No impact incident

CloudLinux: Ruby security releases, October 2026: CVE-2026-97229 and 3 other CVEs

Current status of CloudLinux: Operational — live CloudLinux status

Timeline

1. Oct 23, 2026, 18:48 UTC
   identified
   On 23 October 2026 the Ruby project published Ruby 4.0.9, 3.4.12 and 3.3.13. They fix four vulnerabilities in the Ruby regular expression engine (Onigmo): CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. A specially crafted pattern can corrupt memory while the regular expression is compiled, and this can lead to remote code execution. An application is affected only if it builds regular expressions from input an attacker controls, for example with Regexp.new, Regexp.union or by interpolating input into a pattern. Applications that use only regular expressions written by their developers are not affected. Regexp.timeout does not protect against these issues. We are aware and are building updated alt-ruby packages for CloudLinux OS, including the end-of-life Ruby versions we ship (alt-ruby 2.6 to 3.5), and ea-ruby27 for cPanel. They are not released yet. We will post an update here as soon as fixed packages are available in the repositories, with steps to install them. Until then, avoid compiling regular expressions from untrusted input in your applications. Upstream advisory: Ruby regexp fixes for GitLab CVEs (https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/)
2. Oct 24, 2026, 03:30 UTC
   identified
   Fixed packages are now available in the stable repositories. alt-ruby on CloudLinux OS 7, 8 and 9: - alt-ruby26-2.6.10-20 - alt-ruby27-2.7.8-151 - alt-ruby30-3.0.7-175 - alt-ruby31-3.1.7-15 - alt-ruby32-3.2.11-16 - alt-ruby33-3.3.13-14 - alt-ruby34-3.4.12-13 - alt-ruby35-3.5.0-0.6.preview1 - alt-ruby40-4.0.9-8 alt-ruby on CloudLinux OS for Ubuntu 22.04: - alt-ruby27 2.7.8-11 - alt-ruby30 3.0.7-177 - alt-ruby31 3.1.7-15 - alt-ruby32 3.2.11-16 - alt-ruby33 3.3.13-15 - alt-ruby34 3.4.12-14 - alt-ruby35 3.5.0~preview1-7 - alt-ruby40 4.0.9-9 ea-ruby27 for cPanel (EasyApache 4) on CloudLinux OS 7 and 8: - ea-ruby27-ruby-2.7.8-6.cloudlinux.1 To update on CloudLinux OS 7, 8 and 9: yum update 'alt-ruby*' 'ea-ruby27*' To update on Ubuntu: apt-get update apt-get install --only-upgrade 'alt-ruby*' Restart the Ruby applications afterwards, so they load the updated interpreter. To check that a package is patched, compare its version with the list above. For example: rpm -q alt-ruby27 ea-ruby27-ruby (CloudLinux OS 7, 8, 9) dpkg-query -W 'alt-ruby*' (Ubuntu) Upstream advisory: Ruby regexp fixes for GitLab CVEs
3. Oct 26, 2026, 12:59 UTC
   identified
   Fixed packages are now also released for TuxCare customers. alt-ruby26 , alt-ruby27 , alt-ruby30 , alt-ruby31 , alt-ruby32 , alt-ruby33 , alt-ruby34 , alt-ruby35 and alt-ruby40 are available on every platform where they are supported, in repo.alt.tuxcare.com . The native ruby package under ELS and ESU is fixed for CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 on these systems: - RHEL 7, Oracle Linux 7 and Amazon Linux 2 - AlmaLinux 9.2 ESU, TuxCare 9.6 ESU and TuxCare 9.8 ESU - Alpine 3.18, Ubuntu 16.04, 18.04 and 20.04, Debian 10 and 11 On CloudLinux OS 7, 8 and 9 the current alt-ruby27 build is alt-ruby27-2.7.8-152 . It includes the fix from 2.7.8-151 , so a regular update installs it. Restart the Ruby applications after updating, so they load the updated interpreter.

Updates as published by CloudLinux (original).