Today's Linux patch cycle is dominated by browser-rendering packages, with Chromium pulling 58 CVEs into a single Fedora build and Firefox 73 on SUSE. The same openssh, curl, and sudo advisories are turning up across nearly every distro, so managing multiple boxes means running the same patch twice. Beyond the browser numbers, RHEL's 38 errata, Ubuntu's reboot-required kernel updates, and a rare AlmaLinux libxml2 backport mishap round out a busy day. Browser packages and openssh go first if you're patching now, with kernels needing a separate reboot scheduled afterward.

Daily Linux security roundup: browsers, openssh, and the usual suspects again

Chromium pulled 58 CVEs into one Fedora build, Firefox 73 on SUSE, and the same openssh, curl, and sudo advisories are showing up on nearly every distro today.

Browsers, again. Today's Linux patch cycle reads more like a calendar event than a surprise, and every big number is a web-rendering package. Chromium 153.0.8010.52 landed in Fedora with 58 separate CVEs listed in its own changelog. That is not a rounding error. Fedora's package description calls Chromium "a WebKit (Blink) powered web browser that Google doesn't want you to use," which is about as close to an admission of guilt as a binary gets.

SUSE made the tally worse. A single update to MozillaFirefox 156.0 on openSUSE Tumbleweed ties up 73 issues, and Thunderbird isn't far behind at 31. Put the whole batch together and you land on 136 CVEs across 14 advisories, though only one is actually scored. CVE-2026-92006 at 8.8 does the lifting for the rest.

webkit2gtk3 shows up on AlmaLinux and Oracle too, the package that quietly renders a good chunk of the Linux desktop. AlmaLinux 9 picked up 37 fixes, mostly lifted straight from the Skia and Chromium world. Oracle's is a bigger jump, 2.50.0 to 2.54.0, carrying 41 CVEs. And it even flips the JIT engine back on at the base release, a detail worth remembering.

The recurring cast

Here's the genuinely useful part. The same packages are turning up on nearly every distro, so if you manage more than one box you're basically running the same patch twice.

openssh is the obvious one. AlmaLinux 10 and 9 each picked up five CVEs, including one that lets ssh-agent execute local operations remotely and another that redirects where an sftp download lands. Rocky Linux hit openssh on 8, 9, and 10, and it's the third time this package has been in the news for auth flaws, so treat it as first in the queue. Ubuntu's OpenSSH notice (USN-8804-1) is longer still with ten CVEs, though several need a non-default setup to actually bite you.

curl appears twice in most batches as well. Fedora's Linux 10 update alone has six, covering mTLS reuse, a bad .netrc lookup, super-cookie injection, and leaked proxy credentials. Oracle's curl fix (ELSA-2026-69126) closes a SASL service-name reuse gap plus a hole around proxy settings pulled from the environment. If you pass secrets through curl, these are the ones you want.

sudo landed on release 9 in a few spots, and that's the package you don't sleep on. Fedora, Rocky, and Ubuntu all pushed it, each with the same flavor of policy bypass where an already-authorized user slips past enforcement. Local attacker, limited blast radius, but the sudo track record means you'll probably still treat any sudo advisory as urgent.

PostgreSQL got its own mountain, mostly on the older majors. Fedora bundled sixteen fixes into one advisory for version 16, a spread of RCE paths from type confusion and heap overflows to things reaching into plperl and pltcl. Rocky Linux split PostgreSQL across several advisories, each one also pulling in pg_repack, postgres-decoderbufs, and pgaudit. If you run any of those modules, it's the pile to clear first.

What landed today and what to do with it

The rest of the day is mostly distro-specific, but a few things stand out.

AlmaLinux's batch spans all three supported releases: 16 at Important, three at Moderate, one Low for libarchive. There's a note worth a laugh anyway. The libxml2 update for AlmaLinux 8 lists a genuine backport mishap where someone shipped a wrong upstream commit, dyn:map recursion still crashes, and an internal ticket is already tagging the regression. Security advisories are rarely as tidy as their bullet points imply, but this one admits it out loud.

Debian's LTS crew did the opposite. One tight advisory for memcached (DLA-4791-1), four CVEs for Debian 12 bookworm in version 1.6.18-1+deb12u1. Two date from 2023, which is just how long-term support works: you end up parking a backlog of older problems. The other pair are timing side channels in the SASL auth path, leaking enough data to recover credentials one character at a time if you actually run proxy mode.

Fedora also shipped a 7.2.7 stable kernel. Nothing dramatic in the description, but it brings tree-wide fixes, real-world patches for camera and sensor drivers, and housekeeping where alg_sysctl got reverted for Fedora 43 and 44. If your hardware was flaky, this might actually fix it.

