kalfaoglu.net blog

On 21 October 2026, the PHP security team shipped patches for two critical remote code execution vulnerabilities, collectively dubbed PHP2Shell by the researcher who found the exploit chain, Kirill Firsov. Both flaws carry a CVSSv4.0 score of 9.2. Both are exploitable before any application code runs, with no authentication required. If your server runs PHP to handle web requests — and it almost certainly does — patch now. What is actually broken CVE-2026-109618 — OOM Corruption ...

If you run MariaDB or Dovecot — and if you host anything resembling a mail server backed by a database, you almost certainly do — there are security advisories from the past few weeks that should already be applied. If they are not, this is your reminder. MariaDB: Four CVEs, One with Potential Remote Code Execution On September 7, 2026, MariaDB published advisories covering four CVEs affecting every major supported branch. None are rated Critical, but three score in the 8.0–8.5 High range, which is close enough to warrant attention. ...

Dovecot’s security page quietly listed a new high-severity advisory on August 28, 2026. The major Linux distributions took about six weeks to ship patched packages, and Red Hat’s advisory for RHEL 10 landed on October 8, 2026. If you run Dovecot against a MySQL or MariaDB backend and haven’t updated recently, read on. What the Bug Is CVE-2026-40018 is an SQL injection flaw (CWE-89) in Dovecot’s MySQL driver. The escaping function that sanitizes SQL query parameters falls back to a charset-unaware escape call when the SQL connection drops and reconnects under specific multi-byte character sequences. An attacker who can supply crafted input at the right moment — say, through a malformed username or password string — can break out of the expected SQL context and either read sensitive data or modify it. ...

A website can be healthy while somebody’s DNS resolver refuses to find it. Before moving hosting, changing nameservers, or blaming the last person who touched the firewall, check where the lookup is failing. IANA confirmed that the DNS root zone began using its new Key Signing Key on October 11, 2026. Most users are not expected to notice disruption. DNSSEC-validating resolvers that have not learned to trust the new key, however, may encounter validation failures. This is a maintenance event with a specific technical dependency, not evidence that the Internet has collectively broken. ...

An email filter should spend its time judging messages, not falling over while reading them. Rspamd’s latest patch is a reminder that the machinery around spam scoring deserves attention too. The official release index dates Rspamd 4.2.1 to October 1, 2026. That makes it fresh news for this week’s maintenance list. Our earlier article covered 4.1.0; this update has a different practical angle: check the filter’s health and configuration, rather than reaching immediately for more permissive spam thresholds. ...

A hosting control panel is supposed to save administrators time. Giving somebody else your administrative powers is a rather excessive interpretation of that brief. On September 29, cPanel published three advisories worth putting on your maintenance list. They concern the Multilang adminbin, WHM account modification, and WHM SSL management. The practical lesson: check the installed build, apply the relevant update, and record the result. “Automatic updates are enabled” is a setting, not evidence that an update succeeded. ...

If your server runs cPanel with ConfigServer Firewall (CSF), drop what you’re doing and check your CSF version. On September 3, 2026, cPanel pushed a critical patch for CVE-2026-67402 — a remote code execution vulnerability in CSF’s Messenger service that lets an unauthenticated attacker run arbitrary commands as the Apache user. That’s a bad sentence to read about a piece of software whose entire job is to protect your server. What Is CSF, and Why Did cPanel Inherit It? ConfigServer Security & Firewall has been a staple of cPanel/WHM setups for years — it’s the iptables-based firewall layer that handles port blocking, login failure detection, and email alerts. The original developer discontinued it on August 31, 2025 and released the code as open-source under GPLv3. cPanel (now WebPros) stepped in on February 25, 2026 and forked it, taking over security maintenance. ...

On August 27, 2026, cPanel pushed an unscheduled security update and sent a customer notification that most people probably skimmed past. They shouldn’t have. The flaw, assigned CVE-2026-65643, lets any authenticated cPanel account that has permission to add parked or addon domains create arbitrary files on the underlying server — which in practice means full root-level code execution. That’s not a privilege escalation hidden behind multiple hoops. That’s a regular shared hosting customer owning the machine. ...

On August 10, 2026, Wietse Venema released Postfix 3.11.6, along with coordinated updates for six legacy branches: 3.10.13, 3.9.14, 3.8.20, 3.7.22, 3.6.20, and 3.5.27. If you run mail on Linux, you almost certainly run Postfix. You should update. The release is unusual for two reasons: the scope of what was found, and how it was found. How the bugs were discovered Qualys, working with Anthropic’s Claude Mythos Preview, and separately OpenAI Security, ran an AI-assisted audit of the Postfix codebase — over 150,000 lines of C accumulated across nearly three decades of single-developer maintenance. The results were, to put it charitably, humbling. More than half of the discovered defects date from 20 or more years ago. The oldest traces back to before Postfix’s first public alpha release in April 1997. ...

On July 22, Qualys published a Linux kernel advisory that anyone running shared hosting on a RHEL-family system should read before doing anything else: CVE-2026-64600, nicknamed RefluXFS. It is a local privilege escalation to root in the Linux kernel’s XFS filesystem, and the proof-of-concept Qualys published strips the root password from /etc/passwd in seconds — starting from an ordinary, unprivileged local account. The vulnerability has been sitting in the kernel since version 4.11, released in 2017. Nine years of shared hosting servers, VPS instances, and cloud nodes, quietly exposed. ...