Debian Security, Late Oct 2026: 12 DSAs Servers Should Apply

I was going through debian-security-announce posts from 22 Oct. to 3 Nov. 2026 and noticed how frequently advisories were coming out, so I picked out the server-related packages, leaving out desktop programs (chromium, firefox, thunderbird, eog, vim, tor) and DSAs I had not reviewed in detail, such as erlang, openjdk-21/25, python-git, dpdk, libheif, git-annex and incus. If you use any of these, check debian-security-announce yourself. This note is a summary table with comments on which updates need attention soon and which can wait for the regular update cycle. All the information comes from Debian DSA pages that I read myself.

What happened

This table is ordered by relevance to server administrators, not by date. The "Fixed version" column lists the Debian 13 (trixie) version given in each advisory.

None of these DSAs includes a CVSS score, and I have not checked NVD for every entry, so I am not assigning any scores here. The order in the table is my own assessment.

Severity

Debian DSAs do not include scores, but their descriptions identify the types of impact, which gives me enough to prioritize them.

• Advisories that mention possible code execution brotli (DoS or possibly arbitrary code execution), valkey (DoS, with possible code execution in some cases), ImageMagick (DoS, information disclosure or possible code execution when processing malformed images) and wordpress (the advisory lists DoS, XSS, SQL injection and RCE, but does not say which issue causes which impact)
• Primarily DoS pdns (invalid compression pointers cause DoS) and php-mongodb (DoS in the driver)
• Bypassing protections squid (request smuggling, buffer overflow and FTP command injection under specific conditions), varnish (cache poisoning or authentication bypass)
• Issues outside the usual vulnerability pattern nss removes CAs, while aide concerns local users evading detection

None of the DSAs itself says that exploitation has occurred, but I compared the CVEs in every DSA against the CISA KEV file released on 3 Nov. 2026 and found two entries: brotli's CVE-2026-111497 (DSA-6582-1), added to KEV on 27 Oct. with a remediation deadline of 10 Nov., and WordPress's CVE-2026-119977, which Debian's tracker links to DSA-6596-1, added to KEV on 3 Nov. with a remediation deadline of 6 Nov. The rest are not in KEV.

Details by group

DNS (unbound, pdns) unbound has 5 issues. Two involve DNSSEC (CVE-2026-35501, where an NSEC record can bypass an island trust anchor under an unsigned parent, and CVE-2026-50106, which produces an unsigned NXDOMAIN response). One involves following chains of name pointers during decompression, slowing down the service (CVE-2026-96405). One is a use-after-free in DNS-over-QUIC during path migration on multithreaded systems (CVE-2026-97206). The last is a cache side-channel through unwanted-reply-threshold that allows cache poisoning (CVE-2026-109125). The pdns fix addresses packet parsing with invalid compression pointers that causes DoS (CVE-2026-73206). Resolvers and authoritative DNS servers are often exposed to external traffic, so I put them near the top.

Intermediaries and caches (squid, varnish, valkey) varnish has 2 issues. CVE-2026-34475 concerns parsing HTTP/1.1 absolute-form request targets. If the URL is forwarded to the backend without validation and the backend accepts absolute-form, this can poison the cache or bypass authentication. CVE-2026-93894 is a buffer overflow in VCL's .upper() and .lower(). It requires a configuration that uses these functions on attacker-controlled strings. The result is a worker crash and restart. squid has 3 issues according to the advisory (request smuggling, buffer overflow and FTP command injection), but the advisory does not break down the details. valkey's 7 CVEs are not described individually either; they cause DoS, with possible code execution in some cases.

Libraries and CAs (brotli, nss, imagemagick, php-mongodb) The ImageMagick advisory does not describe its 36 CVEs individually, only saying that they occur when processing malformed images. If you let users upload images and then call ImageMagick (through PHP, convert or a CMS plugin), update it first. The nss update does not address a CVE; it removes 3 certificates: eMudhra emSign Root CA - G3, eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3, because eMudhra's intermediate CA was reported compromised (the advisory says intermediate, but the removed certificates have Root in their names, so the wording is slightly inconsistent). I infer that certificates chaining to these CAs will no longer pass validation in programs using NSS. Anyone without services depending on these CAs will be unaffected.

