Debian released four security advisories on July 23 and 24, 2026, targeting serious vulnerabilities in pdns-recursor, webkit2gtk, squid, and wordpress. The pdns-recursor update closes two specific flaws that could enable cache poisoning or bypass DNSSEC validation checks. WebKitGTK received over thirty fixes for bugs that allowed arbitrary JavaScript execution, sandbox escapes, clipboard hijacking, memory corruption, and silent data leaks when browsers processed malicious web pages.
[DSA 6397-1] pdns-recursor security update
[DSA 6398-1] webkit2gtk security update
[DLA 4697-1] squid security update
[DSA 6399-1] wordpress security update
ELA-1782-1 squid security update
Debian released a batch of security advisories addressing critical flaws in the NSS cryptographic libraries, Firefox ESR web browser, Chromium browser, and BIND9 DNS server across both current stable and legacy Long Term Support distributions. The NSS update patches four CVEs that could allow denial of service or arbitrary code execution for Debian 11, Debian 12, and older Stretch/Buster releases managed by Freexian, while Firefox ESR and Chromium fixes address over 40 vulnerabilities linked to privilege escalation, sandbox escapes, and data leaks. BIND9 administrators must install the new package version immediately to prevent DNSSEC validation bypasses, cache poisoning attacks, and service disruptions identified in nine separate security issues.
[DLA 4694-1] nss security update
ELA-1781-1 nss security update
ELA-1780-1 nss security update
[DSA 6394-1] firefox-esr security update
[DSA 6396-1] chromium security update
[DSA 6395-1] bind9 security update
[DLA 4695-1] firefox-esr security update
Debian released multiple security advisories addressing vulnerabilities in rtpengine, the Linux kernel, Samba, Tomcat8, Roundcube, xz-utils, and ImageMagick. The Linux kernel update for Debian stable (trixie) resolves twelve CVEs linked to privilege escalation and denial of service, while Samba fixes five issues including remote code execution and certificate verification flaws across Debian 10 and 11. Roundcube patches six vulnerabilities involving cross-site scripting and account takeover risks on Debian 11 and 12, whereas xz-utils addresses a buffer overflow in the LZMA decoder and ImageMagick corrects nine flaws that could allow arbitrary code execution via malformed image files.
[DLA 4691-1] rtpengine security update
[DSA 6393-1] linux security update
[DLA 4692-1] samba security update
ELA-1777-1 tomcat8 security update (by )
[DLA 4693-1] roundcube security update
[DLA 4690-1] xz-utils security update
ELA-1779-1 samba security update (by )
ELA-1778-1 imagemagick security update (by )
Debian has issued a security patch for ImageMagick version 8:6.9.10.23+dfsg-2.1+deb10u20 on the Buster operating system. The ELA-1776-1 release resolves nine flaws tracked under multiple CVE identifiers issued in 2026. Attackers can exploit these weaknesses by feeding crafted image files to the application, which may trigger service outages or leak private data. The update also blocks potential remote code execution for users relying on the Debian extended support track.
ELA-1776-1 imagemagick security update
Liquorix Kernel 7.1-5 dropped on July 19, 2026, merging upstream Linux v7.1.4 with over 40 patches that realign its custom Project-C scheduler with mainline locking models. The update slashes the default scheduling timeslice to 2ms, disables split lock detection, and zeroes out watermark boost to aggressively prioritize low-latency task switching for gaming and multimedia workloads. While it locks support strictly to AMD64 and x86_64 hardware, the kernel trades sustained throughput and power efficiency for tighter system responsiveness that creative professionals and desktop tinkerers will actually notice.
Debian released updates for libnfs that patch CVE-2026-53689, which stems from unchecked string lengths causing integer overflows. The tiff library update addresses CVE-2026-12912, allowing attackers to crash systems or run arbitrary code when processing malformed images. Users must upgrade roundcube to version 1.6.17+dfsg-0+deb13u1 to patch six vulnerabilities that enable cross-site scripting, SSRF bypasses, and complete account takeovers.
