October 2026 Security Alert: Patch Your Linux Kernel, PHP and Windows Server Now

Updated 31 October 2026. The last two weeks brought three security problems that matter to almost everyone who runs a server: a critical flaw in the Linux kernel that can be reached over the network, two PHP bugs that attackers are already using, and the largest Windows Patch Tuesday so far. Here is what each one means and exactly what to run.

Short version: update PHP today, update the kernel and reboot, install the October Windows updates. If your Ubuntu, AlmaLinux or Rocky kernel has no fix yet, apply the temporary firewall rule below.

At a glance

1. PHP: two remote code execution bugs, already exploited

On 21 October the PHP team published two critical advisories: CVE-2026-109618 (memory corruption when a request runs out of memory) and CVE-2026-109619 (stale data left over from a previous request). Either one can let an attacker run their own code on your server without logging in, just by sending a crafted request. On 26 October the US agency CISA added both to its list of vulnerabilities being exploited in real attacks.

The PHP team says sites running PHP as an Apache module (mod_php) are the most exposed, because the attack works before your own code even starts. PHP-FPM is also considered vulnerable. The fixed versions came out on 22 October:

• 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (or newer)
• PHP 8.1 and older no longer receive security fixes at all — move to 8.2 or newer.

Check your version:

php -v

Ubuntu and Debian ship their own PHP packages and add security fixes without always changing the version number, so the safest way is simply to install all updates and restart PHP:

sudo apt update && sudo apt upgrade -y
sudo systemctl restart apache2        # if you use mod_php
sudo systemctl restart php8.3-fpm     # if you use PHP-FPM — use your version number

cPanel / WHM (AlmaLinux): PHP comes from the EasyApache ea-php packages:

sudo dnf update "ea-php*" -y

Plesk: go to Tools & Settings → Updates and install the available PHP updates. On shared or managed web hosting, PHP updates are your host's job — ask them to confirm.

2. Linux kernel "Fragnesia" (CVE-2026-46300): now used in attacks

This kernel bug lets a normal user (or a hacked website) become root, and possibly escape a container. Fixes have been available since May, but on 28 October CISA reported it is now being exploited — attackers are chaining it with the PHP bugs above: break in through PHP, plant a web shell, then use Fragnesia to take over the whole server.

If you haven't updated your kernel and rebooted since May, do it now. On Ubuntu the fixed kernels are 5.15.0-181 (22.04), 6.8.0-124 (24.04) and 7.0.0-22 (26.04) or newer. Check what is running:

uname -r

3. Linux kernel CVE-2026-98432: critical and reachable over the network

Published on 15 October and rated 9.8 out of 10, this is a race condition in how the kernel handles incoming IPv4 TCP connections. An attacker who sends carefully timed connection requests can crash the server or, according to Red Hat, potentially run code — no login needed. Since nearly every server accepts TCP connections (SSH, websites, databases), almost every Linux server is in scope. As of 30 October there are no confirmed attacks.

Where things stand:

• Debian 12 and 13: fixed (kernel 6.1.190-1 and 6.12.113-1). Update and reboot.
• Ubuntu 22.04, 24.04, 26.04: fix in progress — not released yet on 30 October.
• RHEL 8, 9, 10 (and so AlmaLinux and Rocky Linux): Red Hat says it is speeding up the fix.

Temporary protection until your kernel fix arrives

Red Hat published a firewall rule that drops incoming IPv4 TCP packets carrying "IP options" — something normal traffic practically never uses. It reduces the risk but does not fully remove it. Save this as cve-2026-98432.nft:

table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}

Then check and load it (on Ubuntu, install the nft tool first with sudo apt install nftables -y):

sudo nft --check --file cve-2026-98432.nft
sudo nft --file cve-2026-98432.nft
sudo nft list table inet cve_2026_98432

It works alongside UFW or firewalld. The rule disappears on reboot — so if you reboot before your fixed kernel is out, load it again. Once the fixed kernel is installed and running, remove it:

sudo nft delete table inet cve_2026_98432

How to update the Linux kernel

Ubuntu / Debian:

sudo apt update && sudo apt full-upgrade -y
ls /var/run/reboot-required && sudo reboot

AlmaLinux / Rocky:

sudo dnf upgrade -y
sudo reboot

A kernel update does nothing until you reboot. Take a snapshot first, then compare uname -r before and after. If you set up automatic security updates (step 7 of our Linux VPS security guide), packages are installed for you — but the reboot is still yours to do.

4. Windows Server: October Patch Tuesday

Microsoft's 13 October updates fixed more than 1,400 vulnerabilities — a record — including critical remote code execution flaws in the Windows DHCP Server and Active Directory. One of them, the Windows Shell flaw CVE-2026-96951, was already being used in attacks and is on CISA's exploited list.

On your Windows VPS, open Settings → Windows Update (or Server Manager → Local Server → Windows Update), install everything and restart. On Server Core, run sconfig and choose option 6. To see when updates were last installed, run this in PowerShell:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

If the newest entry is from before 13 October, you are missing the October update. The next Patch Tuesday is 10 November 2026.

Your checklist for this week

Not sure what your server runs, or want a second pair of eyes? Talk to our team on chat, ticket or phone — 24/7 in Hindi and English, real people. New server? Start with our guides to securing a Linux VPS, or pick a Linux VPS or Windows VPS with full root or Administrator access.

Sources: Ubuntu CVE-2026-98432, Debian security tracker, Red Hat RHSB-2026-016, Ubuntu CVE-2026-46300, PHP advisory GHSA-w8hw-w9fx-j79w, PHP advisory GHSA-6wmf-4rv5-p3rp, CISA Known Exploited Vulnerabilities catalog.