Digest · Week 44
Week 44: PhpSpreadsheet fixes and PostgreSQL 14 end of life
· 7 items · 2 min read
- Act now
- 1
- Updates
- 5
- End of life
- 1
Patch phpoffice/phpspreadsheet first if any client site reads uploaded spreadsheets. The worst of four advisories lets a crafted ODS file exhaust CPU and memory. Also plan PostgreSQL 14 upgrades now, as security fixes stop on 12 Nov 2026.
Act now
1Update these today if the package ships to visitors.
4 advisories, the worst: PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
Four advisories across five version ranges, the worst a denial of service via crafted ODS files. Update to the latest patched release on your branch.
5 ranges no fix yet
Updates
5Moderate or low, or build-time only. Fine for your next round.
PHP are out with medium security fixes for 1 vulnerability.
A PHP security release fixes one medium-severity vulnerability. Fixed versions aren't listed here, so update to the newest patch release on each branch you run.
older patch releases
Debian patched imagemagick (36 CVEs) for 1 release. Run your package updates on servers you manage.
Debian patched imagemagick for 36 CVEs on one release. Run package updates on Debian servers you manage, especially those processing image uploads.
patched
Ubuntu patched nginx (5 CVEs) for 4 releases. Run your package updates on servers you manage.
Ubuntu patched nginx for 5 CVEs across four releases. Run package updates on Ubuntu servers you manage and reload nginx.
patched
CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
Apps using symfony/mime should update to 5.4.55, 6.4.49, 7.4.22 or 8.1.10 to fix an email header injection flaw.
4 ranges →5.4.55 · 6.4.49 · 7.4.22 · 8.1.10
Debian patched valkey (7 CVEs) for 1 release. Run your package updates on servers you manage.
Debian patched valkey for 7 CVEs on one release. Run package updates on Debian servers you manage that use it for cache or queues.
patched
End of life
1Runtimes and databases near or past the end of security support.
PostgreSQL 14 stops getting security fixes on 12 Nov 2026, in 13 days. The newest supported is 18.
PostgreSQL 14 stops getting security fixes on 12 Nov 2026, in 13 days. Plan upgrades to a supported version; the newest is 18.
14 →18
Get this every Friday
One short email: the advisories and end-of-life dates that matter for agency sites. No other mail.
Fridays · unsubscribe in one click · stored in the UK