Alpine Linux disclosed a passwordless SSH login flaw with no CVE yet, working in a single connection when OpenSSH runs without PAM. Debian and Ubuntu both fixed a shared APT vulnerability that lets a man-in-the-middle swap verified packages and get arbitrary root code execution, with Ubuntu backing all the way to 14.04 LTS. Fedora's batch centers on the still-lingering eMudhra CA distrust plus a Python update bundling four interpreter versions, while fence-agents Criticals and 145-CVE Firefox pushes show up across RHEL, Oracle, Rocky, and AlmaLinux. The practical advice: patch Alpine sshd and restart the daemon, grab the APT fix even on old releases, and pull Fedora's Python update first.

A mountain of Linux security patches lands today, and two want your attention first

Alpine's SSH flaw allows passwordless logins and still has no CVE. A shared APT hole across Debian and Ubuntu opens a path to root code execution.

Alpine Linux just disclosed a flaw that lets anyone who can reach your SSH port log in without knowing a password. The whole thing works in a single connection. No retries, no brute forcing. There's still no CVE for it, which is unusual for something this clean.

The bug lives in how Alpine's OpenSSH, built without PAM, checks passwords. It hashes the attempt with crypt() and compares it to the stored field. Here's the trick: musl's crypt() returns the literal string * when the input runs past 256 bytes, and * is exactly what a passwordless account already contains. Send a 257-to-1024-byte password and the hashes line up. Login succeeds.

It needs a few things true at once. You must run Alpine's openssh-server without PAM, or with UsePAM no, and keep PasswordAuthentication yes. The box also needs at least one account whose password field is *, such as root, plus at least one real hash somewhere. Break any one condition and you're probably fine.

If you're running anything else, this mostly doesn't apply. Container folks who don't run sshd inside the container, systems already set to PasswordAuthentication no, and cloud-init images that write that option off sit outside the blast radius.

The fix is the part people routinely botch. Run apk upgrade, then actually restart the daemon. Upgrading the binary does nothing to a running sshd, so half of this advisory is just a reminder to do the restart. Alpine has backported the fix all the way down to 3.16, even though 3.21 only hit end of support on November 1.

The big threads, and the volume that follows

Debian and Ubuntu both shipped fixes for the same APT flaw, and this is the one I'd actually worry about today. Max Justicz found that the package manager merges two genuinely different downloads if an HTTP redirect hands them the same URI. Layer on sloppy file handling during resume and a man-in-the-middle can swap a package after it's been verified. That's arbitrary code execution as root.

You are probably reading this over an apt connection. A quick upgrade closes the hole fastest.

Debian fixed it across stable, LTS, and even the old stretch, buster, and bullseye builds. Ubuntu is pushing the fix across eight releases, all the way back to 14.04 LTS. That's a genuinely long tail for something like this.

Both batches bring other stuff worth a glance. Debian's ImageMagick update is 46 CVEs, and feeding it a bad image can get you denial of service, a policy bypass, leaked info, or code execution. It's an uncomfortable number of ways to die for a program that's just resizing a PNG. Ubuntu's Pillow is similarly cluttered with ten CVEs, from decompression bombs to JPEG2000 tile math.

Fedora's November 5 batch is dominated by the compromised certificate saga that's been popping up everywhere. The eMudhra intermediate CA now gets distrusted by Python's ssl module, boto3, botocore, and a pile of Rust crates rebuilt on newer rustls-webpki, and emSign Root CA C1/C3 got booted out of webpki-roots. If you've been patching this elsewhere, nothing here is new. It's just redundant. The whole Muzdra-hasn't-gone-away situation has been dragging through the ecosystem for months now, and every round is another ripple.

What's genuinely worth pulling to the front of your update queue is Python. A tarfile extraction filter bug lets you escape the destination directory, and a race condition in tempfile cleanup can nuke files outside the temp dir. Both folded into Python 3.11.18, 3.13.18, 3.14.10, and 3.15.2. Four interpreter versions on a single advisory, and the changelog barely shrugs it off.

