SKYLINE Blog

Security advisories

Vulnerabilities, service outages and urgent notices that affect SKYLINE customers. Each advisory says how serious it is, what is affected and what you should do.

Follow advisories by RSS Need help? Open a support ticket

Browse by topic

All advisories

Reading language
All English العربية
  1. Severity: High Status: Patched Vulnerability

    Redis and Valkey on Debian: 2026 security updates (DSA-6586-1, DSA-6538-1, DLA-4794-1 and more)

    Seven Debian advisories in 2026 fixed Redis and Valkey bugs in RESTORE, Lua, TLS and the cluster bus. The versions to be on now and what to restrict.

    Affected
    valkey in Debian 13 (trixie) before 8.1.1+dfsg1-3+deb13u3 and 7 more
    Published
    Updated
  2. Severity: Critical Status: Monitoring Vulnerability

    Unbound DNS resolver on Debian in 2026: DSA-6304-1, DSA-6507-1 and DSA-6581-1 explained

    Three 2026 Debian updates fixed 49 Unbound CVEs on trixie, two rated Critical by NLnet Labs. Bookworm has no fix yet. What to check and do.

    Affected
    unbound in Debian 13 (trixie) before 1.26.2-0+deb13u1 and 3 more
    Published
    Updated
  3. Severity: High Status: Monitoring Vulnerability

    Roundcube on Debian: DSA-6579-1 brings the 1.6.20 security fixes (20 CVEs); bookworm status

    DSA-6579-1 (23 Oct 2026) fixes 20 Roundcube flaws on Debian 13. Debian 12 got the August and September rounds via DLAs, but not this one yet.

    Affected
    roundcube in Debian 13 (trixie) before 1.6.20+dfsg-0+deb13u1 and 2 more
    Published
    Updated
  4. Severity: Critical Status: Patched Vulnerability

    Debian 13 (trixie) php8.4 security updates, December 2025 to October 2026 (DSA-6088-1 to DSA-6574-1)

    Six Debian security advisories updated php8.4 on trixie between December 2025 and October 2026, the last for the actively exploited php2shell flaws.

    Affected
    php8.4 in Debian 13 (trixie) before 8.4.16-1~deb13u1 and 5 more
    Published
    Updated
  5. Severity: Critical Status: Patched Vulnerability

    Debian 12 (bookworm) php8.2 security updates 2025-2026: four DSAs and four LTS advisories

    Every php8.2 security update for Debian 12 from March 2025 to October 2026, including the LTS fix for the actively exploited php2shell flaws.

    Affected
    php8.2 in Debian 12 (bookworm) before 8.2.28-1~deb12u1 and 7 more
    Published
    Updated
  6. Severity: Medium Status: Monitoring Vulnerability

    nginx DSA-6575-1 (October 2026): five memory, HTTP/3 and TLS session ticket fixes for Debian 13

    DSA-6575-1 fixes five nginx flaws in Debian 13, including buffer overflows and a TLS session ticket bug. Debian 12 still awaits its LTS update.

    Affected
    nginx in Debian 13 (trixie) before 1.26.3-3+deb13u10 and 1 more
    Published
    Updated
  7. Severity: High Status: Monitoring Vulnerability

    BIND 9 on Debian: DSA-6576-1 fixes GSS-TSIG memory corruption and three resolver crashes

    DSA-6576-1 (21 Oct 2026) fixes four High-rated BIND flaws on Debian 13. Debian 12 is affected too and has no fixed package yet.

    Affected
    bind9 in Debian 13 (trixie) before 1:9.20.30-1~deb13u1 and 1 more
    Published
    Updated
  8. Severity: High Status: Patched Vulnerability

    HAProxy on Debian, Oct 2025 to Oct 2026: DSA-6570-1, DLA-4842-1 and earlier denial-of-service fixes

    Five Debian advisories in a year fixed HAProxy DoS and HTTP/3 request smuggling bugs. The versions to run now on Debian 12 and 13, and how to check.

    Affected
    haproxy in Debian 13 (trixie) before 3.0.11-1+deb13u4 and 5 more
    Published
    Updated
  9. Severity: Critical Status: Patched Vulnerability

    Debian kernel updates, September-October 2026: DSA-6568-1, DSA-6528-1, DLA-4841-1 and what to reboot

    Debian 13 and 12 received large Linux kernel security updates in September and October 2026. Versions, package names and how to confirm the reboot.

    Affected
    linux in Debian 13 (trixie) before 6.12.111-1 and 6 more
    Published
    Updated
  10. Severity: Medium Status: Monitoring Vulnerability

    Apache HTTP Server DSA-6569-1 (October 2026): 19 CVEs fixed with httpd 2.4.69 in Debian 13

    DSA-6569-1 moves Debian 13 to Apache httpd 2.4.69, fixing 19 CVEs in WebDAV, HTTP/2, vhost_alias and auth modules. Debian 12's LTS update is still pending.

    Affected
    apache2 in Debian 13 (trixie) before 2.4.69-1~deb13u1 and 1 more
    Published
    Updated
  11. Severity: Critical Status: Monitoring Vulnerability

    MariaDB 10.11.19 for Debian 12 (DLA-4835-1): security fixes, a port 3306 exposure fix and trixie status

    DLA-4835-1 brings MariaDB 10.11.19 to Debian 12 and undoes a July change that opened port 3306. Debian 13 is still waiting for a fix.

