FOXBOX SECURITY

Security Watch & Updates

Keep your FoxBox up to date. Follow the security reviews and find the cumulative patch for your software release.

Last verification28 October 2026

Review cadenceWeekly

Patch selectionBy software release

SECURITY WATCH

Latest security publication

28 October 2026

PHP host launcher available with instructions for goofy_pare_mod. The original PHP patch runs inside the application container; the new launcher starts from the host and keeps the original compatibility checks and recovery.

P1Patch available

PHP 7.4 · host/container

An Ubuntu 24.04 host is a different environment from the Ubuntu 20.04 PHP application container. Running the original PHP updater in the host shell triggers its correct base guard.

Vendor versionLauncher 2026.10.27-r1

FoxBox decision

Publish the tested host launcher for the existing PHP module. It reuses the original cumulative payload, verifies the container and package hashes, then runs the PHP update inside the container. No new PHP binaries and no host OS upgrade.

Real offline update and rollback passed in an isolated synthetic application. The host launcher was also checked on the Ubuntu 24.04 demo: PHP was already current, so apply changed no packages or service processes. No customer appliance was updated remotely. This launcher covers PHP only.

RELEASE INSTRUCTIONS

How to update. When to reboot.

For PHP, choose the host launcher or the original in-container method. The cumulative package and separate host OS patch keep their own procedures. Check each procedure for service interruptions and reboot requirements.

Restart requirements for this report
Component / release	Appliance reboot	Service / current condition
PHP 7.4 · host/container`Launcher 2026.10.27-r1`	No host reboot and no Docker container restart.	If PHP needs updating, Apache inside the container stops and starts. Schedule maintenance. Persistent PHP CLI services are drained/reloaded separately if reported.
PHP · start from the Docker host · 2026.10.27-r1 · PHP host launcher	No host reboot and no Docker container restart.	If PHP needs updating, Apache inside the container stops and starts. Schedule maintenance. Persistent PHP CLI services are drained/reloaded separately if reported.
IMPORTANT — Latest customer cumulative security update · Cumulative · 2026.10.26-r1	Not required. No automatic appliance reboot.	Maintenance window: Apache stop/start if PHP changes; MySQL stops and the identified writer containers are suspended during database staging. Persistent PHP CLI services require their application manager. Never use killall.
FoxBox host security updates · 2026.10.19-r2	Required to activate a new kernel, and after an applicable OpenSSL update. Check reboot_required in the result. The program never reboots automatically.	Package scripts may restart services. Refresh SSH and verify a new connection; restart applications that use updated libraries. Schedule a maintenance window.

PHP 7.4 · host/containerLauncher 2026.10.27-r1View steps

Run these commands on the Docker HOST, including Ubuntu 24.04. PHP remains inside goofy_pare_mod: the launcher checks that the application container is Ubuntu 20.04 amd64 with Apache/PHP 7.4. The original cumulative package dated 26 October is also required.

Appliance reboot: No host reboot and no Docker container restart.
Service interruption: If PHP needs updating, Apache inside the container stops and starts. Schedule maintenance. Persistent PHP CLI services are drained/reloaded separately if reported.

On the Docker host, download the original cumulative ZIP 2026.10.26-r1 from its card below and the new PHP host launcher ZIP. Compare each SHA-256 with the value shown on this page, then extract them into two separate folders. Do not edit the original updater or its Ubuntu check.
```
sha256sum foxbox-php74-host-launcher-2026.10.27-r1.zip
sha256sum foxbox-cumulative-update-2026.10.26-r1.zip
```
Put the extracted cumulative files in a folder named foxbox-cumulative-update-2026.10.26-r1. From the parent folder, copy only the new launcher into it and enter that folder. Leave foxbox_php74.py, vendor and tools unchanged.
```
cp foxbox-php74-host-launcher-2026.10.27-r1/foxbox_php74_host.py foxbox-cumulative-update-2026.10.26-r1/
cd foxbox-cumulative-update-2026.10.26-r1
```
Still on the HOST, identify the application environment. The default container name is goofy_pare_mod. Diagnose only reads the container and does not stage or install packages. Check application.os.version_id=20.04 and architecture=amd64. Ubuntu 24.04 on the HOST is allowed.
```
sudo python3 foxbox_php74_host.py diagnose
```
Run the actual PHP check from the HOST. The launcher verifies the original bundle, copies only the public PHP payload into a private container folder if needed and runs the original check there. update_required / exit 2 means an update is needed; it is not an APT failure. Do not chain check and apply with &&.
```
sudo python3 foxbox_php74_host.py check
```
Prepare console access, a maintenance window and protected recovery for this appliance. Apply uses the original customer-specific package/configuration backup and local APT plan. Apache is restarted only when PHP changes. No real SMS/email test send is needed.
```
sudo python3 foxbox_php74_host.py apply --recovery-ready
```
Verify from the HOST. Keep the private checkpoint in the container and a verified protected external copy. If cli_restart_required=true, drain and reload the affected PHP CLI services with their application manager, then repeat check and verify. Never use killall.
```
sudo python3 foxbox_php74_host.py verify
```
If the real application container has a different name, use --container REAL_NAME consistently on every command. If the launcher is outside the original cumulative folder, add --bundle /path/to/foxbox-cumulative-update-2026.10.26-r1. A different container OS/base remains blocked.
For an intentional recovery only, run rollback from the HOST in maintenance. The original updater verifies post-update hashes before restoring that appliance’s previous PHP packages/configuration. A later change blocks rollback. Restoring old packages reopens the vulnerabilities.
```
sudo python3 foxbox_php74_host.py rollback --recovery-ready
```

Completion check: The PHP receipt must report the current web runtime and no pending old CLI runtime. Only PHP is covered by this launcher. CA, MySQL and zlib keep the separate scopes and instructions of the original cumulative release; PHP success is not an overall security PASS.

UPDATE YOUR APPLIANCE

One cumulative patch per release line.

Choose the package for your FoxBox software baseline. Each new cumulative patch checks every previously required correction in that line, so you can start from an earlier patch level. A new FoxBox software version starts a separate line.

01
Identify the release
The model name alone is not enough. Match the FoxBox software version, operating system and hardware requirements in the release notes.
02
Check all prerequisites
The latest package checks the whole cumulative set and stops on an unsupported baseline or unmet requirement. A patch from another release line is not interchangeable.
03
Apply and verify
Follow the package instructions for backup, maintenance and recovery. Kernel changes require a reboot and compatible third-party modules before the update is complete.

Where do I run the PHP patch?

The host and the application container can use different Ubuntu releases. In this setup the host is Ubuntu 24.04 and PHP is in goofy_pare_mod. Choose one PHP method:

PHP method	Where to run it
Original PHP updater · cumulative 26 October`foxbox_php74.py / update-foxbox.sh app`	INSIDE the Ubuntu 20.04 application container containing PHP.
New PHP host launcher`foxbox_php74_host.py`	On the Docker HOST, including Ubuntu 24.04. It executes the original PHP updater inside goofy_pare_mod.

If the original PHP script reports “Supported base: Ubuntu20.04” from an Ubuntu 24.04 host shell, use the host launcher or enter the application container. Do not remove the OS guard. This distinction concerns PHP/app: the cumulative MySQL module and the separate host OS patches retain their own host-side procedures.

PHP · start from the Docker host

Host Docker → goofy_pare_mod application container

Use the PHP patch from the host shell, including an Ubuntu 24.04 host. The existing PHP 7.4 update runs inside the supported Ubuntu 20.04 container. Choose this host method or the original in-container PHP method.

Package 2026.10.27-r1 · PHP host launcher

Patch available

Add-on for the original 2026.10.26-r1 package, not a replacement cumulative ZIP. Includes the full launcher source and instructions. Published here on 28 October.

Download PHP host launcher

SHA-2567c73d897b436ae49c0a54643a8d644b3d2b1cecb3ce1b30ece74b7e6551ebc52

How to use release 2026.10.27-r1 · PHP host launcherView steps

Appliance reboot: No host reboot and no Docker container restart.
Service interruption: If PHP needs updating, Apache inside the container stops and starts. Schedule maintenance. Persistent PHP CLI services are drained/reloaded separately if reported.

