Meta tags:
description=SafeBase monitors your security practices to enable you to win enterprise deals.;

Headings (most frequently used words):

webkit, display, center, flex, security, cve, 2026, the, box, mitigation, kernel, ms, update, advisory, remediation, next, public, trust, in, linux, scaleway, actions, level, align, mptcp, 98432, references, tcp, vulnerabilities, required, for, csa, star, analysis, scope, flexbox, direction, column, font, disable, is, you, and, red, hat, race, condition, ipv4, stack, description, of, impact, patched, kubernetes, node, images, available, achieves, certification, 46333, ssh, keysign, pwn, plan, pack, justify, content, height, 30px, color, 101828, margin, line, overflow, compliance, items, documents, access, drop, packets, recommended, risk, what, go, at, publishes, better, brief, on, services, timeline, 13o7eu2, block, 13yrlxz, nj2228, cmkhl0, size, 20px, style, normal, smoothing, antialiased, left, 12px, min, width, wrap, anywhere, clamp, orient, vertical, hidden, overview, 70qvj9, featured, product, corporate, endpoint, reports, legal, data, privacy, control, infrastructure, policies, grades, updates, not, enough, as, new, with, ip, options, detection, per, os, use, managed, service, web, hosting, serverless, manage, php, yourself, instances, elastic, metal, dedibox, kapsule, containers, if, cannot, immediately, checking, indicators, compromise, changing, driving, european, documentation, current, operating, system, patch, status, assessment, multi, tenant, vs, isolated, environment, temporary, rollback, reactivation, commands, applications, 24, firewall, verify, whether, your, running, already, carries, fix, sequence, 109618, 109619, php2shell, measure, workaround,

Text of the page (most frequently used words):
the (156), and (60), 2026 (45), mptcp (44), #security (43), your (41), kernel (41), cve (36), php (36), for (35), you (27), our (27), this (26), #scaleway (22), are (22), sudo (21), linux (21), sysctl (19), access (19), with (18), not (18), mitigation (17), version (17), tcp (16), update (15), trust (14), from (14), that (14), https (14), 98432 (14), via (13), can (13), have (13), level (13), vulnerabilities (13), any (12), host (12), advisory (12), services (12), csa (12), disable (11), ubuntu (11), center (10), team (10), ptrace (10), unprivileged (10), apply (10), affected (10), patch (10), available (10), exploit (10), patches (10), service (10), patched (10), debian (10), versions (10), web (10), red (10), hat (10), fixed (10), nft (10), default (9), running (9), system (9), across (9), use (9), only (9), controls (9), cloud (9), all (9), listeners (9), information (8), etc (8), ptrace_scope (8), process (8), applications (8), path (8), required (8), code (8), data (8), flaw (8), remediation (8), compliance (8), new (8), net (8), before (8), enabled (8), please (7), yama (7), image (7), nodes (7), control (7), official (7), been (7), status (7), public (7), star (7), supported (7), october (7), then (7), restart (7), rhel (7), after (7), com (7), ipv4 (7), options (7), support (6), remove (6), standard (6), impact (6), name (6), ssh (6), root (6), reboot (6), temporary (6), directly (6), vulnerability (6), actions (6), local (6), risk (6), environment (6), race (6), tracker (6), infrastructure (6), server (6), node (6), images (6), end (6), fpm (6), listener (6), drop (6), inet (6), option (6), built (5), contact (5), file (5), systems (5), these (5), exists (5), kubernetes (5), kapsule (5), must (5), following (5), servers (5), once (5), vendor (5), availability (5), execution (5), critical (5), condition (5), compromise (5), fix (5), released (5), mitigations (5), priority (5), was (5), may (5), iso (5), iec (5), 27001 (5), managed (5), updated (5), www (5), 109619 (5), 109618 (5), request (5), they (5), life (5), being (5), which (5), yet (5), confirm (5), table (5), input (5), view (5), using (4), full (4), console (4), conf (4), has (4), production (4), commands (4), daemonset (4), runtime (4), persist (4), containers (4), memory (4), immediately (4), rule (4), possible (4), distribution (4), users (4), without (4), attacker (4), user (4), within (4), kernels (4), cloudlinux (4), almalinux (4), updates (4), regarding (4), against (4), processes (4), keysign (4), management (4), exposed (4), 46333 (4), now (4), documentation (4), complete (4), its (4), secure (4), fully (4), them (4), network (4), references (4), release (4), reduce (4), but (4), rocky (4), verify (4), through (4), were (4), listenconfig (4), anthropic (4), exposure (4), uname (4), per (4), filter (4), policy (4), endpoint (4), godebug (4), than (4), attack (4), distributions (3), require (3), certain (3), time (3), apps (3), app (3), privileged (3), command (3), reboots (3), echo (3), execute (3), trigger (3), updating (3), check (3), specific (3), prior (3), tenant (3), files (3), multi (3), detailed (3), currently (3), upgrade (3), configuration (3), details (3), package (3), upstream (3), review (3), current (3), such (3), open (3), out (3), read (3), privilege (3), escalation (3), tracking (3), deployed (3), reported (3), pwn (3), analysis (3), scope (3), plan (3), download (3), framework (3), customers (3), based (3), certification (3), questions (3), during (3), pools (3), instances (3), 124 (3), generic (3), fixes (3), applied (3), replace (3), private (3), changing (3), org (3), logs (3), created (3), upload (3), exploitation (3), attempts (3), recommend (3), restrict (3), progress (3), session (3), apt (3), active (3), rebuild (3), changelog (3), identify (3), their (3), dedibox (3), teams (3), hosting (3), testing (3), still (3), upon (3), earlier (3), application (3), one (3), initial (3), soon (3), where (3), remote (3), reports (3), redhat (3), golang (3), notes (3), thehackernews (3), recommended (3), patching (3), already (3), erratum (3), 113 (3), reporting (3), add (3), mptcp_block (3), counter (3), packets (3), socket (3), sockets (3), does (3), connection (3), disabling (3), precondition (3), vulnerable (3), free (3), stack (3), rhsb (3), 016 (3), cve_2026_98432 (3), privacy (3), more (3), documents (3), help (2), remain (2), technical (2), assistance (2), back (2), majority (2), some (2), monitoring (2), specifically (2), kind (2), metadata (2), labels (2), spec (2), template (2), true (2), operator (2), effect (2), nsenter (2), writing (2), pause (2), limits (2), example (2), deploying (2), block (2), tee (2), immediate (2), wide (2), permanent (2), including (2), clusters (2), dedicated (2), run (2), trusted (2), arbitrary (2), third (2), requires (2), isolated (2), criticality (2), provide (2), shell (2), pod (2), other (2), shared (2), assessment (2), actively (2), working (2), workloads (2), below (2), officially (2), bookworm (2), trixie (2), stable (2), whether (2), operating (2), secrets (2), leading (2), container (2), allows (2), binaries (2), sensitive (2), logic (2), note (2), national (2), cybersecurity (2), latest (2), explicitly (2), ccm (2), matrix (2), major (2), european (2), total (2), transparency (2), implemented (2), awareness (2), best (2), practices (2), ensure (2), alliance (2), what (2), achieves (2), external (2), kosmos (2), containing (2), previous (2), because (2), simply (2), restarting (2), sufficient (2), allowing (2), page (2), cert (2), cverecord (2), unusual (2), outbound (2), multipart (2), post (2), requests (2), http (2), cgi (2), sessions (2), starting (2), upload_progress (2), setting (2), cannot (2), upgrading (2), systemctl (2), migration (2), backport (2), used (2), manage (2), yourself (2), elastic (2), metal (2), necessary (2), action (2), individually (2), verified (2), penetration (2), known (2), engine (2), same (2), when (2), processing (2), later (2), description (2), will (2), php2shell (2), cvss (2), unauthenticated (2), published (2), api (2), dev (2), article (2), research (2), compensating (2), firewall (2), subscribe (2), pending (2), alma (2), above (2), grep (2), oracle (2), amazon (2), important (2), dla (2), 190 (2), chain (2), type (2), hook (2), accept (2), inbound (2), syns (2), mp_capable (2), syn (2), uses (2), dropping (2), carry (2), prevents (2), established (2), flag (2), until (2), recreated (2), plain (2), show (2), tlm (2), applies (2), newly (2), removes (2), binary (2), mod (2), multipathtcp (2), off (2), installed (2), detection (2), authentication (2), vector (2), factor (2), therefore (2), targets (2), bulletin (2), surface (2), reduction (2), validate (2), legitimate (2), longer (2), bytes (2), hdrlength (2), 310 (2), better (2), agreement (2), logging (2), protection (2), soa (2), hds (2), nous (2), sécurité (2), dans (2), des (2), need, disposal, further, persistence, reset, restricted, mode, most, restricting, completely, disables, tracing, vast, however, localized, development, debugging, capabilities, profiling, tools, undo, gdb, strace, rollback, reactivation, apiversion, namespace, kube, selector, matchlabels, hostpid, tolerations, noschedule, noexecute, initcontainers, configure, alpine, securitycontext, bin, filesystem, mount, volumemounts, mountpath, registry, k8s, resources, cpu, 8mi, volumes, hostpath, operation, performed, worker, administrator, privileges, unpatched, like, tightening, blocks, initiating, paths, measure, workaround, solution, consists, becomes, invite, regularly, strictly, whose, parties, significantly, lower, exploited, single, moderate, machines, different, clients, multiple, unverified, party, limited, publicly, siphon, owned, credentials, tenants, high, urgency, applying, depends, heavily, usage, patterns, architecture, canonical, backporting, beta, channel, cagefs, instructions, found, guide, validated, promoted, repositories, reviewed, track, varies, platform, determine, here, recommendations, follow, configured, namespaces, extract, escape, pid, containerized, utilizing, clone, descriptors, exiting, suid, highly, chage, pidfd_getfd, located, exit, tracked, checks, lpe, severe, disclosure, do_exit, represents, logical, affecting, massive, portion, globally, making, verification, functional, exploits, online, thank, continued, completed, report, repository, responses, consensus, assessments, initiative, questionnaire, caiq, mapping, between, spanish, streamlining, iberian, deployments, esquema, nacional, seguridad, spain, ens, agency, recognizes, qualification, aligning, closely, extensions, 