Today's Linux security updates hit eight distros with browsers taking the biggest hit and kernels piling on the most raw CVE counts. SUSE listed 230 Chromium CVEs while Debian went further at 266, and Fedora's own Chromium advisory of 230 CVEs smells synthetic until upstream vouches for them. Kernel updates are the real volume, with AlmaLinux 9 packing roughly 40 CVEs and Oracle shipping two fresh 6.12 trees plus microcode and .NET patches repeated across 8.0, 9.0, and 10.0. Standout quirk: Ubuntu's USN-8779-2 quietly reverted a Bubblewrap symlink fix that had broken Flatpak launches, so scan the individual advisories and patch whatever actually runs on your machines.

Today's Linux patch round: browsers eat hundreds of CVEs, kernels don't slow down

Every cycle the pattern is roughly the same. Browsers take the biggest hit. Kernels pile on the most raw CVE counts. Something gets mislabeled along the way. Today's roundup spanning eight distros, follows the usual script. If any of these land in your environment, you probably owe yourself an afternoon.

The loudest figure all week is 230. That's how many CVEs SUSE stacked onto Chromium for openSUSE Leap 16.0, and it's exactly why Fedora's own Chromium advisory should set off alarms. Fedora lists CVE-2026-87429 through CVE-2026-87658 as a neat, contiguous block. Upstream browser updates usually close half a dozen at most. Treat those 230 as fiction until someone upstream vouches for them. The miskeyed link in Fedora's undici entry (id(802)) is another tell. It all smells synthetic.

Firefox pulls a smaller, saner count. Firefox ESR 153.2.0 on SUSE carries 24 CVEs leaning hard on the classics: use-after-frees across the DOM, Graphics/WebGPU, and Audio/Video, plus a sandbox escape in the Remote Settings Client. It still earned SUSE's single critical rating, which is the kind of ranking choice you usually only see from a vendor trying to earn the click.

On Debian the raw totals get uglier. Thunderbird took 31 CVEs (92005 through 92032, plus 92238-92240) for arbitrary code execution, and Firefox ESR got the same 28-CVE range. And then there's Debian's Chromium advisory sitting at 266 CVEs. You might do a double-take at a browser needing a quarter-century's worth of fixes in one release, but that's just how Chromium ships these days. Do it anyway.

The kernel numbers get absurd

If browsers are the headline, kernels are the volume. AlmaLinux 9 picked up a single kernel advisory (67150) reportedly packing around 40 CVEs touching Bluetooth pairing, a SCSI driver reset, and IPv6 header handling. Calling this a tidy security patch would be generous. Oracle Linux went further, dropping two fresh 6.12 trees on OL10: 211.55.1 with 25-plus CVEs and 211.53.1 with 29-plus, alongside a 5.14 bump for OL9 and a 4.18 for OL8. Almost everything is use-after-free and memory-safety bugs in the DRM, networking, and socket layers.

Keep in mind the housekeeping hiding inside some of those kernel releases. Oracle quietly disabled UKI signing and added new driver-signing certificates, so if you hand-sign your own modules you may want to look before rebooting. SUSE's kernel wave is a different flavor: Live Patch versions 46, 57, 30, 32, and 16 all patch an identical five-CVE set capped by CVE-2026-64564, a KVM flaw NVD rates at 9.8. You typically need just one on a given box.

A few things deserve a wince

The Debian xz-utils patch (DLA-4783-1) fixed a memory-corruption bug with no CVE number attached at all. That's a faint echo of the infamous 2024 backdoor, and it still deserves a glance for reasons beyond the count. Debian's zip advisory also reopens CVE-2018-13410, a command injection via crafted filenames that apparently never got fully buried, and it's carried forward across bookworm, stretch, buster, and bullseye. If you're still on stretch you have some ground to make up.

Then there's Ubuntu's USN-8779-2, which openly admits its own predecessor broke something. The Bubblewrap regression pulled back a symlink fix from USN-8779-1 because that fix disrupted symlink resolution enough to stop certain Flatpak apps from launching. They noticed, and they apologized. It's the kind of thing that makes you nervous about trusting the fix in the first place. It's better than silently shipping broken sandboxes, though.

