Security status
When a security vulnerability is made public, Start9 checks whether it affects StartOS, StartTunnel, StartWRT or any service in the Marketplace, and tracks it here until it is resolved.
So far we have reviewed 10 vulnerabilities and shipped 103 security fixes across 87 Marketplace services, plus StartOS 0.4.0.3 and StartTunnel 1.4.0.
The best protection is to keep StartOS and your installed services up to date. Each entry below says what, if anything, you need to do.
Overview
| Vulnerability | Severity | StartOS | StartTunnel | StartWRT | Marketplace services |
|---|---|---|---|---|---|
| Node.js security release (October 2026) | High | In progress | Not affected | Not affected | 22 fixed 4 pending |
| Compromised eMudhra certificate authorities | Critical | Fixed in 0.4.0.3 | Fixed in 1.4.0 | In progress | 65 fixed |
| Pillow: flaws in Python image handling | Critical | Not affected | Not affected | Not affected | 6 fixed 10 pending |
| Ruby pattern-matching flaws | High | Not affected | Not affected | Not affected | 1 fixed 1 pending |
| Linux kernel flaws disclosed before fixes | High | Monitoring | Not affected | Monitoring | Not affected |
| PHP2Shell: critical flaws in PHP | Critical | Not affected | Not affected | Not affected | 3 fixed |
| nginx security release (October 2026) | Medium | Not affected | Not affected | Not affected | 5 fixed |
| Core Lightning security fixes | High | Not affected | Not affected | Not affected | 1 fixed |
| OpenSSH flaws | Medium | Not affected | Not affected | Not affected | Not affected |
| Plex2Shell: critical flaws in Plex Media Server | Critical | Not affected | Not affected | Not affected | Not affected |
| Status | Meaning |
|---|---|
| Fixed | A fixed version is available. Update to it. |
| In progress | A fix is on its way, from Start9 or from the app's developers. |
| Monitoring | No fix exists yet anywhere. We will ship one as soon as it does. |
| Not affected | The vulnerability does not apply. |
Node.js security release (October 2026)
A flaw in how Node.js unpacks compressed (Brotli) data could let a malicious website run code inside an app that downloads from it. Many services are built on Node.js.
What to do: Update StartOS when the next release arrives, and update the services marked fixed. Until the others are fixed, avoid pointing Uptime Kuma, n8n, Linkwarden or Audiobookshelf at websites or feeds you don't trust.
| Platform | Status | Details |
|---|---|---|
| StartOS | In progress | Affects the part of StartOS that runs services. A fix is coming in a StartOS update. |
| StartTunnel | Not affected | Doesn't use Node.js. |
| StartWRT | Not affected | Doesn't use Node.js. |
Marketplace services · 22 fixed · 4 pending
Fixed services show the version that contains the fix.
- Audiobookshelf In progress
- Cal.diy In progress
- Linkwarden In progress
- Spliit In progress
- Actual Budget 26.10.0:3
- Balance of Satoshis 25.0.0:2
- Bitcoin Explorer 3.5.1:16
- Bitcoin Family Dashboard 0.2.2:4
- Cronicle 0.9.135:4
- DeepSeek Harness 0.2.0-rc.2:1
- Dojo 1.29.2:6
- Ghost 6.72.0:1
- God's Eye View 0.2.1:2
- Immich 3.3.5:0
- Kindle Bitcoin Display 1.1.1:3
- Mempool 3.3.2:0
- n8n 2.44.6:0
- Node-RED 5.0.9:0
- OpenClaw 2026.9.4:3
- OpenSERP 0.8.12:2
- Papra 26.7.1:0
- PPQ Private Mode 0.4.1:2
- Public Pool 0.2.5:25
- Ride The Lightning 0.15.15:0
- Scriptwerk 0.1.73:1
- Uptime Kuma 2.5.7:0
Compromised eMudhra certificate authorities
Certificates issued through a compromised certificate authority (eMudhra) could let an attacker impersonate any website to software that still trusts it. Updated software no longer trusts that authority.
What to do: Update StartOS to 0.4.0.3 or later, StartTunnel to 1.4.0 or later, and your installed services. Update StartWRT when its next release arrives.
| Platform | Status | Details |
|---|---|---|
| StartOS | Fixed in 0.4.0.3 | |
| StartTunnel | Fixed in 1.4.0 | |
| StartWRT | In progress | Fixed in the next StartWRT release. |
Marketplace services · 65 fixed
Fixed services show the version that contains the fix.
