Six Linux distributions, Fedora, Debian, Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, and openSUSE, released security patches this weekend, and a few entries crossed from routine into surprising territory. Fedora's standout is Chromium landing at 156.0.8078.47 with 353 security fixes, while openSUSE's kernel tops even that with 129 vulnerabilities in Leap 16.0 and 220 in Tumbleweed's kernel-devel package. Debian's batch is led by Thunderbird at 62 CVEs and includes a Caddy change that strips any request header containing an underscore, so names like X_Api_Key must be renamed with a hyphen. RHEL rounded things out with 13 advisories rated mostly Important, and nothing across the roundup is flagged as actively exploited in the wild.

Linux security roundup: Fedora's Chromium picks up 353 CVEs, SUSE's kernel ships 220

Fedora 44 just landed Chromium 156.0.8078.47 with 353 security fixes. That's a number long enough to make you wonder whether the whole list is even real. Meanwhile, openSUSE's Tumbleweed kernel-devel package absorbed 220 CVEs, and Debian handed Thunderbird 62 of its own. If any of these are running on your boxes, you've got work to do.

Chromium leads the pack. Alongside it, Fedora pushed Firefox 158.0 on Fedora 43 and 158.0.1 on Fedora 45, with Thunderbird getting similar treatment across the same releases. Head here to the Fedora security list if you want the full CSV.

Then came RT, the ticketing system, moving to 5.0.10 and dragging a dozen Perl modules along for dependency reasons. perl-Badger, perl-CLI-Simple, perl-CSS-Inliner, and five others ride the same advisory. Not every package genuinely needs every one of those fixes, but Fedora bundles them together anyway.

.NET got a refresh across its 8.0, 9.0, and 10.0 lines, each absorbing around 35 to 38 CVEs. The Perl JSON and CSV serializers picked up their own memory-safety rounds, with Cpanel-JSON-XS alone taking fifteen advisories plus a handful of performance tweaks.

The rest are individual patches that don't share a theme. openssh caught a denial-of-service via oversized packets and an SFTP path traversal. mupdf got a double-free fix. gegl04 segfaults when reading HDR images. btrfs-backup-ng's changelog is the most readable of the bunch, explaining how its lock store used to follow symlinks so a less-privileged local user could redirect root writes.

The Chromium count does make you do a double-take. If you're keeping score, 353 is honestly the kind of number you expect to be a typo, but Chrome has been shipping this way every month for a while now. Accept it and run the update.

The advisories you can't ignore

AlmaLinux 8 rolled out three advisories, and two of them are basically one problem. Grafana and its Grafana-PCP plugin both absorbed the same HTTP and TLS patches, so a single update clears the overlap.

The one worth your attention is LibreOffice. It ships four fixes, including an arbitrary code execution path that comes through a remote Java database driver. That's the kind of hole you'd rather patch before it sits in your document pipeline. The other three are buffer overflows in PDF import and CFF font handling, meaning a maliciously crafted document is the likely trigger. All three advisories are rated Important.

Keep in mind that after November 2026, twelve AlmaLinux packages stop relying on end-of-life Java, and on 8.10 specifically the Pentaho reporting engine breaks the Base Report Wizard. Both land in ALSA-2026:88164.

Debian wrapped up its week with a fresh pile of advisories too. ImageMagick is the one to look at, with 30 CVEs in a single release. It can still leak information or run arbitrary code on a malformed image. That same release also repairs a regression where converting an SVG with an embedded PNG data URI to PNG would just fail outright. A small mercy for anyone who's hit it.

Thunderbird took the biggest hit with 62 CVEs. Debian is now tracking the 153.x branch because 140.x reached end of support, so you'll want 153.5.1esr. The advisory stays vague on what each vuln does, but arbitrary code execution and information disclosure are both in scope, which usually means "update soon."

Caddy's LTS fix is worth flagging for a different reason. It covers nine issues, from access-control bypass to cross-site scripting, but the fix for CVE-2026-52845 discards every request header whose name contains an underscore. No opt-out. If you forward something like X_Api_Key or gRPC custom metadata through Caddy, rename it with a hyphen or it just stops flowing. That one will bite someone.

