Debian's single Chromium fix carries roughly 258 CVEs, topping a busy week of Linux security updates that otherwise reads as routine housekeeping. The cjose JOSE library drew a Critical rating on four distros this week, with all flagging an all-zero encryption key flaw worth patching immediately. RHEL alone shipped 48 advisories across RHEL 7 through 10, joined by AlmaLinux's 21, plus Oracle, Rocky, SUSE, Fedora, and Ubuntu. Ubuntu quietly locked its working FFmpeg fixes behind Ubuntu Pro, so most admins should prioritize cjose, then the kernel and OpenSSH updates, before touching the moderate entries.

Linux distros pile on another heavy round of security updates

Debian's single Chromium fix carries roughly 258 CVEs. That's the loudest signal today that otherwise reads like routine housekeeping across the Linux world.

There's plenty to patch if you run enterprise Linux, though the tall numbers are mostly browser and mail-client noise. Red Hat pushed 48 advisories across RHEL 7 through 10. AlmaLinux shipped 21 across versions 8, 9, and 10. SUSE and Fedora came in fast too. Only a handful of these land as Critical, so the whole thing looks bigger on paper than it feels in practice.

The one thing you should fix first

Keep your eye on cjose. That's the JOSE (JSON Object Signing and Encryption) C library that pulled a Critical rating on four distros this week: AlmaLinux 10, Oracle Linux 10, RHEL 10, and Rocky Linux 10. The flaw (CVE-2026-53939) makes it encrypt payloads with an all-zero Content Encryption Key. In plain terms, it still mints a token, it just isn't secure. If you sign or encrypt anything with JOSE, grab that update first.

A couple of others have real teeth too. The AlmaLinux kernel advisory (ALSA-2026:76738) is enormous by normal standards. It carries 35 assigned CVEs plus a single unnumbered packet fix, mostly networking with IPv6, netfilter, and Bluetooth, alongside a separate entry for KVM and nvme work. That's a reboot update, plain and simple.

Debian's own standout, once you ignore Chromium, is libgit2 (DLA-4831-1). It quietly closes four doors at once: SSH command injection, a submodule path traversal, a memory-exhaustion DoS, and a credential leak that handed your tokens to a redirect target. Its whole recommendation for Chromium, for what it's worth, comes down to two words. Upgrade everything.

The parts you can schedule for later

Not every Critical wants the same treatment. The Ubuntu story is the one worth a raised eyebrow. Its FFmpeg update carries eight CVEs, and while CVE-2026-30754 lets an attacker run arbitrary code and CVE-2026-75147 can leak sensitive data (that one is 26.04 LTS only), every media fix sits behind Ubuntu Pro. If you're on an older release and haven't signed up, that apt upgrade will look like it's doing absolutely nothing.

The other two Ubuntu notices are far more forgiving. The libx11 fix bundles four flaws, but only the XKB keyboard-map path climbs to arbitrary code execution, and only after you've connected to a malicious X server first. The Google guest-agent hole affects just Ubuntu 22.04 LTS and needs no reboot at all.

You'll spot the same recurring cast across the enterprise distros. curl keeps relearning its lessons, pcre2, python-tornado, and gd each earn their multi-version passes, and Thunderbird tends to show up more than you'd expect. SUSE's Thunderbird note alone lists 129 items against version 153.4, which reads as routine cleanup rather than emergency. SUSE's expat update packs 34 fixes into a jump to 2.8.5. That's the XML parser half the stack leans on without ever naming it, and it's worth the install.

An Overview of the Updates

AlmaLinux

AlmaLinux shipped twenty-one security errata across versions 8, 9, and 10. Most landed on the 12th and 13th, with the older Tornado fixes back-dated to the 9th. The severity spread is one Critical, a stack of Important, and a scattering of Moderates.

The Critical is cjose on AlmaLinux 10 (ALSA-2026:80605). The JOSE library ends up encrypting with an all-zero key, which is a convenient way to quietly drop the "secure" from secure communications. If your stack does JWE or JOSE work, patch that one first.

A big chunk of the rest is curl relearning the same lesson. Five fixes in the Linux 10 build alone - proxy credential leaks, an authentication bypass on connection reuse, a use-after-free. That library trips over header reuse nearly every season. Flatpak is the other loud one with four CVEs ranging from arbitrary code execution as root to privilege escalation via symlink traversal, and the same four show up separately on Linux 8, so expect them on both lines.

pcre2 is the other multi-hitter, seven flaws in the Linux 10 release, several of them out-of-bounds writes that let a crafted regular expression take over the process. If you parse untrusted input with regex, that's the one to watch. The kernel update (ALSA-2026:76738) is genuinely enormous: 36 security entries, 35 with assigned CVEs, almost all networking (IPv6, netfilter, Bluetooth) plus KVM and nvme, then a handful of FIPS wifi and CPU hotplug bug fixes. That's a reboot update. glibc closes the week with four problems including a heap overflow steered by a controlled fopen mode string, which usually points at a mode value your code is passing without a second thought.

