VPS Security Checklist: October 2026

October 2026 has been one of the toughest months for server security. Critical vulnerabilities have been found in PHP, Node.js, nginx, GitLab, Redis, and even the certificates trusted across the internet. Hackers are already exploiting some of them.

We've gathered everything into one list. Think of it as a vehicle inspection: go through the items and check off the ones that apply to you. Start with the summary table. If you don't use a particular program, simply skip its section.

Summary table

“Already being exploited” means that the US cybersecurity agency CISA has added the vulnerability to its list of actively exploited vulnerabilities. These should be patched first.

1. PHP

What happened. Two critical PHP2Shell flaws allow attackers to execute code on a server without a password. On October 26, CISA confirmed that they were already being exploited. There is also a third flaw, CVE-2026-115560, which does not yet have a fix.

Who is affected. Anyone running a PHP-based website: WordPress, Joomla, Bitrix, Laravel, or OpenCart.

What to do

php -v

Update PHP to one of the versions listed in the table and restart PHP-FPM. Then add this line to php.ini:

session.upload_progress.enabled = 0

This mitigates the third flaw until a fix becomes available.

Detailed guide: PHP2Shell: How to Check Your Server

2. Certificates (ca-certificates)

What happened. The eMudhra certificate authority used private keys that could be guessed in a second. One of the keys was the number 4. These keys could be used to impersonate a supposedly “secure” banking or payment website. Browsers have already been updated, but servers have not necessarily caught up.

Who is affected. Almost everyone: websites, scripts, and bots connecting to APIs, payment systems, or email services.

What to do

# Ubuntu и Debian
sudo apt update && sudo apt install --only-upgrade ca-certificates

# AlmaLinux и Rocky Linux
sudo dnf upgrade ca-certificates

Update Python (the certifi package), Node.js, Go, and Java separately. They maintain their own certificate stores. Rebuild Docker images using the --pull flag.

Detailed guide: The Certificate Key Turned Out to Be the Number 4

3. Node.js and Next.js

What happened. A flaw in the Brotli decompressor allows attackers to execute their own code. Node.js fixed it on October 21, and CISA confirmed active exploitation on October 27. Two critical flaws were found in Next.js: one involving SVG images and another involving caching.

Important: Brotli is used by more than just Node.js. It is also embedded in Python and many other programs. Update the system brotli package as well. Patched versions of the library are 1.0.10, 1.1.1, and 1.2.1.

Who is affected. Anyone running Node.js websites, APIs, or bots, as well as all Next.js websites.

What to do

node -v
npm ls next sharp

Update Node.js to 22.23.4, 24.22.1, or 26.12.1; Next.js to 16.4.1+ or 15.5.28+; and sharp to 0.35.5+. Then rebuild and restart the application. Node.js 20 and earlier will not receive fixes.

Detailed guide: Node.js and Next.js: Two Critical Vulnerabilities in One Week

4. Redis

What happened. Redis patched more than a dozen vulnerabilities in August and September. They include bypassing TLS certificate authentication, executing code via a specially crafted database file, and bypassing access permissions within transactions. Unencrypted cluster nodes could also be tricked into accepting an outside server.

Think of Redis as a safe containing your website's data. Even if the safe is locked, it's not ideal to leave it visible from the street.

Who is affected. Everyone using Redis for website caching, queues, sessions, Chatwoot, and many other services.

What to do

redis-server --version

Update Redis to 8.10.2, 8.8.3, 8.6.7, 8.4.7, or 8.2.10. Check that ports 6379 and 16379 are not accessible from the internet:

ss -ltnp | grep -E ':6379|:16379'

If 0.0.0.0 appears next to a port, Redis is listening on all addresses. Block the port with a firewall or set bind 127.0.0.1 in the configuration.

5. PostgreSQL

What happened. PostgreSQL patched 28 vulnerabilities in August, a record for a single update. The most prominent was dubbed PostGREShell (CVE-2026-6471). Through the replication feature, a user with replication-only privileges could gain full control of the database and execute code on the server. The flaw is 12 years old and affects versions 9.4 through 18.

Who is affected. Anyone running a PostgreSQL version older than the August release.

What to do

psql --version

Update to 18.6, 17.11, 16.15, 15.19, or 14.24. A minor-version update does not require a database dump: simply update the package and restart the service.

Attention, PostgreSQL 14 users: November 12 will bring the final update for this version. There will be no further fixes afterward. It's time to plan a move to version 16, 17, or 18.

6. Linux kernel

What happened. A series of Linux kernel flaws with memorable names were discovered throughout 2026: Copy Fail, Dirty Frag, Fragnesia, and PinTheft. All of them allow a regular server user to gain administrator (root) privileges.

