--- title: Ceph.io — v18.2.8 Reef released | daily.dev description: Ceph v18.2.8 Reef is the eighth and expected final backport release in the Reef series, and all users are recommended to update. It includes two security... canonical: https://daily.dev/posts/ceph-io-v18-2-8-reef-released-uoayuftom twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ceph.io — v18.2.8 Reef released | daily.dev og:description: Ceph v18.2.8 Reef is the eighth and expected final backport release in the Reef series, and all users are recommended to update. It includes two security... og:url: https://daily.dev/posts/ceph-io-v18-2-8-reef-released-uoayuftom og:image: https://api.daily.dev/og/posts/uoayuftOm.png og:image:alt: Ceph.io — v18.2.8 Reef released og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ceph.io — v18.2.8 Reef released **[Ceph](https://daily.dev/sources/ceph)** · 25 min read · 0 upvotes · 0 comments ## Summary Ceph v18.2.8 Reef is the eighth and expected final backport release in the Reef series, and all users are recommended to update. It includes two security fixes: preventing unprivileged CephFS clients from setting sgid/suid bits, and enforcing SMTP SSL context in the mgr/alerts module (GHSA-xj9f-7g59-m4jx). Notable fixes cover RGW bucket removal bugs, cephfs-journal-tool trimming issues, MDS stalls during rename/stat workloads, and a BlueStore performance counter bug. A known issue warns against upgrading directly from Pacific to Reef due to an OSD_UPGRADE_FINISHED warning bug, even though Pacific and Reef OSDs interoperate safely. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is it safe to upgrade directly from Ceph Pacific to Reef? Direct upgrades from Pacific to Reef are no longer recommended, out of caution, due to a bug found during v18.2.8 QA. Pacific OSDs still use a deprecated connection feature bit that was repurposed to indicate a Reef OSD, which can trigger a false OSD_UPGRADE_FINISHED warning before all OSDs are actually upgraded, even though Pacific and Reef OSDs otherwise interoperate correctly. _Teams planning a Ceph version jump can track upgrade path caveats like this via daily.dev._ ### What security vulnerabilities were fixed in Ceph 18.2.8? Ceph 18.2.8 fixes two security issues: a CephFS client bug that let unprivileged users modify the sgid or suid bits on a file when those were the only bits being changed, and a vulnerability (GHSA-xj9f-7g59-m4jx) in the mgr/alerts module where SMTP SSL context enforcement was missing, now enforced to SMTP_SSL. _Ops teams patching storage clusters can stay ahead of CVEs like these on daily.dev._ ### Is Ceph 18.2.8 Reef the last release in the Reef series? Yes, v18.2.8 is the eighth backport release in the Reef series and is expected to be the last one, released March 20, 2026. All users running Reef are recommended to update to this final release before the series reaches its planned end. _Anyone planning a Ceph lifecycle migration can follow release timelines like this on daily.dev._ ## Similar posts on daily.dev - [Ceph.io — \[CVE\] \[URGENT\] Squid v19.2.6 and Tentacle v20.2.4 released](https://daily.dev/posts/ceph-io-cve-urgent-squid-v19-2-6-and-tentacle-v20-2-4-released-bzynabdep) · Ceph · 5 upvotes · 0 comments - [PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 Released\!](https://daily.dev/posts/postgresql-18-2-17-8-16-12-15-16-and-14-21-released--nnaoaiphj) · PostgreSQL · 7 upvotes · 1 comments --- Tags: [#open-source](https://daily.dev/tags/open-source) [View this post on daily.dev](https://daily.dev/posts/ceph-io-v18-2-8-reef-released-uoayuftom) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ceph.io — v18.2.8 Reef released","url":"https://daily.dev/posts/ceph-io-v18-2-8-reef-released-uoayuftom","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ceph-io-v18-2-8-reef-released-uoayuftom"},"datePublished":"2026-08-23T12:18:13.950Z","dateModified":"2026-08-23T12:23:18.671Z","description":"Ceph v18.2.8 Reef is the eighth and expected final backport release in the Reef series, and all users are recommended to update. It includes two security...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f74055db56e6d16258a5804db5001afd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f74055db56e6d16258a5804db5001afd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Ceph","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ceph","logo":"https://media.daily.dev/image/upload/s--nHzZM4Ap--/f_auto,q_auto/v1787487446/logos/ceph?_a=BAMAMicg0","url":"https://daily.dev/sources/ceph"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ceph-io-v18-2-8-reef-released-uoayuftom","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"open-source","timeRequired":"PT25M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ceph","item":"https://daily.dev/sources/ceph"},{"@type":"ListItem","position":3,"name":"Ceph.io — v18.2.8 Reef released"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ceph-io-v18-2-8-reef-released-uoayuftom#faq","mainEntity":[{"@type":"Question","name":"Is it safe to upgrade directly from Ceph Pacific to Reef?","acceptedAnswer":{"@type":"Answer","text":"Direct upgrades from Pacific to Reef are no longer recommended, out of caution, due to a bug found during v18.2.8 QA. Pacific OSDs still use a deprecated connection feature bit that was repurposed to indicate a Reef OSD, which can trigger a false OSD_UPGRADE_FINISHED warning before all OSDs are actually upgraded, even though Pacific and Reef OSDs otherwise interoperate correctly. Teams planning a Ceph version jump can track upgrade path caveats like this via daily.dev."}},{"@type":"Question","name":"What security vulnerabilities were fixed in Ceph 18.2.8?","acceptedAnswer":{"@type":"Answer","text":"Ceph 18.2.8 fixes two security issues: a CephFS client bug that let unprivileged users modify the sgid or suid bits on a file when those were the only bits being changed, and a vulnerability (GHSA-xj9f-7g59-m4jx) in the mgr/alerts module where SMTP SSL context enforcement was missing, now enforced to SMTP_SSL. Ops teams patching storage clusters can stay ahead of CVEs like these on daily.dev."}},{"@type":"Question","name":"Is Ceph 18.2.8 Reef the last release in the Reef series?","acceptedAnswer":{"@type":"Answer","text":"Yes, v18.2.8 is the eighth backport release in the Reef series and is expected to be the last one, released March 20, 2026. All users running Reef are recommended to update to this final release before the series reaches its planned end. Anyone planning a Ceph lifecycle migration can follow release timelines like this on daily.dev."}}]} ```