The rest of the pack

PostgreSQL 18 is worth an actual read across several distros. AlmaLinux and Oracle both shipped it with roughly 19 to 20 CVEs, mostly arbitrary code execution through pg_dump, psql's COPY FROM STDIN, the logical decoding plugin, and regex heap handling. AlmaLinux's ALMA 9 variant quietly adds a PostGIS hole on top. On Rocky, patch the whole stack, not just the database, since the advisory drags in pgvector, postgis, pgaudit, and decoderbufs.

.NET gets the same two CVEs repeated across 8.0, 9.0, and 10.0 on Oracle, Red Hat, Rocky, and AlmaLinux. It's convenient if you run more than one line. The lone RHEL Critical this round is RHSA-68567, a mariadb-connector-c bump for RHELAI 3.6 (CVE-2026-44172). Red Hat's queue runs to 46 entries total, with tomcat showing up seven times across support channels and libvirt four times. That's not seven brand-new holes, just the usual spread of patched versions over different tracks.

Rsync finally jumped to 3.5.0 on OL10, closing a directory-traversal and command-injection cluster that was genuinely nasty. Coreutils fixed two real heap overflows in cp and unexpand on both Oracle and AlmaLinux. Neither was ever going to be pretty.

The takeaway across all eight distros is the same one every cycle. You can skip the pieces that don't touch your stack, but most of these fix remote-exploitable holes, so batching in whatever actually runs on your machines is the pragmatic call. Head here to the individual advisories if you want the full CVE lists and exact version numbers for your platform.

The Updates in Detail

AlmaLinux

AlmaLinux pushed a big batch of security errata out across its AlmaLinux 8, 9, and 10 release trains. If any of these land in your environment, you probably owe someone an update.

The loudest single payload sits in PostgreSQL 18, which apparently went through its usual end-of-cycle purge. About 19 CVEs ride along, and nearly all of them share the sunny "arbitrary code execution" designation. The fixes poke at pg_dump, psql's COPY FROM STDIN, the logical decoding plugin, and even regex heap handling. You get two advisories for this one, and the AlmaLinux 9 variant quietly tacks on a PostGIS hole as well.

The kernel is where the numbers get absurd. Four separate kernel advisories span the three releases, and the AlmaLinux 9 kernel update (67150) alone packs somewhere around 40 CVEs. The fixes stretch across Bluetooth pairing, a SCSI driver reset, and IPv6 header handling, so calling this a tidy security patch would be generous.

Other things that show up. Intel microcode (both on AlmaLinux 10 and 9) plugs two privilege-escalation holes in Ring 0 and SMM. .NET got the same pair of CVEs across 8.0, 9.0, and 10.0, though only the 8.0 update reads as Moderate. Tomcat collected eight issues, most of them auth and authz you would rather not have bypassed. DNS services got hit too: unbound can take cache poisonings from predictable UDP ports, and perl-Net-DNS invites denial of service through runaway TSIG recursion. Even coreutils cracked under pressure, with uniq and unexpand now capable of handing you a DoS or an out-of-bounds read.

The takeaway is straightforward. You can skip the pieces that don't touch your stack, but most of these fix remote-exploitable holes, so batching in whatever actually runs on your machines is the pragmatic call.

Debian GNU/Linux

Debian handed out a pile of security patches and Mozilla's packages clearly did the heavy lifting. If you run any of these on Debian 12 or 13, you'll want to upgrade.

The biggest story is arbitrary code execution, which is exactly what you hope never appears in a security advisory. Thunderbird and Firefox ESR each got the same CVE range (92005 through 92032, or 28 bugs for Firefox alone). Chromium showed up with 266 CVEs in a single advisory. You might do a double-take at a browser needing a quarter-century's worth of fixes in one release, but that's just how Chromium ships these days, so do it anyway.

The web server side was more modest. nginx's three fixes cover a heap overflow, a use-after-free, and memory disclosure, though your actual risk depends a lot on your config, specifically whether you're mixing server-side includes with proxy_pass and buffering off. bind9 took harder hit with 12 CVEs, mostly denial of service and cache poisoning, which is the part worth caring about for DNS. There's also a do-nothing-sometimes fix for libapache2-mod-auth-openidc, where malformed cookie parsing just crashes things.

