A wave of Linux security updates landed across the major distros today, with compromised CA certificates appearing simultaneously in Gentoo, Debian, and Ubuntu. AlmaLinux led with twenty advisories featuring a dangerous X11 display-server release, while RHEL handed out nine Critical fixes that all target .NET. Several distros also patched widely used libraries including libssh, BIND, XZ Utils, and sudo-rs for remote and local code execution. The clear priorities are refreshing your certificate trust anchors and chasing the Critical-rated patches before rebooting.

Today's Linux security roundup: a compromised CA, nine .NET Criticals, and a display server with a dozen RCEs

A fresh batch of patches landed across the major Linux distros today. Compromised CA certificates are showing up in three places at once, RHEL hands out nine Critical .NET fixes, and the biggest single batch comes from AlmaLinux.

Security teams didn't get a quiet night. Over the past day, the big Linux distributions pushed a combined pile of updates spanning nearly every class of software running on the server and desktop sides. Some of it is the usual dependency churn. Some of it is the kind that keeps you up. Here's what actually deserves your attention.

The trust anchor story

Certificate trust is the one through-line worth staring at. Gentoo went first with a High-severity advisory aimed straight at the trust root itself. An intermediate CA bundled in ca-certificates has been compromised, which means an attacker can forge a certificate your system would happily accept. The hole is CVE-2026-111943. The fix, app-misc/ca-certificates newer than 20260816.3.125.

Gentoo is clear there's no workaround. Upgrade is the only option. You can pull it in a single emerge command, but do it before most other things since it feeds the whole system-wide trust store.

It isn't just Gentoo. Debian's second advisory swaps out the compromised eMudhra intermediate, removing both the emSign ECC Root CA - G3 and Comodo AAA Services root from the trust store. Ubuntu does the same in USN-8944-1, dropping emSign ECC Root CA - G3 and refreshing the Mozilla 2.90 bundle. Keep in mind that three separate distros trimming the exact same rot from their cert stores is a signal, not a coincidence.

The practical upshot is simple. Bump your cert package and move on.

AlmaLinux: the biggest single batch

AlmaLinux pushed twenty advisories in this round. Almost all of them sit at "Important" across versions 8, 9, and 10. Only glibc gets a Moderate rating, and that's the quiet one.

The one to give your full attention is the X11 stack. The base xorg-x11-server absorbed five independent arbitrary code execution bugs. Xwayland went further with nine, throwing use-after-frees, buffer overflows, and a privilege escalation into a single release. For a display server, the ability to turn "a user opens a window" into "a remote attacker owns your box" is a lot of ground to hand over.

Image tooling had its usual reckoning with malformed files. OpenEXR took five fixes. GIMP picked up four for overflows in its ICO and PSD loaders. Wireshark patched a dozen dissectors that would otherwise blow up on bad protocol data. You mostly only get denial of service from those, which is the one bright spot in the whole batch.

There's more. bubblewrap shipped a symlink traversal bug that lets it write outside its sandbox during setup, so grab that first if you use bwrap. Python 8 picked up an SSL certificate verification bypass. PostgreSQL 16 and 18 both got patched for the same pgvector out-of-bounds write during IVFFlat index builds. The kernel and its realtime variant each took ten fixes, including a genuine use-after-free in strparser.

RHEL: nine Critical, all .NET

Red Hat put out a sizable batch of forty-two advisories. The first thing that jumps out is that nine landed at Critical, and every single one is a .NET update spanning 8.0, 9.0, and 10.0 across RHEL 8, 9, and 10. If any of those run on your backend, patch them first.

The rest sit at the standard "get around to it soon" bar. Most are Important, and five are Moderate. The Moderate cluster covers the usual suspects: OpenSSH, fetchmail, gnome-remote-desktop, and an older OpenShift 4.22.18 release.

A few packages show up more than once. gvfs got hit seven times. openssl appears twice, the kernel three times. OpenShift is worth a glance because you get two entries for the same 4.22 line, one Important for 4.22.19 and a Moderate for the slightly older 4.22.18.

One honest caveat: this digest tells you what changed and how badly Red Hat graded it. The actual meat lives behind each errata link. The CVEs and CVSS scores aren't spelled out here. Head here to the errata pages if you want the specifics on which exact package version to chase.

