This week's Linux security updates span five major distributions, and a few of the CVE counts are worth pausing on. The standout, by a mile, is openSUSE Tumbleweed cramming 353 fixes into a single chromium and chromedriver update with no individual severity scores attached. Debian led with a Ruby patch covering 19 issues and an rsync update with 35 fixes, while Red Hat shipped three Critical OpenShift patches out of 28 total advisories. Fedora spread its fixes in three waves across releases 43, 44, and 45, and Rocky Linux, SUSE, and the rest rounded out a busy patching week.

Today's security updates across Debian, Fedora, Red Hat, Rocky Linux, Slackware, and SUSE are mostly routine, but a few cross into serious territory that needs immediate attention. Debian's zlib patch closes a code-execution hole, SUSE's Flatpak update plugs eleven sandbox escapes, and Red Hat's OpenShift 4.22.22 update earns a Critical rating. A compromised eMudhra certificate threads through both Fedora and SUSE's python-certifi update, while Mozilla's Thunderbird ships a routine-but-expected 66-CVE cleanup. Patch the code-execution and trust-chain issues first, then work through the Rust crate refreshes and module rebuilds on Fedora and Rocky.

Nine Linux distros shipped security updates between November 5 and 6, dominated by a Critical webkit2gtk3 roll-out that quietly absorbed 300+ CVEs across RHEL and AlmaLinux. Beyond the browser bugs, attackers could run code through SUSE's rsyslog template handling, AlmaLinux's 22-CVE .NET 10 batch, and Red Hat's OpenJDK 11 ELS bump. Several entries were more trouble than danger, including Ubuntu's self-reverting fixes that broke Jupyter and a setuid ntfs-3g flaw worth a closer look. Rank the pile by CVSS scores and patch the Criticals first before worrying about the Important long tail.

Alpine Linux disclosed a passwordless SSH login flaw with no CVE yet, working in a single connection when OpenSSH runs without PAM. Debian and Ubuntu both fixed a shared APT vulnerability that lets a man-in-the-middle swap verified packages and get arbitrary root code execution, with Ubuntu backing all the way to 14.04 LTS. Fedora's batch centers on the still-lingering eMudhra CA distrust plus a Python update bundling four interpreter versions, while fence-agents Criticals and 145-CVE Firefox pushes show up across RHEL, Oracle, Rocky, and AlmaLinux. The practical advice: patch Alpine sshd and restart the daemon, grab the APT fix even on old releases, and pull Fedora's Python update first.

A wave of security updates swept Linux distros, with Ubuntu, Red Hat, Oracle, SUSE, Qubes, and several others pushing patches. The most alarming is Qubes QSB-121, which fixes a Xen flaw (XSA-523) that lets a malicious qube read and write arbitrary memory in other qubes and dom0. Images and HTTP libraries recur throughout the batch, featuring critical Pillow fixes across Oracle and SUSE alongside 31 new CVEs for curl, while kernels dominate the Ubuntu, Oracle, and Red Hat releases. Patch Pillow, update curl, don't skip the kernel bumps, and prioritize the Qubes fix since most of this reaches you through your distro's normal patching.

Debian's kernel advisory alone carried 611 CVEs, the standout of today's security roundup across AlmaLinux, RHEL, Rocky, SUSE, and Fedora. Red Hat shipped 32 errata advisories with a single Critical hit, a kernel fix for RHEL 9.4 Update Services for SAP Solutions, while the rest leaned Important. Several problems resurface across vendors, most notably Ghostscript's stubborn .charkeys -dSAFER bypass and fixes for the eMudhra intermediate CA compromise. The practical takeaway is to install the specific advisory builds by version rather than letting a blanket upgrade take its chances.

Red Hat's latest RHEL push delivered an unusually high four Critical advisories, two of which hit the RHEL 8 kernel, making kernel and kernel-rt updates the obvious first priority for admins. Debian topped the CVE counts by squeezing 151 flaws into a single Thunderbird advisory and added a 41-CVE Vim update, with ImageMagick, Dovecot, and python-git rounding out a batch best installed immediately. SUSE hid a 9.8-rated curl hole among 21 vulnerabilities in curl 8.14.1, while also rebranding identical kernel CVEs across 11 live patches. Meanwhile, AlmaLinux and Rocky Linux reversed the usual trend by assigning their star severities to older releases, so sorting by severity number can mislead you there.

Linux distros including AlmaLinux, RHEL, SUSE, Debian, Fedora, Rocky, and Ubuntu all shipped security updates in late October, with a .NET critical cluster on AlmaLinux being the standout for ASP.NET Core systems. RHEL and SUSE also pushed Critical-rated advisories for python-pillow and other packages, though SUSE deliberately downgraded a 353-CVE Chromium build to Moderate while criticalizing low-scoring Django flaws. Chromium dominated the rest of the month, with both Fedora and SUSE releasing mass-CVE updates, while Debian cleared a staggering 150 CVEs in a single Thunderbird advisory. Notably, every Ubuntu Brotli fix targets older LTS releases but is tagged "Available with Ubuntu Pro," meaning a bare upgrade won't apply them without the paid service.

SUSE shipped its biggest haul of the day, clearing 230 vulnerabilities across 20 advisories that include a critical 389-ds directory server flaw and a kernel release with nearly 30 CVEs. Debian's Firefox alone absorbed roughly 145 CVEs in one advisory, while ImageMagick and GitPython each brought close to 37 of their own. Ubuntu had to re-patch a .NET bug, admitting its earlier fix missed the Blazor WebAssembly proxy hole even as a Brotli decompression flaw widened the blast radius. Tying the day together, a single all-zero encryption key bug (CVE-2026-53939) showed up as a Critical across four distros, from AlmaLinux and Oracle to RHEL and Rocky.

