Milan · Como · Since 2010SIM + SMPP / HTTP
FOXBOX SECURITY
Keep your FoxBox up to date. Follow the security reviews and find the cumulative patch for your software release.
SECURITY WATCH
Security priorities from the 12–18 October weekly review, checked against official sources on 19 October. Choose the update procedure for the matching operating system and component.
Canonical published fixes for nine vulnerabilities on 14 October. The advisory covers the Ubuntu 24.04 OpenSSH client and server packages.
Vendor version1:9.6p1-3ubuntu13.20
Update installed Ubuntu 24.04 SSH packages to the fixed version or later, then verify a fresh administrative connection.
The 13 October update changes the kernel ABI. Canonical requires a reboot and compatible third-party modules.
Vendor version6.8.0-147.147
Plan the kernel change and controlled reboot after checking the applicable DKMS modules, modem drivers and recovery path. An installed kernel is only active after a successful boot into that version.
Oracle has announced the Critical Patch Update for 20 October 2026. The pre-release lists MySQL Server 8.4.0–8.4.11 among affected releases; the final update target is not yet confirmed.
The existing 8.4.12 Docker security refresh is under separate assessment, including backup, restore and database compatibility. The October CPU target will be selected after its final advisory and image are verified.
Canonical published new security fixes on 14 October for curl/libcurl and python3-urllib3.
Vendor versioncurl 8.5.0-2ubuntu10.16 · urllib3 2.0.7-1ubuntu0.8
Check installed Ubuntu host packages and their dependencies against the cumulative requirements. A host APT update does not update pip packages or libraries inside containers.
The official 26.8 LTS patch was published on 17 October. The release alone does not establish an urgent security requirement for every FoxBox installation.
Vendor version26.8.30.8 LTS
Qualify ingestion, SMS/DLR statistics, retention, restart and recovery before promoting the candidate. No automatic database or container update is included.
Cloudflare published cloudflared 2026.10.1 on 15 October. It is a compatibility qualification candidate.
Vendor versioncloudflared 2026.10.1
Test HTTPS and SSH access, reconnection and FoxBox API paths before rollout. No emergency upgrade is inferred from the release number alone.
The cumulative patch updates Ubuntu 24.04 host packages. Follow the component instructions for database and container updates and the restart requirements below.
RELEASE INSTRUCTIONS
Use the cumulative patch for Ubuntu 24.04 amd64 host packages, or follow the component instructions below. Each procedure states which services restart and whether an appliance reboot is required.
| Component / release | Appliance reboot | Service / current condition |
|---|---|---|
Ubuntu 24.04 / OpenSSH1:9.6p1-3ubuntu13.20
|
Normally no, for the OpenSSH package update itself. | SSH may restart during the update. Existing sessions are not a guaranteed recovery channel; verify a fresh connection before closing them. |
Ubuntu 24.04 / Kernel6.8.0-147.147
|
Yes. Required to activate the installed new kernel. Schedule a maintenance window. | A host reboot interrupts appliance services. DKMS, third-party drivers and modem compatibility must be qualified first. |
| MySQL 8.4 | No host reboot for the image update itself. | Yes: applying a replacement database image requires a database/container restart and a maintenance window. |
Ubuntu 24.04 / curl + urllib3curl 8.5.0-2ubuntu10.16 · urllib3 2.0.7-1ubuntu0.8
|
Normally no for these libraries alone. | Restart the affected applications/services so they load the updated libraries. |
ClickHouse26.8.30.8 LTS
|
No host reboot for this database update itself. | A service/container restart is required when applying the qualified update. |
Cloudflare Tunnelcloudflared 2026.10.1
|
No host reboot for this service update itself. | Restarting cloudflared interrupts the tunnel. Independent recovery access is required before replacement. |
| Cumulative patch 2026.10.19-r2 | Required to activate a new kernel, and after an applicable OpenSSL update. Check reboot_required in the result. The program never reboots automatically. | Package scripts may restart services. Refresh SSH and verify a new connection; restart applications that use updated libraries. Schedule a maintenance window. |
Ubuntu 24.04 host packages only. Use an existing authorized administrative account, preserve the current SSH configuration and keep two independent SSH sessions open with a recovery path available. If installed packages and the active service already meet the target, no reinstall is necessary.