Fedora, Debian, and the rest

Fedora's queue ran steady with thirty-three advisories. The part that actually earns attention is BIND. Upstream has mostly given up on the 9.18 line, so Fedora kept the DNS server alive by backporting fixes from a branch nobody really maintains anymore. It managed to squeeze about ten CVEs into a single advisory, and if a server you care about runs BIND on Fedora 43, this is the one to install first.

Fedora 44 carries its own list, heavier on the virtualization and media side. Xen picked up six XSA entries, Ghostscript took three, and ImageMagick and gopass rolled to new releases. nebula rounded out the batch by fixing Windows, Android, and macOS quirks that were actively dropping traffic.

Debian's heavyweight is libssh, the compact C SSH library that quietly runs a lot of scripted connections. DLA-4844-1 covers twelve CVEs. The worst is CVE-2026-59846, where a username packed with shell metacharacters gets expanded into ProxyCommand and hands an attacker command injection for free. There's also a crypto slip under the OpenSSL backend where a failed AES-GCM tag check can read as success. Stick with the gcrypt backend and that one skips you.

Rocky Linux rounds out the batch with 21 distinct advisories across its three supported lines. One hits Critical: webkit2gtk3 on Rocky Linux 9. That's the entry to chase first, and it's the only one bundling security fixes together with bug fixes and enhancements. Everything else is mostly security-only, with most of the surface area pointing at Rocky Linux 10.

The small updates still matter

Slackware stayed true to form and shipped a single security bump for mozilla-nss. It's a fresh set of CA certificates for both 15.0 and -current, and you run it whether or not you feel exposed since the cert store is the trust foundation for a large chunk of the internet. SUSE and openSUSE went the other direction with 28 advisories, including four kernel live patches for the 15 SP5 line that all fix the identical four vulnerabilities.

Ubuntu finishes the round with its own cluster. XZ Utils shows up again, this time for a memory allocation failure during decoder reinitialization that could trigger arbitrary code execution. That's a callback to the era when this compression library made headlines for entirely different reasons. Squid brings five issues including HTTP request smuggling and cache poisoning. sudo-rs carries a time-of-check-against-time-of-use flaw in sudoedit, though it only bites you if you went out of your way to configure fine-grained sudoedit permissions. Nobody does that by default. Still, it's privilege escalation, and it affects only Ubuntu 26.10.

The takeaway is mostly housekeeping and judgment. Update the trust anchors and the display servers first. Then work down the list. Most of these are the kind of patches you apply on a schedule anyway. The ones worth leaning into are the ones that touch how your machine decides what to trust, and how a stray window or a signed packet can turn into a login shell you didn't ask for.

A Detailed Breakdown

AlmaLinux

Twenty security advisories tumbled out of AlmaLinux over the weekend, and most of them will want your attention if you run anything on versions 8, 9, or 10. Almost everything landed at "Important," with glibc quietly parked at "Moderate."

X11 is the one worth staring at longest. The base xorg-x11-server absorbed five independent arbitrary code execution bugs, and Xwayland went even further with nine, mixing use-after-frees, buffer overflows, and a privilege escalation into one release. For a display server, turning "a user opens a window" into "a remote attacker owns your box" is a lot of real estate to hand over.

Image tooling is having its annual reckoning with malformed files. OpenEXR took five fixes to stop crashing (and doing worse) on crafted EXR files, GIMP picked up four for overflows in its ICO and PSD loaders plus its plugin system, and Wireshark patched a dozen dissectors that would otherwise blow up on bad protocol data. You mostly only get denial of service from those, which is the one silver lining in the batch.

The rest is worth a glance. bubblewrap, the unprivileged container engine, shipped a symlink traversal bug that lets it write files outside its own sandbox during setup, so grab that first if you use bwrap. Python 8 on AlmaLinux picked up a certificate verification bypass in its SSL handling, a quieter-sounding bug that bites harder than it looks. PostgreSQL 16 and 18 both got patched for the same pgvector out-of-bounds write during IVFFlat index builds, so vector-search deployments should move ahead of the pack. The kernel and its realtime variant each took ten fixes, from SCTP state handling all the way down to a genuine use-after-free in strparser.

Debian GNU/Linux

On October 20, Debian's LTS and security teams pushed a batch of fixes, and the heavyweight is libssh, the compact C SSH library that quietly runs a lot of scripted connections. DLA-4844-1 covers twelve CVEs, from the mildly annoying to the genuinely ugly.

