All news with #patch release tag

🛡️ GitLab has released a fix for a maximum-severity path traversal vulnerability (CVE-2026-85706) that allowed unauthenticated users to read arbitrary files via the repository commits API. The issue affects multiple versions and was remediated on September 10. Security vendors reported in-the-wild probes shortly after disclosure, and CISA added the flaw to its KEV Catalog, urging rapid remediation. Organizations are advised to patch immediately and hunt logs for suspicious POST requests to the commits endpoint.

🔔 Amazon RDS for Oracle now supports the Supplemental Patch Bundle (SPB) for the July 2026 Release Update (RU) for Oracle Database 19c and 26ai. Starting April 2026, Oracle renamed the Oracle Spatial Patch Bundle to Supplemental Patch Bundle, which includes targeted fixes for features like Oracle Spatial, Data Pump, and GoldenGate. You can apply the SPB to new or existing instances by selecting the "Supplemental Patch Bundle Engine Versions" checkbox in the AWS Console, and use AWS Organizations rollout policy to stagger automatic minor upgrades across environments.

🛡️ PaperCut released Regular Maintenance Releases for NG/MF versions 26.0.5, 25.0.13 and 24.1.10 that replace earlier emergency patches addressing two actively exploited vulnerabilities. These MR builds include fixes from Emergency Patch Releases 1–3, additional hardening, and standard QA testing. Customers running emergency patch builds are advised to upgrade to the maintenance releases for full protection.

🖥️ Administrators report that September 2026 cumulative updates are causing Remote Desktop Services (RDS) failures on Windows Server 2019, 2022, and 2025, preventing users from connecting and sometimes requiring hard resets. Affected servers often run normally for hours after patching before RDS connections start failing; existing sessions may not disconnect and new connections hang. Rolling back the updates restores functionality, but also removes security fixes. Microsoft is aware and investigating.

🔧 Users report that Microsoft’s KB5002914 Office security update, released in the September 2026 Patch Tuesday, is breaking copy-and-paste and formula autofill in Excel for some installations. Affected reports span Office versions from 2016 through 2024 and include both MSI and Click-to-Run deployments. Uninstalling or rolling back the update restores functionality for many users, while Microsoft says it is investigating and has added the issue to the KB5002914 release notes.

🔒 Check Point released fixes on September 9 for two critical VPN certificate vulnerabilities affecting its Security Gateway appliances and Security Management Server. Both flaws — CVE-2026-85102 (certificate trust validation) and CVE-2026-85103 (ASN.1 heap overflow) — carry a CVSS score of 9.8 and could, under specific conditions, allow unauthenticated remote code execution. The company deployed fixes via Live Patch and Jumbo Hotfixes, but customers reported rollout delays, broken advisory links, and incomplete version clarity. Check Point says it discovered the issues internally and has no evidence of active exploitation.

🆕 Amazon RDS for MariaDB now supports community minor versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, and 12.3.3, which include operational improvements and post-quantum TLS (PQ-TLS) key exchange support for in-transit encryption. AWS recommends upgrading to gain CVE fixes, bug fixes, performance improvements, and new features. You can upgrade via Blue/Green deployments, in-place upgrades, or snapshot restores, and automate rollouts with automatic minor upgrades and the AWS Organizations Upgrade Rollout Policy. Migration from external MariaDB sources is supported via AWS Database Migration Service.

🔔 Amazon RDS for SQL Server now supports the latest Cumulative Updates (CU) and General Distribution Release (GDR) packages for multiple SQL Server versions, including 2016 SP3+GDR, 2017 CU31+GDR, 2019 CU32+GDR, 2022 CU26, and 2025 CU7. These updates address vulnerabilities tracked as CVE-2026-47295, CVE-2026-47296, CVE-2026-54118, and CVE-2026-55002. AWS recommends upgrading instances via the Amazon RDS Management Console, AWS SDK, or CLI and refers users to Microsoft KB articles and the Amazon RDS SQL Server User Guide for upgrade procedures.

🔒 N-able has released a hotfix addressing a critical pre-authentication remote code execution vulnerability, CVE-2026-86218, in its N-central monitoring and management platform. The flaw, given a maximum CVSS score of 10, impacts N-central versions before 2026.3.1.14 and could allow unauthenticated code execution on the server. N-able patched the issue in N-central 2026.3 Hotfix 4 (build 2026.3.1.14) and reports no evidence of in-the-wild exploitation. This follows several recent high-severity vulnerabilities and prior hotfixes.

🔐 ConnectWise has disclosed a new vulnerability in ScreenConnect Remote Access affecting both cloud and on-premises deployments and plans to release a patch later this week. The company provided immediate mitigation steps requiring administrators to remove the TransferFiles (or TransferFilesInSession) permission from session groups via Administration > Security > Roles. Shadowserver currently tracks nearly 6,000 public ScreenConnect instances, and the vendor cautions that these flaws are often targeted by financially motivated and state-backed threat actors.

