Nine Linux distributions shipped security updates today, with Debian handing its 6.12 kernel more than 500 CVEs and SUSE folding 237 into a single webkit2gtk3 release. A trust-store purge landed across Fedora, RHEL and Rocky after emSign Root CS CA G3 was found signing compromised certificates. The same pair of PHP RCE flaws (CVE-2026-109618 and CVE-2026-109619) turned up in Fedora, SUSE and Oracle, while Oracle's eight Critical .NET advisories are the top priority for managed-code users. Patch the trust-store cut and .NET first, then clear the rest before your next maintenance window.

Today's Linux security roundup brings hundreds of CVEs and a trust-store purge

Debian's 6.12 kernel absorbed more than 500 vulnerabilities, SUSE folded 237 into a single browser library, and Fedora, RHEL and Rocky all chopped a compromised certificate out of their trust stores.

Nine Linux distributions shipped security updates today, and two of them bundled hundreds of CVEs in a single release. Debian handed its 6.12 kernel over 500 of them. SUSE packed 237 into a single webkit2gtk3 package. If your patch-management tools are lighting up across a cluster of boxes, that explains the notifications.

Two of those releases crossed the hundreds, and the numbers alone make this one of the bigger days on record. There's also a trust-store purge now hitting enterprise distros and a set of PHP flaws showing up in at least three places. The rest is more routine, but not entirely boring.

Two releases crossed the hundreds

The Debian kernel bump is the one that makes you stop. Between October 22 and 23, Debian shipped DLA-4850-1 onto Bookworm, pushing version 6.12.113-1~deb12u1 and carrying a wall of advisories that stretches from CVE-2026-52988 all the way to CVE-2026-99999. That's a staggering number for any kernel release. Underneath the volume sits the familiar kernel menu: privilege escalation, denial of service, information leaks. Bookworm is also picking up the bug fixes from the 6.12.112 and 6.12.113 stable bumps along the way.

Head here if you're watching the desktop side. Debian's webkit2gtk update, DSA-6534-3, only exists to repair damage a previous security release actually caused, killing Evolution's ability to show images inside HTML mail. It's a small mercy that they caught it, and it means one extra update on the desktop front.

The SUSE batch is a different kind of story. SUSE-SU-2026:4858 packs 237 CVEs into webkit2gtk3 in one sweep, and SUSE-SU-2026:4868 drops another seven right behind it. Most of them belong to the usual memory-corruption and sandbox-escape family, though a few let an already-compromised renderer reach system parts it shouldn't. Those numbers look nearly absurd until you remember that an entire Chromium release lands packed inside a single library.

Chromium shows up in Debian's batch too, carrying Google's usual pile of 363 CVEs split across both the stable and LTS tracks. The concerns are arbitrary code execution, DoS and information disclosure. If you browse on Linux, this is one to install promptly. Keep in mind that the numbers sit in the 2026-110913 to 2026-113344 range, so a freshly installed trixie box and an older bookworm box are both in scope.

The trust store gets a new victim

The story worth your attention across Fedora, RHEL and Rocky is one you probably never think about: a certificate is being pulled out of your trust store. Fedora dropped emSign Root CS CA G3 from its ca-certificates bundle, landing the change on Fedora 43, 44 and 45. The package changelog is refreshingly blunt about why, saying the root signed compromised certificates and is therefore gone.

Rocky Linux shipped the same cut, with a Critical ca-certificates patch for both Linux 9 and Linux 10. RHEL ran the widest of all. You'll find nine ca-certificates advisories across RHEL 8, 9 and 10, every one rated Critical. A spread that wide usually points to one heavily used package picking up a serious flaw. A corrupted bundle takes TLS down across the whole box with minimal fuss, so fix that first.

.NET took the same Critical treatment across the enterprise layer. Oracle Linux pushed 35 errata with eight rated Critical, and all eight are .NET, spanning 8.0, 9.0 and 10.0 across OS levels 8, 9 and 10. The CVE count actually climbs with the version here, which isn't the usual pattern: ten-dot-zero carries 22, eight-dot-zero tracks 21, and nine-dot-zero sits at 20. A 22-CVE bump for a single runtime release is worth a closer look.

