Linux server software security incidents and patch status

Today's specials

The fix exists. Somebody has to carry it.

ProFTPD16 d Improper Access Control 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-10-08)KEV overdue 13dcritical severity
Fixed in 1.3.5a Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 16 days KEV ✓ Record ✓ Vendor ✓
ISC BIND16 d Data Processing Errors 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-10-08)KEV overdue 13dhigh severity
Fixed in 9.10.2-P3, 9.9.7-P2 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 16 days KEV ✓ Record ✓ Vendor ✓
jxrlib4 h Heap buffer overflow unknown severity
Fixed in mircomir/jxrlib 1.4.4 Advisory
Re-scored 24 Oct ~~high~~ → unknown KEV – Record – Vendor –

Worst week: 5 Oct 2026, 2 new spills.

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.