On the Docker host, download the original cumulative ZIP 2026.10.26-r1 from its card below and the new PHP host launcher ZIP. Compare each SHA-256 with the value shown on this page, then extract them into two separate folders. Do not edit the original updater or its Ubuntu check.
```
sha256sum foxbox-php74-host-launcher-2026.10.27-r1.zip
sha256sum foxbox-cumulative-update-2026.10.26-r1.zip
```
Put the extracted cumulative files in a folder named foxbox-cumulative-update-2026.10.26-r1. From the parent folder, copy only the new launcher into it and enter that folder. Leave foxbox_php74.py, vendor and tools unchanged.
```
cp foxbox-php74-host-launcher-2026.10.27-r1/foxbox_php74_host.py foxbox-cumulative-update-2026.10.26-r1/
cd foxbox-cumulative-update-2026.10.26-r1
```
Still on the HOST, identify the application environment. The default container name is goofy_pare_mod. Diagnose only reads the container and does not stage or install packages. Check application.os.version_id=20.04 and architecture=amd64. Ubuntu 24.04 on the HOST is allowed.
```
sudo python3 foxbox_php74_host.py diagnose
```
Run the actual PHP check from the HOST. The launcher verifies the original bundle, copies only the public PHP payload into a private container folder if needed and runs the original check there. update_required / exit 2 means an update is needed; it is not an APT failure. Do not chain check and apply with &&.
```
sudo python3 foxbox_php74_host.py check
```
Prepare console access, a maintenance window and protected recovery for this appliance. Apply uses the original customer-specific package/configuration backup and local APT plan. Apache is restarted only when PHP changes. No real SMS/email test send is needed.
```
sudo python3 foxbox_php74_host.py apply --recovery-ready
```
Verify from the HOST. Keep the private checkpoint in the container and a verified protected external copy. If cli_restart_required=true, drain and reload the affected PHP CLI services with their application manager, then repeat check and verify. Never use killall.
```
sudo python3 foxbox_php74_host.py verify
```
If the real application container has a different name, use --container REAL_NAME consistently on every command. If the launcher is outside the original cumulative folder, add --bundle /path/to/foxbox-cumulative-update-2026.10.26-r1. A different container OS/base remains blocked.
For an intentional recovery only, run rollback from the HOST in maintenance. The original updater verifies post-update hashes before restoring that appliance’s previous PHP packages/configuration. A later change blocks rollback. Restoring old packages reopens the vulnerabilities.
```
sudo python3 foxbox_php74_host.py rollback --recovery-ready
```

IMPORTANT — Latest customer cumulative security update

Ubuntu 20.04 LTS · amd64 · Apache/PHP 7.4

Original cumulative release: the app/PHP/CA commands run INSIDE the application container when present. Run its MySQL module on the Docker HOST. For PHP-only operation from the host, use the separate launcher above.

Package Cumulative · 2026.10.26-r1

Patch available

Complete offline binaries and automatic scripts. Read the procedure: the application and MySQL run in different environments. Focal zlib is explicitly pending; no overall security PASS is claimed.

Download cumulative patch

SHA-256449fa227da4904280aa5d01f5baa8bf57d37ff04d4fe5347a134b591eca7c997

Download corresponding source and licenses ↓

SHA-256 · source3ad3dc482bdfb1f054dc1a2ed85c25109985e23ae45c41b53b04e679899f9794

How to use release Cumulative · 2026.10.26-r1View steps

Original 26 October cumulative: Ubuntu 20.04 amd64 Apache/PHP 7.4 in the application environment. The app commands below belong INSIDE the container when PHP is containerized. MySQL commands belong on the Docker HOST.

Appliance reboot: Not required. No automatic appliance reboot.
Service interruption: Maintenance window: Apache stop/start if PHP changes; MySQL stops and the identified writer containers are suspended during database staging. Persistent PHP CLI services require their application manager. Never use killall.

Download the latest cumulative ZIP and verify its published SHA-256 before extraction. Inside the extracted directory verify every included file. The original PHP/CA packages and the complete MySQL 8.4.13 image are included; no update-time download is required.
```
sha256sum -c SHA256SUMS
```
Prepare console access, a maintenance window, sufficient backup/Docker storage and a protected external backup. Identify and safely drain ALL database writers and administrators, including external jobs and services. Read README-EN.txt for compatibility, private recovery and unsupported layouts.
Run the application check where PHP is installed, as root; inside the application container when present. Optional extensions are detected, newer packages are preserved.
```
sudo sh ./update-foxbox.sh app check
```
After preparing recovery, update missing PHP/CA packages. The updater backs up that appliance’s original packages and configuration, checks a local-only APT plan and restarts Apache only if PHP changes. CA changes rebuild system trust and preserve local CA files.
```
sudo sh ./update-foxbox.sh app apply --recovery-ready
```
Verify PHP and active CA revocation. If cli_restart_required=true, drain/reload persistent PHP CLI services through their actual application manager and repeat check. Verify TLS paths after CA revocation. Exit3 / PARTIAL_VENDOR_ZLIB_PENDING is deliberate: Canonical has not qualified a Focal zlib fix.
```
sudo sh ./update-foxbox.sh app verify
```
On the Docker host, replace foxbox-db and foxbox-app with actual container names and list every writer. Stage the MySQL update. If the default bridge is attached, first verify that its dynamic address is not used as a fixed endpoint, then add --default-bridge-address-dynamic. No implicit branch migration.
```
sh ./update-foxbox.sh mysql check --db-container foxbox-db
sh ./update-foxbox.sh mysql apply --db-container foxbox-db --writers foxbox-app --maintenance-ready
```
STAGED_READ_ONLY keeps writers suspended. The script preserves the original container/volume, creates logical and cold physical backups, restores into a new volume, preserves MEMORY data and the original server/client configuration, then checks the upgraded server, tables, networks and ports. Verify and copy the private checkpoint to protected external storage before reopening writes. Use the same operator/home throughout.
```
sh ./update-foxbox.sh mysql verify --db-container foxbox-db
```
After validation, commit reopens writes and resumes the listed containers. Check actual application daemons, login, read-only database access and queue health. Never generate real test messages/orders. From commit onward automatic rollback is blocked to protect newer transactions.
```
sh ./update-foxbox.sh mysql commit --db-container foxbox-db
sh ./update-foxbox.sh mysql verify --db-container foxbox-db
```
App recovery restores the customer’s original packages only if post-update hashes still match. MySQL rollback is available only before commit, with writers still suspended: it restores the original image and original volume, including MEMORY contents. It never starts an older MySQL on upgraded data. After writes resume a separate recovery plan must preserve newer transactions.
```
sudo sh ./update-foxbox.sh app rollback --recovery-ready
# MySQL: only BEFORE commit / solo PRIMA della commit
sh ./update-foxbox.sh mysql rollback --db-container foxbox-db --maintenance-ready
```

Completion check: PHP/CA and MySQL have separate verification receipts. Focal zlib remains UNKNOWN until Canonical publishes an applicable fix; no overall security PASS is claimed. Preserve private recovery and previous download versions. No automatic host reboot.

FoxBox host security updates

Ubuntu 24.04 LTS · amd64

Cumulative requirements from the weekly reviews of 7 September–18 October 2026: OpenSSH, curl, urllib3, PolicyKit, nginx, sudo, libxml2, OpenSSL, Expat and OpenVPN, where installed. Kernel GA generic 6.8 has separate reboot and module checks. Databases and containers use their own update procedures.

Package 2026.10.19-r2

Patch available

The patch updates applicable Ubuntu host packages and checks all previous requirements in this line. Already current packages are kept. The program reports any required reboot and never reboots automatically.

Download cumulative patch

SHA-256faf596db24ab3b27c7bafda7e80b4c8dc560272f589e76ac0da6e9060eef2219

How to use release 2026.10.19-r2View steps

Ubuntu 24.04 LTS amd64 host, generic GA 6.8 kernel. Includes the applicable installed Ubuntu packages listed above. Run on the host. Database, container, application and third-party driver updates follow their own procedures.

Appliance reboot: Required to activate a new kernel, and after an applicable OpenSSL update. Check reboot_required in the result. The program never reboots automatically.
Service interruption: Package scripts may restart services. Refresh SSH and verify a new connection; restart applications that use updated libraries. Schedule a maintenance window.