The kernel leads the openSUSE batch. Leap 16.0's kernel alone absorbs 129 vulnerabilities and 135 bug fixes. Tumbleweed's kernel-devel is worse, covering 220 CVEs for anyone compiling their own modules. Docker lands at "important" and mostly earns it, taking in five vulnerabilities including CVE-2026-41567, which hands someone arbitrary code with full daemon privileges simply by uploading a compressed archive to a container. That's the sort of thing that should make container operators lose sleep.

A few oddballs deserve a glance. haproxy carries no CVE at all, rated "moderate" but really just a mountain of bug fixes plus an OTel 2.3.0 bump. There's also CVE-2026-99999 hiding in the kernel list. A placeholder. Someone needed a throwaway number for testing, and here we are, 220 CVEs and one fake among them.

Red Hat's batch landed 13 advisories, eleven rated Important and two Moderate. compat-openssl11 shows up three separate times, but only because Red Hat files it independently across the EUS and SAP Solutions channels rather than cutting a single unified release. openssh and bind both get fixes, and the jackson advisory bundles four Java libraries together in a sensible move. Nothing here is disclosed as being actively exploited, so think routine maintenance rather than a fire drill.

Rocky Linux kept it simple with two kernel updates, one each for versions 10 and 9. Same general treatment, so schedule a reboot on whichever you actually run.

A Detailed Breakdown of the Updates

AlmaLinux

Three security advisories rolled out for AlmaLinux 8 this week, and two of them are really just one problem. Grafana and its Grafana-PCP plugin both absorbed the same HTTP and TLS patches, so if you run either component, a single update clears the overlap.

The LibreOffice advisory is the one worth your attention. It ships four fixes, and one of them is an arbitrary code execution path that comes through a remote Java database driver. That's the kind of hole you'd rather patch before it sits in your document pipeline. The other three are buffer overflows in PDF import and CFF font handling, which means a maliciously crafted document is the likely trigger.

Riding along with the security fixes are the housekeeping items. After November 2026, twelve packages stop relying on end-of-life Java. And on AlmaLinux 8.10 specifically, the packaged Pentaho reporting engine breaks the Base Report Wizard. All three advisories are rated Important.

Debian GNU/Linux

Debian wrapped up its week with a fresh pile of security advisories, and a few of these packages have been dragging their feet a bit. Here's what actually shipped.

ImageMagick is the one that warrants a look, with 30 CVEs patched in a single release. The image-editing suite can still leak information or run arbitrary code when it processes a malformed image, so that's a decent reason to update. Same release also repairs a regression where converting an SVG containing an embedded PNG data URI to PNG would just flat-out fail, which is a small mercy for anyone who has hit it.

Thunderbird absorbed the largest number of fixes with 62 CVEs. Debian is now tracking the 153.x branch because the 140.x line has reached end of support, so you'll want 153.5.1esr. The advisory stays vague about what each vulnerability does, but arbitrary code execution and information disclosure are both in scope, which usually means "update soon."

OpenSSL cleared out six problems in its bookworm update. Most are the usual crypto-architecture headaches: a timing side channel in SM2 and ECDSA scalar multiplication, a NULL pointer deref in the CMP client, heap bloat from an overzealous certificate, and two different ways to end a DTLS session with a single short datagram.

Caddy's LTS fix covers nine issues that range from path- and host-based access-control bypass to unintended file execution through a FastCGI backend, trusted identity-header injection, admin-API reconfiguration, and cross-site scripting. One piece is worth flagging ahead of time: the fix for CVE-2026-52845 discards every request header whose name contains an underscore, with no opt-out. If you forward something like X_Api_Key or gRPC custom metadata through Caddy, you'll need to rename it with a hyphen or it simply stops flowing.

Varnish rounds out the batch with two issues, landing in the stable trixie update. Cache poisoning and authentication bypass arrive from unchecked absolute-form HTTP/1.1 request targets, while a workspace overflow in the VCL .upper() and .lower() string methods gives an attacker a neat way to exhaust the workspace and force the worker to crash and restart. The fix sits in 7.7.0-3+deb13u2.

Fedora Linux

Fedora pushed a fairly large round of security updates over the weekend, touching Fedora 43, 44, and 45 (RC) at once. Most of it is the quiet, unglamorous kind of maintenance you normally scroll past until it bites you.

The biggest headline is Chromium landing on Fedora 44 at 156.0.8078.47 with 353 security fixes. That's a number long enough to make you wonder whether the whole list is real, but Chrome releases this way every month now, so accept it and run the update. Firefox and Thunderbird got similar treatment, arriving at 158.0 on Fedora 43 and 158.0.1 on Fedora 45.

