---
title: 'VPS Security Checklist: October 2026 | Zomro'
description: 'October 2026 VPS security checklist: critical PHP, Node.js, nginx, Redis, PostgreSQL and Linux updates. See what to patch and how to secure your server.'
image: 'https://cdn.zomro.com/uploads/blog/a48%40server-panel.net/2026/10/28/gemini_generated_image_7yqh7yqh7yqh7yqh_q50.jpg'
---

![opened image]()

  * [Zomro](https://zomro.com/)
  * [Useful articles](https://zomro.com/blog/articles/)
  * [Hosting security](https://zomro.com/blog/articles/bezopasnost/)
  * VPS Security Checklist: October 2026 



# VPS Security Checklist: October 2026

28-10-2026

![](https://cdn.zomro.com/uploads/blog/a48%40server-panel.net/2026/10/28/gemini_generated_image_7yqh7yqh7yqh7yqh_q50.jpg)

October 2026 has been one of the toughest months for server security. Critical vulnerabilities have been found in PHP, Node.js, nginx, GitLab, Redis, and even the certificates trusted across the internet. Hackers are already exploiting some of them.

We've gathered everything into one list. Think of it as a vehicle inspection: go through the items and check off the ones that apply to you. Start with the summary table. If you don't use a particular program, simply skip its section.

## 

## 

## Summary table

Component |  Safe version |  Urgency |  Already being exploited?  
---|---|---|---  
PHP |  8.5.12, 8.4.27, 8.3.36, 8.2.35 |  Very high |  Yes  
Node.js |  22.23.4, 24.22.1, 26.12.1 |  Very high |  Yes  
Next.js |  16.4.1+ or 15.5.28+, sharp 0.35.5+  |  High |  No data  
GitLab |  19.5.1, 19.4.3, 19.3.6 and others |  Very high  |  No data  
nginx |  1.30.6 or 1.31.7 |  High |  No data  
Certificates (`ca-certificates`) |  Latest system package |  High |  No data  
Redis |  8.10.2, 8.8.3, 8.6.7, 8.4.7, 8.2.10 |  Medium |  No data  
PostgreSQL |  18.6, 17.11, 16.15, 15.19, 14.24 |  Medium |  No data  
Linux kernel |  Latest system kernel |  Medium |  No data  
Windows Server |  October updates |  High |  Yes  
  
> “Already being exploited” means that the US cybersecurity agency CISA has added the vulnerability to its list of actively exploited vulnerabilities. These should be patched first.

## 

## 1\. PHP

**What happened.** Two critical PHP2Shell flaws allow attackers to execute code on a server without a password. On October 26, CISA confirmed that they were already being exploited. There is also a third flaw, CVE-2026-115560, which does not yet have a fix.

**Who is affected.** Anyone running a PHP-based website: WordPress, Joomla, Bitrix, Laravel, or OpenCart.

**What to do**
    
    
    php -v

Update PHP to one of the versions listed in the table and restart PHP-FPM. Then add this line to `php.ini`:
    
    
    session.upload_progress.enabled = 0

This mitigates the third flaw until a fix becomes available.

**Detailed guide:** **[PHP2Shell: How to Check Your Server](https://zomro.com/blog/articles/746-php2shell-how-to-check-your-server-and-close-a-dangerous-php-vulnerability)**

## 

## 

## 2\. Certificates (`ca-certificates`)

**What happened.** The eMudhra certificate authority used private keys that could be guessed in a second. One of the keys was the number 4. These keys could be used to impersonate a supposedly “secure” banking or payment website. Browsers have already been updated, but servers have not necessarily caught up.

**Who is affected.** Almost everyone: websites, scripts, and bots connecting to APIs, payment systems, or email services.

**What to do**
    
    
    # Ubuntu и Debian
    sudo apt update && sudo apt install --only-upgrade ca-certificates
    
    # AlmaLinux и Rocky Linux
    sudo dnf upgrade ca-certificates

Update Python (the `certifi` package), Node.js, Go, and Java separately. They maintain their own certificate stores. Rebuild Docker images using the `--pull` flag.

**Detailed guide:** **[The Certificate Key Turned Out to Be the Number 4](https://zomro.com/blog/articles/748-the-certificate-key-turned-out-to-be-the-number-4-what-needs-to-be-updated-on-the-server)**

## 

## 

## 3\. Node.js and Next.js

**What happened.** A flaw in the Brotli decompressor allows attackers to execute their own code. Node.js fixed it on October 21, and CISA confirmed active exploitation on October 27. Two critical flaws were found in Next.js: one involving SVG images and another involving caching.