27017, 27018, italy, acn, requirements, german, federal, office, integrate, germany, bsi, global, benchmark, robust, aligns, inspires, standards, achievement, supports, roadmaps, europe, driving, designation, involves, rigorous, self, completing, evaluation, demonstrates, posture, validating, fundamental, world, organization, defining, raising, computing, milestone, reinforces, continuous, efforts, deliver, sovereign, compliant, cornerstones, commitment, ecosystem, proud, announce, achieved, assurance, awarded, regards, replacement, hesitate, ticket, side, manually, recreate, reminder, previously, provided, communications, successfully, replaced, pods, plane, pull, achieve, performing, rolling, recreating, scaling, deleting, old, ones, existing, cluster, transition, away, workarounds, steps, keys, xfrm, subsystem, dirty, frag, 43284, cryptographic, unauthorized, cache, writes, copyfail, 31431, featuring, provides, comprehensive, resolution, three, disclosed, recently, inform, cyber, gouv, alerte, certfr, ale, 014, initiation, deployment, leak, embargo, timeline, connections, originated, suspected, isolate, preserve, php_session_upload_progress, errors, bursts, 500, codes, directories, unexpected, cron, jobs, accounts, apache2, httpd, spawning, utilities, curl, wget, given, occurred, auditing, activity, checking, indicators, non, vpn, whitelisting, form, reverse, proxy, waf, uploads, size, ini, pool, changed, dynamically, ini_set, address, both, dnf, php8, adjust, examples, served, base, redeploy, main, number, installations, line, differ, measures, perform, notified, cases, newer, serverless, effectiveness, analyzed, date, earliest, offered, products, backported, addition, utilize, abundance, caution, temporarily, placed, under, maintenance, while, restored, flaws, reside, core, itself, cms, wordpress, drupal, plugins, modes, mod_php, litespeed, frankenphp, fatal, error, freed, areas, reused, subsequent, handled, method, exhausted, terminate, initializing, internal, structures, cleanup, phase, valid, receive, migrating, relying, eol, contacted, part, brief, two, dubbed, score, allow, simple, observed, internet, even, few, days, top, mobilized, receiving, safeguard, json, hydra, rest, securitydata, issue, github, issues, 82717, pkg, doc, go1, publication, html, discovering, claude, ships, operationally, revalidate, sles, sp7, sequence, centos, rpm, carries, rebuilt, rhsa, none, trusty, work, 4841, 4850, dsa, 6568, sid, forky, deb12u1, 272, 223, 159, suse, fetched, live, secondary, changes, rapidly, acting, definitive, install, trackers, advertising, flags, negotiation, carried, match, natively, nftables, opened, change, keeps, ends, convert, close, inspect, state, affects, otherwise, affect, started, build, force, setmultipathtcp, false, err, listen, ctx, addr, set, disabled, several, ways, substitute, operational, requirement, reduces, capable, recent, iproute2, implicit, population, hosts, likely, larger, never, would, expect, amplified, loss, confidentiality, integrity, reachable, interaction, key, amplifying, consequently, expose, result, compiled, concerns, dialers, explicit, operators, create, according, demonstrated, yielding, made, target, multipath, about, defect, introduced, present, large, today, caused, handling, restarted, especially, understand, eliminate, exploitability, keep, actual, stronger, disablement, alone, there, own, traffic, broadly, case, flows, rely, partial, matches, headers, bit, words, packet, carrying, hooks, runs, early, filtering, delete, syntax, first, load, list, watch, protocol, save, reached, header, modern, networks, rare, comparatively, low, precise, lives, how, frees, setup, behavior, happens, clean, way, why, removing, possibility, underlying, treat, guidance, turns, needlessly, widened, turning, worthwhile, useful, enough, includes, suggestion, publishes, elements, qualys, ssl, labs, grades, quality, intrusion, policies, password, employee, training, officer, cookies, subprocessors, legal, related, response, mobile, device, disk, encryption, email, asset, corporate, role, audit, product, featured, bulk, gdpr, bienvenue, sur, efforçons, inclure, tous, les, aspects, notre, activité, vous, trouverez, informations, qui, attestent, entreprises, pour, garantir, nos, welcome, strive, include, each, every, aspect, business, find, attest, towards, delivering, safe, overview, get, ask, start, powered, safebase,

Text of the page (random words):
