Welcome to Week 1 of a new Sunday feature here at NERDS.xyz. Our Linux security and vulnerability roundup will highlight the developments worth your attention, explain who is affected, and help you figure out what actually needs updating.
We are starting with the week ending November 8, 2026, and there is plenty to discuss. APT package verification, SSH authentication, protected file data, and Ruby applications all feature in this first edition.
The goal is to make security advisories useful without turning every bug into a disaster movie. Some vulnerabilities require very specific configurations, while others affect software that people depend on to keep their systems secure.
APT needs an update on Ubuntu and Debian
A package manager is supposed to help you install software you can trust. That makes CVE-2026-109518 particularly uncomfortable, because it can allow an attacker positioned between a machine and its package mirror to substitute a package after verification.
According to Debian’s advisory, the problem involves HTTP redirects, resumed downloads, and improper file handling. Successful exploitation can result in arbitrary code running as root.
This is not a situation where any stranger can instantly compromise every Ubuntu computer. The attacker needs the necessary network position and download conditions, but AWS warns that Ubuntu 22.04 LTS and later, and Debian 12 and later, are affected in their default configurations.
The fixed Ubuntu packages include APT 2.4.15ubuntu0.1 for 22.04 LTS, 2.8.4ubuntu0.1 for 24.04 LTS, 3.2.1ubuntu0.1 for 26.04 LTS, and 3.3.3ubuntu0.1 for 26.10. Debian’s tracker lists fixes in 2.6.2 for Debian 12 and 3.0.4 for Debian 13.
Prioritize this update, including in container images that use APT. AWS also recommends HTTPS package sources and disabling download retries during the upgrade with Acquire::Retries=0.
Alpine SSH servers need special attention
Alpine’s November 5 SSH security advisory describes a password authentication bypass affecting specific configurations across releases 3.16 through 3.24 and edge. At the time of the advisory, no CVE identifier had been assigned.
The vulnerable combination involves SSH authentication without PAM, password authentication enabled, an account with * in its password field, and another local account with a $5$ or $6$ password hash. Under those conditions, an attacker can log into the first account without knowing a password.
Fixed OpenSSH packages include 10.3_p1-r2 for Alpine 3.24, 10.2_p1-r1 for 3.23, and 10.0_p1-r11 for 3.22. Alpine also issued patches for older branches.
Update OpenSSH and restart sshd; installing the package alone leaves the running daemon unchanged. If patching must wait, disable password authentication after confirming key-based access works.
Containers without an SSH server are outside this issue. Some tiny-cloud images can become vulnerable after an administrator adds a password, however, making configuration changes especially relevant.
A kernel flaw threatens protected file data
CVE-2026-99284 concerns a Linux kernel networking bug that can let an unprivileged user modify the cached contents of a root-owned, read-only file. That is a serious security boundary to cross, even without a dramatic vulnerability nickname.
The description in Debian’s tracker involves shared network-buffer fragments, ESP decryption, and paths involving Netfilter queues or Open vSwitch. It supports concern about privilege escalation, but it does not establish that every Linux installation is exploitable.
Debian 13 has a fix from kernel source package version 6.12.115-1, with 6.12.115-2 listed in the security repository. Debian 12’s listed 6.1.190-1 package remains marked vulnerable. These are Debian package versions, so comparing only upstream kernel numbers can give the wrong impression.
Administrators should check their distribution’s assessment and install an applicable fixed kernel, then boot into it. The sources reviewed for this roundup did not establish active exploitation.
Debian Ruby fixes carry a lesson for GitLab administrators
Debian’s November 7 Ruby security update fixes multiple vulnerabilities in Debian 13 through package version 3.3.13-0+deb13u1. Among them are bugs associated with GitLab CVEs, including CVE-2026-97229.
The relevant Ruby flaws involve compiling attacker-controlled regular expressions. Upstream Ruby 3.3.13, 3.4.12, and 4.0.9 contain all four related fixes, and setting a regex timeout does not protect against the underlying memory corruption.
There is a practical reason to care beyond the advisory text. Alpine previously reported attempted exploitation against its GitLab instance, although it did not establish successful compromise.
Alpine also discovered that upgrading GitLab had not fixed its custom image because the Ruby runtime remained unpatched. That incident predates this week, but Debian’s newly available update makes the lesson timely: verify the runtime your application actually uses, including inside containers.
Linux users have good reasons to value their operating systems, but updates still need attention. For this first Sunday roundup, checking APT, exposed Alpine SSH servers, kernel patch status, and affected Ruby deployments is a worthwhile place to start.
Support independent tech journalism
NERDS.xyz is independently owned and operated. If you enjoy my coverage of Linux, AI, hardware, cybersecurity, and tech culture, consider supporting the site on Ko-fi.
Support NERDS.xyz
