FOXBOX SECURITY UPDATE — 2026.10.19-r2

SCOPE
Cumulative selective updates for the Ubuntu24.04 LTS amd64 HOST with GA6.8
generic kernel. Official Canonical security floors cover weekly reviews from
7 September through 18 October2026. Containers, MySQL, FoxBox application code,
external drivers and third-party repositories are separate.

HOW TO UPDATE
1. Download the ZIP and compare its SHA256 with the Security Watch page.
2. Extract into a private directory outside the webroot and run the package
   on the supported Ubuntu24.04 host.
3. Run: sha256sum -c SHA256SUMS
4. Check: /usr/bin/python3 foxbox_security.py check
5. Apply: sudo /usr/bin/python3 foxbox_security.py apply
   When reviewed floors are already installed, apply also works without sudo
   and reports already_up_to_date. It never reinstalls current/newer packages.
   Previous ZIP releases do not need to be applied first.
6. Read packages_changed, reboot_required, reboot_performed and private_snapshot.
   Verify a fresh SSH connection and application health. Keep a second admin
   session open and arrange suitable console/recovery access before maintenance.

PREREQUISITES FOR CHANGES
Root, system Python3 and python3-apt, consistent dpkg state, authenticated Ubuntu
repositories hosted on ubuntu.com domains, exact archives and at least2GiB
free private-backup space. Kernel installation also needs1GiB free in /boot,
the current kernel/initramfs preserved and recognized in-tree modules only.
DKMS, external modules, HWE kernels and held outdated packages stop for a
separate procedure. If an authenticated old archive is unavailable, installation
stops before changing packages; arrange recovery with support. Custom mirrors
and mixed package origins are rejected.

REBOOT AND ACTIVATION
The updater NEVER reboots the host. An installed but inactive kernel reports
reboot_required=true without reinstalling it. The OpenSSL security advisory
requires reboot. OpenSSH requires service activation and a fresh connection,
not by itself a host reboot. Other library changes may require service restarts.
NEEDRESTART_MODE=l disables automatic restarts by needrestart; normal package
maintainer scripts may still restart their own service. updated verifies
installed package versions, not activation of every running process. Arrange
required activation and modem/driver/application checks during maintenance.
MySQL image migration and its service restart are a separate operation.

PROTECTION AND RECOVERY
Authenticated sources, versions and the APT transaction are checked. Removals,
downgrades and unapproved dependencies are rejected. An APT pre-install guard
rechecks state, configuration and archive hashes under the package-manager lock.
Private root-only snapshots in /var/backups/foxbox-security/<release-run> contain
old archives, targeted configuration, plans and receipts; no customer databases.
Do not publish snapshots. Protected rollback stops if later package/configuration
changes conflict with recorded hashes:
  sudo /usr/bin/python3 foxbox_security.py rollback --snapshot /var/backups/foxbox-security/<release-run>
Rollback restores older versions and may reintroduce security exposure; use
only for operational recovery and plan the corrected update. If a reliable
failure state cannot be captured, preserve the snapshot for assisted recovery.
Power loss or a killed process during rollback can require manual recovery;
rollback is not an automatically resumable transaction.
Never restore an entire customer database over newer writes.

CUMULATIVE BEHAVIOUR
Every run checks actual versions, companion binaries and held packages instead
of trusting old patch markers. Newer versions are preserved. Optional absent
services stay absent. Only an explicitly verified new product baseline can
reset the series; normal weekly releases retain earlier security floors.

EXIT CODES
0: completed check or successful/already-current apply;2: check needs action or
reboot;3: unsupported baseline;4: error or missing prerequisite. On apply errors,
mutates_appliance and private_snapshot identify a partial change requiring recovery.

SOURCES AND PRIVACY
Official references and floors are in manifest.json. JSON receipts collect no
contact/message content, credentials or tokens. Installed-version checks do
not replace service verification after activation.
