Linux Compatible

Arch Linux Halts AUR Adoption After Third Wave of Malware Attack

Arch Linux 984 Published 2026-07-31 20:54 by Philipp Esselbach 0

Arch Linux disabled package adoption on the Arch User Repository on July 30 following a third sustained wave of malicious takeovers dubbed "Atomic Arch." The campaign began in late May when attackers started adopting orphaned packages and embedding compiled ELF binaries directly into build scripts, effectively bypassing the npm and JavaScript-based detection methods that caught the earlier waves. Despite Arch developers declaring the repository clean in mid-June after purging more than 1,900 compromised packages, the threat quickly escalated with obfuscated downloaders and static payloads that execute during the makepkg build phase. The ongoing crisis has exposed the fundamental tension between an open, community-maintained repository and supply-chain security, leaving adoption temporarily frozen while the ecosystem develops more robust trust and detection mechanisms.

Mabox Linux 26.07 Drops Tint2 Tray Fix and FSearch 0.3

MaboxLinux 31 Published 2026-07-31 20:11 by Philipp Esselbach 0

Mabox Linux 26.07 is delivering a downstream patch to tint2 that resolves system-tray freezes triggered by Steam, Lutris, and other X11 status icon applications. The release also upgrades the default FSearch utility to version 0.3, introducing real-time inotify-based filesystem monitoring and per-folder indexing schedules. Under the hood, the ISO inherits Manjaro Stable updates that bring new Mesa drivers, VirtualBox, and System76's COSMIC 1.2 session into an Openbox-focused environment. Available in both Linux 6.18 LTS and 6.6 LTS variants, the build continues the project's monthly cadence for efficiency-driven desktop users.

Devolutions Drops UniGetUI v2026.2.7: Usability Tweaks and Bug Fixes

Software 44643 Published 2026-07-31 19:58 by Philipp Esselbach 0

Devolutions just dropped UniGetUI v2026.2.7, a maintenance patch arriving just two days after the previous update to keep pace with the project's weekly release cadence. The refresh brings configurable environment variable syntax for install paths, clickable operation cards that open live logs directly, and the return of the desktop shortcut prompt that went missing in an earlier release. Developers also squashed a text input bug blocking immersive dialogs during multi-step wizards and rolled out several localization fixes following the recent WinUI-to-Avalonia migration. You can grab the ~27 MB portable build via winget install marticliment.UniGetUI or pull it directly from the GitHub releases page.

pgAdmin 4 v9.17 Released: 7 CVEs Fixed, New Row Cap, and Electron 43 Upgrade

Software 44643 Published 2026-07-31 19:50 by Philipp Esselbach 0

pgAdmin 4 v9.17 dropped on July 30, 2026, addressing seven security vulnerabilities including critical command injection and credential cloning flaws, with three stemming from incomplete patches in the previous release. The update introduces four practical enhancements, led by a new row count cap for the View Data action that helps prevent accidental full-table scans on large databases. Under the hood, the application upgrades to Electron 43.1.1, pins Yarn to 4.15.0, and implements stricter supply chain hardening across the macOS build process and GitHub Actions. Operators running server mode, especially those using shared servers or external authentication, should apply the patch immediately.

Liquorix Kernel 7.1-7 Shipped: Linux 7.1.5 Update Drops irqbalance for Lower Latency

Debian 11017 Ubuntu 7171 Arch Linux 984 Published 2026-07-31 19:38 by Philipp Esselbach 0

Liquorix linux-liquorix 7.1-7 released on July 31, 2026, bringing a single focused packaging change: stripping out the irqbalance recommendation and disabling the service during installation. The kernel remains based on Linux 7.1.5, continuing a rapid 18-day sprint that has produced seven releases as the project aggressively converges scheduler logic with upstream mainline. Available now for Debian and Ubuntu on amd64, the update is the latest step in an enthusiast kernel built specifically for interactive responsiveness and gaming workloads over background automation.

KDE Neon 20260730 Build Released: Rolling Plasma 6 on Ubuntu 24.04 LTS

KDE 1756 Published 2026-07-31 10:28 by Philipp Esselbach 0

KDE neon has released its latest build, dated 20260730-0522, continuing to deliver rolling KDE software straight from upstream on a stable Ubuntu 24.04 LTS base. The distribution maintains multiple edition tracks, including stable, testing, unstable, and developer variants, while officially supporting only Intel and AMD graphics with open-source drivers.

