Week's patches: RabbitMQ, Bind, Go and three WordPress plugins to update

Between 14 and 18 October 2026, three Ubuntu security notices were released affecting packages present on most production servers: RabbitMQ, Bind and Go. To these can be added three CVEs affecting widely-used WordPress plugins. Below are the commands to check your distribution before taking action.

RabbitMQ Server — USN-8933-1 (15 October 2026)

The official advisory covers releases 26.04, 24.04, 22.04, 20.04, 18.04 and 16.04 LTS. Among the issues fixed: RabbitMQ Server handled CORS configuration with wildcards incorrectly, exploitable for cross-site request forgery attacks (CVE-2026-66070), handling of peer TLS certificate DNs in the management UI, exploitable for cross-site scripting (CVE-2026-66077), and a bug in the trust-store plugin that incorrectly validated client certificates, usable to bypass TLS client authentication (CVE-2026-67231). In total 12 CVEs, including DoS on WebSocket and content-header fields.

Patched versions: 26.04 LTS → rabbitmq-server 4.0.5-10ubuntu5.2; 24.04 LTS → 3.12.1-1ubuntu1.7; 22.04 LTS → 3.9.27-0ubuntu0.6; 20.04, 18.04 and 16.04 LTS are covered only with active Ubuntu Pro. Command: apt update && apt install --only-upgrade rabbitmq-server, then systemctl restart rabbitmq-server (restart is not automatic).

Bind — USN-8929-1 (14 October 2026)

This week's heaviest advisory: affects all LTS releases from 14.04 to 26.04, with 24 CVEs listed on the official page. Among the most significant: Bind accepted certain records from responses incorrectly, exploitable for cache poisoning attacks, only on Ubuntu 18.04 LTS (CVE-2025-40778), and a bug in unsafe delegation validation where a remote attacker could cause excessive NSEC3 iterations, consuming CPU and causing denial of service (CVE-2026-1519). Package: bind9. Command: apt update && apt install --only-upgrade bind9, then systemctl restart bind9. For the exact build on your release, it's worth running apt policy bind9 and comparing it with the table on the advisory's official page.

Go — USN-8883-2 (15 October 2026)

Affects only Ubuntu 22.04 LTS, package golang-1.23. This is the completion of USN-8883-1, which had already patched Go 1.18, 1.21 and 1.24: CVE-2026-39821 stems from the x/net/idna package, which mishandled certain Punycode labels decoded to pure ASCII, allowing bypass of hostname-based access controls. Patched version: golang-1.23, golang-1.23-go, golang-1.23-src → 1.23.1-1~22.04.3. Command: apt update && apt install --only-upgrade golang-1.23 golang-1.23-go golang-1.23-src.

WordPress: three plugins to check

In the same week, three CVEs were reported on widely-used plugins: WP Data Access (CVE-2026-106470, SSRF via CSRF, versions prior to 5.5.88), Contact Form 7 Signature Addon (CVE-2026-104246, path traversal up to 4.2.2) and ACF Frontend Admin by DynamiApps (CVE-2026-81344, deserialisation leading to RCE up to 3.29.13). Before updating blindly, check the plugin sheet and correct version on patchstack.com and Wordfence Intelligence: for the first two the exact patched version is not yet confirmed from a primary source. Meanwhile, the command remains wp plugin update <slug> --allow-root, to be run after checking the installed version with wp plugin list.