ELA-1775-1 libnfs security update (by )
[DSA 6392-1] tiff security update
[DSA 6391-1] roundcube security update
XanMod has released new kernel builds for the mainline 7.1.4 and LTS 6.18.39 branches, addressing a massive wave of security vulnerabilities alongside performance optimizations. The update patches critical issues across the rtl8723bs driver, SMB subsystems, and BPF JIT hardening, while retaining popular features like Google's BBRv3 and AMD 3D V-Cache support. Users can choose between the feature-rich mainline track or the stable LTS branch with a support window extending to December 2028. Both builds are available for x86-64 architectures via the XanMod APT repository for Debian and Ubuntu distributions.
Liquorix Linux Kernel 7.1-4 has been released by maintainer Steven Barrett, updating the enthusiast-grade kernel to Linux 7.1.3. The release focuses on a major cleanup, reverting six obsolete patches to reduce maintenance burden and improve stability against upstream code. Core updates include deep integration of the Project-C scheduler framework, which brings significant latency improvements for gaming and interactive workloads.
Debian officials released emergency patches for Chromium, addressing fifteen critical vulnerabilities in both the Debian 12 long-term support release and the Debian 13 stable distribution. The Chromium updates prevent attackers from executing arbitrary code, forcing service interruptions, or exposing sensitive data through specially crafted web content. Separate advisories for OpenSSL and libxfont resolve numerous buffer overflow and pointer dereference flaws that could compromise system memory and cryptographic operations.
[DLA 4687-1] chromium security update
[DSA 6390-1] chromium security update
ELA-1773-1 openssl security update (by )
ELA-1774-1 libxfont security update (by )
Liquorix Linux Kernel 7.1-3 has officially landed, marking the project’s first shift to the Linux 7.1 mainline base. Maintainer Steven Barrett used the rapid release cycle to integrate extensive upstream fixes for Project-C, his custom low-latency scheduler framework. The update also introduces per-mapping control for transparent hugepages on shared memory and tmpfs, improving consistency for databases, containers, and audio production workloads. Packages are now available via Ubuntu PPAs, Debian repositories, and the Arch AUR for desktop users seeking responsive Linux performance.
Debian and Freexian released four security advisories, that address critical flaws in libxfont, grub2, dhcpcd5, and ntfs-3g. The patched vulnerabilities include heap buffer overflows, unauthorized privilege escalation, and potential bypasses of UEFI Secure Boot protections. Malicious users could exploit these issues to execute arbitrary code, crash systems, or corrupt data while operating within X server or local user contexts.
[DSA 6388-1] libxfont security update
[DLA 4685-1] grub2 security update
[DLA 4686-1] dhcpcd5 security update
[DSA 6389-1] ntfs-3g security update
ELA-1774-1 libxfont security update
Debian Linux provides critical security patches for dnsmasq, opam, and wolfSSL to address multiple high-risk flaws in the July 2026 Long Term Support cycle. The dnsmasq update resolves five vulnerabilities that could allow DNS cache poisoning, denial of service attacks, or arbitrary code execution through crafted DHCPv6 packets. The opam release patches a directory traversal flaw that previously permitted unchecked symlink resolution during package installations. The wolfSSL update addresses fourteen distinct security gaps capable of enabling signature forgery, authentication bypasses, memory corruption, and TLS protocol weaknesses across secure communication stacks.
ELA-1772-1 dnsmasq security update (by )
[DLA 4684-1] opam security update
[DLA 4683-1] wolfssl security update
Debian Long Term Support issued security advisories DLA-4679 through DLA-4682 to patch vulnerabilities in mesa, p7zip, redis, and imagemagick. These updates resolve critical flaws including WebGPU memory corruption in mesa, a cluster of eight memory issues in the p7zip archiver, and potential remote code execution bugs in redis and imagemagick triggered by malformed input or authenticated attacks. Administrators managing Debian 11 bullseye must upgrade mesa to 20.3.5-1+deb11u1, p7zip to 16.02+really26.01+dfsg-0+deb11u1, and imagemagick to 8:6.9.11.60+dfsg-1.3+deb11u15, while Debian 12 bookworm users should apply the fix to redis version 5:7.0.15-1~deb12u8, imagemagick version 8:6.9.11.60+dfsg-1.6+deb12u12, and a mesa update currently denoted by a version placeholder. p7zip specifically receives a replacement with a modified 7-Zip release to address its lack of active maintenance, and Debian LTS urges immediate installation of these updates via standard package management tools.
