Patch roundup, week of Nov 2: fix Linux and WS_FTP first, then work down the list

Most of this week's list can wait for a normal window, but two jobs can't. Patch Linux servers against CVE-2026-98432 and reboot them, and if you run Progress WS_FTP Server, upgrade it today. Then work down the rest in the order below.

The two items at the top share a problem: nobody needs a password to start. The Linux flaw sits in the code that handles ordinary TCP connections, so it touches a huge share of servers. WS_FTP is a much smaller product, but a file transfer server often sits at the edge of the network, and this flaw can hand over admin credentials.

It's also a week where the scores mislead. A 10.0 in WS_FTP and a 9.9 in Dameware look like neighbours on a spreadsheet, yet Dameware's needs a login and WS_FTP's doesn't. Zyxel's switch flaw scores lower than both, and of the three it's the only one with a report of real attacks.

Linux kernel CVE-2026-98432. Red Hat rates this IPv4 TCP flaw Critical and started shipping RHEL fixes on November 1. Patch your distribution's kernel and reboot, because the old kernel keeps running until you do. Here's who has a fix and what the stopgap filter misses.

Progress WS_FTP Server. On this Windows file transfer server, CVE-2026-84295 (10.0) lets someone with no login read sensitive data, and that includes admin credentials. Fourteen more flaws came with it. Canada's Cyber Centre names 2025.0.3 and 2024.0.6, but most of the bugs stay open until 2025.0.4 or 2024.0.7, so we'd skip straight to those.

Nobody has reported attacks on WS_FTP so far, and it isn't on CISA's list as of the November 4 catalog. We'd still patch today, because nobody needs a login to try it and the credentials at stake belong to the admin.

Delinea Secret Server, self-hosted. If you missed it, Delinea rescored a login bypass to 9.9, and version 12.2.7 is affected too. Our Secret Server post covers who needs 12.3.000002 and what to look for in your logs.

Rails Active Storage. Rails apps can let a stranger write files on the server (9.8) when three things line up: they accept uploads from untrusted users, they process them with ImageMagickdefinitionSoftware that web apps often call when someone uploads a picture. It can do far more than resize, which is where the trouble starts., and ImageMagick's policy doesn't already block the coders involved. Debian's and Ubuntu's packaged policies don't. Just attaching the upload is enough. Upgrade to 8.1.4.1 or 8.0.5.2, and if you use the mini_magick processor you also need mini_magick 5.1 or later or the app fails at boot.

Here's the part teams miss. If your attachments live on the Disk service, patching isn't the end of the job: the Rails team tells you to change secret_key_base, the master key and every credential the app can read. PDF rendering can also break, because the new policy blocks Ghostscript until you allow it again in the host's policy.xml. Only 8.0 and 8.1 get these patches, so older apps have to copy the policy rules into ImageMagick's system policy or move up.

Barracuda Email Security Gateway. Barracuda changed its advisory on November 5, so re-check it if you triaged this on Monday. CVE-2026-116606 (9.3) was first listed as needing admin access and now reads as no authentication, as long as the attacker can reach the admin interface. Chained with command injection CVE-2026-111560 (8.6), it ends in root. Only ESG has the first flaw. ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway have only the second, which needs an admin login.

Zyxel GS1900 switches. Canada's Cyber Centre cites open-source reporting that CVE-2026-107441 is being exploited. Zyxel doesn't mention attacks, and it isn't on CISA's list as of the November 4 catalog. Anyone on the same network segment can use it without a login (8.8). Go and check the firmware, because Zyxel only patched models still inside their support period.

BeyondTrust customers on 24.3 should read our end-of-support post before the end of the month, since there's no one-step route to 26.x. RSA customers planning Patch 5 can fold it into the move to 8.9 if they haven't made it yet. If you need extra hands, see how we staff Okta and BeyondTrust work.

OpenSSH 10.6p2. On Linux builds that use musldefinitionSome Linux systems use this small C library where most use glibc. You'll usually run into it on Alpine Linux. libc with PAM turned off, some account setups accept any password between 256 and 1024 characters (CVE-2026-123158, 8.1). Most glibc servers aren't in that group. Look at containers and small appliances instead, Alpine being the usual musl base. The CVE record points to public exploit code and OpenSSH calls the fix critical, so affected hosts can't wait for the next release.

The release notes carry a warning worth repeating to your team. OpenSSH says bugs found with AI tools are being found again independently by other researchers, so it will ship fixes more often for now. If your SSH updates wait for a twice-yearly image rebuild, that cadence is starting to look slow.

GitHub Enterprise Server. Someone with an account and SSH access can run commands as the Git service and read its secrets, which is CVE-2026-104608, though they'd need memory offsets for your exact build and a failed try kills the service. In the second bug, CVE-2026-15343, code already running in a Dependabot container can write workflow files if the installation has workflows: write. GitHub says its first fix for that was incomplete, so upgrade again even if you patched it before.