Others (wordpress, aide, linux) wordpress installed through apt gets 6.8.12+dfsg1-0+deb13u1 under DSA-6596-1. The mailing list advisory lists only one CVE number, CVE-2026-66666, despite describing multiple vulnerabilities. However, Debian's tracker also links CVE-2026-119977 (RCE during an upgrade, listed in KEV) to DSA-6596-1 and marks it as fixed in 6.8.12+dfsg1-0+deb13u1. For bookworm (6.1.9+dfsg1-0+deb12u1), the tracker marks both as vulnerable. Debian's own two sources disagree, so I follow the tracker and treat this version as covering both, but if you use WordPress through apt, check the version actually installed. Websites with WordPress installed independently of apt are outside this package's scope and need to update using WordPress's own releases. For CVE-2026-119977, read the separate article WordPress core vulnerability during updates. aide fixes 2 vulnerabilities that allow local users to evade file detection; neither has a CVE number yet. linux (DSA-6602-1) fixes privilege escalation, DoS and information disclosure. The CVE list is too long for me to go through individually. Anyone paying particular attention to the kernel can read more in the kernel article.

How to update

1. Check pending updates first with apt list, filtering for the packages in the table
2. Update the whole system with full-upgrade because a new kernel version is installed as a new package
3. Check which services need restarting with needrestart
4. Reboot if the kernel changed then check the running version
5. Check that unattended-upgrades actually works rather than merely being installed

sudo apt update
apt list --upgradable 2>/dev/null | grep -E '^(unbound|libunbound|libbrotli|brotli|pdns|valkey|varnish|imagemagick|libmagick|libnss3|nss|wordpress|php-mongodb|squid|linux-image|aide)'

sudo apt full-upgrade
sudo needrestart -r l      # แสดงบริการที่ต้องรีสตาร์ต (ยังไม่รีสตาร์ตให้)
sudo needrestart -k        # เช็กว่าเคอร์เนลที่รันอยู่ตรงกับที่ติดตั้งไหม

Restart only the services present on your machine. The example below includes commonly used service names; adjust them to match what you have installed.

sudo systemctl restart unbound squid varnish

Check that the installed versions match those listed in the DSAs.

dpkg-query -W -f='${Package} ${Version}\n' unbound squid varnish aide 2>/dev/null
uname -r
dpkg -l 'linux-image-*' | grep '^ii'

For unattended-upgrades, if you have configured it, check that it actually sees the security source and that automatic reboots are configured the way you want, because the new kernel has no effect without a reboot.

cat /etc/apt/apt.conf.d/20auto-upgrades
sudo unattended-upgrade --dry-run -d 2>&1 | tail -20
tail -30 /var/log/unattended-upgrades/unattended-upgrades.log

Check whether you have been compromised

The DSAs provide no indicators of compromise for the vulnerabilities in this batch. You can only check whether all updates have been applied and look at the behavior of externally exposed services, such as a resolver or proxy crashing and restarting unusually often (consistent with DoS), or repeated varnish worker crashes, which you can inspect with journalctl -u varnish --since "7 days ago".

If you use ImageMagick to handle user-submitted images, I also recommend checking ImageMagick's policy.xml to see whether you have restricted file types you do not need. This is my own general hardening advice, not a recommendation from the DSA.

Personally, if I had to prioritize, I would start with the KEV entries: brotli and WordPress installed through apt. Next would be the kernel and ImageMagick (the kernel because the list is long and it requires a reboot, so schedule a window; ImageMagick if it processes images from outside users), followed by externally exposed resolvers and proxies. The rest can go into the regular update cycle. There is no need to get too worked up about nss or aide if you do not depend on them. All of this depends on staffing and the size of the systems you manage.

P.S. If you are still on Debian 12, do not assume you are unaffected just because the DSA does not mention it. In the Roundcube case I investigated separately, the tracker still marks bookworm as vulnerable. There is also DSA-6607-1 for apt itself, released on 4 Nov. 2026 (CVE-2026-109518, where an attacker in the middle can replace a package after signature verification and execute code as root, fixed in apt 3.0.4 on trixie), which falls outside the table's date range. If you are already running apt update, you will get it along with full-upgrade.

Sources: Debian Security Advisories (lists.debian.org/debian-security-announce/2026, messages msg00494, 00495, 00497, 00498, 00502, 00504, 00506, 00508, 00512, 00515, 00518, 00521, 00525, 00526), Debian Security Tracker (security-tracker.debian.org/tracker), CISA Known Exploited Vulnerabilities Catalog (cisa.gov/known-exploited-vulnerabilities-catalog), Debian LTS security (debian.org/lts/security). Information current as of 5 Nov. 2026. If Debian releases more DSAs or revises the advisories, I will come back and update this.