Today's Linux security roundup delivers some of the year's largest browser patches, including Gentoo's 35-CVE roundup for Chrome, Edge, and Chromium alongside SUSE's 230-vulnerability chromedriver fix. The fixes warrant the most scrutiny are the Critical-rated 389-ds-base updates from both AlmaLinux and Oracle Linux, which hand attackers Directory Manager access. DNS tooling appears repeatedly across Fedora, Red Hat, and Debian as the resolver ecosystem keeps generating trouble. The rest of the batch ranges from routine openssl kernel and ffmpeg bumps to a Perl update on Rocky Linux that quietly rewrote more than two hundred downstream packages.

Today's Linux security roundup: 230 browser CVEs, a Critical directory-server flaw, and a Perl update that swallowed the whole ecosystem

There is a lot to patch today, and some of it deserves attention before your coffee cools. A browser update landed with 230 new vulnerabilities, a directory server got a Critical-rated fix that hands attackers the keys to the kingdom, and one Perl bump on Rocky Linux quietly rewrote more than two hundred downstream packages. If you maintain any of these systems, this is your weekend to-do list.

The biggest headline comes from Gentoo, where GLSA 202609-02 piles 35 CVEs into a single advisory for Chromium, Google Chrome, Microsoft Edge, Opera, and Vivaldi. The vulnerabilities are the usual rendering-engine suspects: memory-safety bugs and privilege escalation. There is no workaround again, which means a plain browser update is the whole game. Thirty-five in one release is a lot, and if you're keeping score, most of the others in this round touch DNS. It's a small ecosystem, and it keeps proving it.

The browser that ate 230 CVEs

SUSE went even further on its own openSUSE Tumbleweed line. Its chromedriver advisory sealed 230 new vulnerabilities bundled into version 153.0.8010.36, shipping alongside chromium. The version bump itself is trivial. Two hundred and thirty CVEs in a single release is the kind of number that usually means a coordinated upstream cleanup, and you'd be right to wonder why the browser engine needed that many doors bolted shut at once. Worth noting that chromedriver matters most if you run automated browser testing, even though the chromium package it accompanies is what a human actually clicks on.

SUSE also handed out 230, so if you run either on Tumbleweed you've got a large pile to wipe out.

Over on the VPN side of things, strongswan got patched four times across this SUSE batch, touching Leap 15.4, 15.5, and 15.6 plus a handful of SLE variants. Nine or ten CVEs each, mostly memory mishandling around PKCS#7 containers and certificate parsing. If you run VPN infrastructure on SUSE, that's your priority, and so is the NetworkManager update that closes a 9.8-rated CVE-2026-19685 for a WPA-Enterprise certificate bypass. Network stuff is exactly the kind of thing you defer until it stops working.

The one that means business: 389-ds-base

If you run a directory server, AlmaLinux's Critical-rated 389-ds-base update is the box to worry about before anything else. That advisory, ALSA-2026:64785, carries five vulnerabilities on Linux 10, and it includes a SASL PLAIN authentication flaw that escalates privilege all the way up to Directory Manager, plus a way for anonymous LDAP clients to skip bind-rule checks. The anonymous bind hole is the sort of thing that makes directory administrators lose sleep for days.

Oracle Linux has its own version of the same headache. Its only Critical entry for this round is 389 Directory Server on OL8, and again it is not theoretical: a pre-authentication NULL pointer dereference, a SASL heap overflow, privilege escalation through a stale Cyrus SASL identity, and that same anonymous-bypass trick. Four CVEs under ELSA-2026-64791-0. If you run either build, patch this first and treat the rest of the batch as background noise.

The DNS ecosystem keeps being a mess

It isn't a coincidence that DNS shows up so often in today's roundups. Fedora put three crates from the hickory-dns family on the hot list, all jumping to 0.26.2 under advisories covering both Fedora 43 and 44, and the changelog politely describes the fixes as "a large number of security relevant bugs." PowerDNS Recursor went to 5.4.6 to close a DNSSEC wildcard validation bypass, golang-x-perf picked up a DoS fix in x509 DNS SAN handling, and mongo-c-driver hardened itself against unsafe JSON parsing. That's a lot of resolver-adjacent trouble on one afternoon.

Red Hat's nginx update closes three distinct CVEs, and Debian's does too, landing all three in the 1.26.3-3+deb13u8 build. The heap buffer overflow in nginx's script engine is the one you'd actually want to hit in production. The use-after-free needs server-side includes paired with proxy_pass and disabled proxy_buffering, which is a setup almost nobody runs by accident. Worth patching anyway since arbitrary code execution was floated as a possible outcome, and arbitrary code execution is never a nuisance.

