MySQL 8.0 Gets Nothing in Oracle’s October 2026 Update, and Ubuntu 24.04 Lists New MySQL Entries as Needs Evaluation: Check What Your Server Runs
Oracle released its October 2026 Critical Patch Update on October 20. The MySQL Server entries in it cover versions 8.4.0 to 8.4.12, 9.7.0 to 9.7.3 and 26.7.0 to 26.7.1. MySQL 8.0 is not in that list. If your Ubuntu 24.04 server runs mysql-server-8.0, which is the only MySQL server package Ubuntu 24.04 installs by default, that is worth ten minutes of your attention today.
The short version: Oracle moved 8.0 to Sustaining Support in April, Ubuntu still patches its own 8.0 package, and on October 23 Ubuntu’s tracker added new MySQL entries for 24.04 with the status Needs evaluation. So today there is no new 8.0 fix to install, and the useful work is to confirm what your server has, who can reach it, and when you will move to a supported branch. This post shows the three commands I typed on my own server and what they printed.
Quick guide
- Read your version and the Ubuntu package state.
- Read the package changelog to see which Oracle update Ubuntu last applied to 8.0.
- Check who can reach the port. A database bound to 127.0.0.1 is a much smaller problem than one open to a network.
- Pick a date to move to 8.4 LTS and take a backup before you do.
What the sources say, and where they disagree
| Question | Answer | Source |
|---|---|---|
| Which MySQL Server versions are in the October update? | 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, 26.7.0 to 26.7.1 | Oracle CPU October 2026 |
| Is MySQL 8.0 still supported? | Oracle’s notice dated April 21, 2026 says 8.0 is covered under Oracle Sustaining Support and recommends upgrading to 8.4 LTS or 9.7 LTS | MySQL end of life notice |
| Did 8.0 get any of the 98 MySQL patches? | One analysis says no, and that absence from the advisory is the absence of a test result, not a clean result | endoflife.ai |
| Does Ubuntu list new MySQL 8.0 entries? | Yes, new entries published October 23 with 24.04 status Needs evaluation | Ubuntu tracker, CVE-2026-101806 |
The sources do not fully agree. The general FAQ in the MySQL 8.4 reference manual still says 8.0 is actively supported for production use, while Oracle’s own notice moves it to Sustaining Support and endoflife.ai gives April 30, 2026 as the end of life date. I could not find a page that spells out what Sustaining Support means for security fixes, and I could not open the MySQL risk matrix inside the Oracle advisory, so I have not listed individual CVEs or scores. The 98 figure is the one endoflife.ai quotes, and I did not count the patches myself.
Step 1: what is my server running
Type these commands. The first shows the client and server version, the second shows the Ubuntu package state, and the third reads the first lines of the package changelog:
mysql --versionapt-cache policy mysql-server-8.0 | head -3apt changelog mysql-server-8.0 2>/dev/null | sed -n "2,5p"Then count how many distinct 2026 CVE numbers the changelog mentions, and whether any of the new 101xxx numbers from Ubuntu’s tracker are in it yet. Last, check where MySQL listens:
apt changelog mysql-server-8.0 2>/dev/null | grep -oE "CVE-2026-[0-9]+" | sort -u | wc -lapt changelog mysql-server-8.0 2>/dev/null | grep -cE "CVE-2026-101[0-9]+"ss -ltn | grep -E "3306|33060"
My server runs 8.0.46-0ubuntu0.24.04.4. The newest entry in its changelog is a security update from Ubuntu on August 26 that applies the July 2026 Oracle fixes. The changelog names 62 distinct 2026 CVE numbers in total, and none of the new CVE-2026-101xxx numbers yet. That matches what Ubuntu’s own tracker says:
The tracker’s summary for this entry says it concerns the MySQL Connectors product, so I would not assume it affects the server package at all. That is exactly what Needs evaluation means: Ubuntu has not decided yet. I only opened two of the new entries, so I cannot say how the rest will be classified. Both said Needs evaluation for 24.04 and both were published on October 23.
Step 2: how exposed is it
The last command in step 1 shows MySQL listening on 127.0.0.1 for both the classic port 3306 and the X Protocol port 33060. Only programs on the same machine can connect. If yours shows 0.0.0.0 or a public address instead, treat that as the first thing to fix, ahead of any version question, by setting bind-address = 127.0.0.1 or by firewalling the port.
Step 3: plan the move to 8.4 LTS
- Backup first: take a logical dump with
mysqldumpand test that you can restore it on another machine. - Pick the target: Oracle names 8.4 LTS and 9.7 LTS in its notice. Ubuntu’s tracker shows
mysql-8.4as a package on 26.04 LTS and not on 24.04, so on 24.04 you would use Oracle’s own repository or move the host to a newer Ubuntu release. I did not do either on my server. - Test your application against 8.4 before you cut over, because 8.4 removes some legacy behavior.
- Keep applying Ubuntu updates in the meantime, since Ubuntu is the one still shipping 8.0 fixes for 24.04.
Same pattern as in my nginx post: a headline number on paper, and a short check of what your own system actually has.
Caveats
I checked one server and two of the new tracker entries. I did not open Oracle’s MySQL risk matrix, so I cannot tell you which of the 98 patches are rated 9.8 or whether any applies to 8.0. The statement that 8.0 received nothing comes from the advisory’s version list and from one secondary analysis. What I verified myself is what my package contains and what Ubuntu’s tracker shows today.
FAQ
Is MySQL 8.0 end of life?
Oracle’s April 21, 2026 notice says 8.0 is covered under Oracle Sustaining Support and tells users to upgrade to 8.4 LTS or 9.7 LTS. One analysis gives April 30, 2026 as the end of life date, while the 8.4 manual’s FAQ still describes 8.0 as actively supported, so read Oracle’s notice for your own contract.
Does Ubuntu 24.04 still patch MySQL 8.0?
Yes, it did most recently on August 26, 2026, for the July Oracle update. For the October entries, Ubuntu’s tracker shows Needs evaluation for 24.04.
Should I upgrade to 8.4 today?
Plan it, but do not rush it. Take a tested backup, try your application on 8.4 first, and choose a maintenance window.
How do I check which address MySQL listens on?
Run ss -ltn and look for ports 3306 and 33060. 127.0.0.1 means local connections only.
Is MariaDB affected by the Oracle update?
I did not check. The Oracle advisory covers Oracle MySQL, and MariaDB is a separate project with its own advisories.