Download the ZIP and compare its complete SHA-256 with the checksum above. Stop if it differs.
```
sha256sum foxbox-security-update-2026.10.19-r2.zip
```

Extract into a new private working directory outside the webroot. Verify every included file; all entries in SHA256SUMS must report OK.

umask 077
unzip foxbox-security-update-2026.10.19-r2.zip -d foxbox-security-update-2026.10.19-r2
cd foxbox-security-update-2026.10.19-r2
sha256sum -c SHA256SUMS

Check installed versions and the supported baseline. The local report identifies packages to update and whether a reboot is pending. Read README-EN.txt for prerequisites and recovery.
```
/usr/bin/python3 foxbox_security.py check
```
Prepare a maintenance window, a second administrative connection and console/recovery access. Changes require root, system Python with python3-apt, authenticated Ubuntu repositories, a consistent dpkg state and 2 GiB free for the protected backup. A kernel installation also requires 1 GiB free in /boot and supported in-tree modules. Held packages below the required version, DKMS, external modules, HWE kernels or unavailable recovery packages stop the operation.
Apply the cumulative patch. It verifies versions, package sources and the APT plan before installing. If all required packages are already current, it returns already_up_to_date. Previous patch ZIPs are not needed.
```
sudo /usr/bin/python3 foxbox_security.py apply
```
Read packages_changed, reboot_required, reboot_performed and private_snapshot in the result. Refresh SSH after a successful configuration check, open a new independent SSH connection and verify the affected services. If reboot_required is true, perform the controlled reboot in the maintenance window, then check the kernel, modem paths and application. Run check again.
```
sudo /usr/sbin/sshd -t && sudo systemctl restart ssh.service
/usr/bin/python3 foxbox_security.py check
```

Completion check: Exit code 0: check complete or apply succeeded/already current; 2: check requires action or reboot; 3: unsupported baseline; 4: error or missing prerequisite. If apply reports a partial change, keep its private snapshot and follow the recovery instructions in the README before retrying.

DATED RECORDS

Report archive

Browse earlier reviews with their original dates and component decisions. For an update today, use the latest compatible cumulative patch, which checks the requirements from previous reviews too.

28 October 2026PHP update guide: Docker host or application containerRead report

First published here: 28 October 2026

P1 · PHP 7.4 · host/containerLauncher 2026.10.27-r1
An Ubuntu 24.04 host is a different environment from the Ubuntu 20.04 PHP application container. Running the original PHP updater in the host shell triggers its correct base guard.
Publish the tested host launcher for the existing PHP module. It reuses the original cumulative payload, verifies the container and package hashes, then runs the PHP update inside the container. No new PHP binaries and no host OS upgrade.
Procedure and reboot requirements at the report date
Run these commands on the Docker HOST, including Ubuntu 24.04. PHP remains inside goofy_pare_mod: the launcher checks that the application container is Ubuntu 20.04 amd64 with Apache/PHP 7.4. The original cumulative package dated 26 October is also required.
Appliance reboot
No host reboot and no Docker container restart.
Service interruption
If PHP needs updating, Apache inside the container stops and starts. Schedule maintenance. Persistent PHP CLI services are drained/reloaded separately if reported.
1. On the Docker host, download the original cumulative ZIP 2026.10.26-r1 from its card below and the new PHP host launcher ZIP. Compare each SHA-256 with the value shown on this page, then extract them into two separate folders. Do not edit the original updater or its Ubuntu check.
```
sha256sum foxbox-php74-host-launcher-2026.10.27-r1.zip
sha256sum foxbox-cumulative-update-2026.10.26-r1.zip
```
2. Put the extracted cumulative files in a folder named foxbox-cumulative-update-2026.10.26-r1. From the parent folder, copy only the new launcher into it and enter that folder. Leave foxbox_php74.py, vendor and tools unchanged.
```
cp foxbox-php74-host-launcher-2026.10.27-r1/foxbox_php74_host.py foxbox-cumulative-update-2026.10.26-r1/
cd foxbox-cumulative-update-2026.10.26-r1
```
3. Still on the HOST, identify the application environment. The default container name is goofy_pare_mod. Diagnose only reads the container and does not stage or install packages. Check application.os.version_id=20.04 and architecture=amd64. Ubuntu 24.04 on the HOST is allowed.
```
sudo python3 foxbox_php74_host.py diagnose
```
4. Run the actual PHP check from the HOST. The launcher verifies the original bundle, copies only the public PHP payload into a private container folder if needed and runs the original check there. update_required / exit 2 means an update is needed; it is not an APT failure. Do not chain check and apply with &&.
```
sudo python3 foxbox_php74_host.py check
```
5. Prepare console access, a maintenance window and protected recovery for this appliance. Apply uses the original customer-specific package/configuration backup and local APT plan. Apache is restarted only when PHP changes. No real SMS/email test send is needed.
```
sudo python3 foxbox_php74_host.py apply --recovery-ready
```
6. Verify from the HOST. Keep the private checkpoint in the container and a verified protected external copy. If cli_restart_required=true, drain and reload the affected PHP CLI services with their application manager, then repeat check and verify. Never use killall.
```
sudo python3 foxbox_php74_host.py verify
```
7. If the real application container has a different name, use --container REAL_NAME consistently on every command. If the launcher is outside the original cumulative folder, add --bundle /path/to/foxbox-cumulative-update-2026.10.26-r1. A different container OS/base remains blocked.
8. For an intentional recovery only, run rollback from the HOST in maintenance. The original updater verifies post-update hashes before restoring that appliance’s previous PHP packages/configuration. A later change blocks rollback. Restoring old packages reopens the vulnerabilities.
```
sudo python3 foxbox_php74_host.py rollback --recovery-ready
```
Completion check: The PHP receipt must report the current web runtime and no pending old CLI runtime. Only PHP is covered by this launcher. CA, MySQL and zlib keep the separate scopes and instructions of the original cumulative release; PHP success is not an overall security PASS.

Official sources

26 October 2026Cumulative security update: MySQL 8.4, PHP 7.4 and CA revocationRead report

First published here: 26 October 2026

Offline customer package for Ubuntu 20.04 amd64 Apache/PHP 7.4, with a separate staged MySQL 8.4 Docker module, private backups and protected recovery. Focal zlib remains under vendor evaluation.

