Server administration

The mastodon.energy server administrator says no new users have contributed to server costs since July, despite ongoing fundraising that began in 2024, jokingly suggesting the instance might sell tote bags or t-shirts to close the gap. Six regular donors are thanked for keeping the climate-focused Mastodon server running, and the admin's appeal highlights the broader financial strain on volunteer-run social media instances.

Nvidia has released a fix for a high-severity vulnerability, tracked as CVE-2026-47483, that could crash GPU monitoring software on servers exposed to the network. Security outlets are covering the flaw and urging administrators running GPU workloads on public-facing servers to apply the patch promptly to avoid monitoring outages.

The OpenSSH project has released version 10.6, updating its widely used secure shell software for encrypted remote access. The release notes are published on the official OpenSSH site. Developers and system administrators are discussing the update, as OpenSSH runs on most servers and new releases typically bring security hardening and bug fixes that teams need to apply quickly.

The OpenSSH project has released version 10.6, the widely used secure shell tool for encrypted remote logins. The release was announced via the OpenBSD community's Undeadly news site and is being shared among system administrators and security professionals, who track OpenSSH updates closely because the software is deployed on millions of servers worldwide.

The OpenSSL project has released version 4.0.3, another security patch release addressing vulnerabilities in the widely used encryption library. The news is spreading through the free and open source software community, where users are being urged to update their systems promptly. As OpenSSL underpins encrypted connections across much of the internet, admins of Linux servers and other deployments are expected to apply the patch quickly.

CISA has added five actively exploited vulnerabilities in widely used self-hosted server software to its Known Exploited Vulnerabilities catalog: BIND, ProFTPD, Apache Struts, ONLYOFFICE and Strapi. Some of the flaws date back to 2015, and China-linked scanning activity is reported to be hitting them at scale. US federal agencies must apply fixes by October 11. Security practitioners are urging self-hosters to patch quickly.

Veeam has released security updates for Backup & Replication version 12, fixing four vulnerabilities. The most serious, tracked as CVE-2025-64393, is a critical remote code execution flaw that could let low-privileged users take control of the backup server. Security professionals are urging administrators to apply the patches quickly, since backup infrastructure is a frequent target in ransomware attacks.

A new write-up by Rainer Sadowski covers recent changes to OpenBSD's httpd web server and relayd load balancer, with a focus on header handling. The post walks through what has been updated in the two lightweight daemons and what administrators should know when running them. Discussion is drawing interest from the sysadmin and web development community.

A medium-severity vulnerability, tracked as EUVD-2026-95523 with a CVSS score of 7.1, has been disclosed in Progress Software's Telerik Report Server. The flaw stems from incorrect privilege assignment in the service-agent SignalR hub and affects all versions prior to 12.2.26.1007. Users are advised to update their installations to the patched release to close the gap.

A new vulnerability, EUVD-2026-95524, has been catalogued affecting Progress Software's Telerik Report Server. Versions prior to 12.2.26.1007 contain a stored cross-site scripting flaw in the shared reporting engine, rated 8.9 out of 10 on the CVSS v3.1 scale. Administrators running affected versions are advised to update to the patched release.

The X.Org Foundation has released security updates for X.Org Server and Xwayland fixing 12 critical vulnerabilities rated 9.1 on the CVSS scale. The flaws could allow arbitrary code execution, server crashes and information disclosure. Users are urged to update their systems promptly, and the disclosure is drawing attention in the security community.

A newly catalogued vulnerability, EUVD-2026-73016, describes a heap-based buffer overflow in the Windows Program Compatibility Assistant affecting Microsoft Windows Server 2019, Windows 11 Version 25H2, Windows 10 Version 21H2 and more than a dozen other Windows versions. The flaw carries a CVSS v3.1 severity score of 7.0, classifying it as high severity. It was published on 8 September 2026 and updated on 7 October 2026, and security teams are being urged to check their systems for patched versions.

A new tutorial walks through installing DNSControl, an open-source tool for managing DNS records across multiple providers, on an Ubuntu VPS and configuring it to control PowerDNS servers. The guide covers what DNSControl is, the installation steps, and how to connect it to PowerDNS, aimed at administrators who want to automate and centralize DNS management from the command line.