- Actual Budget 26.10.0:3
- Am I Exposed? 0.43.2:1
- ArchiveBox 0.9.73:1
- Audiobookshelf 2.37.1:2
- Bark Wallet 0.9.0:6
- BCH Explorer 3.12.0:6
- Beszel 0.20.0:2
- Bitcoin Core 31.1:26
- BTCPay Server 2.4.5:3
- Cal.diy 6.2.0:11
- ChangeDetection.io 0.60.9:0
- Core Lightning 26.6.9:5
- Crawl4AI 0.9.4:2
- Discourse 2026.10.0-latest:6
- DocuSeal 3.3.3:1
- Eclair 0.14.5:1
- Electrs 0.12.0:6
- Element Web 1.12.27.3:2
- Forgejo 16.0.6:1
- Frappe Helpdesk 1.31.0:3
- Gitea 28.2.0:1
- Hashrate Autopilot 1.18.2:2
- Home Assistant 2026.10.2:1
- IPFS 0.42.0:6
- Jellyfin 12.2:1
- LaWallet NWC 2.9.0:0
- Lightning Terminal 0.17.8:0
- Linkwarden 2.16.0:2
- llama.cpp 11669:1
- LNbits 1.6.2:4
- LND 0.21.4-beta:6
- Mattermost 12.0.1:0
- Memos 0.31.0:2
- Mempool 3.3.2:0
- MeTube 2026.10.20:0
- Minecraft Server 26.2:10
- Miniflux 2.3.4:0
- Monero 0.18.5.4:0
- Multi-Scrobbler 0.20.2:0
- n8n 2.43.7:1
- Nextcloud 35.0.2:1
- Nostr RS Relay 0.10.0:7
- NTFY 2.32.0:1
- Ollama 0.40.8:0
- Open WebUI 0.12.3:1
- Pact 0.18.0:5
- Paperless-ngx 3.3.0:1
- Papra 26.7.0:4
- phoenixd 0.9.2:2
- Public Pool 0.2.5:25
- qBittorrent 5.3.0:0
- Readstr 0.1.0:7
- Ride The Lightning 0.15.15:0
- RomM 5.3.1:2
- SearXNG 2026.10.15:1
- Stalwart 0.16.27:1
- Stash 1.0.1:5
- Stirling PDF 2.14.3:6
- Synapse 1.163.0:3
- TunnelSats 1.0.0:2
- Uptime Kuma 2.5.6:1
- Vaultwarden 1.37.4:2
- vLLM 0.32.0:1
- Wasabi Wallet 2.8.4:2
- Wisp 0.9.1:1
Pillow: flaws in Python image handling
Specially crafted image files could let an attacker run code in Python apps that open them with the Pillow image library.
What to do: Update Cloud Print Bridge, Paperless-ngx, RomM and Hermes Agent. Until the others are fixed, avoid uploading or importing images and documents you don't trust into them.
| Platform | Status | Details |
|---|---|---|
| StartOS | Not affected | Doesn't use Pillow. |
| StartTunnel | Not affected | Doesn't use Pillow. |
| StartWRT | Not affected | Doesn't use Pillow. |
Marketplace services · 6 fixed · 10 pending
Fixed services show the version that contains the fix.
- copyparty In progress
- Crawl4AI In progress
- ERPNext In progress
- Frappe Helpdesk In progress
- Home Assistant In progress
- Immich In progress
- LNbits In progress
- Open WebUI In progress
- Robosats In progress
- Stirling PDF In progress
- BOLT12 Pay 0.3.15:0
- Cloud Print Bridge 0.6.0:3
- Hermes Agent 2026.10.23:0
- Paperless-ngx 3.3.4:0
- RomM 5.4.1:0
- vLLM 0.32.0:1
Checked and not affected: Synapse.
CVE-2026-112900CVE-2026-112393CVE-2026-112403Source 1Source 2
Ruby pattern-matching flaws
Flaws in Ruby's pattern-matching (regular expression) engine could let an attacker run code in a Ruby app that accepts patterns from its users.
What to do: Update Discourse. Nothing to do for DocuSeal.
| Platform | Status | Details |
|---|---|---|
| StartOS | Not affected | Doesn't use Ruby. |
| StartTunnel | Not affected | Doesn't use Ruby. |
| StartWRT | Not affected | Doesn't use Ruby. |
Marketplace services · 1 fixed · 1 pending
Fixed services show the version that contains the fix.
- DocuSeal Monitoring (Doesn't accept patterns from its users. It will be updated when a fixed release is available.)