trols as attack surface reduction not remediation red hat s new mitigation drop tcp packets with ip options the vulnerable path is reached through tcp packets that carry ip options the ipv4 header being longer than the standard 20 bytes legitimate use of ip options on modern networks is rare so dropping them is comparatively low impact save the following as cve 2026 98432 nft table inet cve_2026_98432 chain input type filter hook input priority 310 policy accept ip protocol tcp ip hdrlength 5 counter drop apply and verify sudo nft check file cve 2026 98432 nft validate syntax first sudo nft file cve 2026 98432 nft load the rule sudo nft list table inet cve_2026_98432 confirm it is active watch the counter remove it once a fixed kernel is installed sudo nft delete table inet cve_2026_98432 notes the rule hooks at priority 310 so it runs early before other filtering ip hdrlength 5 matches ipv4 headers longer than 5 32 bit words 20 bytes any packet carrying ip options this is still a partial control per red hat only the kernel update is a complete fix validate against your own traffic before deploying broadly in case any legitimate flows rely on ip options recommended actions patch as soon as a fixed kernel is available for your os and reboot if there is no patch then apply red hat s ip options filter above it targets the actual vulnerable path so it is a stronger mitigation control than mptcp disablement alone keep the mptcp controls as surface attack reduction especially disabling the go 1 24 default on exposed services understand they reduce but do not eliminate exploitability remove mitigation once an updated and patched is applied and the server has restarted references red hat bulletin rhsb 2026 016 https access redhat com security vulnerabilities rhsb 2026 016 security advisory cve 2026 98432 race condition in the linux kernel s ipv4 tcp stack description on october 29 2026 thehackernews published an article about cve 2026 98432 which is a use after free caused by a race condition in the linux kernel s ipv4 tcp connection handling path the defect was introduced in linux 4 4 and is therefore present in the large majority of kernels in production today according to public research reporting by anthropic a working unauthenticated remote exploit has been demonstrated yielding root level code execution the reported exploit was made through the target host that exposed a multipath tcp mptcp listener a key amplifying factor applications built with go 1 24 or later create mptcp enabled listeners by default on linux per the official go 1 24 release notes listenconfig now uses mptcp by default on systems where it is supported currently on linux only consequently a go based service can expose an mptcp listener and therefore the precondition this exploit targets without any explicit configuration or awareness by its operators simply as a result of being compiled with go 1 24 outbound go dialers are not affected this concerns inbound listeners only risk impact attack vector network remote no authentication no user interaction required per public reporting precondition a reachable mptcp listener on a vulnerable kernel impact full host compromise arbitrary code execution as root with total loss of confidentiality integrity and availability amplified exposure any linux service re built with go 1 24 is mptcp exposed by default so the population of at risk hosts is likely larger than teams that never explicitly enabled mptcp would expect detection identify mptcp capable listeners requires recent iproute2 ss with mptcp support ss tlm ip mptcp endpoint show identify go binaries built with 1 24 to flag implicit mptcp listeners go version path to binary confirm kernel version before and after patching uname r mitigation use one of these to reduce exposure until a fixed kernel is installed they are compensating controls not a substitute for patching where mptcp is not an operational requirement disabling it reduces the exploit precondition disable mptcp in go applications go 1 24 mptcp can be disabled in several ways in golang option 1 runtime no rebuild set godebug for the service process godebug multipathtcp 0 your service option 2 in code force mptcp off on the listener lc net listenconfig lc setmultipathtcp false ln err lc listen ctx tcp addr option 3 build time default via go mod godebug multipathtcp 0 applies to newly started processes only changing godebug go mod or the binary does not affect an already running service restart the application so its listeners are recreated as plain tcp disable mptcp at the kernel level removes mptcp system wide affects all applications go or otherwise inspect current state sysctl net mptcp enabled disable at runtime sudo sysctl net mptcp enabled 0 persist across reboots echo net mptcp enabled 0 sudo tee etc sysctl d 99 disable mptcp conf sudo sysctl system applies to newly created sockets only the net mptcp enabled flag is read when a socket is created so setting it to 0 prevents new mptcp sockets from being opened