A second cluster grew out of RT, the ticketing system, moving to 5.0.10 and dragging a dozen Perl modules along with it for reasons of dependency. perl-Text-Markdown-Discount, perl-CSS-Inliner, perl-Badger, perl-Encoding-FixLatin, perl-HTML-Query, perl-CLI-Simple, perl-Markdown-Render, and rt itself all ride the same advisory. Not every package genuinely needs every one of those seven fixes, but Fedora bundles them together anyway.

.NET got refreshed across its 8.0, 9.0, and 10.0 lines, each absorbing a pile of CVEs. Around the same window the Perl JSON and CSV serializers picked up their own memory-safety rounds, with Cpanel-JSON-XS alone taking fifteen separate advisories plus a handful of performance tweaks.

The rest are individual patches that don't share a theme: an openssh fix for denial-of-service via oversized packets and an SFTP path traversal; a mupdf double-free; libindi's malformed-XML crash; several MinGW Windows ports (libpng, LibRaw, lxml); podofo and gegl04, the latter a crash when reading HDR images; pgbouncer, php-pecl-mongodb2, and GitPython. btrfs-backup-ng's note is the most readable of the bunch, describing how its lock store used to follow symlinks and how a less-privileged local user could have redirected root writes.

Red Hat Enterprise Linux

Red Hat rolled out a fresh batch of security errata for RHEL, and this one is no small weekend patch. You are looking at 13 advisories, eleven of them rated "Important" on the severity scale and two downgraded to "Moderate." If you run RHEL 8 or 9, you probably have at least one of these to install.

A couple things stand out. compat-openssl11 shows up three separate times, but that is because Red Hat files it independently across the EUS and SAP Solutions channels instead of cutting a single unified release. You are also getting fixes for some of the more obviously attackable software, namely openssh and bind. The jackson advisory bundles four Java libraries together, which is a sensible way to handle dependencies that break in lockstep.

Red Hat assigns each vulnerability a CVSS score you can pull from the CVE links in the References section, though the headline ratings should be enough to get the patching queue moving. Nothing here is disclosed as being actively exploited in the wild, so this is routine maintenance rather than a fire drill.

Rocky Linux

Rocky Linux just pushed two kernel updates, one each for its current and older releases. Nothing exotic here—both cover the usual mix of security patches, bug fixes, and minor enhancements, so if you run either version you'll probably want to schedule a reboot.

Both updates apply the same general treatment, so there's little to separate them beyond which version of the OS you're actually running. Severity ratings exist for each vulnerability via the CVE list, though the notice itself doesn't spell out what the fixes actually address.

SUSE Linux

openSUSE just shipped a batch of security patches covering both Leap 16.0 and Tumbleweed, so figure on running updates on whichever you actually use. The two are not small, and the numbers get silly in a couple of places.

The kernel is the standout. The Leap 16.0 kernel alone absorbs 129 vulnerabilities and 135 bug fixes, which is about as close as a kernel update gets to a deep clean. Tumbleweed's kernel-devel package is worse in the best possible way, covering 220 CVEs for whoever compiles their own modules.

Docker and the Firefox ESE pair land at "important," and they mostly earn it. Docker takes in five vulnerabilities, including CVE-2026-41567, which hands someone arbitrary code with full daemon privileges simply by uploading a compressed archive to a container. That is exactly the sort of thing that should make container operators lose sleep. The Mozilla NSS/Firefox update rides along on 153.5.1 ESR and closes a cryptographic hole in the block-list and allow-list components. Firefox ESR also shows up on its own in Tumbleweed, and this time the count is 61 vulnerabilities across firefox-esr 153.5.0, the kind of tally you get when a whole release cycle of browser bugs arrives in one shot.

A few details deserve more than a glance. The haproxy update carries no CVE at all: it is rated "moderate" but is really just a mountain of bug fixes plus an OTel 2.3.0 bump, so read it as maintenance, not a vuln patch. Python gets chased from five different advisories, and 3.12, 3.13, and 3.14 mostly run after the same handful of CVEs, so do not skip any of them. And there really is a CVE-2026-99999 hiding in the kernel list. Someone needed a placeholder, and here we are.

Below is the full breakdown.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y