- Discourse 2026.10.0-latest.1:0
CVE-2026-89078CVE-2026-93577CVE-2026-97229CVE-2026-110264Source
Linux kernel flaws disclosed before fixes
Reports of several unfixed Linux kernel flaws were accidentally posted publicly. Two affect the kernel's built-in Windows file-sharing (SMB) server, one lets a program already running on a device take full control of it, and one affects only VMware virtual machines. Fixes have not been released yet.
What to do: Nothing to do right now. Install only services you trust, and update StartOS and StartWRT when fixes arrive.
| Platform | Status | Details |
|---|---|---|
| StartOS | Monitoring | Only the take-full-control flaw applies, and it needs a program already running on your server. StartOS doesn't run the SMB server. The fix will come in a StartOS update once it's released. |
| StartTunnel | Not affected | Uses your VPS's own operating system. Install your provider's updates when they're released. |
| StartWRT | Monitoring | Only the take-full-control flaw applies. StartWRT doesn't run the SMB server. The fix will come in a StartWRT update once it's released. |
No Marketplace services are affected.
PHP2Shell: critical flaws in PHP
Two flaws in PHP, the language many web apps are written in, let anyone who can reach a PHP app take control of it without logging in. A smaller follow-up PHP flaw disclosed on October 23 (CVE-2026-115560) affects only apps configured in an unusual way and does not affect any of these services.
What to do: Update Nextcloud, Firefly III and Kimai.
| Platform | Status | Details |
|---|---|---|
| StartOS | Not affected | Doesn't use PHP. |
| StartTunnel | Not affected | Doesn't use PHP. |
| StartWRT | Not affected | Doesn't use PHP. |
Marketplace services · 3 fixed
Fixed services show the version that contains the fix.
- Firefly III 6.7.9:2
- Kimai 2.70.1:1
- Nextcloud 35.0.2:1
CVE-2026-109618CVE-2026-109619CVE-2026-115560Source 1Source 2
nginx security release (October 2026)
nginx, a widely used web server, fixed five flaws. Each one needs a specific setup to be exploited.
What to do: Update Start9 Pages, Bitcoin Family Dashboard and Maple Proxy.
| Platform | Status | Details |
|---|---|---|
| StartOS | Not affected | Doesn't use nginx. |
| StartTunnel | Not affected | Doesn't use nginx. |
| StartWRT | Not affected | Doesn't use nginx. |
Marketplace services · 5 fixed
Fixed services show the version that contains the fix.
- Bitcoin Family Dashboard 0.2.2:4
- Maple Proxy 0.3.2:0
- Minecraft Server 26.2:10
- Start9 Pages 1.1.0:0
- Synapse 1.163.0:3
Checked and not affected: ASICSeer, Bark Wallet, Chama, Clams Remote, EloPool, Primal, Public Pool, Standard Notes Server.
CVE-2026-15176CVE-2026-93479CVE-2026-95101CVE-2026-97629CVE-2026-97205Source 1Source 2
Core Lightning security fixes
Core Lightning 26.06.8 fixes several security problems, including one that could put channel funds at risk. Attackers have been probing nodes that run older versions.
What to do: Update Core Lightning.
| Platform | Status | Details |
|---|---|---|
| StartOS | Not affected | Doesn't use Core Lightning. |
| StartTunnel | Not affected | Doesn't use Core Lightning. |
| StartWRT | Not affected | Doesn't use Core Lightning. |
Marketplace services · 1 fixed
Fixed services show the version that contains the fix.
- Core Lightning 26.6.9:5
OpenSSH flaws
Three OpenSSH flaws affect specific SSH server setups: custom file-transfer (SFTP) restrictions, and Kerberos or Active Directory sign-in.
| Platform | Status | Details |
|---|---|---|
| StartOS | Not affected | Doesn't use the affected setups. |
| StartTunnel | Not affected | Uses your VPS's own SSH server. Install your provider's updates. |
| StartWRT | Not affected | Uses a different SSH server (Dropbear). |
No Marketplace services are affected.
CVE-2026-59997CVE-2026-59998CVE-2026-60000Source 1Source 2
Plex2Shell: critical flaws in Plex Media Server
A chain of Plex Media Server flaws lets an attacker take control of a server without logging in, and it is being actively exploited.
| Platform | Status | Details |
|---|---|---|
| StartOS | Not affected | Doesn't use Plex. |
| StartTunnel | Not affected | Doesn't use Plex. |
| StartWRT | Not affected | Doesn't use Plex. |
Marketplace services: Plex isn't offered in the Marketplace.