A couple of Fedora notes are just wrong, which you might want to sanity-check. The valkey-9.1.3 advisory describes its own release in the body text as "Valkey 8.0.12," and the rust-app-store-connect entry names RUSTSEC-2026-0190 while the changelog actually rebuilds for 0382. Neither's a reason to lose sleep, just mismatched paperwork.

If you run cluster infrastructure, you've probably already seen the fence-agents Criticals multiplying. They show up in AlmaLinux 9 and 10, Oracle Linux, Rocky Linux, and Red Hat's RHEL 10.0 EUS. The fix exists because the package ships a bundled PyJWT with five known flaws. You have to wonder why the JWT library has problems worth patching in the first place, but the update is what it is.

Firefox keeps doing exactly what Firefox does, showing up in Red Hat's batch twice with 145 CVEs each time across OL8 and OL9, all bumping to the 153.6.0 ESR. A browser update with this many bugs is about as inevitable as it gets, though you'd think after fifteen years we'd stop expecting it.

The kernels arrive split, as always. Oracle's OL9 Unbreakable Enterprise kernel for 5.15 drags in nearly 290. That's a number that makes you stop and read the number once more.

SUSE and openSUSE sent out roughly thirty announcements, and the same supply-chain fatigue shows through. One downgraded zstd dependency crashing the decoder turns up in hauler, cadvisor, and go-containerregistry, while the golang.org/x/net HTTP/2 CPU-eater shows up across gh, coredns, trivy, the AWS CloudWatch agent, and vexctl.

Severity ratings here don't track counts very well. Chromium absorbed 21 CVEs and earned only "important." NVIDIA packed 81 into one driver update, still "important." rsyslog fixed a single RCE and took home "critical." And rqlite got rated critical for six vulnerabilities, then explained in its own writeup that it isn't actually affected by any of them because the vendored dependencies were already past the fixes. So a "critical" tag can occasionally mean we checked and it was fine.

Slackware kept it dead simple with one rsync update, catching a flaw where a malicious receiver feeds weak checksums that collide with rolling windows and quietly neuter integrity checks. Not dramatic at all, but it's the kind of thing that gets your data silently wrong.

A Detailed Overview of the Updates

AlmaLinux

AlmaLinux put out a serious security wave this week, and most of it lands on AlmaLinux 10, its newest stream. Between November 3 and 5, the team rolled out advisories for a grab bag of packages that share almost nothing: a remote-desktop client, a web browser, packet-processing libraries, an OCR engine, and a Linux kernel. If you run any of these on AL10, treat the week as a patch weekend.

The only two Critical advisories are worth your attention. fence-agents bundles five pyjwt issues for both AL9 and AL10, most of them authentication bypasses that let an attacker forge or swap tokens. A cluster that relies on fencing unhealthy nodes out will turn those into "patch immediately" pings. The single biggest payload is Firefox ESR 153 on AL10, carrying 27 separate bugs on the rebase, which is the usual monthly Firefox toll: use-after-frees, sandbox escapes, JIT miscompilations. It's a browser, so this was inevitable. DPDK is nearly as crowded, with fourteen vulnerabilities across its vhost and vhost-crypto paths, several guest-triggerable heap writes a malicious VM could twist into host memory corruption.

The kernel updates are the dull-but-necessary ones. AL9 picked up sixteen fixes touching TCP, Bluetooth, USB serial, and network reassembly; AL8 carries a smaller but still genuine set that it shares with kernel-rt.

Then there's the pile on AlmaLinux 8. Some of it is current, like Cockpit, a new Xwayland code-exec bug, python-dns, and raptor2. But a large chunk is older material being resurfaced: advisories dated 2019 and 2020 for exiv2 (which drags in nearly thirty issues across gegl and friends), LibreOffice, MariaDB, Ruby, QEMU and libvirt, and the classic runc container breakout. These aren't fresh holes, just older ones getting their upstream fixes backported into the current stream.