Oracle's Linux 10 side is the quieter half of the day. The two yggdrasil packages get rebuilds against a fresh golang rather than new logic, but that still nets them five and two CVEs. There's also a non-security enhancement for linuxptp on Linux 9, an experimental PROFINET transport, useful if you do time-sync work and otherwise pure background noise.

RHEL is the sprawling one, 38 errata across RHEL, OpenShift, and a pile of application platforms, most at Important. JBoss EAP 8.1.8 got patched four times, once per release, and SAP or telecom channels will see some resurface under Extended Update Support. Keep the errata IDs around when you pull them.

Rocky Linux tracks closely behind with 20 RLSA-2026 advisories and 17 Important. That leaves only unbound, apr-util, and tomcat at Moderate, which keeps the whole fleet from needing an all-night patch session.

Ubuntu's batch is dominated by kernels. Thirteen USNs, and almost every kernel notice carries the ABI-change warning, meaning third-party modules like NVIDIA DKMS or VirtualBox need recompiling or they simply won't load. Reboot after any kernel update. The Raspberry Pi notice does something odd, re-opening CVE-2025-27558 from the 2020 fix, but that needs physical proximity, so it stays a shoulder-surfing problem rather than a remote one.

If you're running any of this today, the practical read is straightforward. Browser packages and openssh go first, since they're the most exposed to the network. curl and sudo next, then PostgreSQL if you run the modules. Kernels need a reboot, so schedule that before the rest. You can find the specific advisories behind the security flag in each distro's update tooling, and the raw CVE references and CVSS scores live on the individual vendor pages.

Keep in mind that those numbers get inflated by browser bundles, so don't let 136 CVEs from one SUSE notice spook you. One scored bug is doing most of the work there, and the rest is routine.

The Updates in Detail

AlmaLinux

AlmaLinux pushed a batch of security errata and it split across all three of its supported releases. If anything in that stack runs on your hardware, you've probably already gotten the email. Sixteen advisories land at Important, three at Moderate, and one (libarchive) at Low, spread across 20 updates total. Here's the shape of it.

The single largest haul is webkit2gtk3 on AlmaLinux 9, where you're looking at 37 fixes. Most are the standard "processing maliciously crafted web content" lineup lifted straight from the Skia and Chromium world. It reads like an annual deep clean of browser CVEs, so expect it every cycle regardless.

PostgreSQL 16 is the other headline, with sixteen fixes bundled into one advisory. That's a wide spread of ways to land arbitrary code execution: type confusion, heap overflows, integer wraparound, plus a few that reach into plperl and pltcl for good measure.

SSH gets a thorough treatment on both majors. AlmaLinux 10 and 9 each picked up five CVEs, including one that lets ssh-agent execute local operations remotely and another that lets an sftp client redirect where downloaded files land. The Linux 10 advisory is ALSA-2026:69129, and the Linux 9 mirror is 69130. Slightly convenient numbering.

curl shows up twice, once per major release, carrying its usual grab-bag of credential and connection-reuse problems. The Linux 10 update alone has six CVEs covering mTLS reuse, a bad .netrc lookup, super-cookie injection, and leaked proxy credentials. If you pass secrets through curl, these are the ones you want.

The quieter fixes are worth a glance without feeling obligated. libarchive covers a heap overflow and an integer overflow under a Low rating. coreutils absorbed one heap under-read in sort, rsyslog, OpenEXR, corosync, FreeRDP, yggdrasil, GStreamer, and PostGIS each took whatever they needed.

One note that's more amusing than reassuring: the libxml2 update for AlmaLinux 8 lists a genuine backport mishap. Someone shipped a wrong upstream commit and dyn:map recursion still crashes, with an internal ticket already tagging the regression. Security advisories are rarely as tidy as their bullet points imply.

Debian GNU/Linux

Debian's LTS crew fixed one thing: memcached. It's a tight advisory, DLA-4791-1, covering four CVEs for Debian 12 bookworm and delivered in version 1.6.18-1+deb12u1. Not much to it, though two of these date from 2023, which is just the nature of long-term support you end up parking a backlog of older problems.

The first two are proxy-mode crashes. CVE-2023-46852 is a buffer overflow that trips when a multiget request has a run of spaces after "get", and CVE-2023-46853 is an off-by-one when a client sends a bare \n instead of \r\n. Either one is enough to destabilize memcached if you actually run it in proxy mode.

The other pair is the quieter, insidious sort. CVE-2026-47783 and CVE-2026-47784 are timing side channels in the SASL password-database auth path. A loop stops as soon as it matches a username, and passwords go through memcmp, so both leak timing data that could, in principle, let someone recover credentials one character at a time.