It's like letting a guest into the hallway, only for them to find a way to open every room and safe.

In October, researchers also accidentally published details of seven more kernel vulnerabilities before patches were released. Two of them affect the ksmbd module, a file server built into the kernel for Windows network shares. It is not enabled on most servers.

Who is affected. Primarily servers that host multiple users, websites belonging to different owners, or Docker containers.

What to do

uname -r

Update the system and reboot the server. The new kernel will not take effect without a reboot.

# Ubuntu и Debian
sudo apt update && sudo apt upgrade
sudo reboot

# AlmaLinux и Rocky Linux
sudo dnf upgrade kernel
sudo reboot

Check whether ksmbd is loaded. If the command returns no output, the module is not loaded:

lsmod | grep ksmbd

7. Windows Server

What happened. In October, Microsoft released a record-breaking update fixing more than 1,400 vulnerabilities. Hackers are already exploiting one of them (CVE-2026-96951). It allows attackers to bypass Windows warnings for files downloaded from the internet. Imagine a security guard letting a package through without checking it because someone attached the right label.

Critical vulnerabilities in these services are especially dangerous for servers:

• DHCP Server and Message Queuing: severity score 9.8 out of 10;
• Remote Desktop Gateway (RD Gateway);
• IIS web server.

Who is affected. Anyone with a Windows-based VPS or dedicated server.

What to do. Install the October updates through Windows Update and reboot the server. To see the latest installed updates, run this in PowerShell:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

If the latest update is older than mid-October, the server is not protected.

8. What else to check

GitLab: maximum severity score of 10 out of 10. On October 21, GitLab fixed CVE-2026-110264, which allows code execution on a server without logging in. Every version since 7.0 is vulnerable, spanning 12 years of releases. Even if you updated on October 12, that is not enough. Fixed versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13.

sudo gitlab-rake gitlab:env:info | grep -i version

nginx: five vulnerabilities. nginx 1.30.6 and 1.31.7 were released on October 14. Three of the flaws may allow code execution, but only under certain configurations. One of them is 21 years old. Updating is easier than investigating every setting.

nginx -v

Nextcloud with built-in Collabora Office. CVE-2026-110447 has been exploited since September. If you use the richdocumentscode app in a version earlier than 26.4.303, update or remove it. Read more: Nextcloud and Collabora.

Magento and Adobe Commerce. On October 27, CISA confirmed attacks exploiting the file-upload vulnerability CVE-2026-48356. Install the latest Adobe security update.

YOOtheme Pro for Joomla and WordPress. CVE-2026-102785, rated 10 out of 10, is already being used to compromise websites. Versions 5.0.0 through 5.0.52 are vulnerable. Update the theme to the latest version.

LiteLLM. On October 27, a 10-out-of-10 vulnerability was fixed in the Enterprise version: an attacker could steal the master key without a password. Fixed versions: 1.106.5, 1.105.6, 1.104.8, 1.103.10. For the poisoned 1.107.0 release, read our article Stolen AI Keys.

What to expect in November

Add these dates to your calendar:

When the PHP update is released, you can remove the session.upload_progress.enabled = 0 setting, but only after installing the new version.

Final checklist

• PHP is updated and session.upload_progress.enabled = 0 has been added.
• The ca-certificates package is updated and Docker images have been rebuilt.
• Node.js, Next.js, and sharp are updated.
• GitLab is updated to a fixed version.
• nginx is updated to 1.30.6 or 1.31.7.
• Redis is updated; ports 6379 and 16379 are blocked from the internet.
• PostgreSQL is updated to the August release.
• The Linux kernel is updated and the server has been rebooted.
• Windows Server has received the October updates.
• Nextcloud, Magento, YOOtheme, and LiteLLM have been checked, if installed.
• November update dates have been added to the calendar.

Don't want to handle it yourself?

There are 10 items on this list, and almost every month the list is just as long. If your business runs on a server, keeping track of everything manually is difficult. Missing just one update can be enough for an attack.

Zomro offers two options for situations like this.

SOD: We'll work through the checklist for you

Our system administrator will:

• check which programs from the list are installed on your server;
• update them to safe versions;
• close unnecessary ports;
• reboot the server at a time that works for you and verify that everything is running.

Price: €12.50 per 15 minutes of work.

Request a server security check

Premium: Fast help when you need it

A standard technical support request can take up to 10 hours to receive a reply. With Premium, we respond within 5 to 30 minutes. If something breaks after an update, you won't have to wait half a day.

New vulnerabilities appear every week. With Premium, you won't have to deal with them on your own.

Get Premium