One item deserves its own mention. The nginx call for testing follows a recent CVE fix that apparently introduced a regression where nginx randomly starts answering a small share of requests with HTTP 500 and logs "no buffer space in script copy." The team tracked down the cause and built fixed packages sitting in the testing repo, waiting on community verification before they reach production. If you're running nginx on any AlmaLinux release, you can help shake it out.

Alpine Linux

If you run sshd on Alpine Linux, treat this as urgent. A newly disclosed flaw lets anyone who can reach your SSH port log in without knowing a password, in a single connection with no retries. There is no CVE yet.

The exploit takes advantage of the way Alpine's OpenSSH, built without PAM, verifies passwords. It hashes the attempt with crypt() and compares it to the stored field. For an account whose field is too short to hold a salt, it borrows another account's salt. Here is the catch: musl's crypt() returns the literal string * when the input exceeds 256 bytes, and * is exactly what the stored field says for every account with no password set. Send a long enough password (257 to 1024 bytes) and the hashes line up. Login succeeds. One password-bearing account on the box is enough to make every password-less account reachable, so a lone admin who ever set a password opens the door for key-only users too.

The exploit needs several conditions in place at once. You must be running Alpine's openssh-server built without PAM, or openssh-server-pam with UsePAM no, with PasswordAuthentication still set to yes (the default). The machine also needs at least one account whose field is *, such as root (which ships as root:* since roughly Alpine 3.16), a key-only user, or the alpine user in tiny-cloud images, plus at least one real $5$ or $6$ hash somewhere on the box. Remove any one of those and you are probably fine. Container users not running sshd inside the container, systems already at PasswordAuthentication no, and cloud-init images (which write that option off) are mostly outside the blast radius.

The fix is a package update followed by the step people routinely skip. Run apk upgrade, then actually restart the daemon. Upgrading the binary does not restart a running sshd, so half of this advisory is just a reminder to do the restart. If you cannot update yet, disable password logins with a drop-in config and set PasswordAuthentication no, then reload. The advisory ships a sed one-liner that handles yes lines with arbitrary spacing and inside Match blocks, and backs up the original first.

One detail that should make administrators nervous: images built before the fixed point releases still ship the vulnerable alpine user with passwordless doas. They are safe on first boot, but the moment someone sets a console password or adds a hashed user, an attacker wins a shell as alpine and escalates to root. Alpine has backported fixed packages all the way down to 3.16, even though 3.21 only reached end of support on November 1. If you suspect a break-in, look for "Accepted password for" lines in /var/log/messages aimed at an account with no password, and if you cannot rule it out, assume the machine is compromised.

Debian GNU/Linux

Debian has put out another round of security advisories, and a good number of them touch software you'd actually run. A few things stand out in today's batch.

APT is the one to worry about. A flaw found by Max Justicz lets the package manager merge two genuinely different downloads if an HTTP redirect hands them the same URI. Stack that on sloppy file handling when resuming a download and a man-in-the-middle can swap a package after it's been verified, landing arbitrary code execution as root. Debian fixed it across the board: stable (trixie), LTS (bookworm), and even the old stretch, buster, and bullseye builds. You're probably reading this very sentence over an apt connection, so a quick upgrade closes the hole fastest.

ImageMagick took the biggest hit on its own, with 46 separate CVEs. Feeding it a malformed image can trigger denial of service, a policy bypass, information disclosure, or arbitrary code execution. That's an uncomfortable number of bad outcomes for a program that's just supposed to resize a PNG.

Xen is next. The hypervisor carries a dozen vulnerabilities (per the LTS advisory) that let a guest escalate to host privileges or leak data. If you run VMs, your host is only as safe as the weakest one. Both stable and LTS trees got fixes, and because one advisory seems to have mislabeled itself, Debian openly apologized for the mix-up. A fair amount of self-correction for a single advisory round.

