Security Notices

Security Notices
Ubuntu USN-8856-1 Fixes Kdenlive, MLT Vulnerability
09/30/2026

Ubuntu 26.04 Kdenlive and MLT updates fix command execution through malicious project proxy parameters. Update the actual editor and runtime packages, preserving project backups; separately packaged applications need their own supported update channels.

Read this guide
Security Notices
Ubuntu USN-8845-1 Fixes GVfs Vulnerabilities
09/30/2026

Ubuntu GVfs updates fix malicious-SFTP data handling and a separate local ownership flaw with narrower release scope. Update installed backends and libraries, save work and restart user sessions; closing one file-manager window is not sufficient.

Read this guide
Security Notices
Ubuntu USN-8816-3 Fixes Linux kernel (Oracle) Vulnerabilities
09/30/2026

Ubuntu 24.04 Oracle-cloud 7.0 kernel updates require matching standard or 64k binaries and a reboot. Update reusable launch images, check external modules and verify the running kernel; this is not an Oracle Linux update.

Read this guide
Security Notices
Cisco Fixes Exploited Catalyst SD-WAN Manager Authentication Bypass
09/30/2026

Cisco confirms exploitation of a Catalyst SD-WAN Manager authentication bypass. Prioritize on-premises branch updates, restrict management access and preserve evidence; Cisco-managed Cloud Hosted remediation does not establish the state of customer-operated systems.

Read this guide
Security Notices
Debian DSA-6531-1 Updates openssl for Security Vulnerabilities
09/30/2026

Debian 13 OpenSSL updates address protocol, certificate and signing flaws, with private-key recovery limited to particular conditions. Update loaded libraries and restart consumers; the advisory does not establish that every TLS certificate's key has leaked.

Read this guide
Security Notices
Mozilla MFSA 2026-101 Fixes Security Vulnerabilities in Thunderbird 157
09/29/2026

Thunderbird 157 fixes multiple component flaws, including an oversized-email overflow not covered by the usual mail-scripting caveat. Update through the supported channel and restart; ordinary mail delivery does not validate every listed security boundary.

Read this guide
Security Notices
Mozilla MFSA 2026-102 Fixes Security Vulnerabilities in Thunderbird 140.17
09/29/2026

Thunderbird's 140 branch receives these fixes in 140.17; this notice does not require migration to 157. Preserve profiles, update through the supported channel, restart, and retain the oversized-email exception to the general scripting caveat.

Read this guide
Security Notices
Mozilla MFSA 2026-103 Fixes Security Vulnerabilities in Thunderbird 153.4
09/29/2026

Thunderbird 153.4 fixes the listed 153-branch vulnerabilities, including an oversized-email overflow. Update and restart through the approved channel; disabled mail scripting limits many issues but is not a blanket exemption for every mail-related flaw.

Read this guide
Security Notices
Debian DSA-6530-1 Updates pcre2 for a Security Vulnerability
09/29/2026

Debian's PCRE2 backport fixes an out-of-bounds write involving attacker-controlled patterns and certain JIT APIs. Update affected libraries and restart consumers; a lower upstream-looking version does not invalidate Debian's maintained security fix.

Read this guide
Security Notices
Debian DSA-6529-1 Updates libwebsockets for Security Vulnerabilities
09/29/2026

Debian 13 libwebsockets updates address missing validation in HPACK path-header parsing, with denial-of-service or possible code-execution risk. Update the actual consuming libraries and processes; not every WebSocket service uses this implementation or parser path.

Read this guide