Confirm that this is the Ubuntu 24.04 host, not the application container. Check the installed SSH packages. Stop if the operating-system baseline differs.
cat /etc/os-release
dpkg-query -W -f='${Package} ${Version}\n' openssh-client openssh-server openssh-sftp-serverWith a backup and recovery path available, refresh signed APT indexes. This changes package indexes; it does not install an update.
sudo apt-get updateSimulate the scoped upgrade. Review the versions, dependencies, held packages and package list. Do not continue if APT proposes unexpected changes or the candidate is below 1:9.6p1-3ubuntu13.20.
sudo apt-get --simulate --only-upgrade --no-remove install openssh-client openssh-server openssh-sftp-serverAfter reviewing the simulation, apply the scoped upgrade in the maintenance window. Review the actual plan again because simulation does not lock APT. Read any configuration prompt and preserve the deployed SSH access policy. Prompts are not auto-accepted.
sudo apt-get --only-upgrade --no-remove install openssh-client openssh-server openssh-sftp-serverValidate the SSH configuration, then refresh the SSH service only if validation succeeds. This may interrupt administrative access, so keep the independent recovery path ready.
sudo /usr/sbin/sshd -t && sudo systemctl restart ssh.serviceCheck the installation state and minimum version for every applicable package. Stop on REPAIR REQUIRED or UPDATE REQUIRED; absent packages are reported and left absent. Then open a separate new SSH connection through the normal administrative path and test configured key restrictions and forwarding.
for package in openssh-client openssh-server openssh-sftp-server; do
state=$(dpkg-query -W -f='${db:Status-Abbrev}' "$package") || {
printf '%s: NOT INSTALLED\n' "$package"; continue;
}
case "$state" in
'ii '|'hi ') ;;
*) printf '%s: REPAIR REQUIRED (%s)\n' "$package" "$state"; continue ;;
esac
version=$(dpkg-query -W -f='${Version}' "$package") || continue
if dpkg --compare-versions "$version" ge '1:9.6p1-3ubuntu13.20'; then
printf '%s: OK (%s)\n' "$package" "$version"
else
printf '%s: UPDATE REQUIRED (%s)\n' "$package" "$version"
fi
doneCompletion check: The version check and a fresh working SSH connection must pass. Installed package versions alone do not prove the running service was refreshed. A reboot requested by another system update must be handled separately.
Ubuntu 24.04 GA generic kernel 6.8.0-147.147. Installation and reboot are separate steps; schedule both against the actual hardware and recovery requirements.
Compare the running kernel with the installed package. An installed package is not an active kernel.
uname -r
dpkg-query -W -f='${Package} ${Version}\n' linux-image-6.8.0-147-genericBefore installing or rebooting, verify boot recovery, the previous bootable kernel and applicable DKMS/third-party modules, including bl_noah where present. Absence of the dkms command does not prove compatibility.
Verify module build and load, modem detection, QMI/serial interfaces, network and failover on the applicable hardware. The cumulative patch supports the generic GA 6.8 kernel with in-tree modules; a detected DKMS or external module requires the appliance-specific procedure before changing the kernel.
Schedule a controlled reboot only after prerequisite checks and the recovery path are ready. After reboot, recheck the running kernel and appliance health. A postponed reboot leaves the kernel activation pending.
uname -rCompletion check: Kernel 6.8.0-147-generic or a later compatible GA 6.8 generic version must actually be running, with the applicable modules, modem paths and services checked after boot.
The already available 8.4.12 update is specific to the MySQL Docker image. It is separate from the October CPU, whose final target is still pending. A tested image source and exact digest are required.