P1 · MySQL Community8.48.4.13
The20October Critical Patch Update applies to affected Community8.4 versions through8.4.12.8.4.13 is the fixed release for this branch.
Offline8.4.13 module, cold/logical backup, isolated restore, verification and protected pre-commit rollback. Other branches or layouts require separate qualification.
Procedure and reboot requirements at the report date
Existing standalone MySQL Community8.4 Docker deployment; supported layout described in the package README.
Appliance reboot
Not required. No automatic appliance reboot.
Service interruption
Maintenance window: Apache stop/start if PHP changes; MySQL stops and the identified writer containers are suspended during database staging. Persistent PHP CLI services require their application manager. Never use killall.
1. On the Docker host, replace foxbox-db and foxbox-app with actual container names and list every writer. Stage the MySQL update. If the default bridge is attached, first verify that its dynamic address is not used as a fixed endpoint, then add --default-bridge-address-dynamic. No implicit branch migration.
```
sh ./update-foxbox.sh mysql check --db-container foxbox-db
sh ./update-foxbox.sh mysql apply --db-container foxbox-db --writers foxbox-app --maintenance-ready
```
2. STAGED_READ_ONLY keeps writers suspended. The script preserves the original container/volume, creates logical and cold physical backups, restores into a new volume, preserves MEMORY data and the original server/client configuration, then checks the upgraded server, tables, networks and ports. Verify and copy the private checkpoint to protected external storage before reopening writes. Use the same operator/home throughout.
```
sh ./update-foxbox.sh mysql verify --db-container foxbox-db
```
3. After validation, commit reopens writes and resumes the listed containers. Check actual application daemons, login, read-only database access and queue health. Never generate real test messages/orders. From commit onward automatic rollback is blocked to protect newer transactions.
```
sh ./update-foxbox.sh mysql commit --db-container foxbox-db
sh ./update-foxbox.sh mysql verify --db-container foxbox-db
```
4. App recovery restores the customer’s original packages only if post-update hashes still match. MySQL rollback is available only before commit, with writers still suspended: it restores the original image and original volume, including MEMORY contents. It never starts an older MySQL on upgraded data. After writes resume a separate recovery plan must preserve newer transactions.
```
sudo sh ./update-foxbox.sh app rollback --recovery-ready
# MySQL: only BEFORE commit / solo PRIMA della commit
sh ./update-foxbox.sh mysql rollback --db-container foxbox-db --maintenance-ready
```
Completion check: PHP/CA and MySQL have separate verification receipts. Focal zlib remains UNKNOWN until Canonical publishes an applicable fix; no overall security PASS is claimed. Preserve private recovery and previous download versions. No automatic host reboot.
P1 · PHP 7.4 · Ubuntu 20.047.4.3-4ubuntu2.29+esm5
CVE-2026-109618 and CVE-2026-109619 allow remote code execution in affected PHP configurations. The Ubuntu Focal fix is retained in this cumulative release.
Detect installed extensions and active runtimes; update only missing official PHP variants. Already corrected installations are verified without forced reinstall.
Procedure and reboot requirements at the report date
Ubuntu 20.04 amd64, Apache mod_php7.4/prefork and Ubuntu PHP 7.4 CLI. Run inside the application container when applicable.
Appliance reboot
Not required. No automatic appliance reboot.
Service interruption
Apache stop/start only if PHP changes; reload persistent CLI services when flagged.
1. Run the application check where PHP is installed, as root; inside the application container when present. Optional extensions are detected, newer packages are preserved.
```
sudo sh ./update-foxbox.sh app check
```
2. After preparing recovery, update missing PHP/CA packages. The updater backs up that appliance’s original packages and configuration, checks a local-only APT plan and restarts Apache only if PHP changes. CA changes rebuild system trust and preserve local CA files.
```
sudo sh ./update-foxbox.sh app apply --recovery-ready
```
3. Verify PHP and active CA revocation. If cli_restart_required=true, drain/reload persistent PHP CLI services through their actual application manager and repeat check. Verify TLS paths after CA revocation. Exit3 / PARTIAL_VENDOR_ZLIB_PENDING is deliberate: Canonical has not qualified a Focal zlib fix.
```
sudo sh ./update-foxbox.sh app verify
```
Completion check: All installed PHP variants and active web/CLI runtimes must be current.
P1 · Ubuntu 20.04 · CA certificates20240203~20.04.1ubuntu0.1~esm2
USN-8944-2 removes trust in emSign ECC Root CA-G3 and Comodo AAA Services root following an intermediate-certificate compromise.
Install the original Focal CA package offline and verify actual active trust, preserving local CA configuration. Review any custom copies of revoked roots.
Procedure and reboot requirements at the report date
Ubuntu 20.04 amd64, Apache mod_php7.4/prefork and Ubuntu PHP 7.4 CLI. Run inside the application container when applicable.
Appliance reboot
Not required. No automatic appliance reboot.
Service interruption
Trust store rebuilt; check TLS paths and application-specific trust caches.
1. After preparing recovery, update missing PHP/CA packages. The updater backs up that appliance’s original packages and configuration, checks a local-only APT plan and restarts Apache only if PHP changes. CA changes rebuild system trust and preserve local CA files.
```
sudo sh ./update-foxbox.sh app apply --recovery-ready
```
2. Verify PHP and active CA revocation. If cli_restart_required=true, drain/reload persistent PHP CLI services through their actual application manager and repeat check. Verify TLS paths after CA revocation. Exit3 / PARTIAL_VENDOR_ZLIB_PENDING is deliberate: Canonical has not qualified a Focal zlib fix.
```
sudo sh ./update-foxbox.sh app verify
```
Completion check: Both compromised roots must be absent from active system trust; custom copies require review.
P2 · Ubuntu 20.04 · zlibCVE-2026-85091
Heap buffer overflow. Canonical lists Focal as Needs evaluation. USN-8954-1 provides a Noble fix; it does not specify a corrected Focal package. Embedded copies in rsync, klibc and zsync are listed as Vulnerable; when installed they remain pending.
UNKNOWN for Ubuntu 20.04. No unqualified/cross-release binary is installed. The cumulative script keeps this requirement pending rather than reporting a false global PASS.
Procedure and reboot requirements at the report date
Ubuntu 20.04/Focal zlib, separately from Ubuntu 24.04/Noble.
Appliance reboot
No Focal patch is installed by this release.
Service interruption
Vendor assessment pending. Noble fixed version does not establish Focal coverage.
1. Check the official CVE release status. Keep the installed Focal package and await a qualified cumulative revision; do not mix Ubuntu releases.
Completion check: UNKNOWN / Needs evaluation for Focal as of26October2026.

Qualification covers the documented baselines and component checks. It does not demonstrate installation on every customer appliance or SMS/email delivery. Focal zlib coverage remains pending.

Official sources

22 October 2026IMPORTANT: PHP security update — customer downloadRead report

IMPORTANT — Update the PHP runtime serving your FoxBox web interface. CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated remote code execution. Both advisories are rated Critical, CVSS v4.0 9.2. Select the correction for your actual distribution and PHP branch.

Source weekly review: 22 October 2026

CRITICAL · 9.2 · PHP · CVE-2026-109618Ubuntu 20.04 PHP 7.4: 7.4.3-4ubuntu2.29+esm5
Memory corruption when request handling runs out of memory can lead to remote code execution. PHP identifies Apache mod_php as the highest-risk deployment.
Update the installed PHP 7.4 runtime and extensions using the official Ubuntu 20.04 backport, then restart and verify Apache. For upstream PHP 8.2/8.3/8.4/8.5 use 8.2.35/8.3.36/8.4.27/8.5.12 or later corrected releases; distribution versions differ.
Procedure and reboot requirements at the report date
FoxBox customer appliances: Ubuntu 20.04 amd64, Apache mod_php7.4/prefork and PHP 7.4 CLI from Ubuntu packages. Run where PHP is installed, inside the application container when applicable. Installed extensions are detected automatically. FPM/embed, PPA/custom binary builds and other platforms require separate qualification.
Appliance reboot
Not required. The program never reboots the appliance. Any previously pending kernel reboot is separate.
Service interruption
Brief web interruption: full stop/start of Apache through its service manager, with old-process exit and current PHP module checks. Other services are preserved.
1. Download the PHP 7.4 update ZIP below. It includes the automatic updater and original corrected packages; no UbuntuPro credentials are required on the appliance. Compare the complete SHA256 with this page.
```
sha256sum foxbox-php74-update-2026.10.22-r1.zip
```
2. Extract in a new private directory outside the webroot and verify every included file. Run inside the application environment as root.
```
umask 077
unzip foxbox-php74-update-2026.10.22-r1.zip -d foxbox-php74-update-2026.10.22-r1
cd foxbox-php74-update-2026.10.22-r1
sha256sum -c SHA256SUMS
```
3. Run the read-only compatibility check. The tool detects installed PHP 7.4 source packages, verifies packaged files and preserves absent optional extensions and newer revisions. Read README-EN.txt.
```
python3 foxbox_php74.py check
```
4. Arrange a maintenance window, a second administrative session, external backup and console/recovery access. Root, Python 3.8+, APT/dpkg, full perl and 512 MiB free are required. Unknown/custom runtimes, holds or unrelated dependencies stop the operation.
5. Apply the update. It first creates private recovery packages from this appliance, saves configuration/runtime hashes, and simulates an offline plan. It installs only existing PHP components, preserves local configuration and fully stops/starts only Apache. No host reboot or real messages.
```
python3 foxbox_php74.py apply --recovery-ready
```
6. Check the result, web login and read-only DB connection. PHP may still display7.4.3: the full package revision must be7.4.3-4ubuntu2.29+esm5. No real SMS/email delivery test.
```
python3 foxbox_php74.py check
python3 foxbox_php74.py verify
```
7. If cli_restart_required is true, existing CLI daemons still hold old PHP in memory. Use the controlled service restart procedure for your application version, preserving queues/data, then repeat check. The updater reports this action and never terminates SMS daemons blindly.
8. Emergency recovery only: rollback compares the current state with the recorded post-install state, then restores the original packages saved from this appliance. It blocks on drift and preserves current business data. Rollback reintroduces the CVEs. Keep the private checkpoint out of the webroot.
```
python3 foxbox_php74.py rollback
```
Completion check: Success requires corrected full package revisions, a refreshed web runtime and preserved configuration/extensions. Check the login page and read-only DB connectivity. Already current returns already_up_to_date without reinstalling or restarting. On a partial APT failure, preserve the private checkpoint and follow README recovery before retrying. Check cli_restart_required: false means no old CLI runtime was observed.
CRITICAL · 9.2 · PHP · CVE-2026-109619Ubuntu 20.04 PHP 7.4: 7.4.3-4ubuntu2.29+esm5
Internal request state may outlive freed memory and be reused by a later request in the same worker, with possible remote code execution.
Update the installed PHP 7.4 runtime and extensions using the official Ubuntu 20.04 backport, then restart and verify Apache. For upstream PHP 8.2/8.3/8.4/8.5 use 8.2.35/8.3.36/8.4.27/8.5.12 or later corrected releases; distribution versions differ.
Procedure and reboot requirements at the report date
FoxBox customer appliances: Ubuntu 20.04 amd64, Apache mod_php7.4/prefork and PHP 7.4 CLI from Ubuntu packages. Run where PHP is installed, inside the application container when applicable. Installed extensions are detected automatically. FPM/embed, PPA/custom binary builds and other platforms require separate qualification.
Appliance reboot
Not required. The program never reboots the appliance. Any previously pending kernel reboot is separate.
Service interruption
Brief web interruption: full stop/start of Apache through its service manager, with old-process exit and current PHP module checks. Other services are preserved.
1. Download the PHP 7.4 update ZIP below. It includes the automatic updater and original corrected packages; no UbuntuPro credentials are required on the appliance. Compare the complete SHA256 with this page.
```
sha256sum foxbox-php74-update-2026.10.22-r1.zip
```
2. Extract in a new private directory outside the webroot and verify every included file. Run inside the application environment as root.
```
umask 077
unzip foxbox-php74-update-2026.10.22-r1.zip -d foxbox-php74-update-2026.10.22-r1
cd foxbox-php74-update-2026.10.22-r1
sha256sum -c SHA256SUMS
```
3. Run the read-only compatibility check. The tool detects installed PHP 7.4 source packages, verifies packaged files and preserves absent optional extensions and newer revisions. Read README-EN.txt.
```
python3 foxbox_php74.py check
```
4. Arrange a maintenance window, a second administrative session, external backup and console/recovery access. Root, Python 3.8+, APT/dpkg, full perl and 512 MiB free are required. Unknown/custom runtimes, holds or unrelated dependencies stop the operation.
5. Apply the update. It first creates private recovery packages from this appliance, saves configuration/runtime hashes, and simulates an offline plan. It installs only existing PHP components, preserves local configuration and fully stops/starts only Apache. No host reboot or real messages.
```
python3 foxbox_php74.py apply --recovery-ready
```
6. Check the result, web login and read-only DB connection. PHP may still display7.4.3: the full package revision must be7.4.3-4ubuntu2.29+esm5. No real SMS/email delivery test.
```
python3 foxbox_php74.py check
python3 foxbox_php74.py verify
```
7. If cli_restart_required is true, existing CLI daemons still hold old PHP in memory. Use the controlled service restart procedure for your application version, preserving queues/data, then repeat check. The updater reports this action and never terminates SMS daemons blindly.
8. Emergency recovery only: rollback compares the current state with the recorded post-install state, then restores the original packages saved from this appliance. It blocks on drift and preserves current business data. Rollback reintroduces the CVEs. Keep the private checkpoint out of the webroot.
```
python3 foxbox_php74.py rollback
```
Completion check: Success requires corrected full package revisions, a refreshed web runtime and preserved configuration/extensions. Check the login page and read-only DB connectivity. Already current returns already_up_to_date without reinstalling or restarting. On a partial APT failure, preserve the private checkpoint and follow README recovery before retrying. Check cli_restart_required: false means no old CLI runtime was observed.

