SKYLINE Blog

Security advisories

Vulnerabilities, service outages and urgent notices that affect SKYLINE customers. Each advisory says how serious it is, what is affected and what you should do.

Follow advisories by RSS Need help? Open a support ticket

Browse by topic

All advisories

Reading language
All English العربية
  1. Severity: High Status: Monitoring Vulnerability

    VPN servers on Debian: strongSwan DSA-6487-1 and OpenVPN DSA-6376-1 / DLA-4666-1 explained

    strongSwan (DSA-6487-1, trixie only) and OpenVPN (DSA-6376-1, DLA-4666-1) updates from 2026: what they fix, what is still open, how to patch.

    Affected
    strongswan in Debian 13 (trixie) before 6.0.1-6+deb13u7 and 3 more
    Published
    Updated
  2. Severity: High Status: Patched Vulnerability

    Debian OpenSSL updates January-August 2026: DSA-6113-1, DSA-6201-1, DSA-6335-1 and DSA-6465-1

    Four Debian OpenSSL advisories between January and August 2026 fixed 33 CVEs, two rated High by OpenSSL. What each fixed and how to confirm you are current.

    Affected
    openssl in Debian 13 (trixie) before 3.5.4-1~deb13u2 and 7 more
    Published
    Updated
  3. Severity: High Status: Monitoring Vulnerability

    Docker and containerd on Debian: DSA-6443-1, DSA-6067-1 and the runc fixes still pending

    Debian fixed seven Docker and BuildKit CVEs in trixie and two containerd CVEs, but several runc and containerd issues remain open. What that means for you.

    Affected
    docker.io in Debian 13 (trixie) before 26.1.5+dfsg1-9+deb13u1 and 3 more
    Published
    Updated
  4. Severity: High Status: Patched Vulnerability

    PostgreSQL 17.11 and 15.19 security updates for Debian 13 and 12 (DSA-6438-1, DLA-4740-1)

    Debian fixed 27 PostgreSQL CVEs in August 2026, including code execution bugs rated 8.8. Update, then check four post-update items.

    Affected
    postgresql-17 in Debian 13 (trixie) before 17.11-0+deb13u1 and 1 more
    Published
    Updated
  5. Severity: High Status: Patched Vulnerability

    libssh and libssh2 security updates for Debian 12 and 13 (DSA-6410-1, DLA-4844-1, DSA-6365-1, DLA-4773-1)

    Debian fixed many libssh and libssh2 flaws in 2026. They are not OpenSSH, but curl, PHP ssh2 and QEMU use them. Versions to check and how to update.

    Affected
    libssh in Debian 13 (trixie) before 0.11.5-0+deb13u1 and 3 more
    Published
    Updated
  6. Severity: High Status: Patched Vulnerability

    PHP security releases of 30 July 2026: 8.5.9, 8.4.24, 8.3.33 and 8.2.33 fix pgsql SQL injection

    PHP's 30 July 2026 releases fixed SQL injection in pg_insert()/pg_select() and friends, a bccomp() memory write, a libgd flaw and a phar crash.

    Affected
    PHP 8.5 before 8.5.9 and 3 more
    Published
    Updated
  9. Severity: High Status: Patched Vulnerability

    GnuTLS DSA-6281-1: DTLS heap overflows, RSA-PSK auth bypass and certificate checks fixed in Debian 12 and 13

    DSA-6281-1 (19 May 2026) fixes 13 GnuTLS flaws, four rated High upstream, on Debian 12 and 13. Check libgnutls30, update and restart services that use it.

    Affected
    gnutls28 in Debian 13 (trixie) before 3.8.9-3+deb13u4 and 3 more
    Published
    Updated
  10. Severity: High Status: Patched Vulnerability

    PostgreSQL 17.10 and 15.18 on Debian: May 2026 security update (DSA-6270-1, DSA-6269-1)

    May 2026 Debian PostgreSQL updates fixed SQL injection, code execution and a denial-of-service bug. What changed, plus the February fixes.

    Affected
    postgresql-17 in Debian 13 (trixie) before 17.10-0+deb13u1 and 3 more
    Published
    Updated
  11. Severity: Critical Status: Patched Vulnerability

    Exim on Debian: DSA-6265-1 fixes critical BDAT use-after-free (CVE-2026-45185), plus DSA-6309-1

    DSA-6265-1 (12 May 2026) fixed a Critical remote Exim flaw and four smaller ones; DSA-6309-1 followed with a PROXY-protocol leak fix.

    Affected
    exim4 in Debian 12 (bookworm) before 4.96-15+deb12u9 and 3 more
    Published
    Updated
  12. Severity: High Status: Patched Vulnerability

    PHP security releases of May 2026: 8.5.6, 8.4.21, 8.3.31 and 8.2.31 fix SOAP, PDO_Firebird and FPM flaws

    The 7 May 2026 PHP releases fixed up to 12 CVEs, including a SOAP use-after-free that may allow code execution and an FPM status page XSS.

