A quieter week than last time out — no active-exploitation fire drills, but a solid batch of releases and patches worth working through.
Linux kernel 7.2.5 and 6.18.51 released
Greg Kroah-Hartman pushed 7.2.5 and 6.18.51 (plus the usual parallel LTS bumps) on September 11, each carrying 500+ fixes. The notable cluster this round is on the graphics side — a run of nouveau patches targeting NVIDIA’s new Blackwell display pipeline — alongside several ksmbd hardening fixes, which matters if you’re exposing SMB shares from a Linux box.
Kernel 7.2.5 / 6.18.51 coverage
Ubuntu security notices: MiniUPnPd and a batch of media-library fixes
The one worth prioritizing is USN-8731-1: an integer underflow in MiniUPnPd’s SOAPAction header parsing (CVE-2026-41196) that a malformed UPnP request can turn into a crash or out-of-bounds memory read — relevant if you run MiniUPnPd for port-forwarding on a router or NAS. Canonical also shipped fixes for KissFFT, libEBML, and Beets this week (USN-8745-1/8746-1/8747-1), all triggered by crafted input files rather than network traffic, but still worth an apt upgrade pass if any of your media tooling pulls them in.
MiniUPnPd advisory · All Ubuntu security notices
Jellyfin 12.0 lands with a version-scheme reset
Jellyfin dropped the old 10.x numbering (what would’ve been 10.12.0 is just 12.0) and shipped native book support, FFmpeg 8.1, faster library scans, and a handful of security patches. The database changes mean there’s no rolling back once you upgrade, so take a full backup of your data directory first if you’re running it in a container or VM.
Jellyfin 12.0 release notes
Home Assistant 2026.9.2 patch release
The second bug-fix patch for the 2026.9 series landed September 11, cleaning up issues across Hive auth, Roomba sensors, Google Calendar sync, Portainer, and several other integrations. Nothing dramatic, but a safe update if you were holding off on 2026.9 for stability reasons.
2026.9.2 release notes
Heads up: InfluxDB’s Docker “latest” tag is switching to InfluxDB 3
Starting September 15, the latest tag on the official InfluxDB Docker image stops pointing at InfluxDB 2 and starts pointing at InfluxDB 3 Core. If your TICK-stack compose files or Ansible playbooks reference influxdb:latest instead of a pinned version, your next pull will hand you a different major version with a different query language and storage engine. Pin your tag now if you’re not ready for that jump.
InfluxData community notice
LWN: CERN is moving its accelerator controls from CentOS to Debian
A talk at MiniDebConf Winterthur covered CERN’s plan to migrate roughly 2,200 embedded industrial-control computers running its particle accelerators from CentOS Linux to Debian trixie. It’s a useful data point if you’re weighing distro choices for infrastructure that needs to be boring and stable for a decade at a time.
CERN’s migration path from CentOS to Debian
WordPress: a fuzzer for plugin bugs, and one plugin to check right now
Researchers at CISPA built THEMIS, a fuzzing tool purpose-built for WordPress plugins, and ran it against 68 real-world plugins — it reproduced 27 known vulnerabilities and turned up 10 previously unknown ones, three of which got CVEs assigned. Separately, if you or anyone you administer runs the small “Advanced Customized Prompts” plugin, versions through 1.0.1 have a critical authentication bypass (CVE-2026-14563, CVSS 9.8) that lets an unauthenticated attacker log in as any user, including admins — update or remove it.
THEMIS fuzzing tool · CVE-2026-14563 details
Leave a Reply