On 12 October 2026 Ceph shipped 19.2.7, the seventh backport in the Squid series, with the usual line: "we recommend that all deployments update to this release". Today we checked what the Proxmox repository actually serves, and the answer is 19.2.6-pve4, with an index dated 9 September. The branch dies on 31 October. Two different calendars, and the one that governs you is not the one on ceph.io.
On 8 October 2026 the NVD published 43 Brocade Fabric OS vulnerabilities on the same day. None critical, the highest 8.7, and 38 of the 43 require credentials. Those three numbers are precisely why nobody will patch this. Inside: the attacker the batch imagines does not come from the internet —it is another switch in your own fabric—, why the 7.1 on CVE-2026-87659 misleads, the maintenance-window excuse dismantled with the vendor's own documentation, the two version branches that do not line up, and four ownership questions instead of a checklist.
Dell advisory DSA-2026-448, carrying two CVSS 10.0 flaws in Container Storage Modules, is dated 1 October 2026. On 6 October we queried its thirteen own CVE identifiers against the public CVE Services API and watched them being published live, one every four or five minutes and in descending order of severity. When they reached NVD, they reached it without a CPE. Inside: the table of timestamps to the second, and why your scanner still cannot tell you whether you are affected.
The Ceph upgrade procedure on Proxmox recommends, as its fourth step, that you run "ceph osd set noout": "optional, but recommended", says the wiki. Ceph's own OSD troubleshooting page says this is "more a thought exercise" than a suggestion that anyone "in the post-Luminous world" should run it. Both sentences are published today and both are defensible. What that flag switches off is not rebalancing: it is a "down" OSD ever reaching "out", which is precisely the step that makes CRUSH recompute and recreate the missing copy. And the flag does not tell the disk you rebooted apart from the disk that genuinely died. Inside: why mon_osd_down_out_subtree_limit already brakes the scenario that actually frightens you, the chain almost nobody spells out (degraded PGs are not flagged as clean, and what is not clean is not scrubbed, so checksum verification stops on exactly the data that just lost a copy), the arithmetic of the two warnings arriving at 10.5 and 12.25 days to a dashboard that has been amber since minute one, the table of what each flag really switches off, and the four commands that do the same job on one disk or one host without touching the rest of the cluster.
A drive dies on a Tuesday and nothing happens: that is what you paid the replica for. But what you bought is not immunity, it is a window of time in which to replace the part before the next failure — and that window was calculated assuming the spare arrives tomorrow. Western Digital told its earnings call it was "pretty much sold out for calendar year 2026" and Seagate said its nearline capacity was "fully allocated" for the same period, with cloud agreements now reaching into 2027 and 2028. We run the arithmetic on Backblaze's published failure rates: with the spare in 48 hours, the probability of a second failure before the repair is 0.18%; with the spare in 20 weeks, it is 11.5%. Same design, same drives, 66 times the risk from a variable that appears in no diagram. Where it hurts most (the node, not the disk), the retention cut nobody signs off, and the six questions we ask now before approving a design.
A dead disk in a three-node cluster fixes itself provided another disk remains on that same server: the CRUSH rule descends to another OSD on the same host. A dead HOST does not. With replica 3 and the failure domain set to "host" — what Proxmox ships by default — there is no fourth place to put the third copy, so placement groups sit at active+undersized+degraded until the node comes back. And the cluster keeps serving, which is exactly why nobody looks at it. Ceph's real timers (20 seconds, 10 minutes, 15 minutes), what you cannot touch while the degraded window lasts, why recovery can cost you corosync quorum, and why the number that matters is not how many nodes you have but how many distinct places.
The array is paid for, so it stays: the cheapest-looking decision in the project and the one that changes your day-to-day the most. In Proxmox the snapshot is not taken by the hypervisor but by the storage plugin, and on a shared LUN with LVM-thick the documentation says «snapshots are not possible by default…». What fixes that has been labelled a technology preview since 9.0, and the vendor puts it in writing on its own roadmap. The seven real options and the decision tree we are willing to sign.