Atlassian has a critical vulnerability, tracked as EUVD-2026-92807, affecting a range of its enterprise products including Bitbucket Data Center, Crowd Server, Crucible Data Center, Confluence Data Center and Jira Service Management. The flaw carries a CVSS v3.1 severity score of 9.3 out of 10, putting it in the critical range. The advisory was updated on 5 October 2026, and security teams are being urged to check whether their deployments of the affected Atlassian products are exposed.

A medium-severity vulnerability, tracked as EUVD-2026-73018 and scored 5.7 out of 10 under CVSS v3.1, affects Microsoft Windows 10 versions 1809 and 21H2, Windows Server 2019 and more than a dozen other Microsoft products. The flaw involves the generation of error messages containing sensitive information. The advisory was published on 8 September 2026 and updated on 7 October 2026, and administrators are being urged to review whether their systems need patching.

LWN.net has published its regular Wednesday roundup of security updates for Linux distributions. The digest collects advisories and patched packages from distros such as Debian, Fedora, Ubuntu and openSUSE, covering vulnerabilities fixed across a range of software. System administrators typically use these roundups to plan patching and keep servers current with the latest fixes.

A medium-severity vulnerability affecting Microsoft Windows Server editions has been catalogued as EUVD-2026-73019, with a CVSS v3.1 score of 5.5 out of 10. The flaw involves missing authentication for a critical function, affecting Windows Server 2025, Windows Server 2016 (Server Core installation), Windows Server 2012 and more than sixteen other configurations. The entry was published on 8 September 2026 and updated on 7 October 2026. Administrators are advised to check whether patches are available for affected builds.

The OpenSSH project has released version 10.6 of its widely used secure shell suite, with release notes published on the official OpenSSH website. OpenSSH is a core security tool used on servers and network devices worldwide, so every new release draws attention from system administrators and developers. Early discussion is focused on what changed in this version and whether upgrades are needed.

A newly disclosed vulnerability in Microsoft Exchange Server, tracked as CVE-2026-96940, carries a high severity score of 8.8. Security researchers say an authenticated attacker could bypass authorization checks and read other users' mailboxes and attachments within the same on-premises Exchange organisation. The flaw does not allow pre-authentication remote code execution, but experts are warning administrators to review exposure and patch promptly.

Atlassian has disclosed CVE-2026-21589, a critical arbitrary file-access vulnerability affecting self-hosted Data Center versions of Confluence, Jira and Bitbucket. The flaw could let attackers read sensitive files on affected servers. Atlassian is urging administrators to patch immediately. Security commentators are sharing the advisory and warning self-hosted deployments to act quickly.

A Germany-based IP address, 88.198.1.113, has been flagged as a network scanner with 58% confidence and appears in one threat intelligence feed. Security watchers are advising administrators to check their server logs for activity from the address, as repeated scanning is often a precursor to targeted attacks.

A new tutorial walks through installing Directus, the open-source headless CMS and data platform, on an AlmaLinux VPS. The guide covers what Directus is — a tool for managing and interacting with databases through an API-first interface — and details the setup steps for server administrators. It reflects steady interest in self-hosting flexible CMS alternatives on enterprise-grade Linux distributions.

A step-by-step tutorial for deploying Nagios Core on an Ubuntu virtual private server has been published, covering system preparation, web access setup, plugins, and host and service configuration through to security hardening. The commands target Ubuntu 22.04 LTS, with notes that they work similarly on 20.04 and 24.04, giving administrators a practical open-source server monitoring option.

An IP address registered in Pakistan to mobile operator CMPak, 223.123.126.197, has been flagged for distributing malware associated with the ua-wget user agent. The flagging carries a low confidence rating, but security practitioners are advised it may be worth blocking at the firewall level if the address appears in server logs. Administrators are encouraged to review their logs and share threat intelligence on suspicious traffic.

Calnode has released version 0.10.1, an update that includes security fixes and a new one-click module for deploying the software on NethServer. The release is being described as shaped by feedback from the project's deployers, and it is drawing attention from self-hosting and server administration communities interested in simplified deployment and patched vulnerabilities.