Cve

Docker Engine 29.9.3: Full Security Line

Docker Engine 29.9.3 went stable on 3 November 2026, and it carries the largest security batch of the 29.9.x line: four Engine and SwarmKit CVEs plus two BuildKit advisories.[1][2] If you have been tracking the 29.x security story you know by now that this line has been shipping steady fixes since 29.9.0 on 8 October - and this release is the one to land on today.[1] This article reworks our earlier 29.9.0 write-up into the full history of the line and gives you a practical upgrade path from 29.9.0 to 29.9.3 on a self-hosted Debian/Ubuntu VPS, with the two spots that deserve special attention: firewalld plus encrypted Swarm overlays, and worker/manager TLS certificate rotation.[2] If you are still choosing where the host lives, the digitalocean vs linode vs vultr comparison covers the entry-tier cloud choice. This upgrade is version-driven, so the distro matters more than the provider. …

Read more →

Next.js Nov 2026 Security Release: Patch to v16.4.5

The Next.js security release is out. Vercel shipped v16.4.5 (Active LTS) and v15.5.29 (Maintenance LTS) on November 3, 2026, closing seven advisories: one high severity and six medium. If you self-host, the patched code only reaches production when you update the dependency, rebuild the standalone artifact, and restart the process. This guide maps all seven advisories to their affected surfaces, calls out the ones that matter most for a self-hosted stack in front of nginx, and walks through the exact update sequence for a standalone build under PM2.…

Read more →

eMudhra CA Compromise: Check Your TLS Chains

Eight eMudhra intermediate CAs had their private keys compromised (CVE-2026-111943). Docker 29.9.2, Go 1.26.10/1.27.3 and the ca-certificates updates from Ubuntu, Red Hat and Debian now reject those certificate chains. This guide shows how to check that your VPS’s git, curl, Docker and Go clients actually stop trusting them - and what the check has to look at before you can call it done.…

Read more →

CVE-2026-98432: VPS Still Vulnerable to Remote Root

CVE-2026-98432 is a remote, unauthenticated use-after-free in the Linux IPv4 TCP stack (CVSS 9.8). The upstream fix is in stable kernels from 5.10.272 through 7.3, but as of 1 November Ubuntu 22.04–26.10 and RHEL 8/9/10 have not shipped a patched kernel. A fresh uname -r does not mean you are safe - you must check the kernel against your distribution’s CVE status, apply Red Hat’s documented nftables filter in the meantime, and reboot after the update.…

Read more →

GitLab CVE-2026-97229: RCE via CI Regexes

GitLab CVE-2026-97229 is a CVSS 10.0 pre-auth RCE triggered by a crafted regular expression in a CI/CD config. The fix shipped in GitLab 19.4.2/19.3.5/19.2.8, but the real patch is in Ruby’s Onigmo regex engine - which GitLab applies only to its official packages. Upgrading GitLab on a custom Ruby build or image leaves you vulnerable, exactly as Alpine discovered on its own instance.…

Read more →

Node2Shell (CVE-2026-111497): the Brotli RCE on VPS

CVE-2026-111497 (Node2Shell) is an out-of-bounds write in Google’s Brotli decoder, rated 9.2 on CVSS 4.0. It reaches any runtime that decodes untrusted Brotli - Node.js 22/24/26, Bun ≤1.4.3, Python brotli/brotlicffi, Envoy and Istio - from either side of an HTTP exchange. Imperva demonstrated unauthenticated remote code execution on the official Node.js 24.22.0 image. Here’s how to check what’s running on your VPS and upgrade safely.…

Read more →

Node.js Oct 2026 Security: 26.12.1 and Node 26 LTS

On 21 Oct 2026 the Node.js project released security versions across all three supported lines - 26.12.1 (Current), 24.22.1 and 22.23.4 (LTS) - closing four HIGH CVEs, three of them remotely reachable by default, plus six more medium/low issues. Node 26 becomes Active LTS on 28 Oct. How to check your version and upgrade on a self-hosted VPS with nvm or a direct tarball, then restart cleanly under pm2.…

Read more →

nginx 1.31.7 / 1.30.6: Five Security Fixes to Apply

nginx 1.31.7 (mainline) and 1.30.6 (stable) fix five medium-severity CVEs shipped 14 Oct 2026: alias+rewrite buffer overflow, script-expression overflow, HTTP/3 body injection, TLS session-ticket forgery, and an AIO/SSI use-after-free. How to tell which of your configs are in scope, and how to upgrade.…

Read more →

Docker 29.8.2 Security Patch: 13 Fixes

If you run any Docker deployment on a VPS you control, the release from 30 September 2026 is not a routine version bump. Docker Engine 29.8.2 ships 13 security fixes - three in the engine itself and ten in the bundled BuildKit - including one high-severity issue that can hand a remote attacker your registry credentials or swap the image you pull, and two that bite exactly the setup most self-hosters use. This is the hosting upgrade to do this week, not next month. Why this release matters Docker Engine 29.8.2 was released on 30 September 2026 as a dedicated security release.[1] It fixes three Docker Engine vulnerabilities plus a batch of ten BuildKit vulnerabilities, and it bundles updated containerd (v2.3.6), BuildKit (v0.33.1) and runc (v1.5.2).[1][2] …

Read more →