+61 2 9043 1246

Knowledge base

Notes from the service department

Security alerts, what breaks, what we check, and what the logbook says · Feed · Get alerts by email

  1. PHP 8.2 reaches end of life on 31 December 2026: what website owners need to do

    PHP 8.2 stops receiving security fixes on 31 December 2026, so any website still running it should plan its move to a supported PHP version now. Here is how to check your site, why the upgrade often includes your CMS, and what to do first.

    Andrew Cornale

  2. CVE-2026-109618 and CVE-2026-109619: the critical PHP flaws, explained for website owners

    Two critical flaws in PHP, the language most websites run on, let an attacker take over a web server without logging in. PHP released the fix on 21 October 2026 and attacks have been seen. Here is how to check your website is patched.

    Andrew Cornale

  3. CVE-2026-85746: the MariaDB Server out-of-bounds write flaw, explained for website owners

    CVE-2026-85746 is a critical flaw in MariaDB Server, the database software, that lets someone with a low-level database login corrupt the server’s memory. It affects six release series before fixes MariaDB shipped in August and September 2026. No attacks are confirmed. Find out which database version your site runs and update it.

    Kristen Cornale

  4. USN-8917-1: the Ubuntu Linux kernel security update, explained for website owners

    USN-8917-1 is Ubuntu’s 13 October 2026 kernel update for Ubuntu 24.04 LTS, fixing a large bundle of Linux kernel flaws. It concerns any website on an Ubuntu 24.04 server. Exploitation is not known and its CISA KEV status is unconfirmed. Install the update and reboot the server.

    Kristen Cornale

  5. The WordPress pending-comment XSS flaw: the WordPress Core comment moderation bug fixed in 7.1.3, explained for website owners

    WordPress 7.1, 7.1.1 and 7.1.2 contain a stored cross-site scripting flaw on the Comments screen: a stranger’s pending comment can run code when a moderator clicks it. No attacks have been reported. WordPress fixed it in 7.1.3 on 6 October 2026. Check your version and update.

    Andrew Cornale

  6. USN-8903-1: the Ubuntu Linux kernel security update, explained for website owners

    USN-8903-1 is Canonical’s 8 October 2026 kernel update for Ubuntu 24.04 and 22.04 servers. It fixes 232 flaws, and one of them, CVE-2026-53266, is on CISA’s list of vulnerabilities being exploited. If your website runs on one of these servers, have the kernel updated and confirm it is running.

    Kristen Cornale

  7. CVE-2026-32475: the Elementor Pro file upload flaw, explained for website owners

    CVE-2026-32475 is a critical vulnerability (CVSS 9.0) in the Elementor Pro WordPress plugin, versions 4.2.1 and earlier, that lets an attacker who is not logged in upload a PHP file through any form with a File Upload field and take over the site. It is being exploited. Update to Elementor Pro 4.2.2 or later, then check your uploads folder.

    Andrew Cornale