Debian GNU/Linux

Debian put out a batch of security advisories, and Chromium is doing the overwhelming bulk of the work. The headline is almost absurd: the Chromium fix in DSA-6553-1, carried over to LTS in DLA-4833-1, bundles roughly 258 individual CVEs in a single release. Those cover arbitrary code execution, denial of service, and information disclosure. Debian's entire recommendation boils down to two words: upgrade everything.

Set Chromium aside and the remaining five advisories are more routine but still worth your attention. The standout is libgit2 (a Debian LTS advisory, DLA-4831-1), which quietly fixes four things at once: SSH command injection, a submodule path traversal, a memory-exhaustion denial of service, and a credential leak that handed your credentials to a redirect target. ntfs-3g claims local root privilege escalation but notably ships with no CVE number yet, which usually means the details aren't fully out. nagios4 appears in both the stable and LTS tracks carrying the same six CVEs (CSRF, XSS, command execution). librsvg and keystone finish the set with smaller, single-issue holes.

Fedora Linux

Fedora's security queue picked up some speed this week. Maintainers pushed advisories across both Fedora 43 and Fedora 44, and the batch mixes genuine fixes with updates that are only tangentially about security.

The ones with real teeth are worth acting on. curl got patched for CVE-2026-19931, a connection-reuse bug under Negotiate authentication that leaks data. xiphos, the Bible study tool, took a hit for CVE-2026-79079, an arbitrary code execution path running through URL handling and menu popups. mkvtoolnix is still chasing CVE-2026-90783, a heap buffer overflow in AVI parsing, showing up on Fedora 43 as a backport and on 44 as a full version jump to 102.0. iperf3 picks up CVE-2026-102253, a denial-of-service where the UDP worker simply loops forever.

Then comes the paperwork. GitPython 3.2.0 and its dependent mkdocs RSS plugin carry six GHSA identifiers, which reads more like a receipt than a changelog. The kernel landed 7.2.9-101 with a wall of notes, but most of it is driver work for Raspberry Pi and AMD display code, not security. libre and baresip moved to 4.12.0 for upstream hardening, and radicale and iperf3 are mostly version bumps wearing security-advisory labels.

Oracle Linux

This round lands heaviest on Oracle Linux 10, and Thunderbird carries most of the weight. Mozilla shipped 140.17.0 ESR with 42 CVEs attached, which is a big number for a mail client but reads as routine cleanup rather than an emergency. The rest of the new distro keeps a smaller footprint: a critical cjose patch worth a second look if you mint signed tokens, a moderate curl fix covering five CVEs (mostly credentials leaking across redirects and proxies), a flatpak hardening, and a virt-v2v enhancement for NBD disk certificates.

Mail servers grab attention on OL 9. Dovecot shows up with eight CVEs and bind with three, so if either fronts anything you actually run, this falls into the "patch this week" bucket. Node.js 22 arrives with its usual stack of dependency-level fixes, and jackson rebases to 2.21.6.

The UEK kernel updates on OL 8 and 9 both cite a single CVE, 2026-80726, but neither lists just one commit. Each changelog runs well over 200 entries, the majority being upstream housekeeping, refcount fixes and off-by-ones. You are better off scanning for the parts that touch your workload than trusting the whole block at a glance. The older kernel on OL 8 is more restrained, carrying three CVEs.

A few single-purpose fixes close out the batch. compat-openssl10 and compat-openssl11 take the same DTLS patch, tftp absorbs one buffer-overflow call, and mod_auth_openidc appears on both 7 and 9 for the same cookie-parsing bug.

Red Hat Enterprise Linux

Red Hat has just pushed another pile of security errata to its Linux line, and this one's on the larger end of normal. You're looking at 48 advisories spanning RHEL 7 through 10, scattered across the usual maze of support channels (EUS, SAP updates, Advanced Mission Critical, Telecommunications, and so on). Only one comes in at Critical, and it's cjose, a fairly obscure C library that handles JOSE (JSON Object Signing and Encryption) on RHEL 10. The rest break down into "Important" and "Moderate," which is the expected shape of a routine Red Hat security release. Each advisory points you to its own CVE links if you want the individual CVSS scores instead of the umbrella rating.

