We’ve kept upload_progress disabled, and PHP.net have again confirmed this as being wise.
CVE-2026-115560 will be patched in an upcoming release, and for now keeping it disabled mitigates it.

Google patched a flaw in Brotli on the 28th of Feb yet didn’t release it as a patch until the 22nd of Oct.
CVE-2026-111497 is mitigated: we upgraded to brotli-1.0.6-5 which addresses the out-of-bounds write.

It’s good to see eMudhra exiting the SSL/TLS market after their CA Private Key blunder, including “4”…
CVE-2026-114406 is mitigated: we upgraded to ca-certificates-2026.2.92 which fully distrusts eMudhra.

We’re not affected by the PXE booting vulnerability in TianoCore EDK II (PXE Driver), due to not using PXE.
CVE-2026-97631 had embargo violated by mistake, resulting in the vulnerability being exposed months early.

We’ve added a “special vdev” to the DirectAdmin backup server, comprised of 3x SSDs in a mirror.

This boosts performance of small-block and metadata I/O, and brings us a step closer to deployment.