The update that swallowed everything

Here's one that trips people up. The Rocky Linux 8 advisory worth pausing on is RLSA-2026:67278, a Moderate-severity fix for the perl:5.32 module. But do not be fooled by the "Moderate" label or the terse title. This one rolls forward 224 package and module entries, which is basically the entire Perl ecosystem bundled into a single bump. Perl modules, as it turns out, do not travel solo.

The specific CVEs and CVSS scores sit under the errata link, which is where you should check before assuming this is a quick patch. It's the kind of update where the changelog looks tiny and the actual diff looks like a small war.

The ones you'll skim and maybe regret

Most of today's entries are the routine kind, and that's fine. Red Hat alone shipped 46 updates across this cycle, and the real priority there is straightforward: openssl on RHEL 9 and 10, since nearly every service leans on TLS eventually. Kernel shows up three times (including a separate entry for NVIDIA's RHEL 10 build), which just hints that the GPU crowd runs on its own release clock. The moderate-rated perl and libkcapi updates can wait for your next maintenance window.

SUSE's ffmpeg-4 split into two separate updates for the 4.4.8 line, each sealing 17 memory-corruption bugs. Out-of-bounds writes, heap overflows, infinite loops. That's genuinely uncomfortable when you consider how often ffmpeg runs unattended inside media servers, crunching videos while nobody watches.

On Ubuntu, the notice that earns the slight frown is USN-8751-1 for python3-urwid, the Curses-based widget library that underpins a surprising amount of terminal-based Python UIs. It shipped a weak pseudo-random number generator, and a local attacker could turn that into either a denial of service or a way to run programs under your login account. You can't really sidestep urwid if you use tools built on top of it. The civetweb update adds one wrinkle worth remembering: after you patch it, you need to actually restart the service for the changes to take effect.

A quick heads up on the Ubuntu and Fedora specifics. The Ubuntu ffmpeg and civetweb fixes sit behind Ubuntu Pro for older LTS lines, so free-support users on 22.04 and 20.04 may not see everything straight away.

The Updates in Detail

AlmaLinux

AlmaLinux pushed a fresh batch of errata across its 8, 9, and 10 lines, and if you run any of them there is a fair amount to patch. Nearly everything shipped on September 14, with one early bird landing on the 11th for go-fdo-client.

The one worth your attention first is the Critical rating on 389-ds-base, the LDAPv3 directory server, for Linux 10. That update carries five vulnerabilities, including a SASL PLAIN authentication flaw that hands privilege escalation all the way up to Directory Manager. If you run a directory server, that is the box to worry about before anything else.

Ruby shows up three times, since it got rebased to the latest releases on Linux 10 (4.0 and 3.3) and on Linux 8 (3.3). The security fixes are identical across all three, mostly a cluster of Net::IMAP command-injection and denial-of-service bugs plus a zlib GzipReader memory-corruption issue. If your stack uses Ruby to fetch email, the IMAP fixes matter more than the rest.

Node.js is another recurring name, with both 22 and 24 getting hit. Those updates cover arbitrary code execution through crafted FTS5 search data in SQLite, several denial-of-service holes, and an SSRF in the ip-address package. The 24 build on Linux 8 adds one extra IPv4-mapped address misclassification quirk you won't find in the others.

The rest is a grab-bag of single-issue advisories. FreeRDP can execute remote code through a malicious TS Gateway, glib2 has a heap overflow in its MIME magic parser, gstreamer trips over a malformed RTSP auth header, and a Go crypto timing leak surfaces inside osbuild-composer on ppc64le. git-lfs and go-fdo-client picked up the same url and TLS denial-of-service fixes, while libkcapi and YAML-Syck round out the batch.

The practical move is straightforward: run your updates and give the 389-ds-base box the longest look if you happen to run one.

Debian GNU/Linux

Debian pushed out three security updates this week, two of them standard advisories for the stable branch (trixie) and one LTS fix stretching back to bookworm. The headline grabber is nginx, and it carries three distinct CVEs, which is a fair amount of trouble for one web server.

The nginx patch closes a heap buffer overflow in the script engine. You'll hit it if a map directive runs a regular expression against string captures that the map itself modified, or if non-cacheable variables shift between the script length pass and the copy pass. The other two bugs are a use-after-free from duplicate finalization of an HTTP subrequest—requires server-side includes paired with proxy_pass and proxy_buffering disabled—and a memory disclosure when ngx_http_regex_exec() swaps the captures array without clearing the capture count. All three get resolved in the 1.26.3-3+deb13u8 build. Worth patching, since arbitrary code execution was floated as a possible outcome.

The xorg-server advisory is shorter but not less annoying. Two CVEs can lead to privilege escalation when the X server is running privileged, which is often the case on a desktop. Fixed at 2:21.1.16-1.3+deb13u4.

