Eight major Linux distributions shipped security errata today, addressing over three hundred CVEs across the standard infrastructure stack. The coordinated update targets recurring HTTP/2 memory exhaustion flaws, Go standard library bypasses, and critical bugs in OpenSSH, Chromium, and PHP. Administrators running internet-facing services should prioritize patching immediately, especially on systems relying on OpenShift, FreeIPA, or unpatched Node.js runtimes. Once the package manager finishes updating, expect to manually restart dependent services like SSSD, SPICE vdagent, and the OpenSSH daemon.

A Heavy Security Batch Hits AlmaLinux, Debian, Fedora, Oracle, RHEL, Rocky, SUSE, and Ubuntu

HTTP/2 flaws, OpenSSH quirks, and a flood of Go stdlib CVEs are pushing a synchronized patch day across the Linux ecosystem.

If your package manager has been pinging you all morning, don't brush it off. Eight major Linux distributions dropped synchronized security errata today, covering everything from the Linux kernel to PHP, Node.js, and OpenSSH. We're looking at well over three hundred CVEs across these releases, and a few of them are actively exploitable in production environments.

The recurring theme across most of these bulletins is HTTP/2 memory exhaustion, unencrypted transport bypasses, and a fresh wave of Go standard library patches. If you're running infrastructure that talks to the internet, treating today as a hard patch deadline is the only sane move.

The Browser and Runtime Fixes

Debian's Chromium bump is the obvious headline. The package jumps to 152.0.7977.75-1~deb13u1, quietly absorbing more than two hundred CVEs in a single flood. Browser engines usually stagger their fixes, but this one arrived all at once. Arbitrary code execution, denial of service, and information disclosure are all on the table if you skip the install.

Over on the Ubuntu side, OpenSSH got hit with three separate bugs. One is a ssh-agent quirk that lets forwarded connections slip past local-only restrictions. Another is a use-after-free condition in concurrent remote forwarding. You should prioritize updating SSH servers on 22.04 LTS and newer. FFmpeg rounded out Ubuntu's notice with fourteen CVEs spanning demuxers and protocol handlers, mostly triggered by crafted media files. Restart SSSD, SPICE vdagent, and OpenSSH after the upgrade takes effect.

The Go ecosystem got a quiet but heavy shakeup. AlmaLinux, Rocky, SUSE, and Oracle all shipped patches for the Go standard library, targeting CVEs that cover HTTP/2 unencrypted DoS, TLS indefinite KeyUpdate loops, and net/url quadratic complexity. Head here to review the full upstream Go advisory if your stack runs custom binaries. These are exactly the kind of routine maintenance updates that keep the lights on.

PHP also got a major bump. AlmaLinux and Oracle both pushed PHP 8.2 and 8.3 rebases to close a PostgreSQL backslash-escaping SQL injection and a phar archive denial of service. Node.js 24 landed across Rocky and Oracle with runtime rebases and npm brace-expansion fixes. Keep in mind that any service speaking HTTP/2 to untrusted networks is likely sitting on one of these patched endpoints.

Kernels, Infrastructure, and the Long Tail

Kernel updates are hitting AlmaLinux, Fedora, Oracle, and RHEL simultaneously. The standard and real-time kernel packages in AlmaLinux each carry fourteen CVEs, targeting use-after-free bugs, out-of-bounds writes, and a lingering AMD Secure Nested Paging flaw. Fedora's 7.1.13 stable bump brings ACPI resource overlap corrections and a page_pool alignment fix that has been throwing kernel panics during active calls. Oracle's Unbreakable Enterprise Kernel tackles Safe-RET vulnerabilities that interfere with interrupt handling. Microcode updates across Oracle and SUSE drop processor-level fixes for over a dozen CPU families.

Infrastructure tools are scattered across the boards. RHEL quietly refreshed OpenShift Container Platform 4.12.97 alongside maintenance streams for Camel and Quarkus, while Satellite management absorbed four async updates across different major versions. Fedora patched FreeIPA for seven CVEs covering authenticated denial-of-service vectors and privilege escalation via krbCanonicalName manipulation. Cockpit, pip, and kbd each took surgical hits for memory leaks and local privilege escalation through openvt and PID file handling. Valkey 9.0.6 rolled out with RDMA connection crash fixes and a lingering ACL bypass in GEORADIUS. SUSE's announcement focused on apr-util landing a critical rating for six flaws, including a heap buffer overflow and a SQL injection path in the Oracle database driver. nodejs20 picked up 35 CVEs there, mostly around TLS hostname verification skips and HTTP request smuggling.

A Detailed Breakdown

AlmaLinux

AlmaLinux shipped eight important security updates for AlmaLinux 8 and 10. The batch spans the Linux kernel, PHP, FreeRDP, Perl DBI, Node.js, and two Go-based utilities. If you run any of these on production hosts, patching them this week makes more sense than hoping the vulnerabilities stay theoretical. The standard and real-time kernel packages carry the heaviest load with fourteen CVEs each, targeting use-after-free bugs, out-of-bounds writes, and a lingering AMD Secure Nested Paging flaw. The two Go packages mostly mirror upstream standard library patches, which keeps your infrastructure secure without forcing a rewrite of your application code. PHP gets rebase to 8.3.33 to close a PostgreSQL backslash-escaping SQL injection and a phar archive denial of service. Node.js, FreeRDP, and Perl DBI round out the list with heap overflows and remote code execution paths that upstream developers already flagged. You will want to review the errata links if any of these services sit in front of untrusted networks.