ASUS Zenbook A16 Laptop, Minisforum MS-02 Ultra Mini PC, Noctua NL-LC1-24 Liquid Cooler, and ROG Strix X870E-A Motherboard Tested

Reviews 52704 Published 2026-07-31 09:50 by Philipp Esselbach 0

The ASUS Zenbook A16 uses a Snapdragon X2 Elite processor and a 16-inch 3K OLED panel to deliver lightweight performance for mobile professionals. Minisforum builds the MS-02 Ultra as a compact desktop station featuring a 285HX chip, 25-Gigabit networking ports, and plenty of internal expansion slots. Noctua NL-LC1-24 AIO coolers beat top air designs by six degrees Celsius under heavy workloads while operating significantly quieter at the same time. ASUS ROG Strix X870E-A Gaming WiFi7 Neo boards pair solid thermal management with a bright aesthetic to support next-generation AMD processors for custom desktops.

Computers: ASUS Zenbook A16 (UX3607OA) Review - Snapdragon Laptops are Getting Better and Better, Minisforum MS-02 Ultra Test: Workstation Mini-PC with 285HX
Cooling: Noctua NL-LC1-24 Review
Motherboards: ASUS ROG Strix X870E-A Gaming WiFI7 Neo Review - A New Enticing Option

Ungoogled Chromium 151 Released with 370 Security Fixes and Stripped Google Services

Software 44643 Published 2026-07-31 09:31 by Philipp Esselbach 0

Ungoogled Chromium 151.0.7922.71-1 has been released, delivering the exact same rendering engine and 370 upstream security fixes as Google's latest Stable channel release. The build gutters every Google service integration at compile time, including telemetry, Safe Browsing, and AI features, while replacing the default domain routing with a private pseudo-TLD. Linux users can grab the archive straight from the project's CI artifacts today, though Windows and macOS builds will lag slightly behind for the upcoming .72 patch. A growing Speedometer benchmark gap suggests the patch layer still carries noticeable overhead, but the privacy baseline keeps drawing a steady crowd to the repository.

PHP 8.2.33, 8.3.33, 8.4.24, and 8.5.9 Updates: Fix 3 CVEs in Fedora and RHEL Packages

Fedora Linux 9436 Published 2026-07-31 09:12 by Philipp Esselbach 0

PHP's July 30 security release fixes three CVEs, including a SQL injection in PostgreSQL extensions and a stack overflow in Phar archives. Remi Collet published corresponding RPM packages for Fedora ≥42 and Enterprise Linux ≥8 on July 31, covering PHP 8.5.9, 8.4.24, 8.3.33, and 8.2.33. The updates are available via remi-modular repository or as parallel Software Collections installations. PHP 8.1 has reached end-of-life, so users should upgrade to at least 8.2.33 immediately.

Ruby-Sinatra, libinput, Python 2.7/3.5, and OpenSSL updates for Ubuntu

Ubuntu 7171 Published 2026-07-31 08:54 by Philipp Esselbach 0

Ubuntu published security notices covering four separate vulnerabilities across its long-term support releases. Ruby-sinatra requires an update to block remote denial of service attacks caused by malformed header parsing. Desktop environments need patches for a libinput privilege escalation flaw, while older Python installations must address resource exhaustion and HTML parser crashes. The OpenSSL update resolves the HollowByte memory allocation bug that enables network-based denial of service attacks, though Ubuntu 22.04 and newer users must reboot their machines to apply the changes.