The shape of the batch is pretty predictable. Thunderbird gets more coverage than you might expect, with six separate updates spread across its supported branches. The kernel shows up four times, and a stack of kpatch entries (the live-patching fixes, mostly aimed at SAP shops) jacks up the count without adding much drama for most admins. You'll spot the usual recurring cast again: pcre2, python-tornado, and gd each getting their own multi-version pass.

If you're patching in priority order, the cjose Critical goes on top, followed by the Important kernel and OpenSSH updates that sit on anything reachable from anywhere you don't trust. The Moderate stuff and the rest of the Important list can queue up behind them. The complete breakdown follows.

Rocky Linux

Rocky Linux has pushed a fresh batch of security errata, and the one to circle first is a Critical fix for cjose on Rocky Linux 10. Everything else in this round lands below that, so unless cjose is in your stack you can skim.

The spread covers all three active releases. Rocky Linux 10 gets five updates, Rocky Linux 9 gets seven, and Rocky Linux 8 gets four. Across the lot, nine come in at Important severity, five at Moderate, and that single Critical sits on RL10.

A couple of things are easy to spot if you run these stacks. Flatpak and flatpak-builder each appear on all three releases, so a single update pass handles both. Emacs shows up twice (RL9 and RL8), and OpenSSL's compatibility packages keep their split personalities on the older branches: compat-openssl11 on RL9 and compat-openssl10 on RL8. The jackson errata on RL9 is the only one bundling multiple packages, and it pulls in four related jars.

There's no hidden detail here beyond package name, severity rating, and the RLSA ID that links out to the actual advisory.

SUSE Linux

SUSE kicked off its security batch with a figure that is probably too high to be trustworthy: Thunderbird 153.4 gets 129 vulnerabilities listed under it. Most are the expected browser buffet of use-after-frees and sandbox escapes, but you do not want to be the one running an outdated mail client when the count reaches that size.

Expat is the other heavyweight. SUSE-SU-2026:4623-1 packs 34 fixes into a jump to 2.8.5. It is the XML parser that countless quiet Linux components lean on, and you rarely notice it until someone names it. Worth the install.

DNS resolver operators should move on unbound (SUSE-SU-2026:4620-1), which takes ten hits, two of them rated 9.2 for heap overflows that end in remote code execution. libsoup gets the same nine issues patched twice, once for the older 15-SP4/SP5 tracks (4616-1) and again for the newer 15-SP6/SP7 releases (4631-1), because SUSE simply splits its maintenance windows.

Squid (4621-1) absorbs five issues plus a memory-leak fix and lands on 6.14. stunnel (4617-1) and python3-paramiko (4618-1) are lighter still, at two and one apiece. The Tumbleweed release brings its usual pile of Python packages, each with a lone moderate CVE. Nothing here should keep you up at night, though python313-impacket does pull in CVE-2021-31800, which still scores a stubborn 9.8.

The Oracle Linux entry (ELSA-2026-500381) is a bit of a trickster. It is marked important, names a single CVE, and then proceeds to dump the entire upstream 5.15 UEK kernel changelog. That one CVE is just the flag on a much broader sweep. The one named CVE is only the hook, but the kernel gets the full treatment regardless.

Ubuntu Linux

Ubuntu rolled out three security notices, and if you only act on one, make it the FFmpeg patch. Eight CVEs in a media-parsing library won't get anyone's pulse racing, but CVE-2026-30754 lets an attacker run arbitrary code, and CVE-2026-75147 can leak sensitive data (that one is Ubuntu 26.04 LTS only). The remaining six are denial-of-service bugs from sloppy memory and arithmetic handling, and none of the FFmpeg fixes are free. Every single one sits behind Ubuntu Pro, which is worth knowing before you run apt and wonder why nothing updates.

The libx11 notice is the most forgiving. It bundles four flaws, but only one climbs past a crash: the XKB keyboard-map handler, and even that needs you to have been snookered into connecting to a malicious X server first. The XIM message handler and the multibyte text converter are strictly denial-of-service, so the real-world bar for an exploit here is comfortably high. Everything from Ubuntu 14.04 LTS all the way to 26.04 LTS is in scope, which is a genuinely long tail, and you'll need to reboot once the update lands. The newer releases update normally; 20.04 and older want Ubuntu Pro.

Then there's the Google notice, the smallest and by far the most targeted. Google's Guest Agent and OS Config Agent both vendored the Go x/net/idna DNS library, which accepted a Punycode trick and let an attacker slip past hostname-based access controls to escalate privileges. Only Ubuntu 22.04 LTS is affected, and a routine update covers it without a reboot.

How to Apply These Linux Security Updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y