Ubuntu Security Updates, October 2026: PHP, Brotli, nginx, zlib, OpenVPN, and the Kernel

If you manage Ubuntu servers, the second half of October 2026 has been unusually busy. Between 13 and 27 October, Canonical published security notices for PHP, Brotli, nginx, zlib, OpenVPN, and the 24.04 kernel, several of them for flaws that can lead to remote code execution. Most of these packages sit on every web server we look after: nginx in front, PHP-FPM behind it, zlib under almost everything. The fix in every case is a standard apt upgrade, but the details that decide whether you are actually protected afterwards are easy to miss: Ubuntu's own version numbers, which processes keep running old libraries, and what happens on releases that have left standard support.

The Notices at a Glance

PHP: Ubuntu Version Numbers Are Not Upstream Version Numbers

USN-8948-1 fixes both PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which Ubuntu rates Critical. The part that confuses people is the version. Upstream PHP fixed these in 8.3.36, but Ubuntu 24.04 ships PHP 8.3.6 and backports security fixes into it. After patching, php -v still says 8.3.6. What changes is the package revision.

Check with dpkg -l 'php8.3*' and compare the revision, not the PHP version. If your servers use the ondrej/php repository instead, which is common on Laravel Forge and many custom setups, the rule is the opposite: those packages follow upstream, so you should see 8.3.36, 8.4.27, or 8.5.12. Either way, restart PHP-FPM and any long-running PHP CLI processes such as queue workers.

Brotli: The System Library Is Only Part of the Fix

USN-8956-1 updates brotli, libbrotli1, and python3-brotli for CVE-2026-111497, the bug the industry calls HTTP2Shell. The fixed versions are 1.1.0-2ubuntu0.1 on 24.04 and 1.0.9-2ubuntu0.1 on 22.04. This protects nginx when it uses Brotli through the system library, curl, and Python code that uses the distribution package.

It does not protect Node.js installed from NodeSource, nvm, or a Docker image, nor Python virtualenvs with their own Brotli wheel, because those carry a separate copy. For those you need Node.js v22.23.4 or v24.22.1 and Python Brotli 1.2.1. Our HTTP2Shell article covers the full list.

nginx: Five Fixes, Three of Them Serious

USN-8955-1 is the notice most web servers should act on first, because nginx faces the internet directly. It fixes five issues:

• CVE-2026-15176: configurations that combine alias with rewrite rules could be crashed by a remote attacker, possibly leading to code execution.
• CVE-2026-93479: map blocks using regular expressions were mishandled, with the same possible impact.
• CVE-2026-97205: asynchronous file I/O with Server Side Includes could crash nginx or possibly run code.
• CVE-2026-97629: with a shared SSL session cache and no explicit ticket key rotation, an attacker could forge sessions and bypass client certificate checks. This affects 24.04 and newer, and matters if you use mutual TLS.
• CVE-2026-95101: HTTP/3 with proxy_request_buffering could let an attacker inject data into proxied requests. Only 26.04 and 26.10 are affected.

The fixed versions are 1.24.0-2ubuntu7.19 on 24.04 and 1.18.0-6ubuntu14.22 on 22.04. map with regular expressions and alias with rewrites are both common in Laravel, WordPress, and reverse proxy configurations, so do not assume your setup is out of scope. If you installed nginx from nginx.org rather than from Ubuntu, this notice does not cover you; update from that repository instead.

zlib: A Small Library Used by Almost Everything

USN-8954-1 fixes CVE-2026-85091, a heap buffer overflow in how zlib handles certain non-blocking writes, which may allow code execution. It affects 24.04, 26.04, and 26.10; on 24.04 the fixed package is zlib1g 1:1.3.dfsg-3.1ubuntu2.3. zlib is linked into nginx, OpenSSH, Python, PHP, Git, and hundreds of other programs. Installing the package replaces the file on disk, but every process that loaded the old library keeps using it in memory until it restarts. This is the update where checking for stale processes matters most.

OpenVPN and the 24.04 Kernel

USN-8953-1 fixes OpenVPN's handling of certificate subject fields (CVE-2026-84790), which could let an authenticated user impersonate another. If you run an OpenVPN server for remote staff, update it and restart the openvpn service; the notice says so explicitly.

USN-8917-1 is the big one by volume: a kernel update for Ubuntu 24.04 referencing about 1,050 CVEs, spanning networking, file systems, BPF, KVM, and most drivers. The new generic kernel is 6.8.0-147, with matching cloud kernels for AWS, GCP, and Oracle; the Azure kernel got the same fixes in USN-8918-1 on the same day. Kernel fixes take effect only after a reboot. If the server cannot go down often, Livepatch from Ubuntu Pro applies critical kernel fixes without rebooting, but you still need to reboot into the new kernel eventually.

Ubuntu 20.04 and Older Need Ubuntu Pro

Ubuntu 20.04 left standard support in 2025. Fixes for it still exist, but only through Ubuntu Pro (ESM): the Brotli fix in USN-8956-2 is 1.0.7-6ubuntu0.1+esm1, and PHP 7.4 is fixed as 7.4.3-4ubuntu2.29+esm5. Without Pro, apt upgrade on a 20.04 server finds nothing, and the server stays vulnerable while looking up to date. Ubuntu Pro is free for personal use on up to five machines, and paid for business beyond that. Ubuntu 25.10, an interim release, is out of support entirely and gets no fixes. Run pro status to see where each server stands.

The Update Routine

1. 1Check the release and support status: lsb_release -a and pro status. Plan an upgrade for anything on 20.04 or older without Pro, and for any interim release.
2. 2See what is pending: sudo apt update, then apt list --upgradable. Check that php, nginx, zlib1g, libbrotli1, openvpn, and linux-image packages are on the list.
3. 3Install: sudo apt upgrade. On servers where a short gap is a problem, do it during low traffic, because nginx and PHP-FPM restart as part of the upgrade.
4. 4Restart what still uses old libraries: sudo needrestart, which is installed by default on Ubuntu Server 22.04 and 24.04. It lists services still running deleted library versions and offers to restart them. Do not forget queue workers, Supervisor programs, and cron jobs that run continuously.
5. 5Reboot if /var/run/reboot-required exists, which it will after the kernel update. After the reboot, uname -r should show 6.8.0-147 or newer on 24.04.
6. 6Verify: dpkg -l nginx zlib1g libbrotli1 'php8.*-fpm' and compare against the versions above.

To stop this from becoming a fire drill every month, enable unattended-upgrades for the security pocket. It is installed by default and applies security updates daily. It does not reboot by default and does not restart every affected service, so a weekly maintenance window for reboots and needrestart is still worth having. And remember that packages from third-party repositories, such as ondrej/php, nginx.org, NodeSource, or Docker, are not covered by Ubuntu security notices at all.