[USN-8624-1] Sinatra vulnerability
[USN-8602-1] libinput vulnerability
[USN-8614-1] Python vulnerabilities
[USN-8625-1] OpenSSL vulnerability

Python, Kubernetes APIservers, Tomcat, Java, and GraphicsMagick updates for SUSE

SUSE 5724 Published 2026-07-31 08:52 by Philipp Esselbach 0

Kernel, OpenSSH, Perl, Firefox, Vim, and Node.js Nodemon updates for Rocky Linux

Rocky Linux 968 Published 2026-07-31 08:48 by Philipp Esselbach 0

Rocky Linux has issued multiple security advisories affecting kernel, OpenSSH, Perl, Firefox, nodejs-nodemon, vim, fence-agents, python-pillow, and firewalld across versions 8, 9, and 10. Most updates carry an important severity rating, including patches for perl:5.32 which encompasses a wide range of sub-modules, while two items, the firewalld fix on Rocky Linux 10 and the OpenSSH update on Rocky Linux 8, hold moderate ratings. Each advisory provides Common Vulnerability Scoring System base scores linked to specific CVE identifiers so system administrators can assess the exact risk level for their environments. Users should install these errata promptly to address security flaws and incorporate the reported bug fixes and enhancements into their systems.

RLSA-2026:47040: Important: kernel security, bug fix, and enhancement update
RLSA-2026:47756: Important: openssh security update
RLSA-2026:47757: Important: openssh security update
RLBA-2026:28238: Moderate:firewalld bug fix and enhancement update
RLSA-2026:47101: Important: firefox security update
RLSA-2026:48032: Important: nodejs-nodemon security update
RLSA-2026:47982: Important: vim security update
RLSA-2026:47736: Important: fence-agents security update
RLSA-2026:47755: Moderate: openssh security update
RLSA-2026:48021: Important: python-pillow security update
RLSA-2026:48225: Important: perl:5.32 security update

Hplip, Openssh, Kernel, Node.js, and more updates for RHEL

Red Hat 9475 Published 2026-07-31 08:44 by Philipp Esselbach 0

Unbound, DokuWiki, Pack, NASM, Valkey, Lego, and libnbd updates for Fedora

Fedora Linux 9436 Published 2026-07-31 08:41 by Philipp Esselbach 0

Fedora released security patches for versions 43 and 44 targeting unbound, dokuwiki, pack, nasm, valkey, lego, and libnbd to address over thirty confirmed CVEs. The vulnerabilities span denial of service attacks through DNS-over-QUIC pressure, remote code execution via TLS connection flaws in Valkey, cache poisoning exploits in Unbound, and privilege escalation risks within containerd used by Pack. System administrators can apply the fixes immediately by running the corresponding DNF advisory commands for each affected package. Delaying these installations leaves servers exposed to memory corruption, unauthorized command execution, and data integrity breaches that attackers could exploit without authentication.

Fedora 43 Update: unbound-1.25.2-1.fc43
Fedora 43 Update: dokuwiki-20250514b-4.fc43
Fedora 43 Update: pack-0.40.8-1.fc43
Fedora 43 Update: nasm-2.16.03-5.fc43
Fedora 43 Update: valkey-8.1.9-1.fc43
Fedora 43 Update: lego-5.3.1-2.fc43
Fedora 43 Update: libnbd-1.24.3-1.fc43
Fedora 44 Update: dokuwiki-20250514b-6.fc44
Fedora 44 Update: pack-0.40.8-1.fc44
Fedora 44 Update: valkey-9.0.5-1.fc44

Expat, Libraw, ImageMagick, Gsasl, and Ruby-Rack updates for Debian

Debian 11017 Published 2026-07-31 08:39 by Philipp Esselbach 0

Debian issued security advisories addressing critical vulnerabilities in the expat, libraw, imagemagick, gsasl, and ruby-rack packages. The patches resolve integer overflows, heap buffer overflows, memory disclosure flaws, and arbitrary code execution risks that could allow attackers to crash systems or run unauthorized commands via malformed inputs. Detailed findings include multipart smuggling and denial-of-service vectors in ruby-rack, regex injection flaws in imagemagick and libraw, and missing input sanitization in the gsasl NTLM client.

[DSA 6404-1] expat security update
ELA-1790-1 libraw security update (by )
ELA-1789-1 imagemagick security update (by )
[DLA 4707-1] gsasl security update
[DLA 4706-1] ruby-rack security update

Node.js, OpenSSH, and Vim updates for AlmaLinux

AlmaLinux 2616 Published 2026-07-31 08:36 by Philipp Esselbach 0

AlmaLinux issued five security errata addressing critical vulnerabilities in Node.js versions 22 and 24, OpenSSH clients, and Vim across its Linux distributions. The advisories resolve denial-of-service flaws in the brace-expansion and tar libraries that impact Node.js packages, while a distinct Vim patch targets arbitrary code execution risks arising from malicious Python docstrings and crafted tags files used during omni-completion. OpenSSH updates mitigate severe threats including remote man-in-the-middle attacks via X11 forwarding, client-side denials of service triggered by double-free errors in DH-GEX validation, heap out-of-bounds reads in GSSAPI cleanup, use-after-free conditions during host key re-exchange, and scp file misplacement issues.