Debian GNU/Linux

Debian issued today a heavy Chromium patch for Debian 13. The update moves the package to version 152.0.7977.75-1~deb13u1 and quietly bundles more than two hundred CVEs covering arbitrary code execution, denial of service, and information disclosure. Browser engines typically ship their fixes in staggered waves, and this one arrives in a single flood. 

Fedora Linux

Fedora is pushing a heavy security and stability batch for both Fedora 43 and 44, and you should treat this as a patch day rather than a rolling upgrade window. The Linux kernel lands another 7.1.13 stable bump across both releases, with upstream CVEs expected to follow shortly. The real wins here are the ACPI resource overlap corrections, the Intel Computer Vision Sensing Controller driver, the Bluetooth RTL8761B quirk narrowing, and a page_pool alignment fix that has been throwing kernel panics at users mid-call. FreeIPA gets the heaviest targeted hit, patching seven CVEs that cover authenticated denial-of-service vectors, privilege escalation via krbCanonicalName manipulation, and a trust-fetch logic flaw that lets unauthorized LDAP writes slip through. Cockpit, pip, kbd, and MRTG each get surgical patches for memory leaks, arbitrary file overwrites, and local privilege escalation through openvt and PID file handling. Valkey (9.0.6) rolls out with a focus on RDMA connection crashes, a lingering ACL bypass in GEORADIUS, and a TLS certificate validation fix that should quiet a few noisy exploit attempts. Expat simply rebases to 2.8.3. The changelogs are dense, the vulnerabilities are real, and deferring this installation just hands attackers a working roadmap.

Oracle Linux

Oracle Linux just published another errata pulse across versions 7 through 10, and the advisory reads less like a security bulletin and more like a comprehensive inventory of everything that could compromise your system if you skip the update. The notice patches well over two hundred CVEs across the standard stack and the Unbreakable Enterprise Kernel. If you run GIMP, Node.js, PHP, Nginx, wget, or Grafana on your servers or desktops, you should pull these packages immediately. The Node.js module jumps to 24.19.0, PHP 8.2 lands on 8.2.33, and Golang picks up version 1.26.7. A handful of Go-dependent components, including Grafana and the FDO server client, got rebuilt purely to swallow the updated Go runtime and its bundled CVE fixes. The kernel updates tackle Safe-RET vulnerabilities that interfere with interrupt handling, plus standard memory management and networking hardening. Microcode drops processor-level fixes for a dozen CPU families. It is exactly the kind of routine but necessary maintenance that keeps production environments from quietly rotting.

Red Hat Enterprise Linux

The Red Hat security team shipped another batch of errata, and the CVSS ratings follow a pretty predictable script. Nearly everything landed with an Important impact, leaving OpenShift Container Platform 4.12.97 as the only Low-rated release in the bunch. You will find patches covering Grafana, Python 3.12, several kernel flavors, and the container toolchain. If your shop runs OpenShift, two maintenance streams are getting refreshed simultaneously. The Camel and Quarkus developer toolkit picked up stability improvements alongside the security fixes, while the Satellite management stack quietly absorbed four async updates across different major versions. You will likely want to map your maintenance windows to this release before the dependency chains start complaining.

Rocky Linux

Rocky Linux just pushed a fresh batch of security errata, and if you are running the RHEL8 family, you have a lot of catching up to do. The release covers a familiar mix of dev and infrastructure tools. Grafana lands on both Rocky 8 and 9, while the Go ecosystem (FDO client, FDO server, and an IPP USB library) gets patched on Rocky 10 alongside PHP. If you are still on Rocky 8, you are also looking at updates for GIMP's underlying graphics toolkit (gegl and gegl04), FreeRDP, Perl's DBI module, and the newly released Node.js 24 stream. All of them are flagged "Important" by the distro, which means CVEs with solid CVSS scores are sitting behind these builds. Time to run your package manager.

SUSE Linux

SUSE shipped a substantial security push, touching foundational libraries, developer runtimes, and infrastructure management tools. If you run any SUSE Linux Enterprise or openSUSE stack, your maintenance window probably just got busier. The most urgent item is the critical rating for apr-util, which addresses six flaws including a heap buffer overflow and a SQL injection path in the Oracle database driver. You will also want to prioritize the nodejs20 patches. That runtime absorbed 35 CVEs, covering everything from permission model bypasses to TLS hostname verification skips and HTTP request smuggling. The patches themselves are routine, but the volume means you should review your deployment scripts before running them in production. A quick zypper patch covers most of these, though you will want to verify your Service Pack alignment since the same flaws appear across multiple release tracks.

Ubuntu Linux

Ubuntu shipped a heavy security batch, patching roughly three dozen CVEs across nine components. The headline fix lands on OpenSSH, which addressed three separate bugs: a ssh-agent quirk that lets forwarded connections perform local-only operations, a use-after-free condition in concurrent remote forwarding, and an authorized_keys tunnel restriction bypass. You should prioritize updating SSH servers running on 22.04 LTS and newer.

The rest of the notice covers library-level validation and parsing flaws. APR-util and rabbitmq-c both shipped heap overflows and framing bugs that could theoretically let a remote party crash the process or run code. FFmpeg rounded out the list with a staggering fourteen CVEs spanning demuxers, decoders, and protocol handlers, mostly triggered by crafted media files. libssh2, GnuPG, SSSD, SPICE vdagent, and Apache Tika each received targeted patches for authentication, session, and file-path handling issues. Standard system updates will pull in most of these, though Ubuntu Pro backs the patches for anything on 20.04 LTS and older. You will also need to restart SSSD, SPICE vdagent, and OpenSSH services after the upgrade takes effect.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y