A critical vulnerability has been identified in React Server Components. Under specific, rare conditions, unauthenticated attackers may execute code within an affected server-side application.

Please check whether you run applications using React Server Components or Next.js on your KVM or dedicated server, and forward this notice to your administrator or development agency where appropriate. Exposure depends on the application's version and configuration. Client-only React applications without React Server Components are not affected by this vulnerability.

This is particularly relevant to self-hosted Next.js websites, online stores and customer portals. Systems built on Next.js, such as Payload CMS, should also have their dependencies checked.

What should you do?

• Next.js: The vendor lists versions 16.0.0 through 16.4.0 as affected when using App Router, Cache Components and “use cache” functions returning multiple typed arrays. Update immediately to at least 16.4.1 or a newer patched version. The vendor recommends upgrading even without such functions. Security update 15.5.28 is available for the 15.5 release line.

• Other applications using React Server Components: Update react-server-dom-webpack, react-server-dom-turbopack or react-server-dom-parcel to at least 19.0.9, 19.1.10, 19.2.9 or 19.3.1 within the respective release line, or to a newer patched framework version.

• Rebuild and redeploy your application after updating. Then verify the version actually running, including in containers. For Next.js, updating the “react” package alone is insufficient; the “next” package must be updated.

If you are unsure or we manage your server, please contact support@smart-weblications.de so we can agree on the necessary action.

This is a precautionary security notice and does not indicate that an attack on your server has been identified.

Further information:
https://radar.cloudflare.com/security/zero-wire/rsc-typed-array-rce
https://nextjs.org/blog/nextjs-security-update-october-14-2026
https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3

A Linux kernel vulnerability, CVE-2026-98432, has been published in IPv4/TCP processing. Specially crafted network connections may cause affected systems to crash.

Please update the Linux kernel on your self-managed KVM or dedicated server promptly. Install the security updates provided by your distribution and reboot the server during a planned maintenance window so the updated kernel becomes active. Then verify the running kernel and your system’s security status.

If your distribution has not yet provided a fixed package, or if you need assistance, contact support@smart-weblications.de.

Further information: https://access.redhat.com/security/cve/cve-2026-98432

We have completed the protective measures against PwnEscape and PHP2Shell for all customers within our managed service scope.

Through security updates and additional hardening measures, we have secured the affected environments within our area of responsibility. Our customers benefit from actively maintained services and our technical support in implementing the necessary protective measures.

Ongoing security maintenance and the assessment of new security advisories remain an integral part of our service.

If you administer your virtual server yourself, please continue to keep its guest operating system and installed applications up to date. Measures on our platform do not replace the updates required inside your server. If you have questions about responsibilities or need assistance, our support team will be happy to help.

We have expanded and optimized our monitoring infrastructure to ensure maximum availability and fast response times. By successfully implementing a high-availability system for Grafana, we have established a robust failover setup that prevents any interruptions even in the event of server failures. The configuration of data sources, dashboards, and alerting systems has been carefully aligned, enabling customers to gain comprehensive insights into their system performance. Additionally, monitoring exporters such as node_exporter and dcgm-exporter have been deployed on high-performance systems equipped with NVIDIA GPUs. These enable precise measurements of hardware and software performance, even under complex workloads. The integration of Ceph and NVIDIA-DCGM dashboards ensures transparent monitoring of critical system components. Our customers benefit from a stable and reliable monitoring solution that enables immediate alerting in case of anomalies. Automated notifications via Telegram allow potential issues to be detected and resolved quickly, further enhancing operational security. With this improvement, we reaffirm our commitment to the highest service quality and provide our customers with a future-proof foundation for their IT infrastructure.

Our cloud infrastructure has received a significant performance boost: we have strategically expanded GPU capacity and successfully integrated the newer Qwen3-VL-30B-AWQ model into our LocalAI-Bridge. This powerful multimodal model is now accessible to customers via the customer portal—ideal for demanding use cases such as document analysis or visual question-answering systems. Additionally, we have improved the routing system for model requests, ensuring that custom alias names are now correctly resolved and visible in the API response. This enhances predictability and integration depth in automated workflows. The overall stability of the AI backend has been further increased through targeted preloading and optimized concurrency configurations. All changes are running in the background without downtime—your applications immediately benefit from greater model diversity, shorter load times, and more precise response prioritization. We continue to think ahead: your innovation, our infrastructure.