Identify the deployed MySQL version, image source, digest, volumes and replication path without exporting credentials or customer data. Do not assume the same tag exists at every registry.
For 8.4.12, check the verified image on representative test data: startup, schema compatibility, restart, backup/restore and MySQL-to-ClickHouse continuity.
Use the appliance-specific upgrade and recovery procedure in a maintenance window. Retain the previous pinned image and a verified backup; restoring a container alone may not reverse database format changes.
For the 20 October CPU, use the target version and image identified in the final advisory. The applicable update instructions will appear in the next dated release.
Completion check: After the service restart, verify database health, application access and the applicable replication/ingestion paths.
Ubuntu 24.04 host APT packages only; container libraries and pip installations are separate. Include the applicable installed binaries from the same source-package family.
Run the cumulative patch in check mode to identify installed curl/libcurl and python3-urllib3 packages below their required versions. Packages not used by this host are skipped.
Refresh APT indexes and review a scoped --simulate --only-upgrade --no-remove transaction for the actual installed packages and dependencies. The correct Ubuntu versions are curl/libcurl >= 8.5.0-2ubuntu10.16 and python3-urllib3 >= 2.0.7-1ubuntu0.8.
Apply the cumulative patch in the maintenance window, then restart affected applications and verify the relevant HTTPS, proxy and Python paths.
Completion check: Re-run the cumulative checker and confirm that affected running services use the updated libraries.
Laboratory qualification candidate for the 26.8 LTS line. The current deployed version remains pinned until validation succeeds.
Prepare a disposable laboratory instance and pin the exact 26.8.30.8 LTS package or image. Preserve the deployed production version.
Test synthetic SMS/DLR ingestion, MergeTree queries, TTL/retention, restart and recovery. Validate the MySQL integration used by the appliance.
Use the appliance-specific upgrade procedure once compatibility is confirmed, including backup, service downtime and recovery checks. This candidate is separate from the host patch.
Completion check: All relevant ingestion, query, retention and recovery tests must pass before promotion.
Compatibility candidate cloudflared 2026.10.1. Confirm the installed architecture and package source before choosing a binary.
Read the installed version. Prepare an alternative administrative route before changing a tunnel that carries SSH access.
cloudflared --versionValidate the official 2026.10.1 build and checksum on the laboratory host first. Test HTTPS/SSH, service restart, WAN reconnection, trailing slashes and encoded FoxBox API paths.
After the compatibility checks, use the appliance’s confirmed installation method and retain a pinned recovery version. This candidate is separate from the host patch.
Completion check: Verify a new HTTPS and SSH connection after the service restart and keep recovery access until the tunnel is stable.
UPDATE YOUR APPLIANCE
Choose the package for your FoxBox software baseline. Each new cumulative patch checks every previously required correction in that line, so you can start from an earlier patch level. A new FoxBox software version starts a separate line.
The model name alone is not enough. Match the FoxBox software version, operating system and hardware requirements in the release notes.
The latest package checks the whole cumulative set and stops on an unsupported baseline or unmet requirement. A patch from another release line is not interchangeable.
Follow the package instructions for backup, maintenance and recovery. Kernel changes require a reboot and compatible third-party modules before the update is complete.
FoxBox host security updates
Cumulative requirements from the weekly reviews of 7 September–18 October 2026: OpenSSH, curl, urllib3, PolicyKit, nginx, sudo, libxml2, OpenSSL, Expat and OpenVPN, where installed. Kernel GA generic 6.8 has separate reboot and module checks. Databases and containers use their own update procedures.
Package 2026.10.19-r2
The patch updates applicable Ubuntu host packages and checks all previous requirements in this line. Already current packages are kept. The program reports any required reboot and never reboots automatically.
