Critical ca-certificates advisories landed today across nearly every major distro, distrusting eMudhra's intermediate CA and dropping emSign roots that can break pinned services. A shared cluster of Go CVEs drove rebuilds across grafana-pcp, podman, ipp-usb, and go-toolset, though much of it is the same binary with a newer compiler. Several genuine RCE bugs stand out, including pgvector index-build code execution, hplip's dozen CVEs on AlmaLinux 8, Apache httpd's eleven CVEs on Oracle Linux 9, and SUSE's php8 and Emacs TRAMP holes. Clear the cert fixes first, then chase the RCE-worthy packages, since the Go and cert churn alone cover a large chunk of what shipped today.

Today's Linux security roundup: cert trust fixes nearly everywhere, with several RCE-worthy bugs needing a reboot

Every daily roundup of this size eventually reduces to the same decision: you're not going to patch all 100-plus advisories the vendors pushed today, so which ones actually matter? The short version is that ca-certificates landed as a Critical advisory across nearly every major distro, a cluster of Go packages got rebuilt against Go 1.26.10, and there's a scatter of genuine remote-code-execution bugs that deserve attention before you move on.

ca-certificates hit Critical on AlmaLinux 10, 9, and 8, Debian's LTS track, Rocky Linux, Red Hat (twice), and SUSE's Mozilla bundle. The core fix distrusts an intermediate certificate from eMudhra, tied to CVE-2026-114406 in most of these.

That matters more than it should. The trust store backs nearly every TLS connection a box makes, so breaking it doesn't kill one application. It kills the ones checking signatures.

AlmaLinux buried the ca-certificates patch at the bottom of its 21-advisory pile. That's arguably the right call since the update lands on its own regardless of where it sits in the list.

One wrinkle worth knowing: SUSE's ca-certificates-mozilla update doesn't just add and remove certs. It drops three emSign roots outright, which can quietly break services pinned to them. A routine cert refresh is not a no-op, so don't treat it like one.

Everything else, ranked by how badly it wants a reboot

Nearly every distro today rolled out a shared cluster of Go CVEs across grafana-pcp, podman, ipp-usb, and go-toolset. Those cover HTTP range denial of service, HTTP/2 SETTINGS DoS, and an x509 man-in-the-middle hole. On AlmaLinux they bundled into golang, which also jumped to Go 1.26.10, and most downstream packages don't need a separate patch once that lands.

Red Hat and Oracle Linux were unusually candid about it. Roughly half of Oracle's errata are golang rebuilds, and they're the same binary with a newer compiler. Standard practice for Go-based packages, though it does mean a fair chunk of these entries are really cosmetic. I'd say the same about much of this batch.

Some of it, however, genuinely needs a maintenance window.

PostgreSQL's pgvector update on AlmaLinux 10 fixes an out-of-bounds write during IVFFlat index builds that hands an attacker code execution. It's in both the PostgreSQL 16 and 18 builds, which is a bit uncomfortable given how many LLM stacks lean on vector search these days.

AlmaLinux 8 took a serious hit on hplip, the printing stack. About a dozen CVEs, several of them remote code execution and privilege escalation. You still print from an AlmaLinux 8 box, this goes first.

Oracle Linux's Apache httpd update on Linux 9 bundles eleven CVEs. There's arbitrary code execution through mod_vhost_alias via an oversized Host header, and another through a heap overflow in mod_proxy_ajp. That's reboot-worthy. One oddity worth flagging: the advisory also swaps the default index.html for Oracle's own oracle_index.html, which only shows up if you diff the tree.

SUSE's php8 patch carries two memory-corruption holes rated up to 9.2, each handing RCE to anyone who can trigger a request. The fix rides php8 to 8.4.27. Emacs is next up on SUSE, where TRAMP ships two command-execution bugs, one framed as a zero-click local privilege escalation.

If you run Flatpak on Debian, the one to grab first is the xdg-dbus-proxy update (DLA 4856-1). The package filters messages on the D-Bus session bus, and its filtering logic was sloppy enough that a malicious or compromised app could slip arbitrary code execution outside its sandbox. The catch is that other frameworks built on the same proxy are equally exposed until they catch up. Brotli also showed up across stable, LTS, and extended LTS with a DoS or arbitrary-code-execution bug, and tzdata shipped the 2026e timezone change. So if you happen to live in the Northwest Territories or Manitoba, you're now on permanent time with no November fall-back.