Automatic customer update for the Ubuntu 20.04 amd64 Apache/PHP 7.4 appliance baseline. Uses installed-package detection and private appliance-specific recovery; custom application changes still require compatibility review. This emergency correction does not restore general upstream PHP 7.4 support. The Ubuntu 24.04 host update remains a separate download.

Official sources

22 October 2026IMPORTANT: critical PHP security updateRead report

Source weekly review: 22 October 2026

CRITICAL · 9.2 · PHP · CVE-2026-109618Ubuntu 20.04 PHP 7.4: 7.4.3-4ubuntu2.29+esm5
Memory corruption when request handling runs out of memory can lead to remote code execution. PHP identifies Apache mod_php as the highest-risk deployment.
Update the installed PHP 7.4 runtime and extensions using the official Ubuntu 20.04 backport, then restart and verify Apache. For upstream PHP 8.2/8.3/8.4/8.5 use 8.2.35/8.3.36/8.4.27/8.5.12 or later corrected releases; distribution versions differ.
Procedure and reboot requirements at the report date
Ubuntu 20.04 amd64 application container, Apache mod_php 7.4 and installed matching extensions. Obtain packages through authorised Ubuntu Pro/ESM access. Different distributions, PHP branches and appliance versions need separate qualification.
Appliance reboot
Not required for this PHP update. Any previously pending kernel reboot is separate.
Service interruption
Apache must restart so all workers load the corrected PHP runtime. A short web interruption is possible; CLI processes that stay running must also be refreshed.
1. Identify the application container, OS, architecture, web SAPI and installed PHP extensions. This procedure is for Ubuntu 20.04 amd64 with Apache mod_php 7.4. Do not run the Ubuntu 24.04 host patch inside this container.
```
cat /etc/os-release
dpkg --print-architecture
php -v
php -m
apache2ctl -M
dpkg-query -W -f='${db:Status-Abbrev} ${Package} ${Version}\n' 'php7.4*' 'libapache2-mod-php7.4'
```
2. Arrange a maintenance window and recovery access. Save PHP/Apache configuration, runtime hashes and the exact original packages in a private directory outside the webroot. Verify package restoration on an isolated container without production data, modems, queues or outgoing transports. Do not restore a database or SMS spool to roll back PHP.
3. Obtain the official Ubuntu Pro/ESM packages for the matching baseline using your authorised subscription. Ubuntu 20.04 requires php7.4 source-package revision 7.4.3-4ubuntu2.29+esm5 or later with both CVEs fixed. Keep credentials private. If the signed repository does not offer the correction, stop and contact support; a successful upgrade of the old public repository is not proof of remediation.
```
apt-cache policy libapache2-mod-php7.4 php7.4-cli php7.4-common
apt-mark showhold
```
4. Build the list from installed PHP 7.4 runtime packages only; absent optional extensions must remain absent. Check signed APT origins and SHA-256 for every package. Simulate the exact local package set before installation. Reject removals, new packages, branch changes, unsatisfied dependencies or unrelated upgrades.
```
# Run from the private directory containing ONLY the reviewed .deb files.
sha256sum -c SHA256SUMS
apt-get --simulate --no-remove --no-install-recommends install ./*.deb
```
5. After the isolated update and rollback tests pass, reread live package/configuration hashes and review the live APT plan. Apply only the approved local packages. Preserve existing configuration; stop on unexpected prompts. Package scripts may restart Apache, so coordinate service interruption and never restart the entire appliance automatically.
```
sudo apt-get --no-remove --no-install-recommends install ./*.deb
sudo apache2ctl configtest
```
6. After Syntax OK, refresh Apache in the maintenance window and confirm that every old worker has exited. Verify the web SAPI as well as CLI, the exact Debian package revisions, loaded extensions, login page and read-only database connectivity. Delete any temporary local-only diagnostic endpoint immediately. Do not send a real SMS or email as a check.
```
sudo apache2ctl -k restart
php -v
php -m
dpkg-query -W -f='${db:Status-Abbrev} ${Package} ${Version}\n' 'php7.4*' 'libapache2-mod-php7.4'
```
7. If checks fail, compare current hashes with the recorded post-update manifest. Only if they match, restore the saved original PHP packages with the reviewed downgrade plan and original configuration, then restart Apache and repeat checks. Stop on editor or package drift; preserve all current business data. A rollback reintroduces these vulnerabilities and is an emergency recovery step.
Completion check: The correction is established by the vendor package revision and refreshed web workers, not by the visible PHP 7.4.3 number alone. Test the supported appliance workflow without real message delivery. The host cumulative ZIP below does not update application containers.
CRITICAL · 9.2 · PHP · CVE-2026-109619Ubuntu 20.04 PHP 7.4: 7.4.3-4ubuntu2.29+esm5
Internal request state may outlive freed memory and be reused by a later request in the same worker, with possible remote code execution.
Update the installed PHP 7.4 runtime and extensions using the official Ubuntu 20.04 backport, then restart and verify Apache. For upstream PHP 8.2/8.3/8.4/8.5 use 8.2.35/8.3.36/8.4.27/8.5.12 or later corrected releases; distribution versions differ.
Procedure and reboot requirements at the report date
Ubuntu 20.04 amd64 application container, Apache mod_php 7.4 and installed matching extensions. Obtain packages through authorised Ubuntu Pro/ESM access. Different distributions, PHP branches and appliance versions need separate qualification.
Appliance reboot
Not required for this PHP update. Any previously pending kernel reboot is separate.
Service interruption
Apache must restart so all workers load the corrected PHP runtime. A short web interruption is possible; CLI processes that stay running must also be refreshed.
1. Identify the application container, OS, architecture, web SAPI and installed PHP extensions. This procedure is for Ubuntu 20.04 amd64 with Apache mod_php 7.4. Do not run the Ubuntu 24.04 host patch inside this container.
```
cat /etc/os-release
dpkg --print-architecture
php -v
php -m
apache2ctl -M
dpkg-query -W -f='${db:Status-Abbrev} ${Package} ${Version}\n' 'php7.4*' 'libapache2-mod-php7.4'
```
2. Arrange a maintenance window and recovery access. Save PHP/Apache configuration, runtime hashes and the exact original packages in a private directory outside the webroot. Verify package restoration on an isolated container without production data, modems, queues or outgoing transports. Do not restore a database or SMS spool to roll back PHP.
3. Obtain the official Ubuntu Pro/ESM packages for the matching baseline using your authorised subscription. Ubuntu 20.04 requires php7.4 source-package revision 7.4.3-4ubuntu2.29+esm5 or later with both CVEs fixed. Keep credentials private. If the signed repository does not offer the correction, stop and contact support; a successful upgrade of the old public repository is not proof of remediation.
```
apt-cache policy libapache2-mod-php7.4 php7.4-cli php7.4-common
apt-mark showhold
```
4. Build the list from installed PHP 7.4 runtime packages only; absent optional extensions must remain absent. Check signed APT origins and SHA-256 for every package. Simulate the exact local package set before installation. Reject removals, new packages, branch changes, unsatisfied dependencies or unrelated upgrades.
```
# Run from the private directory containing ONLY the reviewed .deb files.
sha256sum -c SHA256SUMS
apt-get --simulate --no-remove --no-install-recommends install ./*.deb
```
5. After the isolated update and rollback tests pass, reread live package/configuration hashes and review the live APT plan. Apply only the approved local packages. Preserve existing configuration; stop on unexpected prompts. Package scripts may restart Apache, so coordinate service interruption and never restart the entire appliance automatically.
```
sudo apt-get --no-remove --no-install-recommends install ./*.deb
sudo apache2ctl configtest
```
6. After Syntax OK, refresh Apache in the maintenance window and confirm that every old worker has exited. Verify the web SAPI as well as CLI, the exact Debian package revisions, loaded extensions, login page and read-only database connectivity. Delete any temporary local-only diagnostic endpoint immediately. Do not send a real SMS or email as a check.
```
sudo apache2ctl -k restart
php -v
php -m
dpkg-query -W -f='${db:Status-Abbrev} ${Package} ${Version}\n' 'php7.4*' 'libapache2-mod-php7.4'
```
7. If checks fail, compare current hashes with the recorded post-update manifest. Only if they match, restore the saved original PHP packages with the reviewed downgrade plan and original configuration, then restart Apache and repeat checks. Stop on editor or package drift; preserve all current business data. A rollback reintroduces these vulnerabilities and is an emergency recovery step.
Completion check: The correction is established by the vendor package revision and refreshed web workers, not by the visible PHP 7.4.3 number alone. Test the supported appliance workflow without real message delivery. The host cumulative ZIP below does not update application containers.