Download cumulative patchSHA-256faf596db24ab3b27c7bafda7e80b4c8dc560272f589e76ac0da6e9060eef2219
Ubuntu 24.04 LTS amd64 host, generic GA 6.8 kernel. Includes the applicable installed Ubuntu packages listed above. Run on the host. Database, container, application and third-party driver updates follow their own procedures.
Download the ZIP and compare its complete SHA-256 with the checksum above. Stop if it differs.
sha256sum foxbox-security-update-2026.10.19-r2.zipExtract into a new private working directory outside the webroot. Verify every included file; all entries in SHA256SUMS must report OK.
umask 077
unzip foxbox-security-update-2026.10.19-r2.zip -d foxbox-security-update-2026.10.19-r2
cd foxbox-security-update-2026.10.19-r2
sha256sum -c SHA256SUMSCheck installed versions and the supported baseline. The local report identifies packages to update and whether a reboot is pending. Read README-EN.txt for prerequisites and recovery.
/usr/bin/python3 foxbox_security.py checkPrepare a maintenance window, a second administrative connection and console/recovery access. Changes require root, system Python with python3-apt, authenticated Ubuntu repositories, a consistent dpkg state and 2 GiB free for the protected backup. A kernel installation also requires 1 GiB free in /boot and supported in-tree modules. Held packages below the required version, DKMS, external modules, HWE kernels or unavailable recovery packages stop the operation.
Apply the cumulative patch. It verifies versions, package sources and the APT plan before installing. If all required packages are already current, it returns already_up_to_date. Previous patch ZIPs are not needed.
sudo /usr/bin/python3 foxbox_security.py applyRead packages_changed, reboot_required, reboot_performed and private_snapshot in the result. Refresh SSH after a successful configuration check, open a new independent SSH connection and verify the affected services. If reboot_required is true, perform the controlled reboot in the maintenance window, then check the kernel, modem paths and application. Run check again.
sudo /usr/sbin/sshd -t && sudo systemctl restart ssh.service
/usr/bin/python3 foxbox_security.py checkCompletion check: Exit code 0: check complete or apply succeeded/already current; 2: check requires action or reboot; 3: unsupported baseline; 4: error or missing prerequisite. If apply reports a partial change, keep its private snapshot and follow the recovery instructions in the README before retrying.
DATED RECORDS
Browse earlier reviews with their original dates and component decisions. For an update today, use the latest compatible cumulative patch, which checks the requirements from previous reviews too.
First published here: 19 October 2026
Security priorities from the 12–18 October weekly review, checked against official sources on 19 October. Choose the update procedure for the matching operating system and component.
Source weekly review: 18 October 2026
1:9.6p1-3ubuntu13.20Canonical published fixes for nine vulnerabilities on 14 October. The advisory covers the Ubuntu 24.04 OpenSSH client and server packages.
Update installed Ubuntu 24.04 SSH packages to the fixed version or later, then verify a fresh administrative connection.
Ubuntu 24.04 host packages only. Use an existing authorized administrative account, preserve the current SSH configuration and keep two independent SSH sessions open with a recovery path available. If installed packages and the active service already meet the target, no reinstall is necessary.
Confirm that this is the Ubuntu 24.04 host, not the application container. Check the installed SSH packages. Stop if the operating-system baseline differs.
cat /etc/os-release
dpkg-query -W -f='${Package} ${Version}\n' openssh-client openssh-server openssh-sftp-serverWith a backup and recovery path available, refresh signed APT indexes. This changes package indexes; it does not install an update.
sudo apt-get updateSimulate the scoped upgrade. Review the versions, dependencies, held packages and package list. Do not continue if APT proposes unexpected changes or the candidate is below 1:9.6p1-3ubuntu13.20.
sudo apt-get --simulate --only-upgrade --no-remove install openssh-client openssh-server openssh-sftp-serverAfter reviewing the simulation, apply the scoped upgrade in the maintenance window. Review the actual plan again because simulation does not lock APT. Read any configuration prompt and preserve the deployed SSH access policy. Prompts are not auto-accepted.
