What is the best way of getting notified of new updates that resolve CVEs?

[JAA IT Dept]

Is there a security mailing list or anything?

Thanks

 

[Charles_3CX]

You can check our security updates in the Security change log and subscribe to the blog for news and updates.

 

[aholmes-think]

Not that you've asked, but our platform pushes or can push linux updates behind the scenes if you are self-hosted.

 

[JAA IT Dept]

Not that you've asked, but our platform pushes or can push linux updates behind the scenes if you are self-hosted.

Thanks, yes we do auto update daily.

 

[aholmes-think]

Thanks, yes we do auto update daily.

Here's where they are listed if you are just looking for listing: https://nvd.nist.gov/vuln/detail/cve-2026-98432

This is the most recent i've seen.

 

[KyriacosS_3CX]

Update 10 is introducing an OS level update notification channel, so these will appear as pending updates in the PBX itself as soon as we publish them.

 

[Gasha]

Hello fellas,

auto-update is set daily for our machines as well.
They should have been completed about an hour ago, we are running Update 9 still, we compared both "pre" and "post" update package lists and version and have noticed no difference whatsoever.

The auto-update window was 10-11 am and according to the logs no update has been commited yet.
Can anyone tell us what's going on?

Thank you kindly.

 

[TheodorosG_3CX]

Security updates will apply between 2:00AM - 3:00AM server time when automatic updates is enabled.

 

[Gasha]

Security updates will apply between 2:00AM - 3:00AM server time when automatic updates is enabled.

Appreciate the quick response.

So that means we'll have to wait a bit longer until the tomorrow early EU time then?
We will check early in the morning then!

 

[Alphabetic]

Be sure to turn it on! (Update 10)

 

[bitn]

But if a kernel update is required, the VM has to be restarted. This is necessary for the new kernel to become active.

 

[SteveITS]

I’m also reading it as a daily check/install (like the SBC) as opposed to configurable. Which is arguably good for a security update, but the customer needs to know there’s a new daily window.

@Gasha You can also install them manually.

 

[aholmes-think]

Be sure to turn it on! (Update 10)

View attachment 52783

I missed that, its a great new inclusion, but some of our clients are 24/7 so that doesn't 100% work for us. Also, I'd like to be able to step these out across our systems rather than mass push. I'm an old school Windows admin so i'm bringing on the baggage of years of Microsoft misfires.

 

[SteveITS]

Does the "3CX Updates" setting still also install security updates? Or is that only with the new Security Hotfixes setting? (which I think defaults to off...?)

 

[Charles_3CX]

Does the "3CX Updates" setting still also install security updates? Or is that only with the new Security Hotfixes setting? (which I think defaults to off...?)

With U10, you must also choose to receive security updates.

 

[Evolute IT]

With U10, you must also choose to receive security updates.

Wording needs to be updated then, as it may confuse people.

 

[SteveITS]

Or maybe, if a given server previously had auto updates enabled, turn auto security updates on. Though it has the separate update window.