🔒 N‑able released Hotfix 4 (build 2026.3.1.14) for its N‑central RMM to fix CVE-2026-86218, a pre-auth remote code execution vulnerability affecting all on‑premises builds prior to 2026.3.1.14. The company says hosted instances are patched and urges on‑premises customers to upgrade immediately; agents do not require updates. Communications diverge on whether the flaw has been observed exploited in the wild, and no indicators of compromise or interim mitigations were provided.

🔒 N-able released an emergency hotfix addressing a maximum-severity remote code execution flaw in its N-central RMM platform. Tracked as CVE-2026-86218, the vulnerability allows unauthenticated attackers to execute code on internet-exposed instances. N-able issued N-central 2026.3 Hotfix 4 and urged immediate on-premises upgrades, while Shadowserver reports nearly 1,500 exposed servers. Security firms flagged related high-severity bugs and evidence suggesting active exploitation cannot be ruled out.

🔒 Broadcom has released patches for two vulnerabilities in VMware Workstation and Fusion, including a critical integer-overflow bug (CVE-2026-59346) that could allow arbitrary code execution from a privileged local VM user. A second fix addresses a stack-based buffer overflow in HGFS (CVE-2026-59347). Both flaws require the attacker to have local administrative privileges on the VM and have been fixed in VMware Workstation 26H1u1 and Fusion 26H1u1. Broadcom credited external researchers for reporting the issues and noted no current evidence of in-the-wild exploitation, though recent attacks on VMware products increase urgency.

🔒 PostgreSQL released fixes for CVE-2026-6471, a vulnerability in logical decoding present since 2014 that allows accounts with the REPLICATION attribute to load arbitrary libraries and execute code as the OS user running the server. A new server parameter, output_plugin_libraries, whitelists allowed output plugins and defaults to 'pgoutput, test_decoding', causing non-default plugins like wal2json and decoderbufs to be blocked until administrators add them and reload configuration. The update affects supported branches 14–18 and is available in upstream and vendor packages; administrators are advised to identify used plugins, update, and add any required non-default plugins to the new parameter.

🔒 Plex has released updates for Plex Media Server (1.43.3) and Plex Desktop (1.115.0) to address multiple security flaws and is urging users to upgrade immediately. The vendor has requested CVE identifiers for the patched issues but did not provide technical specifics. Plex recommends manual installation for NAS users if package managers have not yet received the updated builds. This advisory follows prior high-severity fixes and historical exploitation events involving Plex servers.

🔒 Google released security updates fixing 12 Chrome vulnerabilities, including an actively exploited high-severity V8 type confusion bug (CVE-2026-85046) with a CVSS of 8.8. Researcher Salvatore Gulizia (Serotav) reported the flaw on August 4, 2026, and received a $1,000 bounty. Google confirmed exploits exist in the wild and urges users to update Chrome to 152.0.7977.82/.83 on supported platforms. Other Chromium-based browser users should apply vendor fixes when available.

🔒 HPE has released patches for a critical buffer overflow in ArubaOS‑CX (CVE-2026-73749) that lets unauthenticated attackers send crafted packets to a daemon and achieve remote code execution with elevated privileges. The vendor lists fixed builds across multiple release branches and warns that some versions have reached End of Maintenance, receiving only selective critical fixes. The bulletin also addresses 23 additional vulnerabilities ranging from high to low severity and urges customers to upgrade to the patched releases.

🔒 Cisco released patches for a critical Nexus 9000 vulnerability (CVE-2026-20212) that allows unauthenticated remote root code execution via TCP ports 43210 and 43211. The advisory affects 10 Silicon One-based Nexus 9000 PIDs and lists mitigations including iACLs and a Live Protect shield while customers use the Software Checker to pick fixed releases. Cisco also published an IOS XR hardening release bundling seven umbrella CVEs, two rated 9.8, and provided SMUs and upgrade guidance for affected XR trains.

🔒 Plex has urged users to immediately update Plex Media Server and the Plex Desktop client to patch multiple security vulnerabilities affecting Server v1.43.2 and earlier. The company released Plex Media Server 1.43.3 (May 19) and Plex Desktop 1.115.0 (Aug 13) and has emailed affected customers asking them to upgrade. CVE identifiers have been requested and Plex warns users to update before attackers reverse-engineer the fixes. NAS package managers may not yet carry the updated server build, so manual installation could be required.

🛡️ Amazon RDS Custom for SQL Server now supports the latest Cumulative Update (CU) and General Distribution Release (GDR) packages. This update includes SQL Server 2019 CU32+GDR (RDS 15.00.4480.2.v1) and SQL Server 2022 CU25+GDR (RDS 16.00.4262.2.v1). The GDRs address vulnerabilities such as CVE-2026-47295, CVE-2026-47296, CVE-2026-54118, and CVE-2026-55002. You can apply these updates via the Amazon RDS console, AWS SDK, or CLI.