sudo apt-get --only-upgrade --no-remove install openssh-client openssh-server openssh-sftp-serverValidate the SSH configuration, then refresh the SSH service only if validation succeeds. This may interrupt administrative access, so keep the independent recovery path ready.
sudo /usr/sbin/sshd -t && sudo systemctl restart ssh.serviceCheck the installation state and minimum version for every applicable package. Stop on REPAIR REQUIRED or UPDATE REQUIRED; absent packages are reported and left absent. Then open a separate new SSH connection through the normal administrative path and test configured key restrictions and forwarding.
for package in openssh-client openssh-server openssh-sftp-server; do
state=$(dpkg-query -W -f='${db:Status-Abbrev}' "$package") || {
printf '%s: NOT INSTALLED\n' "$package"; continue;
}
case "$state" in
'ii '|'hi ') ;;
*) printf '%s: REPAIR REQUIRED (%s)\n' "$package" "$state"; continue ;;
esac
version=$(dpkg-query -W -f='${Version}' "$package") || continue
if dpkg --compare-versions "$version" ge '1:9.6p1-3ubuntu13.20'; then
printf '%s: OK (%s)\n' "$package" "$version"
else
printf '%s: UPDATE REQUIRED (%s)\n' "$package" "$version"
fi
doneCompletion check: The version check and a fresh working SSH connection must pass. Installed package versions alone do not prove the running service was refreshed. A reboot requested by another system update must be handled separately.
6.8.0-147.147The 13 October update changes the kernel ABI. Canonical requires a reboot and compatible third-party modules.
Plan the kernel change and controlled reboot after checking the applicable DKMS modules, modem drivers and recovery path. An installed kernel is only active after a successful boot into that version.
Ubuntu 24.04 GA generic kernel 6.8.0-147.147. Installation and reboot are separate steps; schedule both against the actual hardware and recovery requirements.
Compare the running kernel with the installed package. An installed package is not an active kernel.
uname -r
dpkg-query -W -f='${Package} ${Version}\n' linux-image-6.8.0-147-genericBefore installing or rebooting, verify boot recovery, the previous bootable kernel and applicable DKMS/third-party modules, including bl_noah where present. Absence of the dkms command does not prove compatibility.
Verify module build and load, modem detection, QMI/serial interfaces, network and failover on the applicable hardware. The cumulative patch supports the generic GA 6.8 kernel with in-tree modules; a detected DKMS or external module requires the appliance-specific procedure before changing the kernel.
Schedule a controlled reboot only after prerequisite checks and the recovery path are ready. After reboot, recheck the running kernel and appliance health. A postponed reboot leaves the kernel activation pending.
uname -rCompletion check: Kernel 6.8.0-147-generic or a later compatible GA 6.8 generic version must actually be running, with the applicable modules, modem paths and services checked after boot.
Oracle has announced the Critical Patch Update for 20 October 2026. The pre-release lists MySQL Server 8.4.0–8.4.11 among affected releases; the final update target is not yet confirmed.
The existing 8.4.12 Docker security refresh is under separate assessment, including backup, restore and database compatibility. The October CPU target will be selected after its final advisory and image are verified.
The already available 8.4.12 update is specific to the MySQL Docker image. It is separate from the October CPU, whose final target is still pending. A tested image source and exact digest are required.
Identify the deployed MySQL version, image source, digest, volumes and replication path without exporting credentials or customer data. Do not assume the same tag exists at every registry.
For 8.4.12, check the verified image on representative test data: startup, schema compatibility, restart, backup/restore and MySQL-to-ClickHouse continuity.
Use the appliance-specific upgrade and recovery procedure in a maintenance window. Retain the previous pinned image and a verified backup; restoring a container alone may not reverse database format changes.
For the 20 October CPU, use the target version and image identified in the final advisory. The applicable update instructions will appear in the next dated release.