Fedora Linux

Fedora's update queue came through this week with a spread of security fixes across both Fedora 44 and Fedora 43. Most of it reads like routine maintenance, but one advisory is worth your immediate attention: Chromium is jumping to 153.0.8010.52 with what the changelog lists as 58 separate CVEs. That is not a typo. The browser's own summary describes it as "a WebKit (Blink) powered web browser that Google doesn't want you to use," which is about as close to an admission of guilt as a package can get. Getting every one of those memory-safety holes closed before your next tab is a good reason to run the update now.

The other heavy hitter is the 7.2.7 stable kernel. Nothing dramatic in the description, but it brings a pile of tree-wide fixes, real-world patches for camera and sensor drivers (int3472, Dell XPS 14), and some neat housekeeping: the alg_sysctl change got reverted back out for Fedora 43 and 44. If your hardware was flaky, this might actually fix it.

.NET received the predictable treatment. Fedora pushed the same runtime and SDK bumps to versions 8, 9, and 10, split across both release lines, all patched against the same five or six CVEs. On 8, 9, or 10, you get the same fix set either way.

Then there is a grab bag of smaller packages. postgresql16-anonymizer climbs to 3.2.2 to close SQL injection and privilege escalation holes. freeipmi lands at 1.6.19 with eight CVEs. perl-Net-DNS goes to 1.57 to shut down a denial-of-service path that abused TSIG records. And Cyrus IMAPd gets version bumps on both 44 (3.12.4) and 43 (3.10.4) with 15 distinct CVEs, mostly around access control and information disclosure in the IMAP and JMAP layers. Everything installs the same way, through the dnf advisory flag.

Oracle Linux

Oracle Linux shipped seven updates this round, split roughly evenly between Linux 9 and Linux 10, and most carry a security stamp you'll want to act on.

The one that grabs the most noise is webkit2gtk3 on Linux 9. Oracle is pushing it from 2.50.0 all the way up to 2.54.0, and along for the ride come 41 CVEs. That's not a typo; the advisory lists every one of them, and it even flips the JIT engine back on at the base release. If your box renders any web content, pull this first.

Two others arrive marked "Important." The curl fix (ELSA-2026-69126) closes two holes: a SASL service-name issue tied to connection reuse, and a gap around proxy settings read out of the environment. The sudo update (ELSA-2026-69123) plugs an execveat interception bypass that let logged subcommands slip through. Both are the sort of thing that quietly becomes a remote-access path once someone already has a foot inside the door.

The Linux 10 side is quieter. The two yggdrasil packages (ELSA-2026-69308 and ELSA-2026-69099) aren't getting new logic so much as a rebuild against a fresh golang, which still nets them five and two CVEs, respectively. The openssl-fips-provider update (ELSA-2026-27746) is rated only "Moderate" but ships an actual FIPS 140 compliance bundle plus the real CVE-2026-31790 fix.

Rounding things out is a non-security enhancement for linuxptp (ELEA-2026-69110) on Linux 9: an experimental PROFINET transport and some pulse-handling fixes in ts2phc. Useful if you do time-sync work; otherwise it's background noise.

Red Hat Enterprise Linux

Red Hat has pushed 38 security errata across RHEL, OpenShift, and a pile of application platforms. Most land at an "Important" rating. Four only hit "Moderate": coreutils, libsoup, tar, and gstreamer1-plugins-good.

The kernels show up repeatedly, which is fair given how much the kernel tends to break. You'll also spot postgresql split across several RHEL releases, and JBoss EAP 8.1.8 patched four separate times for RHEL 8, 9, 10, and as an XP release. Each vulnerability links to a CVE you can chase down in the References section for a real CVSS score.

If you run SAP or telecommunications channels, or sit on an Extended Update Support stream, expect some of these to be patched under multiple service names. Keep the errata IDs around when you pull the updates.

Rocky Linux

Rocky Linux just pushed a wide batch of security advisories, and this batch isn't the gentle kind. Twenty entries under the RLSA-2026 header, and 17 of them carry the "Important" flag. The remaining three Moderate items are unbound, apr-util, and tomcat, spread across three different releases, so they won't drag the whole fleet into an all-night patch session.

openssh is the obvious headline, touched on all three releases from Rocky Linux 8 through 10. It's the third time this package has been in the news for auth flaws, so treat it as the first thing you update. curl shows up twice (9 and 10), and sudo landed on release 9, which is a package whose security track record means you don't want to sleep on any sudo advisory.