Most of the rest is lower priority. Rocky Linux rolled out Thunderbird and Firefox updates for Linux 8, 9, and 10 at Important severity, and GIMP on SUSE got five image-loader fixes leaning toward heap and stack overflows. Nothing urgent unless the specific bug bites your setup.

The price of all this churn is that a lot of it overlaps. Keep in mind that the Go rebuilds and the ca-certificates rotation alone cover a large fraction of what landed today, so you don't need to treat every advisory as a separate task.

If you want to keep it simple, clear ca-certificates first across the platforms you run, then chase the pgvector, hplip, httpd, and php8 RCE fixes, then let the Go rebuilds sort themselves out.

A Detailed Breakdown of the Updates

AlmaLinux

AlmaLinux filed 21 security advisories between October 23 and 24, and the one that actually matters sits at the bottom of the pile: a Critical patch to ca-certificates. That's the Mozilla-managed trust store nearly every TLS connection on the box leans on, so the fix lands whether you asked for it or not. The trigger is a distrust order against eMudhra's intermediate CA, and it hit all three supported releases, 8 through 10.

The Go situation deserves a moment. Four separate crypto and networking bugs rolled out in one cycle across AlmaLinux 10, 9, and 8, and they spread from golang itself into grafana-pcp, ipp-usb, podman, and go-toolset on RHEL8. Most of those packages therefore never need a separate patch, because you'll likely already be covered once the golang update lands.

On AlmaLinux 8 specifically, hplip took the brunt: a dozen CVEs, several of them remote code execution and privilege escalation. If you still print from an AlmaLinux 8 box, that one goes to the top of the queue.

The kernel on AlmaLinux 10 picked up 18 fixes. Most are the usual netstack and driver tidy-ups, but the perf use-after-free and the XFS bounds-check gap are the kind you actually reboot for.

pgvector got hit on AlmaLinux 10 in both the PostgreSQL 16 and 18 builds, fixing an out-of-bounds write during IVFFlat index build that lets an attacker run code. That lands a little uncomfortably now that vector search lives in basically every LLM stack someone cobbled together.

PHP closes out the batch with four versioned packages across 8 and 9, each carrying the same two bugs: an OOM bailout during request parsing that turns into memory corruption and RCE, plus a use-after-free from stale request state retained during fatal errors. The 7.2 and 7.3 builds are long past their use-by date regardless.

cockpit-machines on AlmaLinux 9 rounds things off with three exposure bugs. Guest credentials and an RHSM offline token leaked through process and command-line arguments, so it only bites people who manage libvirt guests through the web UI.

Debian GNU/Linux

Debian put out a fresh batch of security advisories this week, and there is more than one place to grab the fixes. The stable release (trixie) and the long-term support track (bookworm) each got their share, while FreeXian's extended LTS coverage picked up the older releases still clinging to bullseye, buster, and stretch.

The one that deserves your attention most is the xdg-dbus-proxy update (DLA 4856-1). That package filters messages on the D-Bus session bus, and its filtering logic was sloppy enough that a malicious or compromised Flatpak app could slip arbitrary code execution outside its sandbox. Patch this first if you run Flatpak, and keep in mind that other app frameworks built on the same proxy are equally exposed until they catch up.

brotli, the lossless compression library, showed up in four separate advisories. Stable, LTS, and extended LTS all shipped fixes for a bug that could trigger a denial of service or potentially let someone run arbitrary code. The tzdata update is the boring one unless a Canadian time zone actually matters to you, though two provinces did drop their fall-back and switch to permanent time. Firefox ESR got a quiet fix as well, blocking a set of compromised certificates issued by the eMudhra CA for installations that cannot reach the revocation service.

Oracle Linux

Oracle Linux shipped another round of security errata spanning Linux 7 through 10, and if you run any of those you probably have something to patch. The batch splits cleanly into two halves: actual fixes, and dependency churn you can likely schedule around.

Roughly half of these advisories are golang rebuilds. grafana-pcp on both Linux 9 and 10, grafana on Linux 8, podman on Linux 10, ipp-usb, and the go-toolset update all carry the same cluster of CVEs (78667, 97031, 111943 and friends) because they were rebuilt against a newer Go toolchain. That is standard practice for Go-based packages, though it does mean a fair number of these entries are really "new compiler, same binary."