PHP is the thread tying several distros together. The same pair of unauthenticated RCE flaws hit Fedora 43 (8.4.27) and Fedora 45 (8.5.12), logged as CVE-2026-109618 and CVE-2026-109619. One rides in through out-of-memory corruption, the other through stale global state. Red Hat's bug tracker calls them "undisclosed exploit," which is house language for the patch exists but the mechanics stay hidden, so patch and stay quiet. SUSE's php7 sweep of 12 CVEs touches the same two flaws, and Oracle's OL9 entry for the bare 8.0.30 package packs about a dozen fixes on top of them.

RHEL's batch rounds out with a lot of kernel advisories, including two for RHEL 7, which is software older than most sysadmins in this space, plus a paired OpenShift cycle at 4.14.76 and 4.15.70. Grafana and grafana-pcp show up repeatedly, though only three grafana-pcp entries hit the Critical rating. It reads as a broad cleanup pass rather than one catastrophic hole. Nothing scary, just a lot of checkboxes to tick.

AlmaLinux shipped 28 advisories across OS levels 8, 9 and 10, with the Apache httpd update (ALSA-2026:88229) the single biggest item at 11 CVEs including two authentication bypasses and an RCE route through an oversized Host header. Pull that one first if your server proxies traffic. The kernel for AlmaLinux 10 (ALSA-2026:85321) is a broad sweep with 17 security fixes. And fetchmail is still out there, which is remarkable in its own way.

Slackware kept it small and manual, as expected. SSA:2026-295-01 bumps the kernel to 5.15.223 on 15.0 and closes the PwnEscape flaw, which started life in Android's kernel and never really stopped being useful for anyone running with privileges they shouldn't have. You'll upgrade with upgradepkg, rebuild the initrd, and if you boot through LILO or elilo, verify the bootloader actually points at the new kernel before rebooting. There are thirteen packages across the 32- and 64-bit trees, and MD5 sums are included, since Slackware still expects you to verify things by hand.

Ubuntu's three notices are all software you're plausibly running right now. zlib (CVE-2026-85091) is the one to prioritize: a heap buffer overflow from mishandled non-blocking writes can lead to DoS or arbitrary code execution, and zlib sits underneath an uncomfortable amount of the internet. Tornado picked up six CVEs for not validating crafted HTTP input properly, with two of them tracing back to 2023 and 2024. OpenVPN's flaw lets an authenticated remote user impersonate another, which is a more useful prize for an attacker than a plain DoS. One catch worth flagging: Tornado's older LTS releases only get patched through Ubuntu Pro, and with OpenVPN you have to restart the service after updating or the patch simply won't stick.

That's today's Linux security at a glance. If you're running more than one of these distros, group by what's actually shared before you start rebooting, since one maintenance window beats a dozen separate restarts. Head here to the individual advisory pages for the full CVE breakdown if you want the details.

A Detailed Overview

AlmaLinux

AlmaLinux shipped a stack of security errata, and if your inbox is set up like everyone else's, expect this to eat most of your afternoon. Twenty-eight advisories across AlmaLinux 8, 9, and 10. Most are routine. A few you should actually worry about.

The Apache httpd update (ALSA-2026:88229) is the biggest single item, carrying eleven distinct issues: two separate authentication bypasses, an arbitrary code execution route through an oversized Host header, and a couple of denial-of-service bugs. If your server proxies traffic, that's the one to pull first.

PHP gets similar treatment across seven separate advisories spanning 7.4 through 8.4. The crown jewel is an out-of-memory bailout during request parsing that degrades into remote code execution. Still on an older build, like the 7.4 package on AlmaLinux 8, you're looking at a grab-bag of about a dozen fixes stacked on top of the shared problems.

The kernel for AlmaLinux 10 (ALSA-2026:85321) is a broad sweep: seventeen security fixes plus a pile of bug fixes and backports. The real-time kernel on AlmaLinux 8 (ALSA-2026:87374) mirrors the same seven fixes as the standard kernel.

The rest is your standard maintenance-window fare. librsvg-related updates (glycin-loaders, librsvg2) all chase the same use-after-free in XML entity handling, so it's essentially one fix split across packages. And fetchmail is still out there, which is remarkable in its own way.

Debian GNU/Linux

Debian had a busy stretch. Between October 22 and 23 it shipped security fixes across both its stable (trixie) and long-term-support (bookworm) tracks, plus extended-LTS updates for the older Debian releases. Most of these are the routine "run apt upgrade" kind, but two details stand out: the 6.12 kernel picked up a pile of well over 500 CVEs, and the webkit2gtk update is repairing damage the previous security release actually caused.