Vendor security backports can retain the PHP 7.4.3 base version: check the full package revision. PHP 8.1 and older are outside upstream support; this emergency correction does not restore general upstream support. The existing Ubuntu 24.04 host patch remains available separately and does not patch PHP inside containers.

Official sources

19 October 2026Security update notes — October 2026Read report

First published here: 19 October 2026

Security priorities from the 12–18 October weekly review, checked against official sources on 19 October. Choose the update procedure for the matching operating system and component.

Source weekly review: 18 October 2026

P1 · Ubuntu 24.04 / OpenSSH1:9.6p1-3ubuntu13.20
Canonical published fixes for nine vulnerabilities on 14 October. The advisory covers the Ubuntu 24.04 OpenSSH client and server packages.
Update installed Ubuntu 24.04 SSH packages to the fixed version or later, then verify a fresh administrative connection.
Procedure and reboot requirements at the report date
Ubuntu 24.04 host packages only. Use an existing authorized administrative account, preserve the current SSH configuration and keep two independent SSH sessions open with a recovery path available. If installed packages and the active service already meet the target, no reinstall is necessary.
Appliance reboot
Normally no, for the OpenSSH package update itself.
Service interruption
SSH may restart during the update. Existing sessions are not a guaranteed recovery channel; verify a fresh connection before closing them.
1. Confirm that this is the Ubuntu 24.04 host, not the application container. Check the installed SSH packages. Stop if the operating-system baseline differs.
```
cat /etc/os-release
dpkg-query -W -f='${Package} ${Version}\n' openssh-client openssh-server openssh-sftp-server
```
2. With a backup and recovery path available, refresh signed APT indexes. This changes package indexes; it does not install an update.
```
sudo apt-get update
```
3. Simulate the scoped upgrade. Review the versions, dependencies, held packages and package list. Do not continue if APT proposes unexpected changes or the candidate is below 1:9.6p1-3ubuntu13.20.
```
sudo apt-get --simulate --only-upgrade --no-remove install openssh-client openssh-server openssh-sftp-server
```
4. After reviewing the simulation, apply the scoped upgrade in the maintenance window. Review the actual plan again because simulation does not lock APT. Read any configuration prompt and preserve the deployed SSH access policy. Prompts are not auto-accepted.
```
sudo apt-get --only-upgrade --no-remove install openssh-client openssh-server openssh-sftp-server
```
5. Validate the SSH configuration, then refresh the SSH service only if validation succeeds. This may interrupt administrative access, so keep the independent recovery path ready.
```
sudo /usr/sbin/sshd -t && sudo systemctl restart ssh.service
```
6. Check the installation state and minimum version for every applicable package. Stop on REPAIR REQUIRED or UPDATE REQUIRED; absent packages are reported and left absent. Then open a separate new SSH connection through the normal administrative path and test configured key restrictions and forwarding.
```
for package in openssh-client openssh-server openssh-sftp-server; do
  state=$(dpkg-query -W -f='${db:Status-Abbrev}' "$package") || {
    printf '%s: NOT INSTALLED\n' "$package"; continue;
  }
  case "$state" in
    'ii '|'hi ') ;;
    *) printf '%s: REPAIR REQUIRED (%s)\n' "$package" "$state"; continue ;;
  esac
  version=$(dpkg-query -W -f='${Version}' "$package") || continue
  if dpkg --compare-versions "$version" ge '1:9.6p1-3ubuntu13.20'; then
    printf '%s: OK (%s)\n' "$package" "$version"
  else
    printf '%s: UPDATE REQUIRED (%s)\n' "$package" "$version"
  fi
done
```
Completion check: The version check and a fresh working SSH connection must pass. Installed package versions alone do not prove the running service was refreshed. A reboot requested by another system update must be handled separately.
P1 · Ubuntu 24.04 / Kernel6.8.0-147.147
The 13 October update changes the kernel ABI. Canonical requires a reboot and compatible third-party modules.
Plan the kernel change and controlled reboot after checking the applicable DKMS modules, modem drivers and recovery path. An installed kernel is only active after a successful boot into that version.
Procedure and reboot requirements at the report date
Ubuntu 24.04 GA generic kernel 6.8.0-147.147. Installation and reboot are separate steps; schedule both against the actual hardware and recovery requirements.
Appliance reboot
Yes. Required to activate the installed new kernel. Schedule a maintenance window.
Service interruption
A host reboot interrupts appliance services. DKMS, third-party drivers and modem compatibility must be qualified first.
1. Compare the running kernel with the installed package. An installed package is not an active kernel.
```
uname -r
dpkg-query -W -f='${Package} ${Version}\n' linux-image-6.8.0-147-generic
```
2. Before installing or rebooting, verify boot recovery, the previous bootable kernel and applicable DKMS/third-party modules, including bl_noah where present. Absence of the dkms command does not prove compatibility.
3. Verify module build and load, modem detection, QMI/serial interfaces, network and failover on the applicable hardware. The cumulative patch supports the generic GA 6.8 kernel with in-tree modules; a detected DKMS or external module requires the appliance-specific procedure before changing the kernel.
4. Schedule a controlled reboot only after prerequisite checks and the recovery path are ready. After reboot, recheck the running kernel and appliance health. A postponed reboot leaves the kernel activation pending.
```
uname -r
```
Completion check: Kernel 6.8.0-147-generic or a later compatible GA 6.8 generic version must actually be running, with the applicable modules, modem paths and services checked after boot.
P1 · MySQL 8.4
Oracle has announced the Critical Patch Update for 20 October 2026. The pre-release lists MySQL Server 8.4.0–8.4.11 among affected releases; the final update target is not yet confirmed.
The existing 8.4.12 Docker security refresh is under separate assessment, including backup, restore and database compatibility. The October CPU target will be selected after its final advisory and image are verified.
Procedure and reboot requirements at the report date
The already available 8.4.12 update is specific to the MySQL Docker image. It is separate from the October CPU, whose final target is still pending. A tested image source and exact digest are required.
Appliance reboot
No host reboot for the image update itself.
Service interruption
Yes: applying a replacement database image requires a database/container restart and a maintenance window.
1. Identify the deployed MySQL version, image source, digest, volumes and replication path without exporting credentials or customer data. Do not assume the same tag exists at every registry.
2. For 8.4.12, check the verified image on representative test data: startup, schema compatibility, restart, backup/restore and MySQL-to-ClickHouse continuity.
3. Use the appliance-specific upgrade and recovery procedure in a maintenance window. Retain the previous pinned image and a verified backup; restoring a container alone may not reverse database format changes.
4. For the 20 October CPU, use the target version and image identified in the final advisory. The applicable update instructions will appear in the next dated release.
Completion check: After the service restart, verify database health, application access and the applicable replication/ingestion paths.
P2 · Ubuntu 24.04 / curl + urllib3curl 8.5.0-2ubuntu10.16 · urllib3 2.0.7-1ubuntu0.8
Canonical published new security fixes on 14 October for curl/libcurl and python3-urllib3.
Check installed Ubuntu host packages and their dependencies against the cumulative requirements. A host APT update does not update pip packages or libraries inside containers.
Procedure and reboot requirements at the report date
Ubuntu 24.04 host APT packages only; container libraries and pip installations are separate. Include the applicable installed binaries from the same source-package family.
Appliance reboot
Normally no for these libraries alone.
Service interruption
Restart the affected applications/services so they load the updated libraries.
1. Run the cumulative patch in check mode to identify installed curl/libcurl and python3-urllib3 packages below their required versions. Packages not used by this host are skipped.
2. Refresh APT indexes and review a scoped --simulate --only-upgrade --no-remove transaction for the actual installed packages and dependencies. The correct Ubuntu versions are curl/libcurl >= 8.5.0-2ubuntu10.16 and python3-urllib3 >= 2.0.7-1ubuntu0.8.
3. Apply the cumulative patch in the maintenance window, then restart affected applications and verify the relevant HTTPS, proxy and Python paths.
Completion check: Re-run the cumulative checker and confirm that affected running services use the updated libraries.
P2 · ClickHouse26.8.30.8 LTS
The official 26.8 LTS patch was published on 17 October. The release alone does not establish an urgent security requirement for every FoxBox installation.
Qualify ingestion, SMS/DLR statistics, retention, restart and recovery before promoting the candidate. No automatic database or container update is included.
Procedure and reboot requirements at the report date
Laboratory qualification candidate for the 26.8 LTS line. The current deployed version remains pinned until validation succeeds.
Appliance reboot
No host reboot for this database update itself.
Service interruption
A service/container restart is required when applying the qualified update.
1. Prepare a disposable laboratory instance and pin the exact 26.8.30.8 LTS package or image. Preserve the deployed production version.
2. Test synthetic SMS/DLR ingestion, MergeTree queries, TTL/retention, restart and recovery. Validate the MySQL integration used by the appliance.
3. Use the appliance-specific upgrade procedure once compatibility is confirmed, including backup, service downtime and recovery checks. This candidate is separate from the host patch.
Completion check: All relevant ingestion, query, retention and recovery tests must pass before promotion.
P2 · Cloudflare Tunnelcloudflared 2026.10.1
Cloudflare published cloudflared 2026.10.1 on 15 October. It is a compatibility qualification candidate.
Test HTTPS and SSH access, reconnection and FoxBox API paths before rollout. No emergency upgrade is inferred from the release number alone.
Procedure and reboot requirements at the report date
Compatibility candidate cloudflared 2026.10.1. Confirm the installed architecture and package source before choosing a binary.
Appliance reboot
No host reboot for this service update itself.
Service interruption
Restarting cloudflared interrupts the tunnel. Independent recovery access is required before replacement.
1. Read the installed version. Prepare an alternative administrative route before changing a tunnel that carries SSH access.
```
cloudflared --version
```
2. Validate the official 2026.10.1 build and checksum on the laboratory host first. Test HTTPS/SSH, service restart, WAN reconnection, trailing slashes and encoded FoxBox API paths.
3. After the compatibility checks, use the appliance’s confirmed installation method and retain a pinned recovery version. This candidate is separate from the host patch.
Completion check: Verify a new HTTPS and SSH connection after the service restart and keep recovery access until the tunnel is stable.