> **Important:** Brotli is used by more than just Node.js. It is also embedded in Python and many other programs. Update the system `brotli` package as well. Patched versions of the library are 1.0.10, 1.1.1, and 1.2.1.

**Who is affected.** Anyone running Node.js websites, APIs, or bots, as well as all Next.js websites.

**What to do**
    
    
    node -v
    npm ls next sharp

Update Node.js to 22.23.4, 24.22.1, or 26.12.1; Next.js to 16.4.1+ or 15.5.28+; and sharp to 0.35.5+. Then rebuild and restart the application. Node.js 20 and earlier will not receive fixes.

**Detailed guide:** **[Node.js and Next.js: Two Critical Vulnerabilities in One Week](https://zomro.com/blog/articles/749-nodejs-and-nextjs-two-critical-vulnerabilities-in-one-week-and-how-to-protect-your-website)**

## 

## 

## 4\. Redis

**What happened.** Redis patched more than a dozen vulnerabilities in August and September. They include bypassing TLS certificate authentication, executing code via a specially crafted database file, and bypassing access permissions within transactions. Unencrypted cluster nodes could also be tricked into accepting an outside server.

Think of Redis as a safe containing your website's data. Even if the safe is locked, it's not ideal to leave it visible from the street.

**Who is affected.** Everyone using Redis for website caching, queues, sessions, Chatwoot, and many other services.

**What to do**
    
    
    redis-server --version

Update Redis to 8.10.2, 8.8.3, 8.6.7, 8.4.7, or 8.2.10. Check that ports 6379 and 16379 are not accessible from the internet:
    
    
    ss -ltnp | grep -E ':6379|:16379'

If `0.0.0.0` appears next to a port, Redis is listening on all addresses. Block the port with a firewall or set `bind 127.0.0.1` in the configuration.

## 

## 

## 5\. PostgreSQL

**What happened.** PostgreSQL patched 28 vulnerabilities in August, a record for a single update. The most prominent was dubbed PostGREShell (CVE-2026-6471). Through the replication feature, a user with replication-only privileges could gain full control of the database and execute code on the server. The flaw is 12 years old and affects versions 9.4 through 18.

**Who is affected.** Anyone running a PostgreSQL version older than the August release.

**What to do**
    
    
    psql --version

Update to 18.6, 17.11, 16.15, 15.19, or 14.24. A minor-version update does not require a database dump: simply update the package and restart the service.

> **Attention, PostgreSQL 14 users:** November 12 will bring the final update for this version. There will be no further fixes afterward. It's time to plan a move to version 16, 17, or 18.

## 

## 

## 6\. Linux kernel

**What happened.** A series of Linux kernel flaws with memorable names were discovered throughout 2026: Copy Fail, Dirty Frag, Fragnesia, and PinTheft. All of them allow a regular server user to gain administrator (`root`) privileges.

It's like letting a guest into the hallway, only for them to find a way to open every room and safe.

In October, researchers also accidentally published details of seven more kernel vulnerabilities before patches were released. Two of them affect the `ksmbd` module, a file server built into the kernel for Windows network shares. It is not enabled on most servers.

**Who is affected.** Primarily servers that host multiple users, websites belonging to different owners, or Docker containers.

**What to do**
    
    
    uname -r

Update the system and reboot the server. The new kernel will not take effect without a reboot.
    
    
    # Ubuntu и Debian
    sudo apt update && sudo apt upgrade
    sudo reboot
    
    # AlmaLinux и Rocky Linux
    sudo dnf upgrade kernel
    sudo reboot

Check whether `ksmbd` is loaded. If the command returns no output, the module is not loaded:
    
    
    lsmod | grep ksmbd

## 

## 

## 7\. Windows Server

**What happened.** In October, Microsoft released a record-breaking update fixing more than 1,400 vulnerabilities. Hackers are already exploiting one of them (CVE-2026-96951). It allows attackers to bypass Windows warnings for files downloaded from the internet. Imagine a security guard letting a package through without checking it because someone attached the right label.

Critical vulnerabilities in these services are especially dangerous for servers:

  * DHCP Server and Message Queuing: severity score 9.8 out of 10;
  * Remote Desktop Gateway (RD Gateway);
  * IIS web server.



**Who is affected.** Anyone with a Windows-based VPS or dedicated server.

**What to do.** Install the October updates through Windows Update and reboot the server. To see the latest installed updates, run this in PowerShell:
    
    
    Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

If the latest update is older than mid-October, the server is not protected.

