Rocky Linux and SUSE assigned Critical ratings to 389-ds-base and libzypp, while Slackware shipped xz 5.8.4 to patch a liblzma decoder memory safety bug. Ubuntu released USN-8675-2 for 26.04 LTS to harden Perl's Socket, regex engine, and Storable deserializer against information disclosure and integer overflows. Fedora 43 quietly rebased OpenSSL to 3.5.8 and backported roughly 45 FreeRDP CVEs, whereas AlmaLinux, Oracle, and Rocky shipped Valkey 8.0.10 alongside Thunderbird ESR rebuilds. Kernel updates from RHEL, Rocky, and Oracle patched memory corruption across exfat, Samba, and the Bluetooth stack, meaning administrators should prioritize those Critical-rated packages before the rest.

Linux Distributions Hit With Massive Security Patch Wave Across the Board

AlmaLinux, Rocky Linux, RHEL, Oracle Linux, Debian, Fedora, SUSE, Ubuntu, and Slackware all dropped updates today. Three Critical rated vulnerabilities hit the directory server stack on Rocky and SUSE, while Slackware quietly patched a decoder bug that has been lurking since 5.8.3.

The 389 Directory Server is the obvious headache. RHEL and Rocky both flagged Critical CVEs including CVE-2026-18355 and CVE-2026-18453, which chain heap overflows and pre-auth NULL dereferences into full directory compromise. If you run LDAP, this one does not wait for your maintenance window. SUSE pushed a Critical update for libzypp and zypper that fixes stale repository caches and looser credential validation. Empty usernames slipping past a password prompt is exactly how supply chain tools get hijacked.

Slackware's xz patch might look small on paper. Version 5.8.4 closes a memory safety bug in the liblzma decoder layer. The affected functions trip over invalid memory access when allocations fail and the host app tries to reuse the decoder. It is a hard crash waiting to happen if you are feeding untrusted archives to production backups. Ubuntu dropped USN-8675-2 to slap four Perl fixes on 26.04 LTS. The Socket module, regex engine, pack/unpack templates, and Storable deserializer all just got harder to break. CVE-2026-57433 handles crafted Storable data that was previously triggering integer overflows.

The rest of the roundup is less panic-inducing but still worth running. AlmaLinux, RHEL, Rocky, and Oracle all updated kernel packages with memory corruption fixes for exfat, Samba, IPv6, and the Bluetooth stack. Kernel-rt trees got their own security bumps across multiple branches. If you are managing containers, HawtIO 4.4.1 and Apache Camel 4 on RHEL picked up Critical ratings for container image vulnerabilities. Red Hat notes that these packages "address multiple newly disclosed vulnerabilities in upstream software," so skipping them is a calculated risk.

The Recurring Cast of Characters

Redis and Valkey keep showing up with remote code execution holes. CVE-2026-66373 and CVE-2026-81934 are hitting the RESTORE payload handling and TLS pending-data use-after-free on multiple distros. Valkey is also getting rebased to 8.0.10 on AlmaLinux, Oracle, and Rocky, with a couple of additional RCE vectors closed at the same time. The dependency chain on these updates has been one of the biggest headaches since Oracle Linux started rebasing Valkey last quarter. I ran into this exact RCE vector six months ago while debugging a misconfigured cache cluster. The upstream fix is welcome.

Fedora 43 quietly landed OpenSSL 3.5.8, patching ten CVEs while most users will not even notice it running in the background. Thunderbird updates inherited roughly two dozen Firefox-ESR fixes across AlmaLinux, RHEL, and Rocky, covering site isolation breaks, JIT miscompilations, and privilege escalation. Go developers building container images will spot standard library patches for ASN.1 recursion DoS and HTTP/2 denial-of-service vectors, mostly rolling out through Buildah and Skopeo rebuilds.

It is a rather heavy week for library updates, though the patch cadence tracks with a normal quarterly refresh cycle. The real story is how many of these vulnerabilities are chained across components that usually do not talk to each other. A broken decoder here, a stale cache there, and you have an attack path that bypasses three different security layers.

