What to patch this week
A free weekly email for agencies and software teams: the security fixes that matter for WordPress, PHP, Node, Ubuntu, nginx and MySQL servers. Actively exploited flaws first, each in one plain-English line, every Monday morning.
The latest: 26 Oct – 1 Nov 2026
In brief
Four of this week's five fixes are for flaws attackers are already using: Brotli on Ubuntu (rated 9.8); Adobe Commerce and Magento (rated 9.3); WordPress core 7.1.4 (rated 8.1); Linux kernel (rated 7.8). Patch those first.
Also fixed: nginx on Ubuntu (rated 8.1, plus 4 related flaws).
On Ubuntu, three of these come with one apt upgrade; the kernel fix needs a reboot (or Livepatch) to take effect.
The fixes
Brotli on Ubuntu: a memory corruption flaw (CVE-2026-111497, rated 9.8 out of 10) that attackers are already using.
What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses Brotli.
USN-8956-1: Brotli vulnerability: Brotli could be made to crash or run programs if it received specially crafted input.
Affected: Ubuntu 26.10, 26.04, 24.04, 22.04 · CVE-2026-111497 · Source
Adobe Commerce and Magento: a malicious file upload flaw (CVE-2026-48356, rated 9.3 out of 10) that attackers are already using.
What to do: Patch now: attackers are using it. CISA lists it as known exploited (US deadline 10 Nov).
WordPress core: a race condition flaw (CVE-2026-119977, rated 8.1 out of 10) that attackers are already using.
What to do: Update WordPress core to 7.1.4 or later.
WordPress 7.1.4: This security release features fixes for multiple issues.
Fixed in: 7.1.4 · CVE-2026-119977 · Source
Linux Kernel: a memory corruption flaw (CVE-2026-46300, rated 7.8 out of 10) that attackers are already using.
What to do: Patch now: attackers are using it. CISA lists it as known exploited (US deadline 31 Oct).
nginx on Ubuntu: a memory corruption flaw (CVE-2026-15176, rated 8.1 out of 10), and 4 more fixed with it.
What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses nginx.
USN-8955-1: nginx vulnerabilities: Several security issues were fixed in nginx.
Affected: Ubuntu 26.10, 26.04, 24.04, 22.04 · CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205, CVE-2026-97629 · Source
Every past issue
- 26 Oct – 1 Nov 2026: 5 fixes, 4 actively exploited: Brotli on Ubuntu, Adobe Commerce and Magento, WordPress core 7.1.4, Linux kernel, nginx on Ubuntu
- 19–25 Oct 2026: 6 fixes, 2 actively exploited: Node.js 24.22.1, 22.23.4, 26.12.1, PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, curl on Ubuntu, OpenSSH on Ubuntu, Ghostscript on Ubuntu
Questions
What's in it?
The security fixes from the past week that matter for the servers agencies and small software teams run: WordPress and its plugins, PHP, Node.js, Ubuntu and Debian packages, nginx, Apache and MySQL. Flaws being actively exploited come first, then the most severe. Each one has a plain-English line, its CVSS score, what kind of flaw it is and what to do.
Where does it come from?
Vendor security notices, the Ubuntu and Debian advisories, NVD, and CISA's list of known exploited vulnerabilities, collected and sorted by Bobble Pulse, my patch monitoring service. Old flaws that resurface are left out unless they're being exploited.
Who is it for?
Agencies that host their clients' sites, and software teams without a full-time ops person: anyone who has to decide on Monday what gets patched this week.
How often, and can I stop it?
Once a week, on Monday morning. Every email has a one-click unsubscribe link.
Rather someone else did the patching?
Managed servers get security fixes within hours, tested and rolled back if anything breaks. Or start with the free outside check of your site.