One urgent patch dominates this week — everything else is smaller housekeeping, but there’s a decent pile of it.
WordPress 7.1.2: unauthenticated RCE, patch immediately if you haven’t already
WordPress pushed an emergency release on September 22 for CVE-2026-87902 (CVSS 9.2), a flaw in page-template resolution where an attacker can manipulate the value used to pick a page template and get get_page_template() to include an arbitrary readable PHP file from outside the active theme’s directories. No account, no vulnerable plugin, and no admin interaction required — on the right server/theme combination that’s remote code execution. It affects every branch back to 4.7.0, with backported fixes in 7.1.2, 7.0.6, 6.9.9, and 6.8.10. Attackers were probing within hours of disclosure, and CISA added it to its Known Exploited Vulnerabilities catalog on September 25. If auto-updates are off on any site you run, do this one manually today.
WordPress 7.1.2 release notes
MikroTik RouterOS 6.49.22 (long-term): the MikroTrick fix finally lands on the 6.x branch
Released September 21, this backports the fix for CVE-2026-67281 — part of the same public-key SSH authentication bypass family that made up the “MikroTrick” chain a few weeks back — to the old 6.49.x long-term branch. If you’ve got legacy RouterBOARD hardware still pinned to 6.49.x because it can’t run RouterOS 7, this is the update you’ve been waiting for; the 7.x branch already got its fix in an earlier release.
RouterOS 6.49.22 announcement
Ubuntu: large batch of kernel fixes across every supported LTS
September 25 brought a heavy round of kernel security updates — nearly 100 CVEs fixed on 24.04 LTS alone, plus smaller batches for 20.04, 18.04, and 16.04 LTS (the latter two still on extended security maintenance). Nothing here looks like a single standout bug, just the usual accumulated backlog of kernel hardening, but if you’re running any of these releases it’s a reboot-required update, so plan a maintenance window rather than letting it sit.
Ubuntu security notices
Ubuntu: libwebsockets RCE and DoS (USN-8822-1)
Fixed September 28 — libwebsockets mishandled certain malformed CBOR data (potential crash or arbitrary code execution) and certain SSH protocol messages in its SSH handler (resource-exhaustion DoS). Most homelab boxes won’t have much linked against libwebsockets directly, but it shows up as a dependency in some IoT/MQTT and reverse-proxy tooling, so worth a quick check if you’re not sure what pulled it in.
USN-8822-1 advisory
systemd v262 released
A meatier release than usual. Highlights for anyone running servers: TPM-sealed credentials are now pinned to the TPM’s Storage Root Key (protects against an interposed/spoofed TPM), Argon2id is now supported for TPM2 PIN enrollment, a new RestartRandomizedDelaySec= option staggers automatic service restarts instead of having everything hammer back at once, and newly created fscrypt-backed home directories default to fscrypt v2. It also adds support for building a single statically-linked PID 1 for minimal container images, and drops the legacy udev control socket protocol in favor of Varlink. Nothing here demands an immediate action, but it’s a good one to read through before it lands in your distro’s next release.
systemd v262 release notes
Home Assistant 2026.9.4 patch release
Routine bug-fix release on September 27 for the 2026.9 series: fixes Tuya fans shutting off at zero speed, incorrect Todoist timed-event durations, and ISEO Argo BLE discovery scope. Safe to apply if you’re already on 2026.9.
Home Assistant 2026.9.4 release notes
Kernel corner: io_uring’s non-blocking guarantee is harder than it sounds
Worth a read if you’re into the CLI/kernel side of things rather than just running the box: LWN covered an RFC from io_uring maintainer Jens Axboe proposing a scheduler-level mechanism (a new PF_IO_HANDOFF task flag) to detect when a supposedly non-blocking io_uring operation actually blocks somewhere in the kernel. Axboe himself calls it “potentially scary” and isn’t expecting it to merge soon, but it’s a good look at how deep the cracks run in io_uring’s core promise.
Thread-identity switcheroo for io_uring (LWN)
Leave a Reply