The Puppet side got two. Missing event validation in the agent could let an attacker run code on your Puppet server, while a hole in hostname ACL validation let a client pull the catalogue of a different host. Nothing cinematic, but both are exactly the sort of thing you want patched before someone tests it.

The quieter entries: Symfony picked up denial-of-service and email header injection fixes, and shim was re-signed with dual certificates so it still clears Secure Boot under either the 2011 or the newer 2023 Microsoft key. It also added revocations for stale grub2 versions, so keep grub2 current while you're at it.

Fedora Linux

Fedora pushed a batch of security advisories on Nov 5, 2026, spread across Fedora 43, 44, and 45. Fifty-five packages got updated in what looks like a fairly normal monthly round, though a few threads are worth pulling on before you run dnf upgrade.

The obvious one is the compromised certificate business. The eMudhra intermediate CA keeps resurfacing everywhere at once: Python's ssl module, boto3, and botocore all now distrust it, and a pile of Rust crates (redlib, qemu-rdp, app-store-connect) got rebuilt on a newer rustls-webpki to do the same. emSign Root CA C1/C3 also got booted out of webpki-roots. If you've been patching this elsewhere, nothing here is new, just redundant.

The Python cluster took a coordinated hit. A tarfile extraction filter bug (CVE-2026-114583) that lets you escape the destination directory, plus the SSL cert distrust (CVE-2026-115557), got folded into Python 3.11.18, 3.13.18, 3.14.10, and 3.15.2. Python 3.13 and 3.14 also take on CVE-2026-12345, a race condition in tempfile cleanup that can nuke files outside the temp directory. That is a lot of interpreter versions to bundle onto one advisory, and the changelog barely shrugs it off.

The ones you actually want to install promptly: BIND on Fedora 45 absorbed an enormous pile of DNSSEC CVEs via a git snapshot, because the 9.18 release is dead upstream and someone had to keep the lights on. roundcubemail 1.7.5 (present on both 44 and 45) is basically a coupon book of web vulnerabilities, from IMAP command injection to session object injection. dhcpcd on 45 ate five separate CVEs all at once from malformed DHCPv6 traffic, and curl on 45 fixed an HTTP/2 upload use-after-free.

A couple of paperwork oddities you might want to sanity-check. The valkey-9.1.3 advisory on Fedora 45 describes its own release in the body text as "Valkey 8.0.12," which is either a typo or a sign the release notes were copy-pasted. The rust-app-store-connect entry names RUSTSEC-2026-0190 in the header while the changelog actually rebuilds for RUSTSEC-2026-0382. Neither is a reason to lose sleep, just some mismatched notes.

Oracle Linux

Oracle Linux pushed another broad round of security patches, this time reaching across OL7 to OL10. The handful of Criticals are easy to spot, but treat the whole batch as a single run to the update command, since most of these advisories land on the same machines.

The Criticals are two fence-agents releases (OL9 and OL10) plus one .NET 10.0 on OL8. The fence-agents fixes exist because the package ships a bundled PyJWT carrying five known flaws. You have to wonder why the JWT library had problems worth patching in the first place, but the update is what it is. The .NET Critical bundles roughly 22 CVEs, most of them carried over from earlier .NET 10.0 releases.

Firefox is doing exactly what Firefox does, showing up twice with 145 CVEs each. One advisory hits OL8, the other OL9, both bumping to the 153.6.0 ESR. 145 in a single browser update already, spread across two separate releases for the same version line.

The kernels arrive in their usual split form. Mainline gets a modest haul on OL8 (6 CVEs), OL9 (18), and OL10 (1), while the OL9 Unbreakable Enterprise kernel for 5.15 drags in nearly 290. The OL8 UEK entry is a short, aarch64-only list of 4.

