https://deploysmith.dev/tags/security/ Recent content in Security on DeploySmith https://deploysmith.dev/images/og-default.png https://deploysmith.dev/images/og-default.png Hugo en-US Thu, 05 Nov 2026 00:00:00 +0000 https://deploysmith.dev/hosting/docker-engine-29-9-security-upgrade/ Thu, 05 Nov 2026 00:00:00 +0000 https://deploysmith.dev/hosting/docker-engine-29-9-security-upgrade/ Docker Engine 29.9.3 closes four CVEs and two BuildKit advisories, capping the 29.9.x line. Upgrade checklist for a Debian/Ubuntu VPS. https://deploysmith.dev/guides/nextjs-november-2026-security-release/ Wed, 04 Nov 2026 00:00:00 +0000 https://deploysmith.dev/guides/nextjs-november-2026-security-release/ Next.js released v16.4.5 and v15.5.29 on Nov 3, 2026: seven advisories, one high, six medium. Table of affected surfaces and the self-hosted fix path. https://deploysmith.dev/guides/emudhra-ca-client-trust-check/ Mon, 02 Nov 2026 00:00:00 +0000 https://deploysmith.dev/guides/emudhra-ca-client-trust-check/ CVE-2026-111943: eight eMudhra intermediates compromised. Check your VPS's git, curl, Docker and ca-certificates trust store, then update what is stale. https://deploysmith.dev/guides/cve-2026-98432-linux-tcp-use-after-free/ Sun, 01 Nov 2026 00:00:00 +0000 https://deploysmith.dev/guides/cve-2026-98432-linux-tcp-use-after-free/ CVE-2026-98432 - CVSS 9.8 use-after-free in Linux IPv4 TCP. Ubuntu and RHEL haven't shipped a patch yet: check your kernel, apply the filter. https://deploysmith.dev/guides/gitlab-cve-2026-97229-ci-regex-rce/ Thu, 29 Oct 2026 00:00:00 +0000 https://deploysmith.dev/guides/gitlab-cve-2026-97229-ci-regex-rce/ CVE-2026-97229 - CVSS 10.0 RCE via CI/CD regexes. The fix is in Ruby's Onigmo, applied only in official GitLab packages. Check your build. https://deploysmith.dev/guides/tailscale-ssh-privilege-escalation-vps/ Wed, 28 Oct 2026 00:00:00 +0000 https://deploysmith.dev/guides/tailscale-ssh-privilege-escalation-vps/ Tailscale confirmed privilege escalation in Tailscale SSH, fixed in v1.104.4. Advice for self-hosted VPS admins and TS_SSH_DISABLE_FORWARDING. https://deploysmith.dev/guides/nodejs-26-active-lts-transition/ Tue, 27 Oct 2026 00:00:00 +0000 https://deploysmith.dev/guides/nodejs-26-active-lts-transition/ On 28 October 2026 Node.js 26 moves to Active LTS, v24 is in Maintenance and v22 heads to EOL. The upgrade plan for a self-hosted VPS. https://deploysmith.dev/guides/node2shell-brotli-rce-vps/ Sun, 25 Oct 2026 00:00:00 +0000 https://deploysmith.dev/guides/node2shell-brotli-rce-vps/ Node2Shell (CVE-2026-111497) is a 9.2-CVSS out-of-bounds write in the Google Brotli decoder. It hits Node.js, Bun, Python, Envoy and Istio. https://deploysmith.dev/guides/node-october-2026-security-lts-upgrade/ Sat, 24 Oct 2026 00:00:00 +0000 https://deploysmith.dev/guides/node-october-2026-security-lts-upgrade/ On 21 Oct 2026: 26.12.1, 24.22.1, 22.23.4 closed four HIGH CVEs, and Node 26 becomes Active LTS on 28 Oct. How to upgrade a VPS. https://deploysmith.dev/guides/nginx-geoip-mmdb-geoblocking/ Sun, 18 Oct 2026 00:00:00 +0000 https://deploysmith.dev/guides/nginx-geoip-mmdb-geoblocking/ nginx 1.31.7's open-source geoip modules read MaxMind DB (MMDB) files directly; the old .dat format is gone. A 2026 guide to country blocking and routing. https://deploysmith.dev/guides/nginx-1-31-7-1-30-6-security-upgrade/ Sat, 17 Oct 2026 00:00:00 +0000 https://deploysmith.dev/guides/nginx-1-31-7-1-30-6-security-upgrade/ nginx 1.31.7 and 1.30.6 fix five medium-severity CVEs from 14 Oct 2026 - from alias+rewrite overflow to HTTP/3 injection. Check scope and upgrade. https://deploysmith.dev/guides/nextjs-16-4-1-security-upgrade/ Thu, 15 Oct 2026 00:00:00 +0000 https://deploysmith.dev/guides/nextjs-16-4-1-security-upgrade/ Next.js 16.4.1 (14 Oct 2026) fixes two Critical unauthenticated RCEs and a High DoS in Server Actions, plus the right upgrade order for self-hosted apps. https://deploysmith.dev/guides/block-ai-scrapers-vps-nginx/ Tue, 13 Oct 2026 00:00:00 +0000 https://deploysmith.dev/guides/block-ai-scrapers-vps-nginx/ Block AI scrapers and crawlers (GPTBot, ClaudeBot, CCBot) at the nginx level: IP sets, user-agents, and robots.txt rules. https://deploysmith.dev/hosting/docker-engine-29-8-2-security-upgrade/ Fri, 02 Oct 2026 00:00:00 +0000 https://deploysmith.dev/hosting/docker-engine-29-8-2-security-upgrade/ Docker Engine 29.8.2 security release: the CVEs it fixes and the upgrade path on a self-hosted Debian/Ubuntu VPS, with restart notes. https://deploysmith.dev/guides/nginx-1-31-6-http3-security-upgrade/ Wed, 30 Sep 2026 00:00:00 +0000 https://deploysmith.dev/guides/nginx-1-31-6-http3-security-upgrade/ nginx 1.31.6 (and 1.30.5) fix CVE-2026-90439, a heap buffer overflow in the HTTP/3 module with OpenSSL 3.5.0 and earlier. Check your proxy and upgrade.