News
Company & Industry Updates
Announcements, technology updates, and industry news from Private DevOps LTD.
Showing 1-30 of 87 news items
Page 1 of 3
PostgreSQL 14 Reaches End of Life on November 12
PostgreSQL 14 gets its final update on Thursday, November 12, and no fixes after that. PostgreSQL 18 is supported until 2030, pg_upgrade makes the jump in one step, and Amazon RDS keeps 14 on standard support until February 28, 2027. Here is how to plan the move calmly.
Read more about PostgreSQL 14 Reaches End of Life on November 12Next.js November Security Release and Who Needs It
Next.js 16.4.5 and 15.5.29 shipped on November 3 with fixes for seven advisories, one rated High. Most of them only touch apps that use Cache Components, so many teams are not exposed at all. Here is how to tell in a few minutes, and how to upgrade.
Read more about Next.js November Security Release and Who Needs ItNode.js 26 LTS Adds a Modern Date API and Support to 2029
Node.js 26 became the long-term support release on October 28, with fixes until April 2029. It turns on the Temporal date API by default, and Node.js 24 stays supported until 2028, so the upgrade can be planned calmly. Here is what changes and how to move.
Read more about Node.js 26 LTS Adds a Modern Date API and Support to 2029Why GitLab 19.5.1 Is Worth Installing This Week
GitLab fixed a critical bug present in every release since 7.0 and shipped the fix for seven release lines, so most teams can patch without a major jump. GitLab.com is already covered. Here is how to check your version and upgrade in one step.
Read more about Why GitLab 19.5.1 Is Worth Installing This WeekA Magento Loader Hides From Scanners. One Query Finds It
Sansec found a loader in the CMS blocks of 953 stores, mostly Magento. It shows scanners a clean page and keeps its payload in shoppers' browsers. A short database query and two file checks show whether your store is one of them.
Read more about A Magento Loader Hides From Scanners. One Query Finds ItPHP's New Session Flaw Is Rare, and One Setting Covers It
CVE-2026-115560 is a rare PHP session flaw with no patch yet. Turning off session upload progress covers it, and many servers already did that this week.
Read more about PHP's New Session Flaw Is Rare, and One Setting Covers ItPHP Patches Two Unauthenticated RCEs, Worst on mod_php
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, two flaws that allow unauthenticated code execution, worst on mod_php. What changed, who is exposed, and what to do before the update lands.
Read more about PHP Patches Two Unauthenticated RCEs, Worst on mod_phpPHP Patches Two Critical Flaws on Wednesday. Prepare Today
The PHP security team will ship fixes for two critical vulnerabilities, both CVSS v4.0 9.2, on October 21 at 14:00 UTC. Details come with the release, so today is for finding every PHP you run and knowing where its update will come from.
Read more about PHP Patches Two Critical Flaws on Wednesday. Prepare TodayLeaked eMudhra CA Keys Mean Updates for Go, Python and Linux
The private keys of eight eMudhra intermediate CAs leaked. Chrome and Firefox blocked them within hours on October 17, but Go programs, Python's certifi and Linux CA bundles need updates of their own, and Node.js is still waiting on a fix.
Read more about Leaked eMudhra CA Keys Mean Updates for Go, Python and LinuxNode.js Security Fixes Land October 21. Plan the Update
Node.js will ship security releases for the 22.x, 24.x and 26.x lines on or shortly after October 21, with HIGH as the top severity on each. Nothing else is public yet, so the useful step this week is booking the time to roll the update out.
Read more about Node.js Security Fixes Land October 21. Plan the UpdateLet's Encrypt Moves to 64-Day Certificates in February
From February 10, 2027, Let's Encrypt issues 64-day certificates by default, and its staging environment already switched on October 14. Automated renewals keep working, but scripts with a hardcoded 60, 80 or 83 days need a look.
Read more about Let's Encrypt Moves to 64-Day Certificates in FebruaryAWS Lambda Can Now Answer HTTP Directly With Web Functions
AWS has added Lambda Web Functions, where your code runs its own HTTP server and one warm environment serves several requests at once. Only Node.js is supported for now, in five Regions, and existing functions are being renamed Event Functions.
Read more about AWS Lambda Can Now Answer HTTP Directly With Web FunctionsUbuntu 26.10 Removes SysV Init Script Support. Check Yours
Ubuntu 26.10 shipped on October 15 with systemd 261.3, which no longer runs old SysV init scripts. It also completes the move to Rust coreutils and changes several server defaults, so it is worth a read before the next LTS.
Read more about Ubuntu 26.10 Removes SysV Init Script Support. Check YoursMagento October Update Closes an Unauthenticated RCE
Adobe's October 13 bulletin APSB26-153 fixes 11 flaws in Adobe Commerce and Magento Open Source, led by a CVSS 10 template flaw that runs code without a login. Nothing is exploited yet, and Magento Open Source 2.4.6 gets no fix.
Read more about Magento October Update Closes an Unauthenticated RCECloudflare Workers on Your Own Servers, With Deno's Help
The Deno team, led by Node.js creator Ryan Dahl, is joining Cloudflare to make workerd, the open source Workers runtime, a supported way to run Workers and Durable Objects on your own servers. Deno Deploy users have six months to move.
