What happened? On October 25, 2026, the National Vulnerability Database published CVE-2026-98432 , a vulnerability in the Linux kernel's IPv4 TCP stack. The flaw is a use-after-free: when a server handles a retransmitted SYN for a connection request, it can read IP options from memory that has already been freed. This can lead to a crash or memory corruption. The Linux kernel fix defers freeing these IP options until after an RCU (read-copy-update) grace period, so no thread can still be...

What happened? On November 11, 2026, the Apache HTTP Server project released version 2.4.71 to fix a critical remote code execution vulnerability in its HTTP/2 module, mod_http2 (CVE-2026-119618 ).  Affecting Apache HTTP Server versions 2.4.55 through 2.4.70, the flaw allows code to be run remotely without authentication and could result in full control of the server process on systems with HTTP/2 enabled. Okta's response Security Patching: The necessary patches have been deployed across...

Okta’s Response Our security team has reviewed the recent OpenSSH advisory and confirmed that our platform is not affected. Exploitation relies on specific configurations that are not present in our environment, and administrative access is not exposed to the public internet.