it does not convert or close sockets that are already open any mptcp listener or connection established before the change keeps using mptcp until its process ends restart the affected application s or reboot the host so their listeners are recreated as plain tcp after restarting confirm no mptcp listeners remain with ss tlm ip mptcp endpoint show drop mptcp packets at the firewall mptcp negotiation uses tcp option kind 30 the mp_capable option is carried in the initial syn dropping syns that carry it prevents mptcp sessions from being established nftables can match this natively sudo nft add table inet mptcp_block sudo nft add chain inet mptcp_block input type filter hook input priority filter policy accept drop inbound tcp syns advertising mptcp mp_capable sudo nft add rule inet mptcp_block input tcp flags syn tcp option mptcp exists counter drop remediation per os the definitive fix is a patched kernel install it and reboot the table below was verified against vendor security trackers on 2026 10 30 ubuntu debian red hat suse fetched live oracle linux and amazon linux from secondary reporting status changes rapidly re confirm against the vendor tracker before acting os distribution status fixed version advisory upstream stable kernels fixed 5 10 272 5 15 223 6 1 190 6 6 159 6 12 113 6 18 56 7 2 10 7 3 debian fixed bookworm 6 1 190 1 dla 4841 1 6 12 backport 6 12 113 1 deb12u1 dla 4850 1 trixie 6 12 113 1 dsa 6568 1 sid forky fixed ubuntu all supported 26 10 16 04 no fix work in progress none yet use mitigations 14 04 trusty not affected rhel 8 9 10 affected no erratum yet no rhsa released red hat important 8 1 use mitigations rhel kernel rt 8 9 affected no erratum yet same status as the standard kernel rocky linux almalinux pending rhel rebuilt from rhel no upstream erratum to rebuild yet verify whether your running kernel already carries the fix debian ubuntu apt changelog linux image uname r grep cve 2026 98432 rhel centos rocky alma oracle amazon rpm q changelog kernel uname r grep cve 2026 98432 confirm the running kernel version before and after patching reboot uname r recommended remediation sequence if a fixed kernel exists for your os update and reboot then verify with the commands above if no fixed kernel yet ubuntu rhel rocky alma sles 15 sp7 apply mitigations disable mptcp in go apps and or at the kernel level and or drop mptcp at the firewall restart affected services restrict network exposure of affected listeners and subscribe to the vendor s advisory for the pending kernel revalidate once the vendor ships a fixed kernel then remove compensating controls only if mptcp is operationally required references anthropic article https www anthropic com research discovering vulnerabilities with claude thehackernews publication https thehackernews com 2026 10 linux kernel tcp flaw with 98 cvss html go 1 24 release notes mptcp listener default https go dev doc go1 24 go net package documentation listenconfig https pkg go dev net listenconfig golang issue https github com golang go issues 82717 ubuntu cve tracker https ubuntu com security cve 2026 98432 debian security tracker https security tracker debian org tracker cve 2026 98432 red hat cve page https access redhat com security cve cve 2026 98432 red hat security data api json https access redhat com hydra rest securitydata cve cve 2026 98432 if you have any questions please contact our support team via the scaleway console the scaleway team security advisory cve 2026 109618 cve 2026 109619 php2shell analysis scope and remediation vulnerabilities on october 21 2026 the php security team released patches for two critical vulnerabilities in the php engine cve 2026 109618 and cve 2026 109619 dubbed php2shell cvss v4 0 score 9 2 they allow an unauthenticated attacker to execute remote code on a web server running php via a simple http request exploitation attempts were observed on the internet as soon as the advisory was published and even a few days prior as the security of your infrastructure is our top priority our teams mobilized upon receiving the initial reports to safeguard our services and apply the necessary patches in brief our managed services relying on php have been updated web hosting customers running end of life eol php versions have been contacted individually where action on their part is required if you manage php yourself instances elastic metal dedibox servers kubernetes kapsule container images etc you must update php as soon as possible end of life php versions 8 1 and earlier will not receive an official patch we recommend migrating to a supported version description of vulnerabilities cve 2026 109618 when memory is exhausted during initial request processing php may terminate before initializing certain internal data structures which the cleanup phase later processes as if they were valid cve 2026 109619 after a fatal error references to freed memory areas may persist and be reused by a subsequent request handled