BIND and glibc make up the common ground. BIND turns up three times (9.11.36 and 9.16.23 on OL8, plus 9.16.23 on OL9), all chasing the same GSS-TSIG arbitrary-code-execution hole along with a cluster of denial-of-service variants. glibc shows up on OL8 twice and OL10 once, mostly for the usual decoding and wordexp issues.

Everything else trims down: webkit2gtk3 (17 CVEs on OL9, tied to a Skia bump), dpdk (14 on both OL9 and OL10), tesseract (6 on OL9 and OL10), qemu-kvm, freerdp (3 on OL8, 12 on OL10), gimp, grafana, brotli, python-dns, raptor2, Xwayland, and the OL8 automation-manager. The OL7 survivors are just host-metering and gvfs, one CVE apiece.

Red Hat Enterprise Linux

Red Hat cleared out its RHEL advisory queue with a batch of 50 errata, touching versions from 7 all the way to 10.2. If you run any of those, your maintenance window just got busier. The severity split is four Critical, 44 Important, and two Moderate, which is enough "Important" to keep a team occupied without tripping any alarms.

The four Criticals are the ones to patch first. They land on fence-agents (RHEL 10.0 EUS), a kernel update for the 8.6 Advanced Mission Critical and Extended Update Support tracks, and webkit2gtk3 twice, once each for RHEL 8.4 and the 9.4 SAP channel. SAP customers are carrying two hits on that browser engine.

The two Moderate updates (pipewire on RHEL 10.0 EUS, Xwayland on RHEL 8) are the low-priority bucket.

A handful of packages appear more than once, usually because Red Hat chased several CVEs across multiple support channels. bind is the repeat offender with seven entries including bind9.16. flatpak, kernel (regular and -rt), opentelemetry-collector, dnsmasq, libX11, and a PKI cluster (pki-core, dogtag-pki) each show up multiple times across SAP, EUS, and long-life tracks.

Two of the 50 are really just version bumps in advisory clothing: the JBoss EAP XP 6.0.7.GA release on the 8.1.9 base and the Service Interconnect 2.2.4 container images. Skip them if you don't run either.

The last detail worth flagging is RHEL 7. It appears twice, both times under Extended Lifecycle Support, which is Red Hat spelling out that this is the last boat off the island.

Rocky Linux

Rocky Linux just pushed a batch of errata across three of its supported releases, so if you're on v8, v9, or v10, a handful of these likely need your attention. The advisories hit Rocky Linux 8, 9, and 10, meaning this isn't isolated to whichever newest version happens to be in front of you.

The sharpest edges belong to fence-agents, which landed two Critical ratings, one each for v9 and v10. That's the package cluster nodes use to force off VMs that have stopped cooperating, so a hole there is exactly the sort of thing you fix promptly.

The rest is a spread of Important and Moderate updates. Eleven advisories carry the Important tag, covering freerdp (v10 and v8), dpdk (v10 and v9), cockpit (v9), raptor2, python-dns, tesseract, webkit2gtk3, and the v8 kernel. Moderate updates round things out with the v10 and v9 kernels, the v8 cockpit, tang, and mod_auth_openidc.

A couple of details worth flagging before you go applying everything. The virtio-win entry (RLBA-2026:43594) is labelled RLBA rather than RLSA, meaning it's a bug-fix and enhancement release, not a security patch. Similarly, the freerdp, v8 cockpit, and v8 kernel advisories bundle security fixes together with bug fixes and enhancements, so they're part updates, not pure security bumps. The two 2023 advisories (tang and mod_auth_openidc) are simply catching up on Rocky Linux 8, which still has support, so they show up on the list.

Slackware Linux

Slackware has pushed out a security update for rsync, and if you're syncing anything worth keeping intact, it's the one you'll want to grab. The release, tagged SSA:2026-308-01, lands on both Slackware 15.0 and -current, bumping the package to 3.5.2.