Finally there's the LTS fix for jbig2dec, Debian's long-term support line keeping older systems alive. Missing input sanitizing in the JBIG2 decoder could trigger a denial of service, resolved in 0.19-3+deb12u1 for bookworm. Nothing exotic here, but it's the kind of thing you'd rather not leave sitting around.

Fedora Linux

Fedora pushed a fresh batch of security advisories to Fedora 43 and 44, and the hickory-dns family is carrying the weight again. Three crates (resolver, proto, and net) all jumped to 0.26.2 under one advisory each, this time fixing what the changelog politely calls "a large number of security relevant bugs." You get the same package set on both release trains, so there's a clear reason to patch whichever box you're actually running.

DNS fixes show up elsewhere in this round too, and it's not coincidence. PowerDNS Recursor goes to 5.4.6 to close a DNSSEC wildcard validation bypass, mongo-c-driver ships four separate CVEs worth of hardening around unsafe JSON parsing and OCSP errors, and golang-x-perf gets a patch for a denial-of-service in x509 DNS SAN handling. That is a lot of resolver-adjacent trouble, which sort of tells you the DNS ecosystem keeps being fun.

Elixir 1.19.6 lands on both versions to shut down a denial-of-service where a crafted version string burns through resources. PackageKit jumps to 1.4.0 to absorb five more CVEs, including CVE-2026-19816. The one update that isn't about locking things down is the 7.2.5 kernel on both releases, which adds a Sony camera driver for a Lenovo laptop and fixes a Surface Pro 11 probe failure on top of its usual stable-release fixes. Apply it anyway; kernels are the updates you end up regretting.

You can grab everything with a blanket dnf upgrade, or apply each advisory on its own with dnf upgrade --advisory <ID> if you'd rather be surgical about it.

Gentoo Linux

Gentoo published two high-severity security advisories and either one alone is a decent reason to hold off on the weekend and run emerge first.

GLSA 202609-03 is the quieter of the two: a potential remote code execution flaw in Ruby, tied to CVE-2026-41316. Gentoo isn't sharing many specifics, and there's no workaround, so upgrade is really your only play. It reaches across the dev-lang/ruby 3.3, 3.4, and 4.0 slots as well as dev-ruby/erb.

GLSA 202609-02 is the one that makes you wince. It piles a whole batch of browser bugs into a single advisory for Chromium, Google Chrome, Microsoft Edge, Opera, and Vivaldi. Thirty-five CVEs show up here, covering the usual suspects for a rendering engine: memory-safety bugs and privilege escalation. No workaround again, so browser update is the whole ballgame.

Oracle Linux

Oracle Linux pushed out a serious chunk of security updates this round, spanning three major releases at once. If you run OL8, OL9, or OL10, pull up your package manager and check. The batch totals 35 advisories, though one of them (the OpenJDK 21 update, ELSA-2026-42895) is the same advisory Oracle shipped to all three OS versions, so that's really 34 distinct advisories.

The only Critical one here is 389 Directory Server (389-ds:1.4) on OL8. Four CVEs ride along, and they are not theoretical: a pre-authentication NULL pointer dereference, a SASL heap overflow, a privilege escalation to Directory Manager through a stale Cyrus SASL identity, and a hole that lets anonymous LDAP clients skip bind-rule checks entirely. The last bit is exactly the sort of thing that makes directory administrators lose sleep.

The OpenJDK 21 update deserves a look because it carries nine JDK CVEs and a post-quantum cryptography build bump, all bundled under one advisory number across three OS versions. Oracle even left the embargo timestamps (2026-08-18) sitting in the changelog, which is a nice time capsule. Kernels show up on every version too: 6.12.0-211.53.1 on OL10, 5.14.0-687.46.1 and a separate 5.14.0-687.45.1 on OL9, and 4.18.0-553.162.1 on OL8. The OL9 and OL10 kernel builds are notable mostly for the supporting cast, module-signing keys, and certificate refreshes, alongside the actual security patches.

Other packages follow the usual script. nginx gets a single new code-execution fix. vim turns up three times across three OS versions with its familiar cluster of heap overflows and code-execution bugs. The image-builder, osbuild-composer, and git-lfs entries are rebuilt for a pile of overlapping CVEs, with 56860 and 56862 showing up more often than you would guess. openssl-derived and Python stack components (lxml in two flavors, perl-DBI, apr-util) round things out.

Red Hat Enterprise Linux

Red Hat rolled out another batch of security errata this cycle, and it is one of the larger ones. Between the Important-rated advisories and the Moderate ones you are looking at 46 updates, covering everything from the kernel to ffmpeg to a couple of packages most people will have never even heard of, like grafana-pcp and yggdrasil.