The Updates in Detail

AlmaLinux

AlmaLinux pushed a fresh set of security erratas, spanning versions 8 through 10. The cycle leans heavily on closing remote code execution holes in Redis and Valkey, while the Thunderbird release inherits nearly every fix from the latest Mozilla ESR build. If you manage either database, the Valkey update is worth a closer look since it also rebases to version 8.0.10.

Infrastructure admins should flag the Intel CPU microcode refresh, which patches Ring 0 and System Management Mode privilege escalation bugs. The Linux kernel tackles memory corruption across exfat, Samba, IPv6 networking, and the Bluetooth stack. Go developers building container images with Buildah will find standard library fixes for denial-of-service vectors, including a cross-site scripting flaw in the HTML template package. The Thunderbird patch alone covers more than two dozen CVEs across graphics, JavaScript, and networking components, which should keep modern exploit kits looking elsewhere. You will find the full advisory links at the bottom of each notification.

Debian GNU/Linux

Debian's Long Term Support team shipped an updated pyasn1 package for Debian 12, closing three denial-of-service flaws in the ASN.1 parser. If you parse untrusted data, you should upgrade to 0.4.8-3+deb12u3 before those parsing quirks turn into a slow cooker. The patches clamp unbounded tag handling in the BER/CER/DER decoder, fix quadratic complexity in OBJECT IDENTIFIER decoding, and cap runaway exponentiation when converting real values to Python floats. The advisory recommends an immediate upgrade.

Fedora Linux

Fedora pushed a batch of security updates for both Fedora 43 and 44, targeting everything from your desktop graphics stack to your remote desktop clients. The biggest headline is OpenSSL 3.5.8 landing on F43, which quietly patches ten CVEs while you probably won't even notice it running in the background. If you connect to Windows machines via FreeRDP, you have a mountain of backported heap overflow and code execution fixes waiting for you. Valkey and libsoup3 also get their fair share of protocol-level fixes, mostly aimed at keeping malicious packets from tripping over memory boundaries. The Fedora 44 feed brings a smaller set, including darktable 5.6.1 with LibRaw hardening and GitPython cleaning up an out-of-bounds read. You will want to run dnf upgrade at some point this week.

Oracle Linux

Oracle just pushed another round of security errata across Linux 7 through 10. The standout packages this cycle are the 389-ds-base LDAP directory server and Thunderbird, both landing on OL9 and OL10 with critical and important security ratings. You will also see Redis rebased to 7.2.16, Valkey jumping to 8.0.10 and 8.0.11, and a fresh Thunderbird ESR build addressing 23 separate holes. Oracle Linux 10 is getting noticeably more attention than usual. Packages like buildah, skopeo, and git-lfs are picking up fixes for recently disclosed vulnerabilities, mostly driven by a golang rebuild. The kernel updates keep the usual sprawling package counts, but the OL9 5.14 tree is doing the heavy lifting with patches for NFS, SMB, RDMA, and x86/bugs. If you are running anything in that list, you should patch promptly, especially the nginx and cryptography backends. The glibc forward-porting notes read like administrative housekeeping, but they mask a quiet stream of underlying changes. Keep an eye on the xz update for OL10 as well, since buffer overflow fixes in compression libraries tend to cause downstream headaches if you skip them.

Red Hat Enterprise Linux

Red Hat pushed a fresh batch of errata for RHEL 7 through 10, plus a couple of container platforms. You will find a heavy mix of Important-rated patches, with glib2, freerdp, osbuild-composer, and qt5-qtbase each landing on multiple channels. The kernel gets security and bug-fix updates across RHEL 8, 9, and 9.6 EUS. If your shop runs SAP workloads, libvirt, firefox, and gstreamer1-plugins-good all need attention on the 9.2 and 9.4 Update Services. Exactly one Critical rating shows up in this round, and it goes to updated container images for HawtIO 4.4.1 and the Red Hat build of Apache Camel 4. The rest lean Moderate or Important, which tracks with a normal quarterly refresh. You should pull the CVSS scores from the reference links before rolling anything to production, especially on systems that sit behind a public IP.

