What's New in Version 6.21.2

The Securonix team is pleased to announce the availability of ThreatQ version 6.21.2. Below is a list of key security updates included in this release and provides and upgrade instructions.

We strongly recommend upgrading to this version at your earliest convenience, as it includes fixes for the Node2Shell vulnerabilities. ThreatQ v5 instances are not affected. If you’re unable to upgrade or need assistance, contact Securonix Support.

Security and System Updates

The following updates have been made with ThreatQ v6.21.2:

• ThreatQ Container Images - Updated affected ThreatQ container images to use Node.js 24.22.1 and brotli-libs 1.1.1 as part of the security response to CVE-2026-111497 (Node2Shell).

• PHP Session Upload Progress - As a defense-in-depth measure related to CVE-2026-115560, session upload progress is now administratively disabled in the API PHP-FPM configuration. ThreatQ was not identified as vulnerable to this issue, but this setting is recommended.
• Express Denial-of-Service Vulnerability - Updated the Express body-parser package in the frontend and solr-backup-handler containers to a version that addresses CVE-2026-111181, a denial-of-service vulnerability.

Upgrading

Perform the following steps to upgrade your ThreatQ v6 instance.

After you start the upgrade, do not cancel the installation. Doing so will leave your system in an unusable state.

1. Perform a platform check to ensure adequate disk space and that your installed integrations are compatible with the new ThreatQ version. You will be unable to proceed with the upgrade until clearing this check. It is important to note that the command does not apply to integrations installed on third-party systems such as the ThreatQ App for QRadar.
   
   Platform Check Against the Most Recent ThreatQ Version
   # sudo /usr/local/bin/tqadmin platform check

   Copy Code

   
   Platform Check Against a Specific ThreatQ Version
   # sudo /usr/local/bin/tqadmin platform check -v 6.21.2

   Copy Code

2. Run the upgrade command:
   
   Upgrade to the Latest ThreatQ Version
   # sudo /usr/local/bin/tqadmin platform upgrade

   Copy Code

   
   Upgrade to a Specific ThreatQ Version
   # sudo /usr/local/bin/tqadmin platform upgrade -v 6.21.2

   Copy Code

New Installations

If you are installing ThreatQ version 6 for the first time, it is highly recommended that you review the ThreatQ 6x Installation section and guides before proceeding with installation. The guide provides useful information including:

• Required Firewall Ports
• Suggested Partitioning Scheme
• System Requirements (Hardware Specifications, Core CPUs, RAM etc.)
• Steps to pin your RHEL 9 and Ubuntu versions to prevent upgrades to unsupported environments
• Security Hardening Guides

Migrating ThreatQ v5 to v6

It is important that you use the correct ThreatQ version when migrating a ThreatQ v5 instance to ThreatQ v6.

• Migrating to ThreatQ v6.9.1 or greater requires a ThreatQ v5.29.5 backup file.
• Migrating to ThreatQ v6.9.0 and prior requires a ThreatQ v5.29.4 backup file.

Using a backup other than the ones listed above will result in a restore error.

Contact ThreatQ Support or your Technical Account Manager for additional information and to obtain the ThreatQ Migration Guide. The ThreatQuotient team highly recommends that you review the ThreatQ 6x Installation guide when planning your migration.

Support

As always, contact our Support Team if you encounter problems when upgrading or need assistance.

Thank you,

The Securonix Support Team

support@securonix.com
ts.securonix.com
703.574.9893