We’ve re-built all RAID configurations on the NAS to use many RAID-Z1 (4-wide) arrays, up from 3-wide.

There is also now a hot-spare amongst the configuration, meaning if a disk fails, the system will swap-out & into service. This retains the 3-way SSD Mirror for small-block (metadata etc) I/O performance improvements. Work continues on final configuration now we’re at a hardware resting state, then integrating with DirectAdmin.

We’ve kept upload_progress disabled, and PHP.net have again confirmed this as being wise.
CVE-2026-115560 will be patched in an upcoming release, and for now keeping it disabled mitigates it.

Google patched a flaw in Brotli on the 28th of Feb yet didn’t release it as a patch until the 22nd of Oct.
CVE-2026-111497 is mitigated: we upgraded to brotli-1.0.6-5 which addresses the out-of-bounds write.

It’s good to see eMudhra exiting the SSL/TLS market after their CA Private Key blunder, including “4”…
CVE-2026-114406 is mitigated: we upgraded to ca-certificates-2026.2.92 which fully distrusts eMudhra.

We’re not affected by the PXE booting vulnerability in TianoCore EDK II (PXE Driver), due to not using PXE.
CVE-2026-97631 had embargo violated by mistake, resulting in the vulnerability being exposed months early.