by the same php process session upload progress tracking session upload_progress enabled by default is one known method to trigger this flaw these flaws reside in the core php engine itself updating your application cms wordpress drupal etc or plugins is not sufficient all web execution modes are affected php fpm mod_php php cgi litespeed frankenphp affected versions php 5 4 through 8 5 11 patched versions 8 5 12 8 4 27 8 3 36 and 8 2 35 versions without official patches php 8 1 and earlier end of life impact on scaleway services upon the release of the patches we updated all of our managed services that utilize php out of an abundance of caution certain services were temporarily placed under maintenance while patches were applied all services are now fully restored for end of life php versions still offered across our web hosting products we deployed backported patches in addition we have analyzed our logs starting from october 17 2026 the date of the earliest known exploitation attempts verified the effectiveness of the patches through penetration testing required actions you use a scaleway managed service web hosting serverless our teams have implemented the necessary security measures customers required to perform any specific action have been notified individually in all cases we recommend upgrading to a actively supported php version 8 4 or newer you manage php yourself instances elastic metal dedibox kapsule containers identify your php installations and their active versions note the version reported by the command line php v may differ from the version used by your web server update php to a patched version 8 5 12 8 4 27 8 3 36 or 8 2 35 or apply your distribution s latest updates some distributions backport security fixes without changing the main version number check your package s changelog restart php fpm or your web server then verify the active version being served for containers rebuild your images from a patched base image and redeploy them if you are running an end of life version plan a migration path to a supported version command examples debian ubuntu sudo apt update sudo apt upgrade then sudo systemctl restart php8 x fpm adjust for your service name almalinux rocky linux rhel sudo dnf upgrade then sudo systemctl restart php fpm if you cannot update immediately the following mitigations reduce risk but do not replace upgrading as they do not fully address both vulnerabilities disable upload progress tracking in php ini or in your php fpm pool configuration session upload_progress enabled 0 then restart php this setting cannot be changed dynamically via ini_set block multipart form data post requests at the reverse proxy or waf level for applications that do not require file uploads and restrict request size limits restrict access to non public php applications via vpn or ip whitelisting checking for indicators of compromise given that exploitation attempts occurred prior to patch availability we recommend auditing your servers for activity starting from october 17 2026 php processes php fpm php cgi apache2 httpd spawning shell sessions or utilities such as curl wget or nc new php files created in web root or upload directories unexpected cron jobs or new user accounts multipart post requests containing php_session_upload_progress out of memory errors or unusual bursts of http 500 status codes in your web logs unusual outbound network connections originated by web servers if compromise is suspected isolate the server preserve logs and contact our support team timeline october 20 2026 leak of vulnerability details before the end of the embargo october 21 2026 official release of patches by the php security team and initiation of deployment across our infrastructure october 26 2026 remediation complete across all scaleway managed services references cve 2026 109618 https www cve org cverecord id cve 2026 109618 cve 2026 109619 https www cve org cverecord id cve 2026 109619 supported php versions https www php net supported versions php cert fr https www cert cyber gouv fr alerte certfr 2026 ale 014 if you have any questions please contact our support team via the scaleway console the scaleway team update patched kubernetes node images available for linux kernel vulnerabilities vulnerabilities update patched kubernetes node images available for linux kernel vulnerabilities following up on our previous security advisory regarding critical linux kernel vulnerabilities we are writing to inform you that fully patched node images are now available for your kapsule pools what is changing we have released updated node images featuring linux kernel version 6 8 0 124 generic this new kernel provides a comprehensive permanent resolution for the three major vulnerabilities disclosed recently copyfail cve 2026 31431 a logic flaw in the cryptographic template allowing local privilege escalation via unauthorized page cache writes dirty frag cve 2026 43284 a local privilege escalation fla...