Topic
infrastructure
Servers, hypervisors, web servers and monitoring stacks: upgrade notes and security releases with the checks to run before and after.
9 engineering notes.
- Zabbix 6.0 and 7.0 upgrade and configuration traps, and where they return in 8.0The upgrade and configuration mistakes Zabbix documented for 6.0 and 7.0, the same traps in 8.0's notes, and a tested 7.0 to 8.0 upgrade in containers.
- Spamhaus will enforce HELO and reverse DNS from November 2026: check every sending IPSpamhaus now requires forward-confirmed reverse DNS and a HELO name that resolves to the sending IP. A stock Postfix container announces EHLO localhost.
- CVE-2026-98432: a 9.8 kernel TCP use-after-free Ubuntu has not patched yetThe Linux kernel rates it 9.8, Red Hat rates it 5.9, and Ubuntu still lists every maintained release as work in progress. How to tell whether you are exposed.
- Proxmox VE 9.2: what changes before you upgrade a cluster9.2 adds dynamic HA load balancing, disarm/arm HA, WireGuard and BGP SDN, and a 7.0 kernel. An upgrade order and probe for an existing cluster.
- Zabbix 8.0 is a release candidate: inventory before the LTSZabbix 8.0 is at release candidate and planned as the next LTS. A probe to record the server, database and frontend state the upgrade depends on.
- Docker Engine 29: the image store changed under youEngine 29 makes the containerd image store the default for new installs, bumps the API, and its 29.9.x line carries a long list of security fixes.
- OpenSSL 4.0 is current: find the copies your services actually loadOpenSSL 4.0 shipped in April 2026 and 4.1 in October. A probe that finds the OpenSSL builds linked into running services, not the one on PATH.
- TLS certificates are getting shorter: 200 days now, 100 days in 2027The 200-day maximum is already in force, Let's Encrypt moves to 64-day and then 45-day certificates, and hardcoded renewal intervals need to change now.
- nginx 1.30.6 and 1.31.7: the October 2026 security releaseFive nginx CVEs fixed in October 2026: the affected directives, exposure conditions, fixed versions, and how to confirm which build is actually serving.
Related service: Infrastructure Assessment →
