On 12 Nov 2026 the PostgreSQL project released security updates that fix a high-severity vulnerability (CVE-2026-116328, CVSS 8.8).

What is this about?

An integer overflow in PostgreSQL generation memory contexts can allow an authenticated database user to execute arbitrary code with the privileges of the database operating-system user (Remote Code Execution). The flaw occurs when freeing memory blocks larger than 1 GB. An attack requires only a valid low-privilege database login and network access to the database; no user interaction is needed.

When is a system affected?

Affected are the PostgreSQL major versions 16, 17 and 18 before the fixed releases:
• PostgreSQL 16: fixed in 16.16
• PostgreSQL 17: fixed in 17.12
• PostgreSQL 18: fixed in 18.7
Older versions (15 and earlier) are not affected.

Our own managed systems

We reviewed our infrastructure immediately. The affected PostgreSQL instances are reachable only internally (no externally published database port) and are being updated to the fixed releases as part of regular maintenance. There is no direct access from the internet.

Recommended action for self-managed KVM and Dedicated Server customers

If you run PostgreSQL 16, 17 or 18 on your self-managed KVM or Dedicated Server, we strongly recommend updating to a fixed release (16.16 / 17.12 / 18.7 or newer). Check your installed version with "psql --version" or "SELECT version();". A minor update within the same major version requires no data migration — updating the package or container image and restarting the service is sufficient. Please take a backup beforehand.

To reduce risk until the update, we recommend restricting database access to trusted hosts and not exposing database ports publicly.

If you have any questions or require assistance updating your server, please contact support@smart-weblications.de.

Further information:
https://www.postgresql.org/support/security/CVE-2026-116328/
https://cve.now/CVE-2026-116328

The Apache Software Foundation has released Apache HTTP Server 2.4.71, addressing three security vulnerabilities — including a critical flaw in the HTTP/2 module (mod_http2).

Summary of resolved vulnerabilities:

• CVE-2026-119618 (Critical — Heap Corruption & Remote Code Execution in mod_http2): Improper synchronization (race condition) in assign_headers() within mod_http2 when processing concurrent HTTP/2 requests can lead to heap corruption and unauthenticated Remote Code Execution (RCE).
• CVE-2026-106023 (Important — Denial of Service in mod_md): A NULL pointer dereference in mod_md can cause worker child processes to crash (affects Apache 2.4.30 through 2.4.70).
• CVE-2026-109163 (Low — 1-Byte Stack Buffer Overwrite in mod_vhost_alias): An off-by-one stack buffer overwrite in mod_vhost_alias (affects Apache 2.4.69 through 2.4.70).

When is a system affected by CVE-2026-119618?

A server is only vulnerable to CVE-2026-119618 if all of the following conditions apply:
1. It runs Apache HTTP Server 2.4.55 through 2.4.70 (or mod_h2 versions 2.0.8 through 2.0.42). Note for Ubuntu users: Because Ubuntu backported newer mod_h2 releases into earlier updates, Ubuntu 20.04 LTS, 22.04 LTS, and 24.04 LTS packages are also affected.
2. The mod_http2 module is loaded.
3. HTTP/2 (h2 or h2c) is enabled via the Protocols directive. Servers serving only HTTP/1.1 are not affected by CVE-2026-119618.

Recommended action for self-managed KVM & Dedicated Server customers:

If you run Apache HTTP Server on your self-managed KVM or Dedicated Server, please install your distribution's latest security updates and restart the apache2 / httpd service promptly:

• Debian 12 (Bookworm): 2.4.71-1~deb12u1 (DLA-4902-1)
• Debian 13 (Trixie): 2.4.71-1~deb13u1 (DSA-6620-1)
• Ubuntu 24.04 LTS: 2.4.58-1ubuntu8.19 (USN-9090-1)
• Ubuntu 22.04 LTS: 2.4.52-1ubuntu4.27 (USN-9090-1)
• Ubuntu 20.04 LTS (ESM): 2.4.41-4ubuntu3.23+esm11 (USN-9090-1)
• RHEL / AlmaLinux / Rocky Linux 10: mod_http2-2.0.29-5.el10_3.1 (ALSA-2026:98978)
• Upstream / Source builds: Upgrade to Apache HTTP Server 2.4.71 (or mod_h2 >= 2.0.43)

Temporary workaround (if an immediate upgrade is not possible): Disable the HTTP/2 module (a2dismod http2 && systemctl reload apache2) or remove h2 and h2c from all Protocols directives in your Apache configuration.

If you have any questions or require assistance updating your server, please contact support@smart-weblications.de.

Further information:
https://httpd.apache.org/security/vulnerabilities_24.html
https://cve.now/CVE-2026-119618

A critical vulnerability has been identified in React Server Components. Under specific, rare conditions, unauthenticated attackers may execute code within an affected server-side application.

Please check whether you run applications using React Server Components or Next.js on your KVM or dedicated server, and forward this notice to your administrator or development agency where appropriate. Exposure depends on the application's version and configuration. Client-only React applications without React Server Components are not affected by this vulnerability.

This is particularly relevant to self-hosted Next.js websites, online stores and customer portals. Systems built on Next.js, such as Payload CMS, should also have their dependencies checked.

What should you do?

• Next.js: The vendor lists versions 16.0.0 through 16.4.0 as affected when using App Router, Cache Components and “use cache” functions returning multiple typed arrays. Update immediately to at least 16.4.1 or a newer patched version. The vendor recommends upgrading even without such functions. Security update 15.5.28 is available for the 15.5 release line.

• Other applications using React Server Components: Update react-server-dom-webpack, react-server-dom-turbopack or react-server-dom-parcel to at least 19.0.9, 19.1.10, 19.2.9 or 19.3.1 within the respective release line, or to a newer patched framework version.

• Rebuild and redeploy your application after updating. Then verify the version actually running, including in containers. For Next.js, updating the “react” package alone is insufficient; the “next” package must be updated.

If you are unsure or we manage your server, please contact support@smart-weblications.de so we can agree on the necessary action.

This is a precautionary security notice and does not indicate that an attack on your server has been identified.

Further information:
https://radar.cloudflare.com/security/zero-wire/rsc-typed-array-rce
https://nextjs.org/blog/nextjs-security-update-october-14-2026
https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3

A Linux kernel vulnerability, CVE-2026-98432, has been published in IPv4/TCP processing. Specially crafted network connections may cause affected systems to crash.

Please update the Linux kernel on your self-managed KVM or dedicated server promptly. Install the security updates provided by your distribution and reboot the server during a planned maintenance window so the updated kernel becomes active. Then verify the running kernel and your system’s security status.

If your distribution has not yet provided a fixed package, or if you need assistance, contact support@smart-weblications.de.

Further information: https://access.redhat.com/security/cve/cve-2026-98432

We have completed the protective measures against PwnEscape and PHP2Shell for all customers within our managed service scope.

Through security updates and additional hardening measures, we have secured the affected environments within our area of responsibility. Our customers benefit from actively maintained services and our technical support in implementing the necessary protective measures.

Ongoing security maintenance and the assessment of new security advisories remain an integral part of our service.

If you administer your virtual server yourself, please continue to keep its guest operating system and installed applications up to date. Measures on our platform do not replace the updates required inside your server. If you have questions about responsibilities or need assistance, our support team will be happy to help.