[DLA 4679-1] mesa security update
[DLA 4681-1] p7zip security update
[DLA 4682-1] redis security update
[DLA 4680-1] imagemagick security update
Liquorix maintainer damentz has announced the first build based on the Linux 7.1 series, moving the project forward from its current 7.0.14 release. The kernel applies aggressive Zen Interactive Tuning, including a 1000Hz tick rate, PDS scheduler, and hard preemption, to prioritize desktop responsiveness over power efficiency or sustained throughput. Designed specifically for AMD64 desktops, it targets gamers and audio producers who need low-latency performance, with installation scripts and prebuilt binaries already rolling out for Debian, Ubuntu, and Arch.
Debian Long Term Support released two security advisories, addressing critical flaws in Chromium and libxfont. The Chromium update patches 27 vulnerabilities that could allow attackers to run arbitrary code or leak sensitive data, urging Debian 12 users to upgrade to version 150.0.7871.114-1~deb12u1. The libxfont advisory targets three heap overflow flaws in its bitmap and PCF parser, which enable authenticated attackers to execute commands within the X server context, and resolves them in packages for both Debian 11 and Debian 12.
[DLA 4677-1] chromium security update
[DLA 4678-1] libxfont security update
Debian 13.6 Trixie live images drop as volatile RAM sandboxes that erase every config and package on shutdown unless you manually wire up persistence first. Desktop stacks like GNOME 48, KDE Plasma 6.3, and Xfce 4.20 get stability tweaks that prioritize smoother navigation over feature bloat. On the backend, the release finally tackles the expired 2013 UEFI Secure Boot certificate with updated fwupd and shim packages while patching critical vulnerabilities across Chromium, Firefox, nginx, and the kernel.
Debian and FreeXian released security patches, addressing critical flaws across multiple packages. The chromium advisory fixes twenty-five CVEs that allowed attackers to execute arbitrary code, cause denial of service, or steal sensitive data. Administrators must also update tomcat9 to version 9.0.118-0+deb10u1 and upgrade libtcnative-1 to resolve fifteen security issues involving authentication bypass and information disclosure.
[DLA 4676-1] wireless-regdb new upstream version
[DSA 6387-1] chromium security update
ELA-1771-1 tomcat9 security update
Debian has released point update 13.6 for its "trixie" stable distribution, delivering a critical update to fwupd that resolves expiration issues with the legacy 2013 UEFI Secure Boot certificate authority. The release also reverts the geoip-database package to a 2019 snapshot due to DFSG licensing conflicts, advising consumers to obtain recent data via a direct GeoLite license instead. Security patches address a wide array of vulnerabilities across QEMU, curl, nginx, and major browsers, mitigating remote code execution and denial-of-service risks. Existing systems can be updated immediately through standard package managers, while new installation images will soon appear at official download locations.
Debian GNU/Linux 12.15 hit the archives today as Bookworm's final point release. The core Debian Security Team stops maintaining this version immediately, pushing the distribution straight into Long Term Support managed by the community and Freexian. This last major update ships over 60 critical patches, fixing expired Secure Boot certificates that could brick UEFI systems and closing vulnerabilities across the Linux kernel and common web services. New deployments should jump to Debian 13 Trixie now, while LTS users still have roughly two years of updates before paid extended support takes over.
FreeXian released security updates for the linux-5.10 and linux-6.1 kernels on Debian stretch and buster, providing versions 5.10.259-1 and 6.1.176-1 that address the CVEs enabling privilege escalation, denial of service, and information leaks. Debian issued DSA-6386-1 for the opam package manager to fix CVE-2026-57825, which allowed directory traversal attacks due to insufficient symlink checks in .install files that failed to resolve target paths correctly. The opam correction appears in version 2.3.0-1+deb13u2 for the trixie distribution, and the kernel patches include additional bug fixes from stable revisions 5.10.258, 5.10.259, 6.1.175, and 6.1.176.
ELA-1770-1 linux-5.10 security update
ELA-1769-1 linux-6.1 security update
[DSA 6386-1] opam security update