ALSA-2026:48034: nodejs24 security update (Important)
ALSA-2026:48032: nodejs-nodemon security update (Important)
ALSA-2026:48033: nodejs22 security update (Important)
ALSA-2026:47757: openssh security update (Important)
ALSA-2026:48703: vim security update (Important)
ALSA-2026:47755: openssh security update (Moderate)

Xen Project 4.22 Released: AMD Zen 5 BLT, FRED Support, and Automotive Safety Updates

Software 44643 Published 2026-07-30 22:06 by Philipp Esselbach 0

The Xen Project has officially released version 4.22, pushing the date back from its original schedule to ensure embargo-expiring security fixes land simultaneously with the public announcement. The update brings critical hardware support including AMD Zen 5 Bus Lock Threshold handling and Intel FRED, alongside significant advancements in cloud scalability via per-domain Xenstore quotas and Arm-based guest power management. Major industry players like Honda, Ford, and Renesas are leveraging the release for software-defined vehicles and functional safety certification, solidifying the hypervisor's niche in mixed-criticality systems where competitors like KVM fall short.

Fedora Splits Community Architect Role for New AI Alignment Seat

Fedora Linux 9436 Published 2026-07-30 21:49 by Philipp Esselbach 0

Red Hat has split Fedora’s top community leadership position into two dedicated roles, with Shaun McCance inheriting the traditional Fedora Community Architect seat and Justin Wheeler moving into a newly created AI Alignment Community Architect position. The transition runs through the Fedora Linux 45 release in October 2026, giving McCance time to take over event logistics, budget stewardship, and Fedora Council representation while Wheeler focuses on aligning default AI services with the project’s four founding principles.

XanMod Linux Kernel 6.18.41 LTS Released with LLVM Builds and Heavy Patchset

Debian 11017 Ubuntu 7171 Published 2026-07-30 21:36 by Philipp Esselbach 0

XanMod Linux Kernel 6.18.41-xanmod1 arrived today and built on top of upstream Linux 6.18.41 LTS. The kernel compiles with LLVM ThinLTO across three x86-64 ABI tiers and applies a curated collection of performance patches, including Google BBRv3, AMD 3D V-Cache optimization, and Cloudflare TCP Collapse. This point release prioritizes stability by backporting Thomas Gleixner's fixes for posix-cpu-timers use-after-free vulnerabilities and timer arm callback validation. The 6.18 branch provides long-term support through December 2028 and bundles NVIDIA graphics drivers for both open and proprietary stacks.

Zen Browser 1.21.10b Linux Release: Firefox 153.0.1 Fix Brings Workspace Polish and Performance Tweaks

Software 44643 Published 2026-07-30 21:24 by Philipp Esselbach 0

Zen Browser 1.21.10b drops five days after its predecessor, shipping the Firefox 153.0.1 engine with a sharp focus on Linux workflow stability. The release skips Windows-specific RTX and HDR patches but delivers critical fixes for Spaces crashes, accidental workspace switching, and broken CSS overrides in Boosts. Released by @mr-cheffy with a verified GPG signature, the build emphasizes a rapid five-day cadence across both the stable Release and Twilight canary channels. Linux users chasing a faster, more polished Firefox fork should install this patch to smooth out the desktop experience.

Exim 4.100 Release Candidate 1 Available for Testing

Software 44643 Published 2026-07-30 21:12 by Philipp Esselbach 0

Exim 4.100-RC1 has arrived in the official testing directory. The release stays firmly within the 4.x line, but two decades of incremental development have finally been packaged under a century mark, bringing native SPF/DKIM/DMARC authentication, dynamic loadable modules, and expanded taint tracking to the long-lived codebase. Operators should audit their configurations against removed legacy drivers and patched log formats, as 4.100-RC1 also closes four confirmed CVEs including a musl-specific DNS crash and a JSON heap corruption flaw. The release candidate is available now for review, though the stable 4.99.5 build remains the production default until the RC testing period concludes.