    Affected
    PHP 8.5 before 8.5.6 and 3 more
    Published
    Updated
  13. Severity: High Status: Patched Vulnerability

    Apache HTTP Server DSA-6248-1 and DSA-6323-1 (May-June 2026): httpd 2.4.67, HTTP/2 double free and DoS fixes

    DSA-6248-1 moved Debian 12 and 13 to Apache httpd 2.4.67, fixing an important HTTP/2 double free and ten more CVEs; DSA-6323-1 added an HTTP/2 DoS fix in June.

    Affected
    apache2 in Debian 13 (trixie) before 2.4.67-1~deb13u2 and 3 more
    Published
    Updated
  14. Severity: Low Status: Patched Vulnerability

    Debian OpenSSH GSSAPI key exchange flaw (DSA-6204-1, CVE-2026-3497): who is affected and how to update

    DSA-6204-1 fixes a flaw in Debian's GSSAPI key exchange patch for OpenSSH. Only servers with GSSAPIKeyExchange enabled are exposed.

    Affected
    openssh in Debian 12 (bookworm) before 1:9.2p1-2+deb12u9 and 1 more
    Published
    Updated
  15. Severity: High Status: Patched Vulnerability

    Dovecot on Debian: DSA-6197-1 security fixes and the two bookworm regression updates (DSA-6197-2, -3)

    DSA-6197-1 (5 Apr 2026) fixed Dovecot auth and DoS flaws; two follow-ups repaired ManageSieve logins and passwd-file lookups on Debian 12.

    Affected
    dovecot in Debian 13 (trixie) before 1:2.4.1+dfsg1-6+deb13u4 and 4 more
    Published
    Updated
  16. Severity: Medium Status: Patched Vulnerability

    PHP security releases of December 2025: 8.5.1, 8.4.16, 8.3.29, 8.2.30 and the final 8.1.34

    PHP's 18 December 2025 releases fixed bugs in PDO quoting, array_merge() and getimagesize(), and 8.1.34 closed out the 8.1 branch. What to check.

    Affected
    PHP 8.5 before 8.5.1 and 4 more
    Published
    Updated
  17. Severity: High Status: Patched Vulnerability

    BIND 9 cache poisoning fixes on Debian: DSA-6033-1 (CVE-2025-40778, CVE-2025-40780)

    DSA-6033-1 (23 Oct 2025) fixed two BIND cache-poisoning flaws and a DNSKEY CPU-exhaustion bug on Debian 12 and 13. What it covered and how to check.

    Affected
    bind9 in Debian 12 (bookworm) before 1:9.18.41-1~deb12u1 and 2 more
    Published
    Updated
  18. Severity: High Status: Patched Vulnerability

    Debian intel-microcode updates DSA-6030-1 and DSA-5924-1: Intel CPU fixes and how to apply them

    DSA-6030-1 and DSA-5924-1 ship new Intel CPU microcode for Debian 12 and 13. Which servers need it, how to check the loaded revision, and why a reboot matters.

    Affected
    intel-microcode in Debian 12 (bookworm) before 3.20250812.1~deb12u1 and 2 more
    Published
    Updated
  19. Severity: Critical Status: Patched Vulnerability

    Redis and Valkey Lua scripting flaws, incl. CVE-2025-49844: Debian DSA-6020-1 and DSA-6022-1

    Four Lua scripting bugs in Redis and Valkey, one rated 10.0 by Redis, were fixed in Debian in October 2025. Check versions and who can run scripts.

    Affected
    redis in Debian 12 (bookworm) before 5:7.0.15-1~deb12u6 and 3 more
    Published
    Updated
  20. Severity: Medium Status: Patched Vulnerability

    PHP security releases of July 2025: 8.4.10, 8.3.23, 8.2.29 and 8.1.33

    The 3 July 2025 PHP releases fixed three CVEs in pgsql escaping, SOAP and hostname handling. What they mean and how to confirm you are patched.

    Affected
    PHP 8.4 before 8.4.10 and 3 more
    Published
    Updated

Get these advisories by email

Email me the alerts I ticked. I can unsubscribe at any time. We’ll email you a link to confirm. You aren’t subscribed until you click it. Privacy policy

How we rate severity
  • Severity: Critical Serious and exploitable now. Act immediately.
  • Severity: High Significant impact. Act as soon as you can.
  • Severity: Medium Limited impact or needs special conditions. Update in your next maintenance window.
  • Severity: Low Low risk. Update when convenient.
  • Severity: Informational For your information. No action needed.