Six major Linux distributions shipped security updates today, with the same X11 library bugs recurring across SUSE, Oracle, and Red Hat advisories. Debian's Firefox ESR picked up a massive 145 CVEs alongside Chromium (52) and OpenJDK 25 (40), all covered by a single apt upgrade. Red Hat flagged eight Critical items led by a certificate trust-stack bug on RHEL 6 ELS and four OpenShift platform releases that need real attention. Meanwhile SUSE's curl update closes 23 CVEs with DPDK topping 8.0, and AlmaLinux packed 16 kernel fixes into one advisory.

Fedora and SUSE both pushed Chromium to 156.0.8078.47 with 353 CVEs crammed in, making the browser the day's biggest patch. Debian's OpenJDK update carried the heaviest count on its side with 40 flaws, though a regression fix restoring PGP mail is arguably the more useful piece. Fedora, RHEL, Oracle, and the others shipped routine kernel and daemon patches, with one LibreWAN advisory even listing a mismatched CVE that reporters would likely overlook. If you use any of these distros, patch the browsers first, reboot the servers on the kernel rows, and don't skip the Thunderbird fix.

This morning's Linux security roundup shows the same vulnerabilities appearing across nearly every major distro, with Brotli's CVE-2026-111497 alone patching Fedora, Oracle, and all supported Ubuntu releases in one motion. Grafana is the standout Critical, flagged by Oracle, Red Hat, and AlmaLinux on RHEL 9 even though the same package gets a lower rating on other channels. Kernels need the real reboots, especially AlmaLinux's Dirty Frag "Fragnesia" privilege-escalation fixes, while SUSE's python-social-auth-core auth bypass is the flaw worth worrying about most. Patch Brotli, Grafana, and the kernels first, then handle the rest as housekeeping.

Six Linux distributions, Fedora, Debian, Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, and openSUSE, released security patches this weekend, and a few entries crossed from routine into surprising territory. Fedora's standout is Chromium landing at 156.0.8078.47 with 353 security fixes, while openSUSE's kernel tops even that with 129 vulnerabilities in Leap 16.0 and 220 in Tumbleweed's kernel-devel package. Debian's batch is led by Thunderbird at 62 CVEs and includes a Caddy change that strips any request header containing an underscore, so names like X_Api_Key must be renamed with a hyphen. RHEL rounded things out with 13 advisories rated mostly Important, and nothing across the roundup is flagged as actively exploited in the wild.

Critical ca-certificates advisories landed today across nearly every major distro, distrusting eMudhra's intermediate CA and dropping emSign roots that can break pinned services. A shared cluster of Go CVEs drove rebuilds across grafana-pcp, podman, ipp-usb, and go-toolset, though much of it is the same binary with a newer compiler. Several genuine RCE bugs stand out, including pgvector index-build code execution, hplip's dozen CVEs on AlmaLinux 8, Apache httpd's eleven CVEs on Oracle Linux 9, and SUSE's php8 and Emacs TRAMP holes. Clear the cert fixes first, then chase the RCE-worthy packages, since the Go and cert churn alone cover a large chunk of what shipped today.

Nine Linux distributions shipped security updates today, with Debian handing its 6.12 kernel more than 500 CVEs and SUSE folding 237 into a single webkit2gtk3 release. A trust-store purge landed across Fedora, RHEL and Rocky after emSign Root CS CA G3 was found signing compromised certificates. The same pair of PHP RCE flaws (CVE-2026-109618 and CVE-2026-109619) turned up in Fedora, SUSE and Oracle, while Oracle's eight Critical .NET advisories are the top priority for managed-code users. Patch the trust-store cut and .NET first, then clear the rest before your next maintenance window.

Eleven Linux distros shipped overlapping security patches today, and the same three stories repeat across nearly all of them. PHP's two arbitrary code execution flaws (CVE-2026-109618 and CVE-2026-109619) turned up on Arch, Debian, Fedora, Gentoo, RHEL, Rocky, Slackware, SUSE, and Ubuntu. A compromised eMudhra root CA forced distros to blacklist the emSign ECC Root CA and Comodo AAA entries, though patching only one of the affected stores leaves you half-protected. .NET claims the largest Critical ratings with patches for 8.0, 9.0, and 10.0, while Ubuntu's batch also sneaks in a .NET 11 release candidate inside a normal security update.

The PHP Foundation released an emergency out-of-band update today, fixing two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, each scored 9.2, that let unauthenticated attackers run code in PHP's native request-parsing layer before any application logic runs. The embargo broke down fast: details leaked to Hacker News ahead of schedule, Cloudflare had already spotted live attacks, and Sansec expects mass exploitation within roughly 15 minutes. PHP's patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the foundation stresses there are no real mitigations, only an update makes you safe, with Apache mod_php being the easiest to weaponize. Analysts note that reliable public exploits remain unproven so far, but the guidance is clear: patch internet-facing PHP first and check logs for signs of compromise.

A wave of Linux security updates landed across the major distros today, with compromised CA certificates appearing simultaneously in Gentoo, Debian, and Ubuntu. AlmaLinux led with twenty advisories featuring a dangerous X11 display-server release, while RHEL handed out nine Critical fixes that all target .NET. Several distros also patched widely used libraries including libssh, BIND, XZ Utils, and sudo-rs for remote and local code execution. The clear priorities are refreshing your certificate trust anchors and chasing the Critical-rated patches before rebooting.