Security Updates

squid DSA-6606-1 fixes request smuggling, buffer overflow and FTP injection on Debian 13. Check exposure, patch to 6.13-2+deb13u4 and verify the binary.

Trivy on Debian 13: verify the binary with cosign after the v0.69.4 compromise, scan images, filesystems and configs, and cut Debian no-dsa noise.

libexpat DSA-6566-1 fixes six CVEs on Debian 13. Upgrade to 2.9.0-1~deb13u1, restart processes still using the old library and find bundled copies.

Debian DSA-6549-1 fixes an LZMA1 decoder memory write in xz-utils on Debian 13. Check liblzma5, update to 5.8.1-1+deb13u2 and restart affected services.

OpenSSL DSA-6531-1 fixes 13 CVEs on Debian 13. Check libssl3t64 against 3.5.7-1~deb13u3, restart daemons using the old library and verify the fix.

Debian DSA-6527-1 fixes 33 rsync CVEs in Debian 13. Check if rsyncd or rsync over SSH is exposed, patch to 3.5.0, verify and test backup jobs.

DSA-6514-1 fixes 10 PHP 8.4 CVEs on Debian 13. Check for 8.4.26-1~deb13u1, restart PHP-FPM or Apache mod_php, and verify the running binary.

Debian 13 fixes BIND9 and Unbound flaws (DSA-6505-1, DSA-6507-1): how to check versions, patch, restart and verify your recursive DNS resolver.

Web server security baseline for Debian 13: unattended-upgrades, key-only SSH, certbot TLS with HSTS, nftables and Fail2ban, with checks for each step.