNetScaler under attack: two critical CVEs and how to harden the gateway post-patch
Two unauthenticated RCE flaws in Citrix NetScaler are already being exploited. Cloudflare explains how to limit exposure even after patching.
NewsOpenLiteSpeed automates ACME certificates in WordPress vhost creation
A single command creates a vhost, Let's Encrypt certificate and WordPress installation on OpenLiteSpeed. Requirements, script and versions involved.
Newscifs-utils on Ubuntu: local flaw leads to root, patch for four releases
CVE-2026-104715: a local attacker injects CIFS mount options and escalates to root. Patch available for Ubuntu 22.04, 24.04, 26.04 and 26.10.
NewsWeek's patches: critical RCE in Bricksforge, Apache, OpenSSH and curl on Ubuntu
Round-up of CVEs published from 13 to 19 October 2026 for WordPress plugins and Ubuntu packages, with fixed versions and update commands.
NewsHetzner and OVHcloud price increases 2026: the official price lists
Hetzner and OVHcloud's public price lists reveal increases of up to 176% on some VPS plans in 2026, with RAM cited as the reason.
NewsNGINX Gateway Fabric 2.8: IP lists, passive health checks and sticky sessions on OSS
Version 2.8 released 14 October 2026: AccessPolicy for IP, passive health checks on UpstreamSettingsPolicy, sticky cookies now available on NGINX Open Source.
NewsRank Math SEO PRO 3.0.123: malware in some copies, critical CVE-2026-111862
Copies of Rank Math SEO PRO 3.0.123 downloaded between 15–16 October 2026 contained malware. Wordfence assigns CVSS 9.8; patch released in 3.0.124.
NewsMariaDB Migrator reaches GA: MySQL-to-MariaDB tool is not open source
MariaDB Migrator 1.5.0 exits beta with a faster parallel engine. Official documentation, however, classifies it as proprietary software, not open source.
NewsBackuply: Second-order SQL injection flaw, 600,000 WordPress sites at risk
CVE-2026-93953, CVSS 8.0: a subscriber can take control of the site during backup restore. Patch available in version 1.5.9.