Completion check: After the service restart, verify database health, application access and the applicable replication/ingestion paths.
curl 8.5.0-2ubuntu10.16 · urllib3 2.0.7-1ubuntu0.8Canonical published new security fixes on 14 October for curl/libcurl and python3-urllib3.
Check installed Ubuntu host packages and their dependencies against the cumulative requirements. A host APT update does not update pip packages or libraries inside containers.
Ubuntu 24.04 host APT packages only; container libraries and pip installations are separate. Include the applicable installed binaries from the same source-package family.
Run the cumulative patch in check mode to identify installed curl/libcurl and python3-urllib3 packages below their required versions. Packages not used by this host are skipped.
Refresh APT indexes and review a scoped --simulate --only-upgrade --no-remove transaction for the actual installed packages and dependencies. The correct Ubuntu versions are curl/libcurl >= 8.5.0-2ubuntu10.16 and python3-urllib3 >= 2.0.7-1ubuntu0.8.
Apply the cumulative patch in the maintenance window, then restart affected applications and verify the relevant HTTPS, proxy and Python paths.
Completion check: Re-run the cumulative checker and confirm that affected running services use the updated libraries.
26.8.30.8 LTSThe official 26.8 LTS patch was published on 17 October. The release alone does not establish an urgent security requirement for every FoxBox installation.
Qualify ingestion, SMS/DLR statistics, retention, restart and recovery before promoting the candidate. No automatic database or container update is included.
Laboratory qualification candidate for the 26.8 LTS line. The current deployed version remains pinned until validation succeeds.
Prepare a disposable laboratory instance and pin the exact 26.8.30.8 LTS package or image. Preserve the deployed production version.
Test synthetic SMS/DLR ingestion, MergeTree queries, TTL/retention, restart and recovery. Validate the MySQL integration used by the appliance.
Use the appliance-specific upgrade procedure once compatibility is confirmed, including backup, service downtime and recovery checks. This candidate is separate from the host patch.
Completion check: All relevant ingestion, query, retention and recovery tests must pass before promotion.
cloudflared 2026.10.1Cloudflare published cloudflared 2026.10.1 on 15 October. It is a compatibility qualification candidate.
Test HTTPS and SSH access, reconnection and FoxBox API paths before rollout. No emergency upgrade is inferred from the release number alone.
Compatibility candidate cloudflared 2026.10.1. Confirm the installed architecture and package source before choosing a binary.
Read the installed version. Prepare an alternative administrative route before changing a tunnel that carries SSH access.
cloudflared --versionValidate the official 2026.10.1 build and checksum on the laboratory host first. Test HTTPS/SSH, service restart, WAN reconnection, trailing slashes and encoded FoxBox API paths.
After the compatibility checks, use the appliance’s confirmed installation method and retain a pinned recovery version. This candidate is separate from the host patch.
Completion check: Verify a new HTTPS and SSH connection after the service restart and keep recovery access until the tunnel is stable.
The cumulative patch updates Ubuntu 24.04 host packages. Follow the component instructions for database and container updates and the restart requirements below.
First published here: 19 October 2026
The source review for 12–18 October proposed OpenSSH/curl/urllib3 patching, kernel qualification and preparation for the 20 October CPU.
Source weekly review: 18 October 2026
1:9.6p1-3ubuntu13.20The review identified the nine-vulnerability USN-8928-1 update.
Update after SSH access tests. Current installation instructions are in the 19 October release notes.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
6.8.0-147.147The review flagged a security update and ABI change requiring hardware qualification.
Require DKMS/third-party modules, modem, network and boot-recovery validation before a controlled reboot. Use the latest report for the current kernel target.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
The review recorded Oracle’s pre-release announcement for 20 October; it did not identify a final October target.
Prepare backup/restore and qualification; distinguish the existing August 8.4.12 Docker refresh from the upcoming final CPU.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
8.5.0-2ubuntu10.16The review identified the new USN-8932-1 curl/libcurl floor.
