Most security work is quiet, and that is the point. Here is what we handled across the servers we maintain over the past week: a fix for the Apache web server, Node.js updates, a MySQL library refresh, and one improvement to the plumbing that delivers updates in the first place.

The Apache HTTP/2 fix

On November 11 the Apache project released version 2.4.71 of its web server to fix a serious bug (CVE-2026-119618, rated 9.8 out of 10) in the component that handles HTTP/2, the modern protocol browsers use to talk to websites. On an affected server, the bug could let someone run code on the machine without logging in. Apache versions 2.4.55 through 2.4.70 with HTTP/2 enabled are affected.

Within a day we had checked every server we maintain. Nearly all of them run nginx, a different web server that this bug does not touch, so there was nothing to change. The one machine in our fleet that does run Apache is not reachable directly from the internet (a filtering proxy sits in front of it), and we reviewed it directly and took it through our gated update process, which applies the vendor's fix only once the packages are published and verifies the site afterwards. A client also asked us the same day whether their site was affected; we confirmed on the server itself that it runs nginx and needed nothing.

Node.js November updates

Node.js published its November security releases, fixing 16 issues across the supported version lines (fixed in 22.23.5, 24.22.3 and 26.13.1). We reviewed each Node application we run and confirmed the highest-severity issues do not apply to how they are deployed: those issues only matter when Node itself handles HTTPS or HTTP/2 from the outside world, and in our setups a separate web server does that job in front. We then prepared version-gated updates so the fixed builds install as soon as the package repositories carry them, with service checks and a rollback path built in.

A MySQL client library, and better update plumbing

Ubuntu published USN-9046-1, covering Oracle's October round of MySQL fixes. Our database servers run MariaDB, which this notice does not cover, but the MySQL client library (libmysqlclient21) was installed on several machines, so we brought it up to the fixed build on five servers. No service restarts were needed, because we first verified that no running process was actually using the library.

Along the way we found something more useful than the patch itself: the package mirror operated by one of our cloud providers was serving security updates with a delay. A server pointed only at that mirror would have waited longer than necessary for this fix, and for any future one. We added the official Ubuntu archives alongside the provider's mirror on every affected machine, so the update system now takes whichever source has the newest packages.

Checks that ended well

We also verified the whole fleet against an OpenSSH advisory (CVE-2026-123158, a password authentication bypass): it only affects systems built on musl libc without PAM, a configuration none of our servers use, so no changes were needed. And after a round of scheduled maintenance reboots this week, we confirmed every site and service came back healthy.

If you run the same software

• Apache 2.4.55 to 2.4.70 with HTTP/2 enabled: update to 2.4.71 or your distribution's fixed package. If you run nginx, this one does not apply to you.
• Node.js: update to 22.23.5, 24.22.3 or 26.13.1, depending on your release line.
• If your servers use a hosting provider's package mirror, check that security updates also come from the distribution's own security archive. Mirrors can lag at exactly the wrong moment.

If we maintain your servers, everything above is already handled, and there is nothing you need to do.