PostgreSQL gets its own little mountain. Version 15 received two separate advisories (one on release 8, one on 9) plus one for version 16 on release 8, and each one also pulls in the pg_repack, postgres-decoderbufs, and pgaudit modules. If you run any of that, it's the pile to clear out first. Firefox and webkit2gtk3 also appear, riding on the usual browser-renderer worries.

Most advisories target just one release, but the PostgreSQL overlap is worth flagging if you have a multi-version shop.

SUSE Linux

Firefox grabbed most of the CVE paperclips this week. A single update to MozillaFirefox 156.0 on openSUSE Tumbleweed ties up 73 issues, and Thunderbird isn't far behind at 31. As you've probably seen with these browser releases, Mozilla files a huge pile of bugs under one version and lets the advisory highlight just the handful worth stressing about. Here the only scored entry is CVE-2026-92006 at 8.8, which does the work for the rest.

Tally it all up and you get 136 CVEs across 14 advisories. The rest of the batch is a grab bag of Tumbleweed packages: apptainer, apko, the Kubernetes policy tool kyverno, libsoup, PyMuPDF for Python, an AWS CloudWatch agent, bazel's Python rules, and a set of SSSD development libraries. Most are single CVEs landing in the 7-to-9 range, so they're the kind you patch without much deliberation.

Only two advisories in the set are rated "important," and freeipmi is the one you actually want to circle. It packs seven CVEs, mostly stack buffer overflows, including arbitrary code execution in the ipmi-oem client and several more triggered when a BMC sends back more bytes than it was asked to. If you run SUSE Linux Enterprise against server management hardware with an IPMI interface, this is the fix to apply first. php-composer2 shows up twice, once as an important patch covering the 15 SP4/SP5 line with six CVEs, and again as a moderate follow-up for the newer 15 SP7 with three. It looks redundant, but SUSE just tracks the two support lines separately. The rest are moderate, including libtpms (a TPM heap read bug) and a libsoup update that pushes two CVEs into the 8-to-9 range.

Ubuntu Linux

Ubuntu pushed a round of security notices and the headline is kernels. Thirteen USNs in the batch, spanning libssh2, OpenSSH, sudo, and roughly every Linux kernel flavor you can think of (Azure, Azure CVM, Oracle, NVIDIA BaseOS, NVIDIA, Raspberry Pi, low latency). The kernel notices bundle the most CVEs, so here's the shape of things before you start running updates.

The libssh2 fix (USN-8799-1) is the one you can read in one sitting. Four issues, all about the library mishandling publickey subsystem responses and SFTP server responses closely enough to crash or possibly run arbitrary code. The affected range runs 14.04 through 22.04, which matters because you still might have something old doing SSH work. The 22.04 package jumps to 1.10.0-3ubuntu0.1; the older releases require Ubuntu Pro.

OpenSSH (USN-8804-1) carries a longer list: ten CVEs, from shell metacharacters in usernames to a use-after-free in concurrent remote forwarding. The shell-metacharacter hole (CVE-2026-35386) is 14.04-only and needs a non-default setup to bite you, so don't lose sleep over it. The GSSAPI and forwarding bugs touch 18.04 and 20.04, and the three older releases again sit behind Ubuntu Pro.

The sudo patch (USN-8803-1) is smaller than its name implies. Sudo skipped an intercept-policy check for commands run under certain conditions, letting an already-authorized user slip past enforcement and logging. Local attacker, limited blast radius, but a genuine policy bypass. Ubuntu 24.04 and 26.04.

The kernels are where the volume lives. The ARM TLB broadcast invalidation flaw (CVE-2025-10263) shows up repeatedly: a local attacker could write to memory after permissions were revoked, and it's spread across both Azure notices. The plain Azure notice (USN-8728-2) also bundles the AMD Zen 2 operation-cache issue (CVE-2025-54518). Tally those up across Azure, Azure CVM, NVIDIA BaseOS, Oracle, low latency, NVIDIA, and Raspberry Pi and you're looking at a couple hundred distinct CVEs. The NVIDIA BaseOS notice (USN-8800-1) is the bloated one, touching subsystems for most of the kernel's subsystems at once.

Two things to flag before the reboot. Almost every kernel notice carries the ABI-change warning, which means third-party modules (NVIDIA DKMS, VirtualBox, that sort of thing) need recompiling and reinstalling or they simply won't load. A standard upgrade usually handles the metapackage side for you. The Raspberry Pi notice (USN-8661-5) also re-opens CVE-2025-27558: the WiFi mesh code still mishandles aggregated frames from the original 2020 fix, letting a nearby attacker inject packets. Physical proximity required, so it stays a physical-proximity problem rather than a remote one.

Reboot after any kernel update. Everything else completes with a normal update.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all