A security-heavy week for anyone running a TICK-stack dashboard or automated backups — two patches below are worth prioritizing over the rest.
Grafana 13.2.2: patch if you run it alongside InfluxDB/Telegraf
Released September 15, this fixes a high-severity plugin-install RCE (CVE-2026-15815, CVSS 8.8) — a crafted plugin archive can use chained symlinks to drop an executable outside the plugin directory that then runs with the Grafana server’s privileges — plus a stored XSS in the Geomap panel (CVE-2026-76154, CVSS 7.3) that lets an Editor-role user escalate to Org Admin. If Grafana is sitting in front of your InfluxDB or Telegraf metrics, this one’s worth doing sooner rather than later, especially if you allow plugin installs from anyone other than admins.
Grafana 13.2.2 release notes
Ubuntu: rclone remote-control API can be tricked into running arbitrary commands
USN-8782-1 (September 18, CVE-2026-49980) fixes a bug where rclone mishandles unauthenticated requests to its remote-control API, letting an attacker who can reach that API execute arbitrary commands as whatever user is running rclone. Only relevant if you run rclone with --rc enabled and exposed beyond localhost — a fairly common setup for people who trigger backups from a separate management box — but worth checking your bind address either way.
USN-8782-1 advisory
WordPress 7.1.1 maintenance and security release
Out September 17 with 11 security fixes on top of the usual round of core and block-editor bugs. The headline is an unauthenticated stored XSS in wpautop(), the function that turns line breaks into paragraphs on almost everything WordPress renders — about as broad a blast radius as a WordPress bug gets. The rest are mostly privilege and disclosure issues that need at least contributor-level access, including an arbitrary post overwrite and a path-traversal bug in the REST API templates controller. Update now if your host hasn’t already done it for you.
WordPress 7.1.1 release notes
Nextcloud Hub 26 “Summer” released
Landed September 16 with a new Nextcloud Teams feature for dedicated team spaces, a reworked Photos app, and the usual pile of automation and Office-integration updates. Hub 25 “Autumn” is now end-of-life, so if you’re self-hosting Nextcloud on that branch, it’s time to plan the upgrade.
Nextcloud Hub 26 Summer announcement
Home Assistant 2026.9.3 patch release
This week’s bug-fix patch for the 2026.9 series (September 18) is mostly routine — fixes for Spotify, Wiz, and IMAP integrations, plus a fix for encrypting and decrypting the supervisor backup archive correctly. Safe to apply if you’re already on 2026.9.
2026.9.3 release notes
MikroTik RouterOS 7.24.4: small follow-up fix, not the security patch
Don’t confuse this with the MikroTrick fix from a couple of weeks back — 7.24.4 (September 16) just corrects a regression in 7.24.3 that could delete modem firmware on a handful of specific LTE hardware variants (RBSXTLTE3-7 and certain EC25/EG25 modem combos). Only matters if you’re running one of those cards, but good to know before updating blind.
RouterOS 7.24.4 announcement
Leave a Reply