The week's main news for people who run their own VPS: what was released, what to update right away, and what is changing. Each item links to the primary source.

Let's Encrypt: 64-day certificates from February 10, 2027

Let's Encrypt announced that starting February 10, 2027, all certificates will be issued for 64 days instead of 90. The staging environment switches to the new lifetime as early as October 14, 2026. At the same time, the period during which a domain validation can be reused shrinks from 30 to 10 days.

What to do. If your certificates are renewed by certbot or another client that supports ARI (ACME Renewal Info), nothing needs to change. If renewal runs after a hard-coded number of days, move it to roughly two thirds of the certificate lifetime. Let's Encrypt suggests searching your scripts and cron jobs for the numbers 83, 80 and 60. How automatic renewal works is covered in the article on Nginx and certbot.

OpenSSH 10.6

OpenSSH 10.6 is out (October 6) with security fixes. Among the changes: sftp checks paths sent by the server more strictly; the restrict option in authorized_keys now applies to tunnels as well; traffic compression no longer uses the dictionary that made a side-channel attack possible, so the Compression option will be less effective. scp -R is deprecated.

What to do. At the time of this digest there are no Ubuntu or Debian packages with 10.6 yet; update once they show up in apt upgrade. If you restrict keys with restrict, check whether those keys were used for tunnels.

Docker Engine 29.9.0 and Go fixes

Docker 29.9.0 (October 8) is built with a patched Go version and fixes several HTTP/2 vulnerabilities in the daemon, ranging from crashes to memory exhaustion. On the same day Go 1.27.2 and 1.26.9 were released with 15 security fixes, including fixes in net/http.

What to do. Update docker-ce, especially if the daemon API is reachable over the network (which is best avoided altogether). Rebuild your own Go services with the new version; for third-party Go programs such as Caddy, Traefik and Gitea, watch for new releases.

Apache httpd 2.4.69: 19 vulnerabilities fixed

Apache httpd 2.4.69 fixes 19 vulnerabilities, including use-after-free bugs in mod_http2 and mod_rewrite and overflows in mod_dav. Ubuntu released an update on October 7 (USN-8898-1) for 22.04, 24.04 and 26.04. As of October 11, stable Debian releases do not have the fix yet (Debian tracker).

What to do. On Ubuntu, run sudo apt update && sudo apt upgrade. On Debian, watch for the DSA; until then you can disable HTTP/2 with the line Protocols http/1.1 if you don't need it.

Redis: remote code execution over TLS

The vulnerability CVE-2026-81934 in Redis allows code execution without authentication when TLS is enabled in Redis. Fixes have been released in Ubuntu (USN-8866-1, October 6) and Debian (DSA-6538-1).

What to do. Update the redis-server package. Also check that the Redis port is not exposed to the internet: sudo ss -ltnp | grep redis should show 127.0.0.1, not 0.0.0.0.

Python 3.15 and the end of 3.10 support

Python 3.15.0 is out (October 9): UTF-8 by default, explicit lazy imports, a built-in frozendict and a faster JIT. Along with the October 1 security releases, the 3.10 branch received its last update and is no longer supported.

What to do. If applications on your server run on Python 3.10, plan a move to 3.12 or newer.

Ubuntu 26.10 is due October 15

Ubuntu 26.10 is in final freeze, with the release scheduled for October 15. It is an interim release with 9 months of support.

What to do. For servers, stay on Ubuntu 26.04 LTS, which is supported until 2031.

New on the blog