HestiaCP 1.9.8 Released: Security Hardening Follows Rapid 1.9.7 Patch Haul

Software 44643 Published 2026-07-30 20:52 by Philipp Esselbach 0

HestiaCP released version 1.9.8, just two weeks after addressing nine critical CVEs in 1.9.7. The new update hardens access controls around the ROOT_USER account to prevent privilege escalation and patches cross-site scripting in notifications alongside command injection risks in the backup queue. Functional fixes address a regression in the SFTP jail feature that broke connectivity for jailed users, as well as broken FTP certificate reloading and corrupted JSON output from SSL queries.

Linux Kernel LTS Releases 5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, and 6.18.41 Fix 16-Year-Old POSIX Timer UAF Race

Linux 3397 Published 2026-07-30 20:40 by Philipp Esselbach 0

Greg Kroah-Hartman released six coordinated Linux kernel stable versions this past Thursday, with every currently-supported longterm branch receiving the exact same critical patch. The fix targets a 16-year-old use-after-free vulnerability in the POSIX CPU timers subsystem caused by a race condition between sys_timer_delete() and non-leader exec() calls. Independently discovered by researchers Wongi Lee and Jungwoo Lee, the bug could silently disable timers or enable local privilege escalation on multi-threaded systems. Thomas Gleixner's four-part patch lands across all six branches, with 6.18.41 additionally picking up a preparatory callback update while stable maintainers continue merging dozens of branch-specific fixes behind the scenes.

ASUS ROG GR70, Alienware Area-51, MSI Models, Noctua Cooling, and AULA Keyboard Reviews

Reviews 52704 Published 2026-07-30 09:44 by Philipp Esselbach 0

Tech reviewers tested several new desktop and mini PC options, including the compact ASUS ROG GR70 with an RTX 5070 Laptop GPU, the Alienware Area-51 featuring a Ryzen 7 9850X3D processor, and two MSI models packing Panther Lake silicon and Core Ultra 9 chips. Each system demonstrated strong performance across gaming, productivity, and AI workloads while highlighting different design approaches to small form factor computing. On the cooling front, Noctua released a 360mm liquid CPU cooler that prioritizes quiet operation and solid build quality for both Intel and AMD platforms. Input device enthusiasts received an early look at AULA's compact 60% gaming keyboard built around magnetic switch technology.

Computers: ASUS ROG GR70 Mini PC Review, Alienware Area-51 Review: Ryzen 7 9850X3D Powered Elite Gaming, MSI Cubi NUC AI+ 3MG review: Panther Lake in an understated mini PC, MSI MEG Vision X AI review: a powerful gaming PC with a useful built-in screen
Cooling: Noctua NL-LC1-36 Liquid CPU Cooler Review
Input: AULA AG60 Pro Keyboard Review

UniGetUI v2026.2.6: WinUI Refresh, CSV Exports and Bug Fixes

Software 44643 Published 2026-07-30 09:25 by Philipp Esselbach 0

Devolutions released UniGetUI v2026.2.6, landing a polish-heavy update that refreshes the interface with WinUI-inspired overlays and adds CSV export for installed packages and available updates. The release marks four months of active stewardship since the company acquired the project, focusing on visual parity with Windows 11, richer operation history tracking, and smarter settings management. Real-world pain points take priority in this cycle, with targeted fixes for WinGet update loops, PowerShell scope mismatches, silent install location overrides, embedded web content memory leaks, and background UAC prompts. For users juggling WinGet, Scoop, Chocolatey, Homebrew, and dozens of other package managers, v2026.2.6 delivers the kind of day-to-day friction reduction that signals a truly mature open-source tool.

Shelly 3.0.1 Released: AUR Detail View and Flatpak Fixes for Arch Linux

Software 44643 Published 2026-07-30 09:17 by Philipp Esselbach 0

Seafoam-Labs released Shelly 3.0.1 on July 30, consolidating twelve pull requests to polish Arch Linux's GTK4-based package manager. The update adds a --detail flag for AUR metadata, a persistent --install-path option for AppImages, and a dedicated Flatpak dialog that loads on demand. Critical bug fixes include rewritten package selection logic that prioritizes exact matches, added keybinding support for dialog interactions, and targeted GNOME compatibility improvements. Available now via CachyOS repositories, the AUR, or from source, Shelly 3.0.1 builds on a stable foundation with upcoming features focused on repository modification and offline updates.

