Worth your time: week of 26 October
Five pieces from the week of 26 October, picked as an edit: the ones that still matter after the week they ran.
5 entriesMonday 2 November 2026an edit, not a feed
summarylive
the edition5
01Let's Encrypt moves to 64-day certificates in February, and renewal maths has to move with itFrom 10 February 2027 Let's Encrypt issues 64-day certificates by default, with the last 90-day certificate expiring on 11 May 2027 and no revocation of what is already out there. Clients that follow ACME Renewal Info handle it; hard-coded offsets need to move to about two thirds of the lifetime, and a third-party test in October found one acme.sh version scheduling its renewal after the certificate had already expired.
02Memos 26.10.0 signs API clients out, stops reading /etc/secrets and makes export an admin jobMemos 26.10.0 is the first release under calendar versioning, and its upgrade notes matter more than its features: old installs need a 0.31.0 waypoint, cached access tokens expire on upgrade, the /etc/secrets files from 0.31.0 are no longer read, member export disappears, and the old upload and memo-length settings are replaced without migration. The features are a rich editor by default, per-user usage limits and declarative configuration.
03CVE-2026-98432 is a Linux TCP use-after-free, and Anthropic's model reached root with itCVE-2026-98432 is a race in the Linux kernel's handling of IPv4 TCP options, where a retransmitted SYN can free a structure another thread is still reading. The record carries a 9.8 critical CVSS v3.1 vector and stable backports, and Anthropic's write-up names it as the kernel bug behind a zero-click chain that reached a root shell on servers with a multipath TCP listener.
04borgmatic 2.2.0 keeps Borg deduplicating the tarballs you back upborgmatic 2.2.0 adds a beta tarballs data source that streams a tar file into Borg as individual files, so VM exports deduplicate instead of sitting in the archive as one packed blob. The release also fixes a hang that hit database dumps with heavy output, file-descriptor exhaustion when dumping hundreds of databases, and a regression that cost ZFS, LVM and Btrfs hooks their Borg cache hits.
05Tailscale's SSH bugs sat after authorisation, and it rejects the worm labelTailscale shipped v1.104.4 on 28 October with fixes for privilege-boundary bugs in Tailscale SSH and three Serve bugs. The flaws were about what a session could do after it was authorised, not who could connect, and Tailscale argues the 'Tailworm' framing overstates them: exploitation needs an existing foothold in the tailnet and SSH permitted by policy.