Rocky Linux

Rocky Linux just pushed another round of errata, and if your systems haven't been patched in a while, this is a solid nudge to open a terminal. The release spans Rocky Linux 8, 9, and 10, with security fixes landing across everything from core components like kernel and 389-ds-base to developer tooling like opentelemetry-collector and skopeo. Two patches hit the Critical tier for the 389 Directory Server on Rocky Linux 8 and 10. Directory services always draw a lot of eyes from attackers, so rolling those out fast makes sense. You will also notice moderate updates for expat, glib2, and xz repeating across multiple branches. Python 3.14 cryptography gets its own dedicated patch across three OS versions, while Rocky Linux 10 picks up a heavier load of newer packages like Valkey, OpenTelemetry, and Qt5/6 compatibility layers. The CVSS boilerplate repeats for every single entry, but the takeaway is straightforward. Patch the Critical and Important items first, schedule the moderate ones around your maintenance windows, and keep your automation scripts current.

Slackware Linux

Slackware pushed a security patch for xz, and if your systems are still running version 5.8.3 or older on Slackware 15.0 or the rolling -current branch, you need to upgrade. The package bumps to 5.8.4 and closes a memory safety bug in the liblzma decoder layer. The affected functions are lzma_alone_decoder, lzma_lzip_decoder, lzma_auto_decoder, and lzma_microlzma_decoder. They can trip over an invalid memory access if an allocation fails and the host application tries to reuse the decoder for a new file, which usually ends in a hard crash. You will want to patch this before handing the library to production backups or large file imports. Slackware built packages for both 32-bit and 64-bit architectures across 15.0 and -current, shipped them with MD5 checksums, and provided a straightforward upgradepkg command to get everything installed. No feature creep, just a targeted fix for a decoder that should not be throwing exceptions in the first place.

SUSE Linux

This round of SUSE security errata mixes routine maintenance patches with one critical release that actually deserves your immediate attention. Tumbleweed gets a steady stream of moderate CVE fixes, covering DNS resolution in dnspython, Perl's Net-DNS module, Python IDNA validation, kernel headers, and the open image-scan library. The Keybase filesystem and client package pulls the highest severity at 8.7, mostly because it still leaves room for unauthenticated service disruption.

The headline here is SUSE-SU-2026:4096-1. It pushes libzypp to 17.38.15 and zypper to 1.14.101 across Leap 15.4, the SLE 15 SP4 family, SUSE Manager 4.3, and SLE Micro 5.3/5.4. The package ships nine fixes. Three target actual security posture: clearing stale unsigned repository caches, tightening credential validation so empty usernames or passwords no longer slip through, and fixing how GPG key hints get auto-imported. The other six are behavioral tweaks that probably save sysadmins from future friction. If you run any SLE 15 SP4 variant, this one lands on your box.

Two smaller notes worth flagging. The prometheus_slurm_exporter update closes a denial-of-service flaw originally reported in prometheus client_golang. The CVE dates back to 2022, but it still carries a 7.5 severity, so if your Slurm cluster exports metrics through it, apply the patch. python311-sqlparse finally gets a fix for a quadratic CPU spike that fires whenever the formatter processes tuple lists. Low severity on paper, but it is the kind of thing that turns a quick database query into a full morning. Run your patches. The package manager will tell you what actually changed on your system.

Ubuntu Linux

Ubuntu is rolling out USN-8675-2 to patch four Perl vulnerabilities on Ubuntu 26.04 LTS. The fixes close gaps in the Socket module, the regular expression engine, pack/unpack template handling, and the Storable deserialization module. If you are running Perl, a standard system update will pull in the necessary changes.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y