The kernel update (DLA-4850-1) is the obvious headline. That is a staggering number of advisories folded into one release, ranging from CVE-2026-52988 all the way up to CVE-2026-99999. Underneath the volume is the familiar kernel menu: privilege escalation, denial of service and information leaks. Bookworm is getting 6.12.113-1~deb12u1, and it also carries the bug fixes from the 6.12.112 and 6.12.113 stable bumps.

Then comes the webkit2gtk situation. The prior security push (DSA-6534-1) broke Evolution's ability to display images embedded in HTML mail, so DSA-6534-3 exists purely to fix that regression. It is a small mercy that Debian noticed. Trixie gets 2.54.0-1~deb13u3.

Chromium shows up twice, once for each track, and both are carrying Google's usual wall of CVEs (363 of them, in the 2026-110913 to 2026-113344 range). The concerns are arbitrary code execution, denial of service and information disclosure. If you browse on Linux, this is one you probably want to install promptly.

Perl gets the most detailed write-up of the bunch, thanks to the extended-LTS releases. The 13 CVEs span IO::Uncompress::Unzip, HTTP::Tiny, Archive::Tar, Storable and more, and a couple of them are bad news. One lets an attacker-controlled output glob run arbitrary Perl. Another has HTTP::Tiny forwarding your Authorization header across a redirect to a completely different host, including HTTPS-to-HTTP downgrades. You would want 5.32.1-4+deb11u6 or later to be covered on the older releases.

The rest round things out by what you actually run. Erlang (18 CVEs) closes TLS server-impersonation holes, which is a good one to have squashed. Unbound gets five fixes including a cache-poisoning side channel and a use-after-free when a DoH/QUIC connection migrates paths. Roundcube picks up fixes for IMAP command injection, SSRF bypass, email-header injection and privilege escalation. ClamAV and both aide advisories are mostly about denial of service and, in aide's case, a local user slipping past malicious-file detection. The final trio of Perl-adjacent packages got build and regression fixes rather than security patches, since a broken test suite or build was quietly stalling the actual Perl updates.

Fedora Linux

Fedora shipped a batch of security fixes across Fedora 43, 44, and 45 (RC), and the story worth your attention is one you probably never think about: a certificate in your trust store is being removed. The ca-certificates package, which holds the Mozilla root CA bundle, landed on all three branches to drop emSign Root CS CA G3, a code signing root that signed at least two compromised certificates. The changelog phrasing is refreshingly blunt about the intent: the key was signing bad stuff, so now it's gone. If you run any of these three releases, this is the one to get installed first, since it sits at the bottom of the trust chain for a lot of routine networked activity.

The PHP updates tell a similar story. The same pair of unauthenticated remote code execution flaws hit both Fedora 43 (getting the 8.4.27 series) and Fedora 45 (8.5.12). One rides in through memory corruption triggered by an out-of-memory state, the other through stale global state, catalogued as CVE-2026-109618 and CVE-2026-109619. Red Hat's own bug tracker calls them "undisclosed exploit," which is house language for the patch is here but the mechanics aren't public yet. That usually means you should patch and stay quiet about it.

The rest of the batch is more routine, though BIND still managed to pull in a dozen-odd fixes. The security tag occasionally shows up on what is essentially a version bump, which is normal for how Fedora files these things. Here's the full breakdown.

Oracle Linux

Oracle Linux just pushed a fresh batch of security advisories across OS levels 8, 9 and 10. The set holds 35 errata, eight of them rated Critical, and every one of those eight is .NET. If you run managed code on any of these releases, that is where the maintenance window should open.

The .NET coverage spans 8.0, 9.0 and 10.0 on all three OSes, moving SDK and runtime in lockstep: 8.0.132 with runtime 8.0.32, 9.0.122 with runtime 9.0.21, 10.0.113 with runtime 10.0.13. The CVE count climbs with the version, which is not the usual pattern. Ten-dot-zero carries 22, eight-dot-zero tracks 21, nine-dot-zero sits at 20. A 22-CVE bump for a single runtime release is worth a closer look.

PHP is the next-biggest theme, and it shows up on every OS level and most language versions. Linux 10 gets php8.4 up to 8.4.27 and the 8.3 branch to 8.3.36. Linux 9 gets 8.3.36 and 8.2.35, plus a bare "php" package that turns out to be 8.0.30 wearing a costume. Linux 8 is where PHP goes to be gently reminded it is still patched, with 7.4.33 and 8.2.35. The newer releases chase CVE-2026-91765 and the 109618/109619 pair, which cover state corruption via bailout and out-of-bounds reads. The OL9 8.0.30 entry alone packs about a dozen fixes, including the older 91768 and 91769 and the SOAP/PHPAR buffer overflows.