The strangest entries come from compression tools. xz-utils picked up a memory-corruption fix with no CVE number attached at all, which has faint echoes of the infamous 2024 backdoor and is worth a wince. zip picked up a 2018 CVE (CVE-2018-13410), a command injection via crafted filenames that apparently never got fully buried. Debian carried it forward across both the standard LTS track and Extended LTS (FreeXian), covering bookworm, stretch, buster, and bullseye, so if you're still running stretch you have some ground to make up.

Everything splits between Debian's normal security tracker and the LTS / Extended LTS tracks, so whether you can upgrade today depends on which release you're actually on.

Fedora Linux

If a Fedora advisory claims a single browser release squashes 230 vulnerabilities, do a double take. That is not how Chromium ships.

What you have is a stack of Fedora 44 and 43 security notices dated September 18, 2026, and a fair chunk of it smells like synthetic output. The entries carry future dates, and the Chromium listing runs a neat, contiguous block of CVEs from CVE-2026-87429 to CVE-2026-87658. Upstream browser updates typically close a half dozen issues at most, so treat those 230 numbers as fiction until someone upstream vouches for them. The miskeyed link in the undici entry (id(802) is another tell.

Ignore the smell for a moment and look at what is genuinely going out. Beyond Chromium, the rest is routine hardening. parted patches 32-bit integer overflows in its partition and resize code, django5 takes the latest 5.2.17 release to kill a high-severity file-write flaw plus three lower issues, undici closes a denial-of-service bug, gnatcoll and sblim-cmpi-base are quiet fixes, and GitPython bumps to 3.1.62.

Oracle Linux

Oracle Linux pushed a large batch of errata across versions 8, 9, and 10, and the security advisories are doing nearly all the work this round. Sort the noise and a few patterns show up quickly.

The kernels carry the real weight. OL10 picked up two fresh 6.12 trees (211.55.1 and 211.53.1), OL9 got a 5.14 bump, and OL8 inherited a 4.18 one. The 6.12 updates alone tag well over two dozen CVEs each, mostly use-after-free and memory-safety bugs in the DRM, networking, and socket layers. There's also Oracle housekeeping in there: new driver-signing certificates and a quiet decision to disable UKI signing, so if you hand-sign your own modules you may want to check before rebooting.

.NET gets treatment on three major versions at once (8.0, 9.0, and 10.0), all rebuilt for Oracle Linux. The same two CVEs ride along across every one, which is convenient if you run more than a single line.

The rest is a practical grab bag. rsync finally jumped to 3.5.0 on OL10 (3.2.7 on OL9) to close a genuinely nasty cluster of directory-traversal and command-injection bugs. coreutils fixes two real heap overflows in cp and unexpand that were never going to be pretty. postgresql:18 opens a brand-new module stream while :16 gets patched, and nginx:1.24 keeps taking hits for HTTP/2 and MP4 exploits as if that version never rests. perl gets its trie-overflow CVE fixed on both the 5.32 module and the ancient 5.26 line. Redis, tesseract, rsyslog, libevent, firewalld, unbound, libsoup, and corosync round out the batch. Microcode_ctl updates touch a wide swath of Intel families, so anyone on server silicon should just install them and move on.

Red Hat Enterprise Linux

Red Hat has cleared a fresh batch of RHSA-2026 advisories, and the queue runs to 46 entries. One warrants a Critical rating, four are Low, five sit at Moderate, and the remaining 36 land on the "Important" mark. Standard stuff, though a few names repeat enough to make you lose count.

The lone Critical is RHSA-68567, a mariadb-connector-c bump for RHELAI 3.6 (CVE-2026-44172). Everything else is workaday. libvirt gets patched four separate times across RHEL 9.6 EUS, 9.4 UFS, 10.0 EUS, and 9.2 UFS. tomcat shows up seven times across the support channels, and perl-XML-LibXML four. Red Hat is obviously not hunting down seven brand-new tomcat holes at once, so think of it as the usual spread of patched versions over different tracks.

The kernel family gets its slice too: plain kernel across RHEL 8, 9, and 10, plus a real-time variant for RHEL 8. That wave also carries sudo, corosync, freerdp, and vim updates, so if you run any of those, a look is warranted.

Four OpenShift advisories (65906, 65907, 65838, 65839) are really bug-fix releases with a token Low security rating stuck on, so don't expect fireworks. The 4.18.55 pair (65851, 66385) does pull an Important rating and drags them out of the sleepy tier. RHEL 7 Extended Lifecycle Support hasn't been left behind either: corosync, freerdp, vim, and gstreamer1-plugins-bad-free all land updates there.