    Affected
    mariadb in Debian 12 (bookworm) before 10.11.19-0+deb12u1 and 1 more
    Published
    Updated
  12. Severity: High Status: Patched Vulnerability

    curl DSA-6558-1 (October 2026): HTTP/2 upload use-after-free CVE-2026-92392 fixed in Debian 13

    DSA-6558-1 fixes a High-rated libcurl HTTP/2 upload use-after-free and three minor curl bugs in Debian 13. Debian 12's curl 7.88 is not affected.

    Affected
    curl in Debian 13 (trixie) before 8.14.1-2+deb13u7
    Published
    Updated
  13. Severity: High Status: Patched Vulnerability

    OpenSSL DSA-6531-1 and DLA-4859-1: September 2026 DTLS, QUIC and timing fixes for Debian 13 and 12

    OpenSSL's 29 Sep 2026 advisory fixes one High and many Low issues. Debian 13 gets DSA-6531-1, Debian 12 gets DLA-4859-1. Update, then restart services.

    Affected
    openssl in Debian 13 (trixie) before 3.5.7-1~deb13u3 and 1 more
    Published
    Updated
  14. Severity: Critical Status: Monitoring Vulnerability

    rsync 3.5.0 for Debian 13 fixes 33 CVEs (DSA-6527-1), plus the May 2026 update DSA-6282-1

    Debian 13 moved to rsync 3.5.0 to fix 33 CVEs; Debian 12 got the May fixes but the September batch is still open. What to check and change.

    Affected
    rsync in Debian 13 (trixie) before 3.5.0+ds1-0+deb13u1 and 2 more
    Published
    Updated
  15. Severity: Critical Status: Patched Vulnerability

    Dovecot on Debian: DSA-6526-1 and DLA-4873-1 fix 25 flaws, including Sieve editheader RCE

    Dovecot's August 2026 security round reached Debian 13 on 28 Sep (DSA-6526-1) and Debian 12 on 31 Oct (DLA-4873-1). Vendor rating: Critical.

    Affected
    dovecot in Debian 13 (trixie) before 1:2.4.1+dfsg1-6+deb13u7 and 1 more
    Published
    Updated
  16. Severity: High Status: Monitoring Vulnerability

    Exim on Debian 13: DSA-6522-1 (SMTP smuggling, PROXY flaws) and DSA-6400-1 (local privilege escalation)

    Two 2026 Exim updates for Debian 13: DSA-6400-1 (July) and DSA-6522-1 (September). Debian 12 is still listed as vulnerable. What to check.

    Affected
    exim4 in Debian 13 (trixie) before 4.98.2-1+deb13u5 and 2 more
    Published
    Updated
  17. Severity: High Status: Patched Vulnerability

    Node.js security updates for Debian 13 and 12 (DSA-6517-1, DLA-4809-1): HTTP/2, TLS and permission fixes

    Debian backported fixes from Node.js's June and July 2026 security releases to its Node 20 and 18 packages. The October 2026 issues are still open.

    Affected
    nodejs in Debian 13 (trixie) before 20.19.2+dfsg-1+deb13u3 and 1 more
    Published
    Updated
  18. Severity: High Status: Patched Vulnerability

    PHP security releases of September 2026: 8.5.11, 8.4.26, 8.3.35 and 8.2.34 fix 11 CVEs

    PHP's 24 September 2026 releases fixed 11 CVEs: credential leaks on HTTP redirects, TLS name checks, an FPM IPv6 access bypass and a SOAP crash.

    Affected
    PHP 8.5 before 8.5.11 and 3 more
    Published
    Updated
  19. Severity: High Status: Monitoring Vulnerability

    BIND 9 on Debian: 14 fixes in DSA-6505-1 (trixie) and DLA-4865-1 (bookworm)

    DSA-6505-1 fixed 14 BIND flaws on Debian 13 in September 2026; DLA-4865-1 brought ten of them to Debian 12 on 27 October.

    Affected
    bind9 in Debian 13 (trixie) before 1:9.20.29-1~deb13u1 and 1 more
    Published
    Updated
  20. Severity: High Status: Patched Vulnerability

    nginx DSA-6496-1 and DLA-4784-1 (September 2026): map/regex buffer overflow fixed in Debian 13 and 12

    DSA-6496-1 and DLA-4784-1 fix a major-rated nginx buffer overflow and two medium bugs in Debian 13 and 12. Includes earlier 2026 nginx updates.

    Affected
    nginx in Debian 13 (trixie) before 1.26.3-3+deb13u8 and 2 more
    Published
    Updated

Get these advisories by email

Email me the alerts I ticked. I can unsubscribe at any time. We’ll email you a link to confirm. You aren’t subscribed until you click it. Privacy policy

How we rate severity
  • Severity: Critical Serious and exploitable now. Act immediately.
  • Severity: High Significant impact. Act as soon as you can.
  • Severity: Medium Limited impact or needs special conditions. Update in your next maintenance window.
  • Severity: Low Low risk. Update when convenient.
  • Severity: Informational For your information. No action needed.