## 

## 

## 8\. What else to check

**GitLab: maximum severity score of 10 out of 10.** On October 21, GitLab fixed CVE-2026-110264, which allows code execution on a server without logging in. Every version since 7.0 is vulnerable, spanning 12 years of releases. Even if you updated on October 12, that is not enough. Fixed versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13.
    
    
    sudo gitlab-rake gitlab:env:info | grep -i version

**nginx: five vulnerabilities.** nginx 1.30.6 and 1.31.7 were released on October 14. Three of the flaws may allow code execution, but only under certain configurations. One of them is 21 years old. Updating is easier than investigating every setting.
    
    
    nginx -v

**Nextcloud with built-in Collabora Office.** CVE-2026-110447 has been exploited since September. If you use the `richdocumentscode` app in a version earlier than 26.4.303, update or remove it. **Read more:** Nextcloud and Collabora.

**Magento and Adobe Commerce.** On October 27, CISA confirmed attacks exploiting the file-upload vulnerability CVE-2026-48356. Install the latest Adobe security update.

**YOOtheme Pro for Joomla and WordPress.** CVE-2026-102785, rated 10 out of 10, is already being used to compromise websites. Versions 5.0.0 through 5.0.52 are vulnerable. Update the theme to the latest version.

**LiteLLM.** On October 27, a 10-out-of-10 vulnerability was fixed in the Enterprise version: an attacker could steal the master key without a password. Fixed versions: 1.106.5, 1.105.6, 1.104.8, 1.103.10. For the poisoned 1.107.0 release, read our article _Stolen AI Keys_.

## 

## 

## What to expect in November

Add these dates to your calendar:

When |  What  
---|---  
November 10 |  Microsoft's monthly security update for Windows Server  
November 12 |  Scheduled PostgreSQL update; the last one for PostgreSQL 14   
In the coming weeks  |  Planned PHP release fixing CVE-2026-115560  
December 31 |  PHP 8.2 stops receiving security fixes  
  
When the PHP update is released, you can remove the `session.upload_progress.enabled = 0` setting, but only after installing the new version.

## 

## 

## Final checklist

  * PHP is updated and `session.upload_progress.enabled = 0` has been added.
  * The `ca-certificates` package is updated and Docker images have been rebuilt.
  * Node.js, Next.js, and sharp are updated.
  * GitLab is updated to a fixed version.
  * nginx is updated to 1.30.6 or 1.31.7.
  * Redis is updated; ports 6379 and 16379 are blocked from the internet.
  * PostgreSQL is updated to the August release.
  * The Linux kernel is updated and the server has been rebooted.
  * Windows Server has received the October updates.
  * Nextcloud, Magento, YOOtheme, and LiteLLM have been checked, if installed.
  * November update dates have been added to the calendar.



## 

## 

## Don't want to handle it yourself?

There are 10 items on this list, and almost every month the list is just as long. If your business runs on a server, keeping track of everything manually is difficult. Missing just one update can be enough for an attack.

Zomro offers two options for situations like this.

### 

### **SOD: We'll work through the checklist for you**

Our system administrator will:

  * check which programs from the list are installed on your server;
  * update them to safe versions;
  * close unnecessary ports;
  * reboot the server at a time that works for you and verify that everything is running.



**Price:** €12.50 per 15 minutes of work.

[**Request a server security check**](https://zomro.com/paid-support-services/server-management-services)

### Premium: Fast help when you need it

A standard technical support request can take up to 10 hours to receive a reply. With Premium, we respond within 5 to 30 minutes. If something breaks after an update, you won't have to wait half a day.

New vulnerabilities appear every week. With Premium, you won't have to deal with them on your own.

[**Get Premium**](https://zomro.com/paid-support-services)

Similar articles:

[The Certificate Key Turned Out to Be the Number 4: What to Update on Your Server](https://zomro.com/blog/articles/748-the-certificate-key-turned-out-to-be-the-number-4-what-needs-to-be-updated-on-the-server) [Creating a strong and secure password](https://zomro.com/blog/articles/27-sozdaem-nadezhnyy-i-bezopasnyy-parol) [Nextcloud and Collabora: A Vulnerability Already Being Exploited by Hackers](https://zomro.com/blog/articles/750-nextcloud-and-collabora-a-vulnerability-already-being-exploited-by-hackers) [PHP2Shell: how to check your server and fix the dangerous PHP Vulnerability](https://zomro.com/blog/articles/746-php2shell-how-to-check-your-server-and-close-a-dangerous-php-vulnerability) [Security on a cloud VPS: how to protect the server from attacks](https://zomro.com/blog/articles/541-security-on-cloud-vps-how-to-protect-the-server-from-attacks)

[ GPU server from €174.80/mon ](/dedicated-servers/type=gpu)