The worst of the lot is probably CVE-2026-59846, where a username packed with shell metacharacters can get expanded into ProxyCommand. Get a cleverly named account into your config and you've handed an attacker command injection without much effort. There's also a sneaky crypto slip (CVE-2026-59847): with the OpenSSL backend, a failed AES-GCM tag check can be read as a success. The gcrypt backend never had the flaw, so if you've stuck with it, this one skips you. The rest are denial-of-service quirks and buffer overreads where a badly behaved SFTP or SCP server shoves data where it isn't supposed to go. Note that CVE-2026-0964 is the same escape-the-working-directory trick OpenSSH had back in 2019.

The other two advisories deal with something more ordinary but still real: compromised eMudhra intermediate CA certificates. The swap removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" from the trust store. It lands in two tracks at once, LTS for Debian 12 bookworm and the stable release, trixie, so you can likely knock out both with a single update run rather than two separate passes.

Fedora Linux

Fedora's security queue ran steady on Friday, with 33 advisories spread across Fedora 43 and 44 and a fairly predictable shape to the whole batch. The part that actually earns attention is BIND. Upstream has mostly given up on the 9.18 line, so Fedora kept the DNS server alive by backporting fixes from a branch nobody really maintains anymore, and it managed to squeeze about ten CVEs into a single advisory. That is a fair number of denial-of-service and cache-poisoning fixes jammed into one command. If a server you care about runs BIND on Fedora 43, this is the one to install first.

The rest follows a more familiar pattern. The Rust object crate picked up a new 0.40, plus a compatibility shim for 0.39 and dependency bumps for the older 0.37 and 0.38 lines to close a decompression-bomb hole in ruzstd, with the same patch reaching backtrace too. The last-resort old libpng builds (versions 12 and 15, for binaries that simply refuse to upgrade) both picked up the same two CVEs, and a Perl captcha generator and a domain-lookup tool grabbed their respective fixes.

Fedora 44 carries its own list, heavier on the virtualization and media side. Xen picked up six XSA entries, Ghostscript took three, and ImageMagick and gopass rolled to new releases. nebula rounded out the batch by fixing Windows, Android, and macOS quirks that were actively dropping traffic.

Full breakdown:

Gentoo Linux

Gentoo's security team published a High-severity advisory today about something worse than the usual patched-dependency slog: the trust root itself. An intermediate Certificate Authority bundled in ca-certificates has been compromised, which means an attacker could forge certificates your system would accept without a second thought and slip into a man-in-the-middle position. The identifier for the hole is CVE-2026-111943.

The affected package is app-misc/ca-certificates, specifically anything older than 20260816.3.125. There is no workaround, so upgrading is the only real option, and it is the kind of update worth doing before most other things since it feeds the system-wide trust store. Pull the fix with emerge --sync, then run emerge --ask --oneshot --verbose ">=app-misc/ca-certificates-20260816.3.125".

Red Hat Enterprise Linux

Red Hat put out a sizeable security batch for RHEL, and the first thing that jumps out is how the Critical ratings landed almost entirely on .NET. Nine of the advisories in this round carry a Critical rating, and every single one is a .NET update spanning versions 8.0, 9.0, and 10.0 across RHEL 8, 9, and 10. If you run any of those on the backend, that is the one to patch first.

The full tally sits at 42 advisories. Most are Important, which on Red Hat's scale is basically the standard "get around to it soon" bar. Five are rated Moderate, and they cover the usual suspects: OpenSSH, fetchmail, gnome-remote-desktop, and an older OpenShift 4.22.18 release.

A few patterns earn a second look. gvfs got hit seven times, all Important, which is a lot of advisories for one GUI-adjacent package. openssl shows up twice, the kernel three times, and both golang and ruby:3.3 landed twice each. OpenShift is worth a glance because you get two entries for the same 4.22 line, one Important for 4.22.19 and a Moderate for the slightly older 4.22.18.

One honest caveat: this digest tells you what changed and how badly Red Hat graded it, but the actual meat lives behind each errata link. The CVEs and CVSS scores are not spelled out here, and neither are the vulnerable package versions. Head to the errata pages if you want the specifics.

Rocky Linux

Rocky Linux pushed a fresh batch of errata, and if you run anything on version 9 or 10 there's a decent shot one of your packages is now patched. The release covers all three supported lines (Rocky Linux 8, 9, and 10). The raw feed lists 23 entries, but two of them repeat, which leaves you with 21 distinct advisories.