Most of these are the sort of patch you install on schedule and promptly forget. The openssl fixes for RHEL 9 and 10 are the ones you actually want to prioritize, since nearly every service leans on TLS eventually. Kernel shows up in three separate advisories here (RHEL 10 EUS, RHEL 9, and a distinct entry for NVIDIA's RHEL 10 build), which hints the GPU crowd runs on its own release clock.

A couple of things to keep straight before you go patching. git-lfs and acl each appear three times, split across regular, SAP, and EUS channels, so if you run more than one RHEL flavor you are installing each several times, not once. Red Hat split the libkcapi updates into three separate Moderate advisories by version, and the ffmpeg CVE fixes come one per RHEL AI release (3.3, 3.4, 3.5) because each base-image line counts on its own. Run the Important-rated ones first and let the Moderate pile wait for your next window.

Rocky Linux

If you happen to run Rocky Linux 8, one advisory is worth pausing on this cycle: RLSA-2026:67278, a Moderate-severity security update for the perl:5.32 module. Quick but important distinction from the earlier Red Hat batch you may have just read through: this is a Rocky Linux advisory, filed in the RLSA system rather than Red Hat's RHSA one. That means you track it through Rocky's own errata and security channels, not a Red Hat subscription.

The story here is reach, not severity. Perl modules, as it turns out, do not travel solo, and this bump rolls forward 224 package and module entries, which is basically the entire Perl ecosystem bundled into one update. You get the compression stack (Compress-Raw-Zlib, Compress-Raw-Lzma, Compress-Bzip2), the archiving tools (Archive-Tar, Archive-Zip), the CPAN plumbing (CPAN-Meta, CPAN-Meta-YAML, CPAN-DistnameInfo), plus the usual everyday workhorses like Encode, Storable, URI, Digest-SHA, Getopt-Long, and Test-Harness. In practice perl-libs got versioned up and everything downstream came along for the ride, which is normal for this ecosystem but produces a wider diff than the terse one-word title lets on.

The specific CVEs and their CVSS scores sit under the errata link, which is where you will want to check before assuming this is a quick patch.

SUSE Linux

SUSE pushed a fresh round of security patches on September 14th, and most of it is the routine housekeeping you'd rather clear before heading home for the weekend. A few entries, though, are big enough to actually pause over.

The obvious headline is chromedriver, which shipped 230 newly patched vulnerabilities bundled into version 153.0.8010.36. It goes out alongside chromium, so if you run either on openSUSE Tumbleweed you've got a large pile to wipe out. The version bump itself is trivial; 230 CVEs in a single release is the kind of number that usually means a coordinated upstream cleanup, and you'd be right to wonder why the browser engine needed that many doors bolted shut at once.

ffmpeg-4 deserves a second look too. SUSE delivered two separate updates for the 4.4.8 line, each sealing 17 memory-corruption bugs - out-of-bounds writes, heap overflows, infinite loops. That is genuinely uncomfortable when you consider how often ffmpeg runs unattended inside media servers.

strongswan gets patched four times across this batch, touching Leap 15.4, 15.5, and 15.6 plus a handful of SLE variants. Nine to ten CVEs each, mostly memory mishandling around PKCS#7 containers and certificate parsing. If you run VPN infrastructure on SUSE, that's your priority. NetworkManager rounds out the important-rated fixes, closing a local privilege escalation through malformed MUD URLs and a WPA-Enterprise certificate bypass, with a 9.8-rated CVE-2026-19685 you won't want to defer.

The full breakdown is below, split by product line.

Ubuntu Linux

Three Ubuntu Security Notices dropped on September 14, 2026, and they span everything from a Curses widget library to a media transcoding workhorse to an embeddable web server. Most of these are routine patching, but one of them is the kind you should look at before your coffee cools.

The Urwid notice (USN-8751-1) is the one that earns a slight frown. The library, which underpins no shortage of terminal-based Python UIs, shipped a weak pseudo-random number generator. Katriel Moses caught it, and a local attacker could turn it into either a denial of service or a way to run programs as your login account. You can't really sidestep urwid if you use tools built on top of it, so this one just means keeping things current.

FFmpeg (USN-8750-1) got five separate fixes tied to six CVEs, though they boil down to a single complaint about memory operations handled incorrectly. Several of them want a victim tricked into opening a specially crafted file, and the one Adrian Junge found leaks sensitive information rather than just crashing. Worst case is arbitrary code; most of these are nuisance-level at best. The catch is that both patched builds sit behind Ubuntu Pro, so free-support users on 22.04 and 20.04 may not see them straight away.

CivetWeb (USN-8749-1) finishes the batch with two CVEs around URI and HTTP request parsing. A remote attacker could crash the server or seize control, but only the 22.04 and 24.04 releases were actually exposed. The 26.04 build already had the flaw baked out. One wrinkle here you won't see in the other two notices: after updating, you need to restart civetweb for the changes to take effect.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world