PrivacySafe Security Patches: newest advisoriesChecks, hunts and protection for serious vulnerabilities, from PrivacySafe.https://privacysafe.app/docs/security-patches/2026-11-04T00:00:00ZPrivacySafe Foundationhttps://privacysafe.foundationCC0 1.0 Universal Linux kernel module blockerhttps://privacysafe.app/docs/security-patches/linux-kernel/#2026-11-032026-11-03T00:00:00Za generic tool that stops any module from loading, with a list of 42 modules from recent exploits to rarely needed attack surface Linux kernel IPv4 TCP use-after-freehttps://privacysafe.app/docs/security-patches/linux-kernel/#2026-11-032026-11-03T00:00:00Z(CVE-2026-98432): an unauthenticated peer can trigger it with a SYN that carries IP options, and remote code execution has been shown against an MPTCP listener eMudhra on macOShttps://privacysafe.app/docs/security-patches/pki/#2026-11-022026-11-02T00:00:00Zthe command line tools that ship with macOS (curl, git, python3, pip) still trust the compromised eMudhra intermediates through /etc/ssl/cert.pem, and hosted macOS CI images keep an old Homebrew ca-certificates (no new CVE) BTCPay Serverhttps://privacysafe.app/docs/security-patches/btcpayserver/#2026-11-022026-11-02T00:00:00Zhot wallets drained on instances running 2.4.1 or earlier from 1 November. The fix is a fresh server and a new wallet, not an update (no CVE) vsftpdhttps://privacysafe.app/docs/security-patches/vsftpd/#2026-10-302026-10-30T00:00:00Za resumed FTPS session ticket is accepted as proof that a data connection belongs to the logged-in user, so someone who shares your source IP can take over a transfer (CVE-2026-119568). A separate denial of service affects Red Hat family packages (CVE-2025-14242) Claude Code extension backdoorhttps://privacysafe.app/docs/security-patches/claude-code-vsx/#2026-10-292026-10-29T00:00:00Ztampered builds 2.1.312 and 2.1.313 were served from Cursor's marketplace and planted an SSH key and a persistent tunnel (no CVE) Brotlihttps://privacysafe.app/docs/security-patches/brotli/#2026-10-252026-10-25T00:00:00Zan out-of-bounds write in the decoder, reachable from Node.js and many other programs (CVE-2026-111497) Grav corehttps://privacysafe.app/docs/security-patches/grav/#2026-10-242026-10-24T00:00:00Za page editor can run arbitrary public static methods, fixed in 2.2.13 (CVE-2026-116019) PHP2Shellhttps://privacysafe.app/docs/security-patches/php/detect/#2026-10-242026-10-24T00:00:00Za honeypot report confirmed the exploit chain in the wild baserCMS 5https://privacysafe.app/docs/security-patches/basercms/#2026-10-232026-10-23T00:00:00Zadmin SQL injection, path traversal and deserialization that leads to command execution (CVE-2026-114621, CVE-2026-114622, CVE-2026-114624) openapi-typescript-codegenhttps://privacysafe.app/docs/security-patches/openapi/#2026-10-232026-10-23T00:00:00Zcode injection through the API document (CVE-2026-108551) Ruby and GitLabhttps://privacysafe.app/docs/security-patches/ruby/#2026-10-232026-10-23T00:00:00Zmemory corruption in Onigmo, Ruby's regular expression engine (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264) Django REST frameworkhttps://privacysafe.app/docs/security-patches/django/#2026-10-222026-10-22T00:00:00Zan oversized Accept header burns CPU (CVE-2026-114138), and TokenProxy.delete() revokes nothing (CVE-2026-114137) libexpathttps://privacysafe.app/docs/security-patches/expat/#2026-10-222026-10-22T00:00:00Zentity amplification is detected too late (CVE-2026-115506) HAProxyhttps://privacysafe.app/docs/security-patches/haproxy/#2026-10-222026-10-22T00:00:00Za truncated HTTP/2 PING frame pins a worker thread (CVE-2026-110353) rsysloghttps://privacysafe.app/docs/security-patches/rsyslog/#2026-10-222026-10-22T00:00:00Zpath traversal through dynaFile (CVE-2026-92709) YOOtheme Prohttps://privacysafe.app/docs/security-patches/yootheme/#2026-10-222026-10-22T00:00:00Zunauthenticated remote code execution, CVSS 10.0 (CVE-2026-102785)