Severity does most of the work here. Fifteen land at "Important," five sit at "Moderate," and just one hits "Critical," webkit2gtk3 on Rocky Linux 9. That's the entry worth your attention first, and it's the only one that bundles security fixes together with bug fixes and enhancements. Everything else is mostly security-only.

The Moderate cluster includes a glibc update, which came in lower than you might expect for a core system library. PostgreSQL appears twice (16 and 18) simply because those versions run on separate tracks. Most of the security-only fixes target Rocky Linux 10, so that's where the bulk of the surface area is.

Slackware Linux

Slackware's never been one for fanfare, and this one's no exception. A single security bump for mozilla-nss went out for both Slackware 15.0 and -current, and the fix boils down to a fresh set of CA certificates so SSL connections get checked against up to date trust anchors. No patchnotes drama, just a new batch of CA roots and one upgrade command.

Version 3.131.1 (SSA:2026-293-04) ships across 32-bit and 64-bit builds on both the stable and -current tracks. It's the kind of update you run whether or not you feel exposed, since the cert store is effectively the trust foundation for a large chunk of the internet. If a CA gets revoked or issues a cert it shouldn't, you want the updated list in hand.

SUSE Linux

SUSE and openSUSE shipped a sizable batch of security fixes this week, and you probably have something to patch. The releases cover the expected range: kernel live patches for SUSE Linux Enterprise, a pile of Python library bumps, and a wave of openSUSE Leap 16.0 and Tumbleweed package updates. Count them and you land on 28 separate advisories.

A couple of patterns jump out. SUSE handed out four kernel live patches for the 15 SP5 line (34, 35, 37, and 39) that all fix the identical four vulnerabilities, spanning a netfilter MAC-header gap and a libceph multiplication overflow. Four separate advisories, one shared fix list, so if you missed one you were probably already covered by another. Two of those four rate 9.8 under NVD.

The biggest raw numbers come from Tumbleweed's install-media notices. kernel-devel picked up 389 vulnerabilities, and ImageMagick absorbed 22. That's the usual bulk cleanup you get for stale GA-media packages, which makes it more housekeeping than a reason to lose sleep.

The ones that actually deserve a terminal are the high-severity releases. python3 swallowed 26 issues, grafana took on 17, and critical-rated fixes landed for gh, tinyproxy, and joserfc. The joserfc hole is the interesting one: JWS signature verification can be bypassed with an empty signature array. gh's patch also pushes Go all the way to 1.27.1. A few others, including podman and rekor, just rebuild against Go's latest security release with no CVE of their own.

Ubuntu Linux

Here is what landed in this round of Ubuntu security notices, all stamped the same day (Oct. 20, 2026) and spanning everything from a cache proxy to the package that vouches for your certificates.

The one worth looking at first is XZ Utils. That compression library used to make headlines in a bad way, and this fix addresses a memory allocation failure during decoder reinitialization that could let an attacker trigger an invalid memory write and run code whenever they please. It hits nearly every release, with the older LTS lines requiring a Ubuntu Pro subscription to pull the patched package. Run any of these and update.

Squid brings five problems to the party, including HTTP request smuggling, cache poisoning, an information leak, and a couple of crashes. The modern LTS releases (24.04 and 22.04) get real fixes for the smuggling issue, which is the nastiest one. Everything older than 20.04 gets the full stack of patches but only through Ubuntu Pro, which is Ubuntu's polite way of reminding you that keeping an old release alive costs money.

sudo-rs is smaller but uglier: a time-of-check versus time-of-use bug in sudoedit lets a local attacker with specific file-editing rights move files into arbitrary directories and escalate. The catch is that this only bites you if you went out of your way to configure fine-grained sudoedit permissions, which nobody does by default. Still, it is privilege escalation and it affects only Ubuntu 26.10, so it is worth five minutes.

The ca-certificates update removes the emSign ECC Root CA - G3 because an intermediate CA beneath it got compromised, and refreshes stale certificates over Mozilla's 2.90 bundle. It isn't tied to a single CVE, but you do not want your trust anchors quietly rotting behind you.

Protocol Buffers finishes the batch with a denial-of-service in the PHP library. Bad varint lengths and missing recursion limits mean a single crafted packet can bring an app to its knees. Two LTS lines are affected.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world