Worth your time: week of 19 October
Five pieces from the week of 19 October, picked as an edit: the ones that still matter after the week they ran.
5 entriesMonday 26 October 2026an edit, not a feed
summarylive
the edition5
01Tube Archivist 0.6.0 can run as a non-root user, and the migration is not optionalTube Archivist v0.6.0, published 25 October, can run under a dedicated non-root user, which meant removing the bundled nginx and serving media from the application. The release calls that a security improvement and a set of breaking changes: HOST_UID and HOST_GID go, ownership is yours to set, TA_BACKEND_PORT gives way to TA_PORT, media URLs changed, and Elasticsearch moves from 8.19.0 to 9.5.5.
02HTTP2Shell: CVE-2026-111497 is a Brotli flaw, and it is bigger than Node.jsCVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, not a Node.js bug. Versions 1.0.3 through 1.2.0 are affected on all platforms, fixed in 1.2.1 or the 1.0.10 and 1.1.1 backports, and the flaw works in both directions. This desk's 22 October Node.js story framed the scope too narrowly, and this is the correction.
03Unraid 7.2.9 carries the PHP2Shell fixes and the eMudhra CA updateUnraid OS 7.2.9 is a targeted security patch for the 7.2 branch: PHP 8.4.27 covering ten CVEs including the PHP2Shell pair, a CA bundle that addresses the eMudhra compromise, and an API update whose bundled Node 22.23.4 resolves the certificate issue. Unraid still points 7.2 users at 7.3.4 for the newer kernel.
04GitLab's critical patch fixes a CVSS 10.0 unauthenticated RCECVE-2026-110264 is an integer overflow in GitLab's regular expression compiler that could let an unauthenticated user run code on the server. Patches are out for every supported line, with backports to older branches and two threat detections for self-managed instances.
05CVE-2026-99999: a critical Linux kernel flaw lets a guest attack the hostA critical IPv4 checksum bug in the Linux kernel lets a guest virtual machine, or any local sender of crafted packets, corrupt the host kernel's memory. The fix is upstream and backported, Red Hat tracks it as an active-exploit case, and there is no mitigation beyond a kernel update.