Patch digest › 26 Oct – 1 Nov 2026

Patch digest: 26 Oct – 1 Nov 2026

What to patch from the week of 26 Oct – 1 Nov 2026: 5 fixes, 4 actively exploited: Brotli on Ubuntu, Adobe Commerce and Magento, WordPress core 7.1.4, Linux kernel, nginx on Ubuntu. Actively exploited flaws first. Get it by email every Monday.

In brief

Four of this week's five fixes are for flaws attackers are already using: Brotli on Ubuntu (rated 9.8); Adobe Commerce and Magento (rated 9.3); WordPress core 7.1.4 (rated 8.1); Linux kernel (rated 7.8). Patch those first.

Also fixed: nginx on Ubuntu (rated 8.1, plus 4 related flaws).

On Ubuntu, three of these come with one apt upgrade; the kernel fix needs a reboot (or Livepatch) to take effect.

The fixes

1

Ubuntu Actively exploited CVSS 9.8 Memory corruption

Brotli on Ubuntu: a memory corruption flaw (CVE-2026-111497, rated 9.8 out of 10) that attackers are already using.

What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses Brotli.

USN-8956-1: Brotli vulnerability: Brotli could be made to crash or run programs if it received specially crafted input.

Affected: Ubuntu 26.10, 26.04, 24.04, 22.04 · CVE-2026-111497 · Source

2

Magento / Adobe Commerce Actively exploited CVSS 9.3 Malicious file upload

Adobe Commerce and Magento: a malicious file upload flaw (CVE-2026-48356, rated 9.3 out of 10) that attackers are already using.

What to do: Patch now: attackers are using it. CISA lists it as known exploited (US deadline 10 Nov).

CVE-2026-48356 · Source

3

WordPress core Actively exploited CVSS 8.1 Race condition

WordPress core: a race condition flaw (CVE-2026-119977, rated 8.1 out of 10) that attackers are already using.

What to do: Update WordPress core to 7.1.4 or later.

WordPress 7.1.4: This security release features fixes for multiple issues.

Fixed in: 7.1.4 · CVE-2026-119977 · Source

4

Ubuntu Actively exploited CVSS 7.8 Memory corruption

Linux Kernel: a memory corruption flaw (CVE-2026-46300, rated 7.8 out of 10) that attackers are already using.

What to do: Patch now: attackers are using it. CISA lists it as known exploited (US deadline 31 Oct).

CVE-2026-46300 · Source

5

Ubuntu CVSS 8.1 Memory corruption

nginx on Ubuntu: a memory corruption flaw (CVE-2026-15176, rated 8.1 out of 10), and 4 more fixed with it.

What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses nginx.

USN-8955-1: nginx vulnerabilities: Several security issues were fixed in nginx.

Affected: Ubuntu 26.10, 26.04, 24.04, 22.04 · CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205, CVE-2026-97629 · Source

‹ 19–25 Oct 2026 · Every past issue

Get it every Monday

Free. One email a week, unsubscribe with one click.

You'll get one email to confirm first. Your address is used only for the digest, never shared, and sent through Amazon SES. Privacy.

Rather someone else did the patching?

Managed servers get security fixes within hours, tested and rolled back if anything breaks. Or start with the free outside check of your site.

Book a callWrite instead