Filed under security
Here’s a roundup of 8 critical/high security issues disclosed this week affecting popular open-source self-hosted projects, plus 3 earlier advisories for Langflow, Portainer and Mastodon we hadn’t covered yet (see Missed Earlier). Start with your edge: OpenSSH has a password…
What the Tailscale “Tailworm” research report means for your tailnet: no confirmed exploitation and no advice to disable Tailscale SSH, but review your exposure and enable Tailnet Lock while fixes land.
18 critical and high security issues in self-hosted software for 31 October to 7 November 2026, including an LXD authentication bypass (CVE-2026-112816) and vulnerabilities in Traefik, Caddy and Keycloak.
11 critical and high security issues in self-hosted software for 29 October to 4 November 2026: an actively exploited WordPress core RCE, a CVSS 10.0 Incus/LXD auth bypass, Traefik, BIND, Caddy and pgAdmin fixes.
CVE-2026-98432 is a CVSS 9.8 use-after-free in the Linux IPv4 TCP handshake, reachable by one unauthenticated SYN on kernels since 4.4. How to patch, and which MPTCP mitigations actually hold up.
10 critical and high security issues in self-hosted software for 22 to 28 October 2026: the actively exploited Brotli “Node2Shell” and Nextcloud Collabora CODE bugs, and a CVSS 10.0 LiteLLM key leak.
Debian security update DSA-6607-1 fixes CVE-2026-109518 in APT, where a man-in-the-middle could swap a package after verification and run code as root. Update to apt 3.0.4 on Debian trixie.