https://ubuntu.com/security/notices/rss.xmlRecent content on Ubuntu security notices2026 Canonical Ltd. Ubuntu and Canonical are registered trademarks of Canonical Ltd.http://www.rssboard.org/rss-specificationFeedgenWed, 21 Oct 2026 14:17:31 +0000https://ubuntu.com/security/notices/USN-8948-1It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109619)https://ubuntu.com/security/notices/USN-8948-1Wed, 21 Oct 2026 13:56:19 +0000https://ubuntu.com/security/notices/USN-8944-2USN-8944-1 updated ca-certificates. This update provides the corresponding changes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS by removing the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificates. Original advisory details: This update removes the "emSign ECC Root CA - G3" CA certificate due to intermediate CA certificates being compromised. In addition, in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS, the ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.90 version of the Mozilla certificate authority bundle.https://ubuntu.com/security/notices/USN-8944-2Tue, 20 Oct 2026 21:21:42 +0000https://ubuntu.com/security/notices/USN-8945-1It was discovered that XZ Utils incorrectly handled certain memory allocation failures when reinitializing decoders for specific compressed file formats. An attacker could possibly use this issue to trigger an invalid memory write, resulting in a denial of service or arbitrary code execution.https://ubuntu.com/security/notices/USN-8945-1Tue, 20 Oct 2026 17:45:10 +0000https://ubuntu.com/security/notices/USN-8944-1This update removes the "emSign ECC Root CA - G3" CA certificate due to intermediate CA certificates being compromised. In addition, in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS, the ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.90 version of the Mozilla certificate authority bundle.https://ubuntu.com/security/notices/USN-8944-1Tue, 20 Oct 2026 15:52:06 +0000https://ubuntu.com/security/notices/USN-8942-1Multiple security issues were discovered in .NET and this update includes new upstream .NET versions to fix these issues. .NET 8 has been updated to 8.0.32 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. .NET 10 has been updated to 10.0.13 in Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. .NET 11 has been updated to 11.0.0~rc2 in Ubuntu 26.10. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.https://ubuntu.com/security/notices/USN-8942-1Tue, 20 Oct 2026 15:15:07 +0000https://ubuntu.com/security/notices/USN-8943-1It was discovered that Protocol Buffers did not properly handle negative varint lengths or enforce recursion limits when parsing input in the PHP library. An attacker could possibly use this issue to cause applications using Protocol Buffers to crash or consume resources, resulting in a denial of service.https://ubuntu.com/security/notices/USN-8943-1Tue, 20 Oct 2026 14:49:32 +0000https://ubuntu.com/security/notices/USN-8708-2USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the corresponding fix for Ubuntu 26.10. Original advisory details: It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only affected systems configured to grant fine-grained sudoedit file editing permissions, which is not the default configuration.https://ubuntu.com/security/notices/USN-8708-2Tue, 20 Oct 2026 14:23:39 +0000https://ubuntu.com/security/notices/USN-8941-1It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches. (CVE-2026-61642) It was discovered that Squid incorrectly handled certain cache digest replies, which could lead to a buffer overflow. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-50012) It was discovered that Squid incorrectly handled parsing certain FTP directory listings. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-47729) It was discovered that Squid incorrectly handled certain ICP traffic. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-32748, CVE-2026-33526) It was discovered that Squid incorrectly handled certain ICP requests. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-33515)https://ubuntu.com/security/notices/USN-8941-1Tue, 20 Oct 2026 13:59:52 +0000https://ubuntu.com/security/notices/USN-8940-1It was discovered that the Perl XS::Parse::Keyword module did not correctly handle certain inputs. If a user or automated system were tricked into receiving specially crafted input, an attacker could cause a denial of service.https://ubuntu.com/security/notices/USN-8940-1Tue, 20 Oct 2026 03:21:29 +0000https://ubuntu.com/security/notices/USN-8939-1It was discovered that libXtst did not properly handle certain RECORD replies from the X server. A malicious X server could possibly use this issue to cause libXtst clients to crash, resulting in a denial of service. (CVE-2026-94286) Tobias Stoeckmann discovered that libXtst did not properly handle certain memory operations. A malicious X server could possibly use this issue to cause libXtst to access memory out of bounds, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7951) Tobias Stoeckmann discovered that libXtst did not properly handle certain replies from the X server. A malicious X server could possibly use this issue to cause libXtst to enter an infinite loop, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7952)https://ubuntu.com/security/notices/USN-8939-1Mon, 19 Oct 2026 17:17:18 +0000