Update applicable host packages and qualify their consumers; container libraries are separate.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
2.0.7-1ubuntu0.8The review identified the Noble package fix in USN-8926-1.
Check the installed APT package and Python consumers; this does not update pip packages or containers.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
26.8.30.8The review selected 26.8.30.8 LTS as the next laboratory target.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
2026.10.1The review selected 2026.10.1 as a laboratory compatibility candidate.
Qualify HTTP/SSH, WAN reconnection, restart and encoded/trailing-slash URLs before promotion. This is the target recorded at the time.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.
First published here: 19 October 2026
The review raised the kernel target and included new sudo/libxml2 security floors.
Source weekly review: 11 October 2026
6.8.0-146.146The review flagged a security update and ABI change requiring hardware qualification.
Require DKMS/third-party modules, modem, network and boot-recovery validation before a controlled reboot. Use the latest report for the current kernel target.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
1.9.15p5-3ubuntu5.24.04.4The review selected USN-8895-1, published on 7 October.
Include the fix in installed-package security maintenance and verify restricted sudo policy.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
2.9.14+dfsg-1.3ubuntu3.10The review selected USN-8910-1, published on 8 October.
Update applicable installed binaries and test XML-consuming features.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
5 October 2026The review retained the post-deadline API audit as an unresolved applicability check.
Review route-ID endpoints and the dedicated connections endpoint. Publication correction: also check cloudflared route ip add/delete; absence of custom API code alone is insufficient for a full N/A conclusion.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
2026.10.0The review selected 2026.10.0 as a laboratory compatibility candidate.
Qualify HTTP/SSH, WAN reconnection, restart and encoded/trailing-slash URLs before promotion. This is the target recorded at the time.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
26.8.23.6The review selected 26.8.23.6 LTS as the next laboratory target.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
8.4.12No new MySQL action was recorded beyond completing the 8.4.12 Docker qualification.
Keep the Docker-image security refresh open until backup/restore and database compatibility are qualified.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.
First published here: 19 October 2026
The review prioritised OpenSSL, the next-day Cloudflare deadline and a new ClickHouse laboratory target.
Source weekly review: 4 October 2026
3.0.13-0ubuntu3.16USN-8847-1 supplied the OpenSSL/libssl3t64 floor; Canonical specifies a reboot.
Update applicable host packages and schedule the reboot with recovery checks. Container libraries require separate inventory.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
2.6.19-0ubuntu0.24.04.4The review flagged USN-8852-1 when OpenVPN is installed.
Establish applicability, update installed packages and check VPN reconnect/routing before promotion.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
5 October 2026The review marked 5 October as the API migration deadline.
Review route-ID endpoints and the dedicated connections endpoint. Publication correction: also check cloudflared route ip add/delete; absence of custom API code alone is insufficient for a full N/A conclusion.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
2026.9.3The review selected 2026.9.3 as a laboratory compatibility candidate.
Qualify HTTP/SSH, WAN reconnection, restart and encoded/trailing-slash URLs before promotion. This is the target recorded at the time.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
26.8.16.41The review proposed 26.8.16.41 LTS and raised priority where ssl_certificate authentication or other affected features were used. This is the risk assessment recorded at that time.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
6.8.0-142.142The review flagged a security update and ABI change requiring hardware qualification.
Require DKMS/third-party modules, modem, network and boot-recovery validation before a controlled reboot. Use the latest report for the current kernel target.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
8.4.12The review retained the pending 8.4.12 Docker refresh without a new database release action.
Keep the Docker-image security refresh open until backup/restore and database compatibility are qualified.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.
First published here: 19 October 2026
The review separated kernel hardware qualification from ordinary userspace security patching.
Source weekly review: 27 September 2026
6.8.0-142.142The review flagged a security update and ABI change requiring hardware qualification.
Require DKMS/third-party modules, modem, network and boot-recovery validation before a controlled reboot. Use the latest report for the current kernel target.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
8.5.0-2ubuntu10.15USN-8820-1 was the curl/libcurl floor selected in this review.