WatchGuard Fireware OS. A Firebox set up with an Active Directory auth server can be hit by whoever controls or intercepts traffic to that server (CVE-2026-112710, 9.2). WatchGuard knows of no attacks. It's a backfill from last week, so check you've got it.

Cisco. UCS Central has a remote code execution flaw for logged-in users (7.6), and Unified CM has a cross-site scripting flaw that needs someone to click a link (6.1). Finesse, used in contact centers, has a server-side request forgery flaw with a public write-up, and Packaged and Unified CCE customers have to upgrade the Finesse component themselves. None of the Cisco items has a workaround, and Cisco knows of no malicious use.

ServiceNow. Brazil Patch 2 arrived on November 5 with 348 fixes, some of them for security problems. The details sit in KB3228372, which we couldn't read, so we won't guess at severity. From last week's batch, CVE-2026-103094 is the one to look at: it could leave a user's plaintext password in a system table. Our ServiceNow page has more on the platform.

MuleSoft. This is the easy one to miss, because nothing happens by itself this month. CloudHub and CloudHub 2.0 paused automatic patching for the November cycle, so apps only get 4.13.2, 4.12.6, 4.9.24 or 4.6.37 if someone upgrades them by hand. Put a name next to that job.

IBM Sterling B2B Integrator. A protocol downgrade flaw (CVE-2026-18668, 6.5) is fixed in 6.2.1.3 and 6.2.2.2. UiPath Orchestrator: job.created webhooks now always send source fields as names, so update any integration that expects numbers. InterSystems IRIS for Health: CVE-2026-111594 gets no product fix. You have to set the superserver to require TLS, because the "Enabled" setting still lets clients connect without it.

Two Snowflake driver updates will produce the same help desk call. JDBC 4.4.1 is a real security fix: tokens could collide when one identity signs in to more than one account or role. Go driver 2.4.0 moves the token cache. After either upgrade, people using browser SSO, MFA or OAuth with cached tokens have to sign in once more, so warn them first and check any scheduled job that counts on a cached token.

On the dbt side, 2.0.11 hardens credential redaction in logged Databricks SQL and locks down the DuckDB database behind checks and dbt show. It also renames --run-cache-mode to --state-mode, and the old flag only survives as a deprecated alias, so change your CI scripts while you're there. dbt-core 1.11.17 moves git credentials for dbt deps into a credential helper. dbt doesn't label that a vulnerability fix, though it's still a good change. See our dbt page for version notes.

Smaller client updates: SnowSQL 1.5.4 tightens signature checks on auto-upgrade downloads, and Snowflake CLI 3.32.1 lets snow dbt execute run check and clone. Databricks' legacy Simba JDBC 2.8.6 updates lz4-java, Jackson and libthrift.

The eMudhra certificate compromise keeps rippling out, and this is where it can break things. Terraform Enterprise 2.1.0 and 2.1.1 both reject the eight compromised intermediates and drop two whole roots from the bundle: connections to hosts chaining to emSign Root TLS CA G3 or Comodo AAA Certificate Services will fail. Search your VCS, registry and proxy certificates for those chains before you upgrade. If you're already on 2.1.0, you've got this change now.

PTC lists Creo+, Creo Parametric 10.0 to 13.4 and Windchill Workgroup Manager as impacted, with steps in a support article. GitLab removed trust in its 19.5.3 release and the matching backports, and self-hosted Runner and AI Gateway need their own upgrades. Our Java and eMudhra post explains the background.

PHP2Shell has now reached industrial products. CISA lists the PHP flaws as exploited, but that describes the bugs in general and nobody has said these products were attacked. Our PHP2Shell post has the full story, and our OT security page has more on these networks.

MES4 is the awkward one. Festo says older deployments run PHP up to 7.3, which no longer gets patches, and one of its suggested Apache settings carries a significant performance cost. Plan that system's replacement now. A firewall rule that only lets the HMI panels of manual workstations talk to it is a stopgap and nothing more.

# We made these versions up, so yours will look different. It's example output, and you should only run it on systems you own.
$ uname -r
5.14.0-570.el9.x86_64
# Compare this with your distribution's fixed kernel. If the package is new and this is old, you still need the reboot.
$ ssh -V
OpenSSH_10.6p1
$ ldd /usr/sbin/sshd | grep -E 'musl|pam'
/lib/ld-musl-x86_64.so.1
# musl shows up and pam doesn't: move this host to 10.6p2.
$ bundle list
  * activestorage (8.0.5.1)
  * mini_magick (4.13.2)
# Needs activestorage 8.0.5.2 and, on the mini_magick processor, mini_magick 5.1 or later.

Many of the platforms on this list sit in our cybersecurity and identity practice, and you can ask us about any item. If you aren't sure what you run, start with an assessment. For a specific platform, look at Delinea, Okta or Snowflake. Last week's list is in the previous roundup.