Patch digest › 2–8 Nov 2026
Patch Digest: 2–8 Nov 2026
What to patch from the week of 2–8 Nov 2026: 6 fixes, 3 actively exploited: Linux kernel on Ubuntu, WordPress Core, libuser on Ubuntu, Bind on Ubuntu, nginx on Ubuntu, HAProxy on Ubuntu. Actively exploited flaws first. Get it by email every Monday.
In Brief
Three of this week's six fixes are for flaws attackers are already using: Linux kernel on Ubuntu (rated 8.8, plus 4578 related flaws); WordPress Core (rated 8.1); libuser on Ubuntu (rated 7.4, plus 1 related flaw). Patch those first.
Also fixed: Bind on Ubuntu (rated 8.1, plus 17 related flaws); nginx on Ubuntu (rated 8.1, plus 3 related flaws); HAProxy on Ubuntu (rated 7.5, plus 1 related flaw).
On Ubuntu, four of these come with one apt upgrade; the kernel fix needs a reboot (or Livepatch) to take effect.
The Fixes
Linux kernel on Ubuntu: a memory corruption flaw (CVE-2026-53266, rated 8.8 out of 10) that attackers are already using, among 4579 fixes.
What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and reboot.
USN-8963-1: Linux kernel (NVIDIA Tegra) vulnerabilities: Several security issues were fixed in the Linux kernel.
Affected: Ubuntu 22.04, 20.04 · CVE-2022-1205, CVE-2022-3114, CVE-2022-49234, CVE-2022-49359, CVE-2022-49562, CVE-2022-49651 and 4573 more · Source
WordPress Core: a race condition flaw (CVE-2026-119977, rated 8.1 out of 10) that attackers are already using.
What to do: Patch now: attackers are using it. CISA lists it as known exploited (US deadline 6 Nov).
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window.
libuser on Ubuntu: a race condition flaw (CVE-2015-3246, rated 7.4 out of 10) that attackers are already using, and 1 more fixed with it.
What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses libuser.
USN-8987-1: libuser vulnerabilities: Several security issues were fixed in libuser.
Affected: Ubuntu 16.04 · CVE-2015-3245, CVE-2015-3246 · Source
Bind on Ubuntu: a memory corruption flaw (CVE-2026-94300, rated 8.1 out of 10), and 17 more fixed with it.
What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses Bind.
USN-8969-1: Bind vulnerabilities: Several security issues were fixed in Bind.
Affected: Ubuntu 26.10, 26.04, 24.04, 22.04 · CVE-2026-19033, CVE-2026-19630, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668 and 12 more · Source
nginx on Ubuntu: a memory corruption flaw (CVE-2026-15176, rated 8.1 out of 10), and 3 more fixed with it.
What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses nginx.
USN-8955-2: nginx vulnerabilities: Several security issues were fixed in nginx.
Affected: Ubuntu 20.04, 18.04, 16.04, 14.04 · CVE-2026-15176, CVE-2026-42533, CVE-2026-93479, CVE-2026-97205 · Source
HAProxy on Ubuntu: a denial of service flaw (CVE-2026-110353, rated 7.5 out of 10), and 1 more fixed with it.
What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses HAProxy.
USN-8972-1: HAProxy vulnerabilities: HAProxy could be made to crash if it received specially crafted network traffic.
Affected: Ubuntu 26.10, 26.04, 24.04, 22.04 · CVE-2026-110353, CVE-2026-110354 · Source
Rather Someone Else Did the Patching?
Managed servers get security fixes within hours, tested and rolled back if anything breaks. Or start with the free outside check of your site.