The cumulative patch updates Ubuntu 24.04 host packages. Follow the component instructions for database and container updates and the restart requirements below.

Official sources

18 October 2026OpenSSH, kernel and the upcoming MySQL CPURead report

First published here: 19 October 2026

The source review for 12–18 October proposed OpenSSH/curl/urllib3 patching, kernel qualification and preparation for the 20 October CPU.

Source weekly review: 18 October 2026

P1 · Ubuntu 24.04 / OpenSSH1:9.6p1-3ubuntu13.20
The review identified the nine-vulnerability USN-8928-1 update.
Update after SSH access tests. Current installation instructions are in the 19 October release notes.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
OpenSSH must use the updated binaries; validate configuration and a fresh connection after service restart.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 · Ubuntu 24.04 / Kernel6.8.0-147.147
The review flagged a security update and ABI change requiring hardware qualification.
Require DKMS/third-party modules, modem, network and boot-recovery validation before a controlled reboot. Use the latest report for the current kernel target.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Yes, after hardware and recovery qualification; never automatic.
Service interruption
All appliance services are interrupted by a reboot.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 · MySQL 8.4 / October CPU
The review recorded Oracle’s pre-release announcement for 20 October; it did not identify a final October target.
Prepare backup/restore and qualification; distinguish the existing August 8.4.12 Docker refresh from the upcoming final CPU.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Replacing the database image requires database/container restart and a maintenance window.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · Ubuntu 24.04 / curl8.5.0-2ubuntu10.16
The review identified the new USN-8932-1 curl/libcurl floor.
Update applicable host packages and qualify their consumers; container libraries are separate.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Check and restart affected consumers where necessary.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · Ubuntu 24.04 / urllib32.0.7-1ubuntu0.8
The review identified the Noble package fix in USN-8926-1.
Check the installed APT package and Python consumers; this does not update pip packages or containers.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Check and restart affected consumers where necessary.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · ClickHouse 26.8 LTS26.8.30.8
The review selected 26.8.30.8 LTS as the next laboratory target.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
The database service/container must be restarted when applying a qualified update.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · cloudflared2026.10.1
The review selected 2026.10.1 as a laboratory compatibility candidate.
Qualify HTTP/SSH, WAN reconnection, restart and encoded/trailing-slash URLs before promotion. This is the target recorded at the time.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Tunnel restart can interrupt remote access; prepare independent recovery.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.

Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.

Official sources

11 October 2026New kernel, sudo and libxml2Read report

First published here: 19 October 2026

The review raised the kernel target and included new sudo/libxml2 security floors.

Source weekly review: 11 October 2026

P1 · Ubuntu 24.04 / Kernel6.8.0-146.146
The review flagged a security update and ABI change requiring hardware qualification.
Require DKMS/third-party modules, modem, network and boot-recovery validation before a controlled reboot. Use the latest report for the current kernel target.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Yes, after hardware and recovery qualification; never automatic.
Service interruption
All appliance services are interrupted by a reboot.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 · Ubuntu 24.04 / sudo1.9.15p5-3ubuntu5.24.04.4
The review selected USN-8895-1, published on 7 October.
Include the fix in installed-package security maintenance and verify restricted sudo policy.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Check and restart affected consumers where necessary.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · Ubuntu 24.04 / libxml22.9.14+dfsg-1.3ubuntu3.10
The review selected USN-8910-1, published on 8 October.
Update applicable installed binaries and test XML-consuming features.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Check and restart affected consumers where necessary.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 · Cloudflare Tunnel API5 October 2026
The review retained the post-deadline API audit as an unresolved applicability check.
Review route-ID endpoints and the dedicated connections endpoint. Publication correction: also check cloudflared route ip add/delete; absence of custom API code alone is insufficient for a full N/A conclusion.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
No appliance reboot for an API migration itself.
Service interruption
Qualify the affected provisioning and monitoring integrations; no generic service restart is prescribed.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · cloudflared2026.10.0
The review selected 2026.10.0 as a laboratory compatibility candidate.
Qualify HTTP/SSH, WAN reconnection, restart and encoded/trailing-slash URLs before promotion. This is the target recorded at the time.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Tunnel restart can interrupt remote access; prepare independent recovery.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · ClickHouse 26.8 LTS26.8.23.6
The review selected 26.8.23.6 LTS as the next laboratory target.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
The database service/container must be restarted when applying a qualified update.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · MySQL 8.48.4.12
No new MySQL action was recorded beyond completing the 8.4.12 Docker qualification.
Keep the Docker-image security refresh open until backup/restore and database compatibility are qualified.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Replacing the database image requires database/container restart and a maintenance window.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.

Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.

Official sources

4 October 2026OpenSSL, API migration and ClickHouse qualificationRead report

First published here: 19 October 2026

The review prioritised OpenSSL, the next-day Cloudflare deadline and a new ClickHouse laboratory target.