NVIDIA, Azure FIPS, IBM, Raspberry Pi, and KVM Kernel updates for Ubuntu

Ubuntu 7171 Published 2026-07-30 09:04 by Philipp Esselbach 0

Ubuntu released a batch of security notices to patch critical vulnerabilities across its Linux kernel variants for NVIDIA, IBM, Azure FIPS, Raspberry Pi, and KVM platforms. The updates fix logic flaws in networking subsystems like XFRM ESP-in-TCP alongside issues affecting storage drivers, file systems, and multiple processor architectures across Ubuntu versions ranging from 18.04 LTS to 26.04 LTS. Administrators must run a standard system upgrade followed by a manual reboot to fully apply the patches and activate the security fixes. Users relying on custom kernel modules will need to recompile those packages because the new version numbers reflect an unavoidable Application Binary Interface change.

[USN-8623-1] Linux kernel (NVIDIA) vulnerabilities
[USN-8622-1] Linux kernel (NVIDIA) vulnerabilities
[USN-8615-1] Linux kernel vulnerabilities
[USN-8616-1] Linux kernel (IBM) vulnerabilities
[USN-8620-2] Linux kernel (Azure FIPS) vulnerabilities
[USN-8547-2] Linux kernel (Azure FIPS) vulnerabilities
[USN-8615-2] Linux kernel (Raspberry Pi) vulnerabilities
[USN-8617-1] Linux kernel (KVM) vulnerabilities

Rsyslog, Gimp, Openvpn, Xen, and Java 17 updates for SUSE

SUSE 5724 Published 2026-07-30 09:00 by Philipp Esselbach 0

Kernel, Firefox, PHP, Nginx, and more for Rocky Linux

Rocky Linux 968 Published 2026-07-30 08:56 by Philipp Esselbach 0

Quarkus 3.27.4.SP3, Kernel Modules for RHEL SAP and EUS, OpenShift 4.18/4.19, Gstreamer, Nodejs22, Grafana, and MariaDB Connector C updates for RHEL

Red Hat 9475 Published 2026-07-30 08:53 by Philipp Esselbach 0

Kernel, golang, nginx, openssl, podman, and freerdp updates for Oracle Linux

Oracle Linux 6523 Published 2026-07-30 08:51 by Philipp Esselbach 0

Oracle Linux released multiple security advisories for version 10 that update core system packages including the Unbreakable Enterprise kernel, golang, openssl, podman, nginx, freerdp, libreswan, and mariadb-connector-c across x86_64 and aarch64 architectures. These patches resolve dozens of assigned CVEs covering memory corruption flaws, arbitrary code execution risks, and denial-of-service vulnerabilities alongside specific driver regressions in the arm64 ACPI subsystem and virtio_pci networking stack. Oracle Linux Premier Support subscribers can use Ksplice to patch out-of-bounds memory access flaws in the IPv6 networking stack and RDMA RXE driver on OL7 and OL8 systems without restarting their servers.

ELSA-2026-43505 Important: Oracle Linux 10 mariadb-connector-c security update
ELBA-2026-500062 Unbreakable Enterprise kernel bug fix update
ELSA-2026-46398 Important: Oracle Linux 10 libreswan security update
New Ksplice updates for UEKR6 5.4.17 on OL7 and OL8
ELSA-2026-29980 Moderate: Oracle Linux 10 golang security, bug fix, and enhancement update
ELBA-2026-39326 Oracle Linux 10 openssl bug fix and enhancement update
ELSA-2026-24386 Important: Oracle Linux 10 podman security update
ELSA-2026-18289 Important: Oracle Linux 10 podman security update
ELSA-2026-19142 Moderate: Oracle Linux 10 freerdp security update
ELSA-2026-29874 Important: Oracle Linux 10 nginx security update
ELBA-2026-500086 xfsprogs bug fix update
ELSA-2026-46394 Important: Oracle Linux 10 go-fdo-client security update
ELSA-2026-37072 Important: Oracle Linux 10 podman security, bug fix, and enhancement update