The headline fix addresses something a bit more insidious than the usual "off-by-one and boom" bug. A malicious receiver could feed weak checksums that collide with consecutive rolling windows, which effectively neutered rsync's strong-checksum verification. That means the integrity check that's supposed to catch corrupted transfers could be quietly bypassed. CVE-2026-119741 covers it. Not the kind of thing that gets you hacked in a dramatic way, but the kind of thing that gets your data silently wrong.

As usual, you'll want to run this as root. Two arches per branch get their packages, plus MD5 signatures if you care about verifying what came down the wire.

SUSE Linux

SUSE and openSUSE pushed a fresh batch of security patches this week, and the tally runs to roughly thirty separate announcements. That covers everything from Linux kernel live patches to a pair of graphics drivers, plus enough everyday tooling that you probably already have some of them installed. A couple of threads run all the way through the batch, and they're worth pulling on before you start applying fixes.

The most obvious is how frequently the same flaw shows up in unrelated projects. A crafted zstd frame that crashes the decoder (CVE-2026-116591) lands in hauler, cadvisor, and go-containerregistry, while the golang.org/x/net CPU-eating HTTP/2 bug (CVE-2026-78669) turns up across gh, coredns, trivy, the AWS CloudWatch agent, and vexctl. One downgraded dependency grabbing six different packages is about as supply-chain as it gets.

Severity labels here don't track headline counts very well. Chromium absorbs 21 CVEs and earns only "important," NVIDIA packs 81 into one driver update (still "important"), while rsyslog fixes a single RCE plus a small length-wrap bug and takes home "critical." rqlite is arguably the strangest of the lot: it gets rated critical for six vulnerabilities, then explains in its own writeup that it isn't actually affected by any of them because the vendored dependencies were already past the fixes. So a "critical" tag can occasionally mean "we checked, and it was already fine."

A few are genuinely the ones to install first. Chromium 156 cleans up memory-corruption and use-after-free bugs, the class that tends to ship in the wild. rsyslog's critical rating comes from an omfile template that uses untrusted input as a file path, which puts a shell within reach of anyone who can feed it log data. The NVIDIA update is less about those 81 CVEs and more about the housekeeping: it re-enables CXL support, then immediately re-disables it on NVIDIA's advice, and repairs builds against a renamed kernel flavor.

Half the batch reads like the part people skip. A dozen moderate updates for openSUSE Tumbleweed's default media cover Firefox ESR, libpolkit, a Perl web framework, and several more packages nursing the same HTTP/2 bug. None of them scream, which is precisely the problem. Every one installs the same way you'd expect on SUSE systems, so a plain zypper patch or YaST's online update will sort them out.

Ubuntu Linux

Ubuntu's security team issued a batch of patches on November 4th, and most of it is the quiet, unglamorous maintenance you'd rather see happen. A few of these are worth your actual attention, though.

The one to look at first is APT (USN-8996-1). Max Justicz found that APT mishandles hard links when it hits redirects and retries downloads, which a remote attacker sitting in the network path can turn into installing an unverified package and running code as root. It's the rare notice where the impact is genuinely bad, and Ubuntu is pushing the fix across eight releases, going all the way back to 14.04 LTS. The fix even reaches the ESM-supported oldies, so you may as well update if you're still there.

The rest lean toward denial-of-service, with a couple that can also execute arbitrary code. Pillow (USN-8999-1) is the cluttered entry here: Ubuntu folded ten separate CVEs into one notice covering everything from decompression bombs to JPEG2000 tile math and PDF stream sizes. Squid (USN-8998-1) is the more interesting failure mode, since a bug in how it handles Transfer-Encoding headers opens the door to HTTP request smuggling, cache poisoning, and bypassing security checks. Net-SNMP (USN-8997-1) will simply hang on newly accepted connections, and Twisted's IMAP server (USN-9000-1) chokes on wildcard patterns in mailbox list commands. The ADOdb fix (USN-7530-2) is a follow-up to an earlier notice, and every patched package here sits behind Ubuntu Pro.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all