On 9 September Proxmox published the procedure to migrate cephx keys from aes to aes256k. The hard part is not cryptographic: it is knowing what counts as "refreshing a client". The documentation says it in six words — "A guest reboot is not enough" — and the failure does not show up when you run the command, but minutes or days later, when a ticket expires. What has changed since August, the kernel 7.0 gate, and the order we follow.
On 5 August, a commit in the Ceph documentation moved the two dates that govern the calendar of anyone running distributed storage in production: Squid went from 19 September to 31 October, and Tentacle from 18 November 2027 to 1 June 2027. The extension is visible in the chart; the 170-day cut to the version everyone is migrating to we have not seen discussed anywhere. What it means that the field is called target_eol, and why Tentacle lives 560 days where Squid lived 765.
Squid expires on 31 October and Tentacle has been in Proxmox's enterprise repository since July, so the maintenance window is no longer hypothetical. Inside it something happens that almost no plan accounts for: monitors, managers and OSDs restart separately, and the cluster spends hours — or days — split across two versions. Why "restart OSDs on one node at a time" decides your window, why calling noout "optional" is misleading, and the command most people mistake for the finish line.
A single OSD above 95% stops writes across the whole cluster even while "ceph df" still shows dozens of free terabytes. The three default thresholds (0.85 / 0.90 / 0.95), why the mechanism that repairs switches off five points before the one that serves, and the capacity calculation with one node missing that almost nobody runs: with four nodes the ceiling is 71 points, and 67 if you want the rebuild to actually finish.
Joint advisory AA26-222A, published on 10 August 2026 by six agencies, records that at one Gunra victim the actors deleted backup and archived data at the primary data centre <em>and</em> at the recovery one, before and after deploying the encryptor. Another section describes how they got the key cabinet: SSH to an access control server and a symmetric key that decrypted the passwords for enterprise server accounts across the company. Our reading: two sites that accept the same credential are one site with two postal addresses. What falls outside a retention lock, and six checks for this week — two of which have to be actually run.
On 19 August Ceph shipped Squid 19.2.6 and Tentacle 20.2.4 tagged [URGENT]. One of the four flaws is not fixed by installing anything: it forces you to rotate every CephX key in the cluster, ten manual steps, and it leaves the cluster in HEALTH_ERR in the meantime. What is inside each CVE, why anyone holding a "mon allow r" key could read your OSD LUKS passphrases, and what we found today in Proxmox's Ceph repository.
Since Ceph Quincy the scheduler for BlueStore OSDs is mClock, and the work ceiling it shares out does not come from the vendor datasheet: it comes from a benchmark each OSD runs at boot. If that measurement is discarded, you are left with 315 IOPS for a spinning disk and 21,500 for a solid-state one, whatever you bought. How to check what your cluster believes, which parameters stopped having any effect, and when the drive really is the problem.
Ceph Tentacle ships Fast EC, the erasure coding performance work people had been waiting years for. And it arrives switched off: you enable it pool by pool, with one command, and the monitor then refuses to clear it — rolling back means draining and recreating the pool. On top of that, the "at least double" in the headline was measured with a 16K stripe unit, which is precisely what an existing pool cannot have. The conditions the monitor enforces, the half of the improvement frozen on the day you created the pool, what happens to the cluster when you flip it, and why three-way replication is still faster.
Ceph's lifecycle table puts the estimated end of life of Squid (19.2) on 19 September 2026: fifty days from today. Its replacement, Tentacle (20.2), has been stable since November and Proxmox has marked it stable since 9.2. The problem is not the jump, it is that it is not a jump: it is a sequence of three maintenance windows whose order you do not get to choose, with two details almost nobody has looked at — the mgr/zabbix module is gone, and erasure coding optimisations do not switch themselves on.
TrendForce forecast second-quarter contract price rises of 58% to 63% for conventional DRAM and 70% to 75% for NAND. In one quarter, with nothing inside your company to explain it. Why the big cloud providers are hedged by multi-year contracts and you are not, how this lands in your refresh plan, what to check before signing a purchase order, and how long it lasts — with dates.
Same fault tolerance and twice the usable space: pitched like that, erasure coding sounds obvious. We run Ceph in production and our VMs are still on 3-way replication. The space math, the write math, the recovery math and the node math — and where we do use erasure coding.
To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list
Microsoft 365
ES 
CAT 
EN