A few things worth your attention from the past week and a half:
Multipath TCP flagged as a remote-code-execution risk on Linux — and Go enables it by default. The Go security team warned on October 29 that Go’s networking stack turns on multipath TCP (MPTCP) automatically, which combines with a kernel-side bug to open a remote-code-execution path on affected Linux systems. A lot of self-hosted tooling is written in Go, so if you’re running Go-based services, check whether a kernel fix has reached your distro yet, and consider disabling MPTCP as a stopgap in the meantime. Source
MikroTik ships RouterOS 7.25 stable. The “important security update” MikroTik flagged in the 7.25 beta a few weeks back — without saying what it fixed, as usual — has now landed in the October 22 stable release. It also brings dynamic ARP inspection and IP source guard on bridges, a new BGP always-compare-med option, and a fix for fragmented IPv6 traffic getting dropped by DHCPv6 snooping. Worth updating sooner rather than later given the undisclosed fix. Source
nginx 1.31.8 (mainline) released. A small follow-up to the October 14 security release: fixes an HTTP/3 undefined-behavior bug and some working_directory handling issues. No new CVEs this round. Source
Linux 7.4 merge window closes as an unusually large cycle — and it’s expected to be the next LTS. Torvalds called it a genuinely “big” merge window: nearly 20,000 commits landed, versus the more typical ~15,000. If you’re the type who picks a kernel version to standardize a fleet on, 7.4 is one to keep an eye on. Source
KeePassXC 2.8.0 released, after a month of beta testing. The password manager finally moved its UI from Qt5 to Qt6, auto-type now works under Wayland via XDG desktop portals, and there’s a new option to import a database straight from a remote host over SFTP/SCP. If a shaky KeePassXC experience was the last thing keeping you on an Xorg session, this removes some of the excuse. Source
Critical auth bypass in Avada/Fusion Builder (CVE-2026-97670, CVSS 9.1). An unauthenticated attacker can trigger arbitrary WordPress action hooks through a form-notification code path on any site with a published Avada form — one disclosed test request permanently deleted trashed posts, pages, and comments. Fixed in Avada 7.16.2; update now if you’re running the Avada theme or Fusion Builder. Source
Authentication bypass in the LatePoint booking plugin (CVE-2026-110653, CVSS 9.1). A race condition in the one-time-passcode attempt counter lets an attacker bypass authentication entirely, no credentials needed. Fixed past version 5.7.4 — patch it if you use LatePoint for appointment scheduling on a self-hosted site. Source
Leave a Reply