Update installed binaries and test HTTPS/proxy paths. The October report supersedes this floor with .16.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
1.9.15p5-3ubuntu5.24.04.3The review flagged USN-8803-1 for a policy-enforcement issue.
Update and check restricted administration; the later .4 floor supersedes this historical .3.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
2.6.1-2ubuntu0.6The review included Expat in baseline security patching where installed.
Check the installed components that process XML and apply the relevant Ubuntu security update.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
5 October 2026The review called for closing the API inventory before the following week’s deadline.
Review route-ID endpoints and the dedicated connections endpoint. Publication correction: also check cloudflared route ip add/delete; absence of custom API code alone is insufficient for a full N/A conclusion.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
2026.9.3The review selected 2026.9.3 as a laboratory compatibility candidate.
Qualify HTTP/SSH, WAN reconnection, restart and encoded/trailing-slash URLs before promotion. This is the target recorded at the time.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
26.8.12.53The review selected 26.8.12.53 LTS as the next laboratory target.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
8.4.12The 8.4.12 Docker qualification remained a carry-over action.
Keep the Docker-image security refresh open until backup/restore and database compatibility are qualified.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.
First published here: 19 October 2026
The review prioritised polkit, the Ubuntu nginx fix where applicable and API migration before 5 October.
Source weekly review: 20 September 2026
124-2ubuntu1.24.04.4The review identified USN-8762-1 for local security issues in polkit.
Include installed polkit binaries in the security baseline and smoke-test administration.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
1.24.0-2ubuntu7.18The review flagged the corrected Ubuntu nginx update after an earlier regression.
Apply only to installed Ubuntu nginx packages after reverse-proxy/configuration tests; container images have a separate baseline.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
5 October 2026The review required an API inventory ahead of the 5 October retirement.
Review route-ID endpoints and the dedicated connections endpoint. Publication correction: also check cloudflared route ip add/delete; absence of custom API code alone is insufficient for a full N/A conclusion.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
2026.9.1The review selected 2026.9.1 as a laboratory compatibility candidate.
Qualify HTTP/SSH, WAN reconnection, restart and encoded/trailing-slash URLs before promotion. This is the target recorded at the time.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
26.8.7.19The review selected 26.8.7.19 LTS as the next laboratory target.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
8.4.12The review recorded no new MySQL action beyond the pending 8.4.12 Docker refresh.
Keep the Docker-image security refresh open until backup/restore and database compatibility are qualified.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.
First published here: 19 October 2026
This review prioritised OpenSSH, the installed cloudflared version and Docker/database compatibility.
Source weekly review: 7 September 2026
1:9.6p1-3ubuntu13.19USN-8721-1 introduced the OpenSSH floor recorded by this review.
Update after access tests; this historical floor is superseded by .20 in the October report.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
2026.8.3The review required an inventory and exclusion of problematic 2026.8.0/2026.8.1, proposing 2026.8.3 for qualification.
Test URL handling, HTTP/SSH and restart before replacing a tunnel; later reports record newer candidates.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
8.4.12The review identified the 18 August 8.4.12 Docker-only security refresh.
Keep the Docker-image security refresh open until backup/restore and database compatibility are qualified.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
26.8.2.7The review selected 26.8.2.7 LTS as the next laboratory target.
Keep production pinned until ingestion, query correctness, retention and recovery tests pass. Later weekly candidates supersede this historical target.
Instructions retained from the historical review. For current software versions and installation steps, follow the latest compatible cumulative release.
Read the decision in its original review context. Do not install an older target merely because it appears here.
Check the latest report, actual host/container inventory and applicable qualification before scheduling an update.
Completion check: Use the current component procedure to verify the package version, running service and restart requirements after an update.
Historical review: versions and decisions refer to the date shown above. For a current update, follow the latest compatible cumulative release and its component instructions.