WordPress, Node.js 24, Nginx 1.30.4, Unbound, ProFTPD, Squid, libssh, and Perl-HTTP-Date updates for Fedora

Fedora Linux 9436 Published 2026-07-30 08:48 by Philipp Esselbach 0

Fedora pushed a large batch of security patches to both Fedora 43 and Fedora 44. The release tackles serious flaws across WordPress 6.9.5, Node.js 24, Nginx 1.30.4, Unbound, ProFTPD, Squid, libssh, and Perl-HTTP-Date. System administrators gain fixes for remote code execution risks in the WordPress REST API, heap buffer overflows in Unbound, denial of service threats inside Node.js undici libraries, and cache poisoning flaws across several network services.

Fedora 44 Update: libssh-0.12.2-1.fc44
Fedora 44 Update: unbound-1.25.2-1.fc44
Fedora 44 Update: proftpd-1.3.9c-3.fc44
Fedora 44 Update: squid-7.6-1.fc44
Fedora 44 Update: nodejs24-24.18.0-1.fc44
Fedora 44 Update: wordpress-6.9.5-1.fc44
Fedora 43 Update: proftpd-1.3.9c-3.fc43
Fedora 43 Update: wordpress-6.9.5-1.fc43
Fedora 43 Update: nginx-mod-fancyindex-0.6.0-8.fc43
Fedora 43 Update: nginx-mod-vts-0.2.4-13.fc43
Fedora 43 Update: nginx-mod-modsecurity-1.0.4-16.fc43
Fedora 43 Update: nginx-mod-brotli-1.0.0~rc-13.fc43
Fedora 43 Update: nginx-1.30.4-1.fc43
Fedora 43 Update: nginx-mod-naxsi-1.6-21.fc43
Fedora 43 Update: nginx-mod-headers-more-0.40-3.fc43
Fedora 43 Update: perl-HTTP-Date-6.08-1.fc43

Calibre and NSS updates for Debian

Debian 11017 Published 2026-07-30 08:45 by Philipp Esselbach 0

Debian issued two security advisories, addressing critical flaws in the calibre e-book manager and the nss cryptography library. The calibre update (DLA-4705-1) resolves five vulnerabilities across CVE-2026-27810, CVE-2026-27824, CVE-2026-30853, CVE-2026-33205, and CVE-2026-33206, which include path traversal risks in the RocketBook plugin, HTTP response header injection, brute-force protection bypasses via spoofed headers, and server-side request forgery that could expose data from the ebook sandbox. The nss advisory (DSA-6403-1) fixes CVE-2026-16389 in the Mozilla Network Security Service library, where processing a maliciously crafted certificate could trigger arbitrary code execution. Users running Debian 11 bullseye should upgrade calibre to version 5.12.0+dfsg-1+deb11u5 immediately, while trixie users must apply nss update 2:3.110-1+deb13u4 to close these security gaps.

[DLA 4705-1] calibre security update
[DSA 6403-1] nss security update

Gstreamer1-plugins-bad-free, Rest, NodeJS, and more updates for AlmaLinux

AlmaLinux 2616 Published 2026-07-30 08:42 by Philipp Esselbach 0

AlmaLinux released a batch of important security errata, targeting multiple core libraries across both the AlmaLinux 8 and 10 operating systems. The updates address memory corruption flaws in gstreamer1-plugins-bad-free, libXfont2, rest, nodejs versions 22 and 24, and libtiff that could allow remote code execution or cause system crashes. Administrators will also find patches for denial-of-service vulnerabilities in the Node.js tar and brace-expansion modules alongside a weak random number generation issue inside the librest PKCE implementation.

ALSA-2026:47180: gstreamer1-plugins-bad-free security update (Important)
ALSA-2026:47079: libXfont2 security update (Important)
ALSA-2026:47085: rest security update (Important)
ALSA-2026:47059: nodejs:22 security update (Important)
ALSA-2026:47060: nodejs:24 security update (Important)
ALSA-2026:47184: libtiff security update (Important)
ALSA-2026:47731: gstreamer1-plugins-bad-free security update (Important)
ALSA-2026:47103: libXfont2 security update (Important)