Read more about Cloudflare Workers on Your Own Servers, With Deno's HelpPlanning a DigitalOcean Database? Read This Before Oct 15
From October 15, new DigitalOcean accounts can no longer create Standard Edition PostgreSQL or MySQL clusters above 4 GiB of RAM or with standby nodes, and from November 30 the same applies to every account. Existing clusters keep everything.
Read more about Planning a DigitalOcean Database? Read This Before Oct 15Hetzner Adds CPX02, a 1 GB Cloud Server for Small Sites
Hetzner added the CPX02 on October 6, a Regular Performance cloud server with 1 vCPU, 1 GB of RAM and 20 GB of NVMe for static sites, blogs and small single apps. On October 12 it was listed as currently unavailable, like the rest of the CPX line.
Read more about Hetzner Adds CPX02, a 1 GB Cloud Server for Small SitesGitHub Trains a Model to Catch Leaked Secrets
Since October 7, GitHub's AI-detected secret alerts run on a new model trained to spot credentials with no recognizable format, such as plain passwords in config files. It is included with Secret Protection and Advanced Security, and push protection is in preview.
Read more about GitHub Trains a Model to Catch Leaked SecretsOne Line in Laravel 13.35 Stops Duplicate Scheduled Jobs
Scale a Laravel app to three servers and every scheduled task can run three times, from the morning report to the billing run. Laravel 13.35, released October 6, 2026, adds one setting that keeps every task on a single server, plus gentler deploys for long jobs.
Read more about One Line in Laravel 13.35 Stops Duplicate Scheduled JobsThe DNS Root Key Changes on October 11. Is Your Server Ready?
On October 11, 2026 the DNS root starts signing with a new key-signing key, KSK-2024, for only the second time ever. Most sites need to do nothing. A server that validates DNSSEC through its own resolver must already trust the new key, and a one-minute check tells you.
Read more about The DNS Root Key Changes on October 11. Is Your Server Ready?WordPress 7.1.3 Fixes a Stored XSS in the Comments Screen
WordPress 7.1.3, released October 6, 2026, fixes seven security issues, among them a stored XSS on the Comments screen that a pending comment can trigger. Most sites update themselves, but sites that cannot write their own files need a manual update.
Read more about WordPress 7.1.3 Fixes a Stored XSS in the Comments ScreenNext.js 16.4 Shrinks the Turbopack Cache by Up to a Quarter
Next.js 16.4, released October 6, 2026, cuts the Turbopack disk cache by 20 to 25 percent, trims production bundles and ships React 19.3. It also makes Cache Components the default for new apps, ahead of Next.js 17 making it the default everywhere.
Read more about Next.js 16.4 Shrinks the Turbopack Cache by Up to a QuarterCloudflare Makes Threat Intelligence Free for Every Account
Cloudflare now gives every account Threat Signals, which turns a security RSS feed into tagged indicators, plus access to its Threat Events platform. The free tier covers one feed and 30 days of data, and turning indicators into WAF rules stays on enterprise plans.
Read more about Cloudflare Makes Threat Intelligence Free for Every AccountEmDash 1.0 Is Out. Should a WordPress Site Move to It?
Cloudflare released EmDash 1.0, an open source CMS on Astro that it calls a spiritual successor to WordPress, with plugins that run in a sandbox. It imports WordPress content but not themes or PHP plugins, so it suits some sites today and not others.
Read more about EmDash 1.0 Is Out. Should a WordPress Site Move to It?GitHub Retires SHA-1 SSH, and Old Git Clients Feel It First
GitHub will stop accepting SHA-1 RSA signatures and one old key exchange over SSH, with brownouts on November 4 and December 9. HTTPS remotes are untouched and any OpenSSH from the last ten years already copes. The risk sits in tools that carry their own SSH code.
Read more about GitHub Retires SHA-1 SSH, and Old Git Clients Feel It FirstNext.js 16.3.6 Patches an RCE in next/og ImageResponse
Next.js 16.3.6 fixes a critical remote code execution bug in next/og ImageResponse. One thing your OG routes do decides whether you were exposed, and two days after release npm audit still had no record of it.
Read more about Next.js 16.3.6 Patches an RCE in next/og ImageResponseGitLab Fixes Two 9.9 RCEs Any Signed-In User Can Trigger
GitLab 19.4.1, 19.3.3 and 19.2.7 fix eleven security issues. In the two rated 9.9, any signed-in user can run code on the server with a crafted regular expression in a CI/CD configuration. GitLab.com is already patched.
Read more about GitLab Fixes Two 9.9 RCEs Any Signed-In User Can TriggerHetzner IP Space Hijacked to Poison a Virtualizor Update
For 33 hours across 28 to 30 August, an unauthorized announcement diverted traffic bound for the Virtualizor update servers, and the attacker obtained a genuine TLS certificate for it. If you run Virtualizor, there is one file to check first.
Read more about Hetzner IP Space Hijacked to Poison a Virtualizor UpdateOVHcloud Prices Rise on 1 October, at Your Renewal Date
Headlines say 87 percent. OVHcloud's own tables say up to 158 on servers and 652 on memory. What rises, what does not, and why 1 October matters.
Read more about OVHcloud Prices Rise on 1 October, at Your Renewal DatecPanel and Plesk Both Patched a Root Escalation the Same Day
On August 27 both control panels shipped a fix for a customer account becoming root. They read as the same bug and they are not. One needs nothing but a normal hosting account, the other needs shell access and can be blocked without patching.
Read more about cPanel and Plesk Both Patched a Root Escalation the Same Day