Security

Docker Engine 29.9.3: Full Security Line

Docker Engine 29.9.3 went stable on 3 November 2026, and it carries the largest security batch of the 29.9.x line: four Engine and SwarmKit CVEs plus two BuildKit advisories.[1][2] If you have been tracking the 29.x security story you know by now that this line has been shipping steady fixes since 29.9.0 on 8 October - and this release is the one to land on today.[1] This article reworks our earlier 29.9.0 write-up into the full history of the line and gives you a practical upgrade path from 29.9.0 to 29.9.3 on a self-hosted Debian/Ubuntu VPS, with the two spots that deserve special attention: firewalld plus encrypted Swarm overlays, and worker/manager TLS certificate rotation.[2] If you are still choosing where the host lives, the digitalocean vs linode vs vultr comparison covers the entry-tier cloud choice. This upgrade is version-driven, so the distro matters more than the provider. …

Read more →

Next.js Nov 2026 Security Release: Patch to v16.4.5

The Next.js security release is out. Vercel shipped v16.4.5 (Active LTS) and v15.5.29 (Maintenance LTS) on November 3, 2026, closing seven advisories: one high severity and six medium. If you self-host, the patched code only reaches production when you update the dependency, rebuild the standalone artifact, and restart the process. This guide maps all seven advisories to their affected surfaces, calls out the ones that matter most for a self-hosted stack in front of nginx, and walks through the exact update sequence for a standalone build under PM2.…

Read more →

eMudhra CA Compromise: Check Your TLS Chains

Eight eMudhra intermediate CAs had their private keys compromised (CVE-2026-111943). Docker 29.9.2, Go 1.26.10/1.27.3 and the ca-certificates updates from Ubuntu, Red Hat and Debian now reject those certificate chains. This guide shows how to check that your VPS’s git, curl, Docker and Go clients actually stop trusting them - and what the check has to look at before you can call it done.…

Read more →

CVE-2026-98432: VPS Still Vulnerable to Remote Root

CVE-2026-98432 is a remote, unauthenticated use-after-free in the Linux IPv4 TCP stack (CVSS 9.8). The upstream fix is in stable kernels from 5.10.272 through 7.3, but as of 1 November Ubuntu 22.04–26.10 and RHEL 8/9/10 have not shipped a patched kernel. A fresh uname -r does not mean you are safe - you must check the kernel against your distribution’s CVE status, apply Red Hat’s documented nftables filter in the meantime, and reboot after the update.…

Read more →

GitLab CVE-2026-97229: RCE via CI Regexes

GitLab CVE-2026-97229 is a CVSS 10.0 pre-auth RCE triggered by a crafted regular expression in a CI/CD config. The fix shipped in GitLab 19.4.2/19.3.5/19.2.8, but the real patch is in Ruby’s Onigmo regex engine - which GitLab applies only to its official packages. Upgrading GitLab on a custom Ruby build or image leaves you vulnerable, exactly as Alpine discovered on its own instance.…

Read more →

Tailscale SSH Privilege Escalation: VPS Fix

On 26 Oct 2026 Tailscale confirmed that most reported Tailscale SSH issues are privilege-escalation problems; on 28 Oct the patched client v1.104.4 shipped and the TS-2026-014–017 advisory landed. A peer already allowed into a session could act beyond its user’s permissions - up to root-only Unix sockets. Here is what to check, upgrade and tighten.…

Read more →

Node.js 26 Is Active LTS: 24/22 Migration Plan

On 28 October 2026 Node.js 26 becomes Active LTS. It is the last LTS promotion under the old even/odd release model, and the first window where the new annual cadence (v27 Alpha starts the same day) shapes your version choice. v24 moved to Maintenance on 20 October; v22 reaches end-of-life in April 2027. Worst of all, the version to move to - 26.12.1 - is also the one that carries the October HIGH security fixes, including the Node2Shell Brotli RCE. Here’s how to plan the move on a self-hosted VPS, what breaks when you jump from 24/22, and the exact check-install-verify commands.…

Read more →

Node2Shell (CVE-2026-111497): the Brotli RCE on VPS

CVE-2026-111497 (Node2Shell) is an out-of-bounds write in Google’s Brotli decoder, rated 9.2 on CVSS 4.0. It reaches any runtime that decodes untrusted Brotli - Node.js 22/24/26, Bun ≤1.4.3, Python brotli/brotlicffi, Envoy and Istio - from either side of an HTTP exchange. Imperva demonstrated unauthenticated remote code execution on the official Node.js 24.22.0 image. Here’s how to check what’s running on your VPS and upgrade safely.…

Read more →

Node.js Oct 2026 Security: 26.12.1 and Node 26 LTS

On 21 Oct 2026 the Node.js project released security versions across all three supported lines - 26.12.1 (Current), 24.22.1 and 22.23.4 (LTS) - closing four HIGH CVEs, three of them remotely reachable by default, plus six more medium/low issues. Node 26 becomes Active LTS on 28 Oct. How to check your version and upgrade on a self-hosted VPS with nvm or a direct tarball, then restart cleanly under pm2.…

Read more →

Nginx GeoIP: MMDB Country Blocking and Routing

Nginx 1.31.7 moved the open-source geoip modules from the retired GeoLite .dat format to native MaxMind DB (MMDB) support. Here is the 2026 way to geo-block and geo-route by country on stock nginx: geoip_country + GeoLite2-Country.mmdb, map and if for the block, geo-aware rate limiting, and the http and stream modules side by side.…

Read more →