Source weekly review: 4 October 2026

P1 · Ubuntu 24.04 / OpenSSL3.0.13-0ubuntu3.16
USN-8847-1 supplied the OpenSSL/libssl3t64 floor; Canonical specifies a reboot.
Update applicable host packages and schedule the reboot with recovery checks. Container libraries require separate inventory.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
The cited Canonical notice requires a reboot to complete the update.
Service interruption
Processes using the old library must be refreshed; the notice specifies a host reboot.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 conditional · Ubuntu 24.04 / OpenVPN2.6.19-0ubuntu0.24.04.4
The review flagged USN-8852-1 when OpenVPN is installed.
Establish applicability, update installed packages and check VPN reconnect/routing before promotion.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Check and restart affected consumers where necessary.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 · Cloudflare Tunnel API5 October 2026
The review marked 5 October as the API migration deadline.
Review route-ID endpoints and the dedicated connections endpoint. Publication correction: also check cloudflared route ip add/delete; absence of custom API code alone is insufficient for a full N/A conclusion.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
No appliance reboot for an API migration itself.
Service interruption
Qualify the affected provisioning and monitoring integrations; no generic service restart is prescribed.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · cloudflared2026.9.3
The review selected 2026.9.3 as a laboratory compatibility candidate.
Qualify HTTP/SSH, WAN reconnection, restart and encoded/trailing-slash URLs before promotion. This is the target recorded at the time.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Tunnel restart can interrupt remote access; prepare independent recovery.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 / P1 conditional · ClickHouse 26.8 LTS26.8.16.41
The review proposed 26.8.16.41 LTS and raised priority where ssl_certificate authentication or other affected features were used. This is the risk assessment recorded at that time.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
The database service/container must be restarted when applying a qualified update.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 · Ubuntu 24.04 / Kernel6.8.0-142.142
The review flagged a security update and ABI change requiring hardware qualification.
Require DKMS/third-party modules, modem, network and boot-recovery validation before a controlled reboot. Use the latest report for the current kernel target.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Yes, after hardware and recovery qualification; never automatic.
Service interruption
All appliance services are interrupted by a reboot.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · MySQL 8.48.4.12
The review retained the pending 8.4.12 Docker refresh without a new database release action.
Keep the Docker-image security refresh open until backup/restore and database compatibility are qualified.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Replacing the database image requires database/container restart and a maintenance window.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.

Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.

Official sources

27 September 2026Kernel ABI, curl and sudoRead report

First published here: 19 October 2026

The review separated kernel hardware qualification from ordinary userspace security patching.

Source weekly review: 27 September 2026

P1 · Ubuntu 24.04 / Kernel6.8.0-142.142
The review flagged a security update and ABI change requiring hardware qualification.
Require DKMS/third-party modules, modem, network and boot-recovery validation before a controlled reboot. Use the latest report for the current kernel target.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Yes, after hardware and recovery qualification; never automatic.
Service interruption
All appliance services are interrupted by a reboot.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 · Ubuntu 24.04 / curl8.5.0-2ubuntu10.15
USN-8820-1 was the curl/libcurl floor selected in this review.
Update installed binaries and test HTTPS/proxy paths. The October report supersedes this floor with .16.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Check and restart affected consumers where necessary.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · Ubuntu 24.04 / sudo1.9.15p5-3ubuntu5.24.04.3
The review flagged USN-8803-1 for a policy-enforcement issue.
Update and check restricted administration; the later .4 floor supersedes this historical .3.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Check and restart affected consumers where necessary.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · Ubuntu 24.04 / Expat2.6.1-2ubuntu0.6
The review included Expat in baseline security patching where installed.
Check the installed components that process XML and apply the relevant Ubuntu security update.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Check and restart affected consumers where necessary.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 · Cloudflare Tunnel API5 October 2026
The review called for closing the API inventory before the following week’s deadline.
Review route-ID endpoints and the dedicated connections endpoint. Publication correction: also check cloudflared route ip add/delete; absence of custom API code alone is insufficient for a full N/A conclusion.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
No appliance reboot for an API migration itself.
Service interruption
Qualify the affected provisioning and monitoring integrations; no generic service restart is prescribed.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · cloudflared2026.9.3
The review selected 2026.9.3 as a laboratory compatibility candidate.
Qualify HTTP/SSH, WAN reconnection, restart and encoded/trailing-slash URLs before promotion. This is the target recorded at the time.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Tunnel restart can interrupt remote access; prepare independent recovery.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · ClickHouse 26.8 LTS26.8.12.53
The review selected 26.8.12.53 LTS as the next laboratory target.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
The database service/container must be restarted when applying a qualified update.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · MySQL 8.48.4.12
The 8.4.12 Docker qualification remained a carry-over action.
Keep the Docker-image security refresh open until backup/restore and database compatibility are qualified.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Replacing the database image requires database/container restart and a maintenance window.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.

Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.

Official sources

20 September 2026polkit, conditional nginx and the Cloudflare API deadlineRead report

First published here: 19 October 2026

The review prioritised polkit, the Ubuntu nginx fix where applicable and API migration before 5 October.

Source weekly review: 20 September 2026

P1 · Ubuntu 24.04 / polkit124-2ubuntu1.24.04.4
The review identified USN-8762-1 for local security issues in polkit.
Include installed polkit binaries in the security baseline and smoke-test administration.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Check and restart affected consumers where necessary.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 conditional · Ubuntu 24.04 / nginx1.24.0-2ubuntu7.18
The review flagged the corrected Ubuntu nginx update after an earlier regression.
Apply only to installed Ubuntu nginx packages after reverse-proxy/configuration tests; container images have a separate baseline.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Check and restart affected consumers where necessary.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 · Cloudflare Tunnel API5 October 2026
The review required an API inventory ahead of the 5 October retirement.
Review route-ID endpoints and the dedicated connections endpoint. Publication correction: also check cloudflared route ip add/delete; absence of custom API code alone is insufficient for a full N/A conclusion.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
No appliance reboot for an API migration itself.
Service interruption
Qualify the affected provisioning and monitoring integrations; no generic service restart is prescribed.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · cloudflared2026.9.1
The review selected 2026.9.1 as a laboratory compatibility candidate.
Qualify HTTP/SSH, WAN reconnection, restart and encoded/trailing-slash URLs before promotion. This is the target recorded at the time.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Tunnel restart can interrupt remote access; prepare independent recovery.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · ClickHouse 26.8 LTS26.8.7.19
The review selected 26.8.7.19 LTS as the next laboratory target.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
The database service/container must be restarted when applying a qualified update.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · MySQL 8.48.4.12
The review recorded no new MySQL action beyond the pending 8.4.12 Docker refresh.
Keep the Docker-image security refresh open until backup/restore and database compatibility are qualified.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Replacing the database image requires database/container restart and a maintenance window.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.

Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.

Official sources

7 September 2026OpenSSH and tunnel version checksRead report

First published here: 19 October 2026

This review prioritised OpenSSH, the installed cloudflared version and Docker/database compatibility.

Source weekly review: 7 September 2026

P1 · Ubuntu 24.04 / OpenSSH1:9.6p1-3ubuntu13.19
USN-8721-1 introduced the OpenSSH floor recorded by this review.
Update after access tests; this historical floor is superseded by .20 in the October report.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
OpenSSH must use the updated binaries; validate configuration and a fresh connection after service restart.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P1 · cloudflared2026.8.3
The review required an inventory and exclusion of problematic 2026.8.0/2026.8.1, proposing 2026.8.3 for qualification.
Test URL handling, HTTP/SSH and restart before replacing a tunnel; later reports record newer candidates.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Tunnel restart can interrupt remote access; prepare independent recovery.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · MySQL 8.48.4.12
The review identified the 18 August 8.4.12 Docker-only security refresh.
Keep the Docker-image security refresh open until backup/restore and database compatibility are qualified.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
Replacing the database image requires database/container restart and a maintenance window.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
P2 · ClickHouse 26.8 LTS26.8.2.7
The review selected 26.8.2.7 LTS as the next laboratory target.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Procedure and reboot requirements at the report date
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Appliance reboot
Normally no host reboot for this component alone; follow the current qualified procedure.
Service interruption
The database service/container must be restarted when applying a qualified update.
1. Read the decision in its original review context. Do not install an older target merely because it appears here.
2. Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.

Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.

PHP 7.4 · host/container

Identify the release

Check all prerequisites

Apply and verify

Where do I run the PHP patch?

Host Docker → goofy_pare_mod application container

Ubuntu 20.04 LTS · amd64 · Apache/PHP 7.4

Ubuntu 24.04 LTS · amd64

Official sources

Official sources

Official sources

Official sources

Official sources

Official sources

Official sources

Official sources

Official sources

Official sources

Official sources

Contact US