Rocky Linux

Rocky Linux has pushed a batch of errata across 8, 9 and 10. Twenty advisories all told, and most of them are security fixes, with a handful layering bug-fix and enhancement work on top. If your systems haven't caught up since the last patch cycle, this is the pile you'll want to clear.

The ninth release tops the count with eight advisories, half of them marked Important. microcode_ctl, the package that ships processor microcode updates, gets its usual mix of security plus bug-fix and enhancement work. The postgresql:18 advisory is the one worth actually reading: it pulls in not just the database but a cluster of related extensions and modules (pgvector, postgis, pgaudit, decoderbufs and friends), so PostgreSQL users should patch the whole stack, not just the main package.

Six advisories land on Rocky Linux 10, repeating much of the same lineup seen in v9. You'll see microcode_ctl, corosync, unbound, tesseract and libevent again across both releases. That overlap is expected, but it does mean you patch each version on its own rather than expecting one update to cover everything.

The eighth release is the most application-flavored of the bunch. .NET 8.0 and .NET 9.0 both arrive here (Moderate and Important respectively), alongside python-lxml, tesseract, libsoup and libevent.

SUSE Linux

SUSE delivered a fairly large batch of security advisories in mid-September 2026, and if you want a place to start worrying, the browsers are it. Chromium (openSUSE Leap 16.0) absorbed 230 fixes, a count that makes you wonder how the changelog ever reached the bottom of the page. Firefox ESR 153.2.0 is comparatively modest with 24 CVEs, but they lean on the classics: use-after-free and sandbox escape. Only one item in the whole set earned SUSE's top "critical" rating, and it is the one with the lower headline number, which is the kind of ranking choice you usually only see from a vendor trying to make you click.

The kernel people all got the same five issues, dressed up four different times. Live Patch versions 46 and 57 for SLE 15 SP4, and 30 and 32 for SP5 (with 16 going to SP6) patch an identical CVE set, capped by CVE-2026-64564, a KVM flaw NVD rates near the top of the scale at 9.8. You typically need just one of these on a given box, but since SUSE issued them per-release, your patch command lands the right variant no matter which SP you run.

Several supporting libraries got hit harder than usual too. pcre2 picked up six out-of-bounds writes and reads across SLE 15 SP6/SP7, glibc took seven split between a moderate SLE advisory and a Tumbleweed one, and cjose plus its devel package chase the same AES key-wrap and CBC problems. GVFA appears twice, once for each release line, and openvpn rounds out the SLE side with a misidentification bug and a denial-of-service path. The openSUSE side reads more like a grab bag: perl-Net-DNS closes a remote code injection hole, gh bumps its vendored SSH library to kill three deadlocks, mbedtls-2 plugs a padding oracle, and openai-codex carries a single moderate advisory while dragging a genuinely exhausting feature list along with it. The full set follows, grouped so you can find your platform quickly.

Ubuntu Linux

Ubuntu shipped a batch of security notices this week, and the one you'll probably care about most is a self-inflicted wound.

The story is USN-8779-2, a follow-up that openly admits its predecessor broke something. The Bubblewrap regression notice pulls back the symlink fix from USN-8779-1 (CVE-2026-87766), because that fix disrupted symlink resolution well enough to stop certain Flatpak applications from launching. They noticed and apologized. It's the kind of thing that makes you nervous about trusting the fix in the first place, but it's better than silently shipping broken sandboxes.

Everything else is standard patching. SQLite (USN-8775-1) crashes on a maliciously crafted SQLar archive a buffer overflow in the sqlar extension, so it's a denial of service rather than remote code execution. Still worth updating.

GNU Bison (USN-8777-1) is the more genuinely interesting one. It mishandles grammar-defined configuration variables when generating HTML reports, which lets an attacker run code under your login. That's an actual privilege move, not just a crash.

GStreamer's Good plugins (USN-8778-1) eat through resources when fed fragmented RTP traffic, again a denial of service, and this one spans the widest range of releases, including 16.04.

A normal system update takes care of it all. Watch the 20.04 and 18.04 entries on SQLite, GStreamer, and Bubblewrap: those sit behind the paid Ubuntu Pro / extended security maintenance line, so you'll need the subscription if you haven't already.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y