Self-Hosted Weekly: Week 45, 2026. 948 Kernel Exploits, Keycloak, WordPress KEV
OpenAI says one automated run produced working root exploits for 948 Linux kernel bugs, and most of the fixes haven't landed yet. Keycloak shipped 33 CVE fixes in a single patch release, and WordPress made CISA's exploited list. If you were hoping for a quiet week to catch up on updates, I have bad news.
Let's get into it.
1. OpenAI's 948 Kernel Exploits
Help Net Security has the numbers from OpenAI's write-up. In mid-October, an autonomous pipeline running an unreleased cyber model scanned the latest Linux kernel. It reproduced 1,724 of 2,308 candidate bugs and built root exploits for 948 distinct local privilege escalation flaws, at about $1,279 per exploit in API credits. The Register reports that 588 of them were previously unknown.
About 10 days in, 61 were patched upstream, 43 had staging patches and 299 were being reported and discussed publicly. These are OpenAI's own figures, not independent findings, and it admits its agents' self-reports were unreliable early on: 20 of 200 claimed exploits reached root through a different bug than the one assigned.
Hot take: Even if you discount the count, the price is the story. OpenAI's advice is to treat an unpatched low-privilege account as nearly equivalent to root against a well-funded attacker. Containers share the host's kernel, so anyone running untrusted code in plain Docker should take that personally. Expect more kernel reboots, and if you run other people's code, look at gVisor or Firecracker.
2. Keycloak 26.8.2 Fixes 33 CVEs
Keycloak 26.8.2 landed on November 5 with 33 CVE-tagged entries in one patch release. The worst include a SAML redirect signature bypass allowing broker login as any user (CVE-2026-117691), account takeover via authentication race (CVE-2026-103112), stored XSS on the login page (CVE-2026-107889), and several unauthenticated denial-of-service bugs in the SAML code, one of which kills the JVM with a single request (CVE-2026-110931).
Hot take: Your identity provider is the one service that can't be "patched next sprint", because it holds the keys to everything else. If you use SAML brokering, treat this as today's job. Several entries carry bug bounty references, so my guess is a research backlog clearing out, and I doubt it's the last big batch.
3. WordPress Core Lands on CISA's List
CISA added CVE-2026-119977 to its exploited catalog on November 3, with a federal deadline of today. It's a race condition in the core update process, fixed in 7.1.4 on October 28, with fixes for older branches too. Wordfence blocked 62,969 attacks in a single day.
Exploitation is awkward. The attacker has to catch a full-package update during a window of seconds, with a predictable staging directory that's reachable from the web and can run PHP.
Hot take: A narrow window stops mattering when bots will poll your site for 14 hours straight, which is what Wordfence saw from two of the largest sources. Update, then check for files that shouldn't be there. Blocking PHP execution under wp-content/upgrade at the web server closes off this trick too.
4. Alpine's GitLab Post-Mortem Is Worth Your Time
Alpine Linux published a detailed account of an attack on its GitLab instance through CVE-2026-97229, a CVSS 10 bug in Ruby's Onigmo regex engine. It installed 19.3.4 instead of the fixed 19.3.5 by mistake, and then upgraded to 19.3.6, which didn't help, because its image ran a stock Ruby and the fix lives in Ruby. The attacker crashed workers eight times on October 21. Alpine found no evidence of success but couldn't rule it out, so it rebuilt from scratch and reset every password.
Hot take: Read this one if you build your own images. "We upgraded the app" and "we're no longer vulnerable" turned out to be different statements. If you bring your own Ruby, you need 3.3.13, 3.4.12, 4.0.9 or later. Credit to Alpine for publishing the embarrassing parts.
5. Gitea 28.3.0 Fixes 21 CVEs
Gitea 28.3.0 shipped on November 1, and many of the fixes involve public-only tokens reaching things they shouldn't. One let a site admin's public-only token create new administrators (CVE-2026-117635). Another let an org owner's token delete private repositories (CVE-2026-119441). CVE-2026-118386 lets a reader run pull_request_review workflows with secrets by pointing a review at their own commit.
Hot take: That last one should ring a bell: Forgejo fixed a very similar pull_request_review problem last week. Review events running with trust are now a pattern across forges, so check your own workflows. If you hand tokens to scripts or agents, don't assume "public-only" meant what it said before this release.
6. Docker Engine and the Rest of the Patch List
Docker Engine 29.9.3 fixes a set of issues, and Swarm users should look closely. Encrypted overlay networks could lose their protections after firewalld flushed Docker's iptables rules (CVE-2026-115538), and a stolen worker certificate could yield a manager certificate after a leader change (CVE-2026-115539). Also from this week's release feeds:
| Project | Version | What it fixes |
|---|---|---|
| Mastodon | 4.7.5 | Password auth bypass for inactive accounts, JSON-LD DoS |
| Caddy | 2.11.9 | Mostly FastCGI security fixes, plus a PHP regression from 2.11.8 |
| Vaultwarden | 1.37.5 | Emergency access and website icon advisories |
| Mattermost | 12.0.2, 11.11.4, 11.10.5, 11.7.15 | Fixes rated up to High |
| Open WebUI | 0.13.0 | Security fixes, details to be published later |
Hot take: Caddy's notes are the most honest of the bunch: they thank maintainers for triaging "in this relentless new age of AI". That's what story one looks like from a small project's side. And if you updated to Caddy 2.11.8 and your PHP site started throwing 404s, that's why.
7. Home Assistant 2026.11 Ships the Marketplace
Last week's watch item is done. Home Assistant 2026.11 landed on November 4 with HACS built in as the Marketplace, and existing HACS setups migrate automatically on first startup. Entity naming also changed, so some dashboard labels will look different, though entity IDs stay the same.
Hot take: The notice you have to accept is the part I like: community projects are not tested, audited or supported by Home Assistant. Being one click away in Settings makes third-party code feel official, and it isn't.
8. Coolify Splits Delete From Write
Coolify 4.6.0 adds a separate delete ability. A write token can no longer delete resources, environment variables, backups or storages through the API or the MCP server.
Hot take: It's a breaking change, and a correct one. Agents with write access are normal now, and "can edit" should never have implied "can destroy the backups".
What We're Watching Next Week
PostgreSQL's next minor releases are due on November 12, and PostgreSQL 14 reaches end of life the same day, so 14.x users should have a plan. We're also watching how quickly OpenAI's remaining kernel reports turn into patches and distro updates, and how many follow-up fixes Wiki.js 3 needs in its first month.
The Bottom Line
Finding bugs is getting cheaper faster than fixing them. Keycloak's 33 CVEs and OpenAI's 948 exploits are two views of the same shift, and the Alpine post-mortem shows how easily a normal upgrade can miss the real fix.
Patch Keycloak and WordPress today, plan for more kernel reboots, and check that your images actually contain the fixes you think they do.
If tracking all of that by hand is the part you'd rather skip, that's what Elestio's managed deployments handle: automated updates, backups and monitoring on infrastructure you still own.
Thanks for reading ❤️ See you next week 👋