The one worth your attention is the Apache httpd update on Linux 9. It bundles eleven CVEs, including arbitrary code execution via an oversized Host header in mod_vhost_alias and another through a heap overflow in mod_proxy_ajp. That is a reboot-worthy change. You also get the usual OpenSSH pileup on Linux 8 (five issues around GSSAPI and authentication timing), expat on Linux 9 and 10 stacking memory-safety patches, and the expected CA certificate rotation on Linux 7 and 10. One oddity worth flagging: the httpd advisory slips in a non-security change that swaps the default index.html for Oracle's own oracle_index.html page. It will show up if you diff the tree.

Red Hat Enterprise Linux

Red Hat shipped nine security erratas, and if you run RHEL you probably want to patch before doing anything else. Most of them land on the "Important" severity tier, but two are Critical and both hit ca-certificates. Broken certificate trust is one of those things that doesn't take down a single app; it takes down everything that checks a signature.

The bulk of the updates are for PHP, and PHP is spread across nearly every platform Red Hat still touches: 9.6 EUS, 9.4 SAP Solutions, 9.2 SAP Solutions, and 7 ELS. There's also a kernel update aimed at RHEL 10.0 EUS, plus the two Critical ca-certificates advisories covering RHEL 7 ELS and 9.2 SAP Solutions.

Each advisory is rated on a CVSS scale, and Red Hat links the underlying CVEs in the References section of every errata so you can chase down exactly what each package fixes.

Rocky Linux

Rocky Linux shipped a batch of security advisories this round, and if you run their mail client or browser on a supported release, this is the "go update now" kind of email. The fixes cover Thunderbird and Firefox across Rocky Linux 8, 9, and 10, along with a single Critical patch for ca-certificates.

Most land at "Important" severity, which is a relief but not a reason to wait. The ca-certificates advisory is the lone Critical entry here, and that's the one you should clear first: outdated or broken certificate bundles can quietly break HTTPS across a machine, and the fallout is far messier than a stale browser.

The advisories hand you an identifier and a pointer to the errata tracker for the CVE and CVSS detail, but they deliberately don't spell out what each patch actually fixes. You'll want to follow the link if you care about the specifics, which is common for these notices.

SUSE Linux

SUSE rolled out a wide batch of security patches, and most of it looks like the usual maintenance churn. A few entries are the kind you actually want to schedule time for before you forget.

The one that keeps sysadmins up at night is php8 (openSUSE-SU-2026:22151-1). Two memory-corruption holes, both rated up to 9.2, hand remote code execution to anyone who can trigger a request. The fix rides php8 up to 8.4.27. If your web stack lives on Leap 16.0, patch it.

The emacs update (SUSE-SU-2026:4893-1) carries the same "important" label and earns it. TRAMP comes with two command-execution bugs, one framed as a zero-click local privilege escalation. Anyone who remote-edits through Emacs should clear a slot in their update queue for this one. It spreads across a long list of SLE 15 SP4 through SP7 plus openSUSE Leap 15.4, all bumped to 27.2.

GIMP (SUSE-SU-2026:4895-1) takes five hits in a single patch, all image-loader problems leaning toward heap and stack overflows from crafted files. Batch-process photos or thumbnails at your own risk until you're on 2.10.30.

Two Go lines land on Leap 16.0. go1.27 moves to 1.27.3 with just a crypto/x509 mitigation, while go1.26 gets 1.26.10 plus three fixes, including a pair of HTTP/2 resource-exhaustion issues. Pick whichever build line you actually depend on.

The Tumbleweed section is a pile of "on GA media" moderate updates, many of which only matter if you happened to pull that package off the base install media. ffmpeg-7 collects seven CVEs, xwayland swallows twelve, and xorg-x11-server eats eleven, on top of strikes against Django, CairoSVG, guava, libvpx, libxls, and the AWS ECS init script. Nothing tops the critical tier here, though the combined count across the display stack is enough to glance at.

One quiet change to flag: the ca-certificates update removes three emSign root certificates outright, which can quietly break services that pinned to those CAs. Don't mistake a routine cert refresh for a no-op.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y