Weekly patches: Ubuntu kernel, libxml2 and critical WordPress flaw

Review for Monday, 12 October 2026: what came out this week on ubuntu.com/security/notices and the Patchstack database, and what needs deploying immediately on production servers.

Ubuntu: libxml2, libarchive and kernel

USN-8910-1 (8 October 2026) addresses multiple vulnerabilities in libxml2 across Ubuntu 26.04, 24.04, 22.04, 20.04, 18.04, 16.04 and 14.04 LTS, including CVE-2026-86144, CVE-2026-86142, CVE-2026-76781 and three others. Command: sudo apt update && sudo apt install --only-upgrade libxml2. System reboot is not required, but processes holding the library in memory must be restarted (e.g. systemctl restart apache2 nginx).

Same day, USN-8909-1 closes a libde265 bug that "could be crashed if it received specially crafted input" (CVE-2026-88373, affecting 26.04 through 16.04 LTS). USN-8907-1 addresses libgit2, which "could be made to expose sensitive information over the network" (CVE-2026-53583, 26.04 and 24.04 LTS only). USN-8902-1 covers libarchive, which "could be crashed or execute code as your login user if it opened a specially crafted file" (CVE-2026-16517, across 26.04, 24.04, 22.04 LTS). For all three: sudo apt install --only-upgrade <package>, no system reboot required.

On the kernel front, USN-8906-1 from 8 October 2026 addresses multiple security issues in the Linux kernel (IBM variant) for Ubuntu 22.04 LTS, updating to linux-image-6.8.0-1066-ibm version 6.8.0-1066.67~22.04.1. Among the fixed defects, some ARM processors could complete a TLB broadcast invalidation before memory writes were observed globally, allowing a local attacker to write to memory after permission was revoked (CVE-2025-10263). Same day USN-8903-1 addresses the generic kernel for Ubuntu 24.04 and 22.04 LTS. In both cases: sudo apt update && sudo apt full-upgrade, then mandatory reboot.

Also worth noting is USN-8900-1 from 7 October 2026 for Go Networking on Ubuntu 22.04 LTS, where a researcher discovered the package misinterpreted tags in external content with unquoted attributes ending with a slash, causing content to be placed in the wrong scope during DOM construction (CVE-2025-22872), plus a quadratic parsing bug (CVE-2025-47911) and an infinite loop (CVE-2025-58190) leading to denial of service, and an access control bypass via Punycode (CVE-2026-39821). Anyone building Go binaries using this package must rebuild them after the update.

WordPress: 7.1.3 and the still-active flaw

WordPress 7.1.3 was released on 6 October 2026. It is a maintenance and security release with seven security fixes and four bug fixes, backported to 6.6 branch releases; at time of article publication, the 4.7–6.5 branches had not yet been patched. Command via WP-CLI: wp core update && wp core update-db.

Still to be closed, for those who haven't done so, is CVE-2026-87902, a path traversal leading to local file inclusion and, in certain PHP configurations, to conditional RCE, with CVSS 9.2, no authentication required, affecting versions 4.7.0 through 7.1.1. If not yet updated, WordPress 7.1.2 or the correct release on your branch remains the solution, and is now urgent.

Plugins to check

From the Patchstack database, updated 10 October 2026:

Plugin	Affected version	Type	Priority score	Disclosure
Request a Quote for WooCommerce	<= 2.9.2	Unauthenticated arbitrary file upload	10	~9 October 2026
Elementor Website Builder	4.3.0–4.3.1	CSRF	8.8	~6 October 2026
Contact Form by WPForms	<= 2.0.2	Reflected XSS	7.1	~6 October 2026
Bookly	<= 28.2	IDOR (disclosure/cancellation of booking token)	6.5	~6 October 2026

Also monitor the Bricksforge plugin: on 8 October 2026 Patchstack published an advisory on a critical unauthenticated arbitrary file upload vulnerability, actively exploited. Users should immediately check the installed version in the plugins panel and apply the latest available update.

Sources: ubuntu.com/security/notices, patchstack.com/articles, patchstack.com/database/statistics/wordpress/2026.