Databases do not escape. PostgreSQL 16 moves to 16.15, though the actual security payload lives in pgvector (CVE-2026-103484), an out-of-bounds write during IVFFlat index builds that can hand you arbitrary code execution. MariaDB 11.8 on Linux 10 is mostly a release bump to chase down a pile of pcre2 CVEs.

Then the smaller, still-notable stuff. rust-sequoia-sq takes CVE-2026-93599 and 93657, OpenEXR on OL9 eats five separate CVEs in one package, and librsvg2 gets patched three times (OL8, OL9, OL10) for the same CVE-2026-96889 use-after-free. If you have that library anywhere, check three places. Go lands on 1.26.10 for OL9 and OL10 with four new CVEs. Xwayland on OL8 absorbs ten CVEs in one xorg-x11-server refresh. python-gitpython gets CVE-2026-67324 and 78676 fixes shipped on both OL8 and OL9.

The calmer end of the batch: fetchmail repairs a stack-based buffer overflow in NTLM auth (CVE-2026-94184) for OL8 and OL9, openssh on OL9 handles a GSSAPI-based DoS and an internal-sftp parsing limit, and cockpit-files, cockpit-machines and jackson-core round out the Moderate list. No single item here is a stop-the-world bug, but the surface is wide enough that one maintenance window beats a dozen separate restarts.

Red Hat Enterprise Linux

Red Hat pushed another batch of RHEL security errata, and if you skim the errata list the same two packages will catch your eye: ca-certificates and grafana. The certificate trust package isn't surprising, but the sheer number of advisories chasing it is. You'll find nine ca-certificates updates across RHEL 8, 9, and 10, every one rated Critical. A spread that wide usually points to one heavily used package picking up a serious flaw.

.NET took the same Critical treatment, split between 8.0 and 9.0 and aimed mostly at Extended Update Support channels. If you run containers, you'll spot podman, buildah, and qemu-kvm all getting Important fixes, and kernel showed up more often than you'd hope, including two Extended Lifecycle Support entries for RHEL 7, software older than most sysadmins in this room.

OpenShift got its usual paired release cycle, with 4.14.76 and 4.15.70 both landing bug fixes alongside the security patches. Most of the volume sits at Important, though three grafana-pcp updates carried a Critical rating, including one aimed at RHEL 9.8. Only two advisories, libkcapi and openssh, landed at Moderate. It reads as a broad cleanup pass rather than one catastrophic hole. Nothing scary, just a lot of checkboxes to tick.

Rocky Linux

Rocky Linux just pushed a sizable batch of errata, and most of it is the kind of update you want to apply on a slow morning before something quietly breaks. The raw feed re-emitted a couple of advisories multiple times, so if you naively counted the entries you'd think there were twice as many as there really are. The actual unique advisory count sits at 22.

The one to handle first is the Critical ca-certificates patch, which landed for both Linux 9 and Linux 10. A corrupted certificate bundle is the kind of thing that takes down TLS across the whole box without much fuss, so that deserves your attention before you get comfortable with the rest. Not far behind sits a grab-bag LibreOffice update (RLSA-2026:88164) that drags in a dozen libraries and gives you a mouthful of a title to read, and grafana-pcp shows up on all three supported releases.

The bulk of the rest land at Important severity. The kernel gets a security patch on Linux 8, with kernel-rt covered too, and httpd, qemu-kvm, podman, buildah, expat, iperf3, and both PostgreSQL pgvector variants round out the list. php:8.2 gets its own patch split across Linux 8 and Linux 9. openssh is the only Moderate entry, and honestly that's a relief given how many things you'd rather not leave exposed. If you're running any of this stack, you have a fair number of packages to push.

Slackware Linux

Slackware just issued a kernel security advisory, SSA:2026-295-01, aimed squarely at Slackware 15.0. It bumps the kernel to 5.15.223 and closes the PwnEscape flaw, which started life in Android's kernel and never really stopped being handy for anyone who'd rather not run with privileges they shouldn't have. Worth the reboot.

Two things before you upgrade. The CVE id in the advisory (CVE-2026-99999) reads more like a placeholder than a real record, so lean on the advisory text rather than any linked record for context. This is also Slackware, which means it is not going to do the plumbing for you. You'll upgrade with upgradepkg, then rebuild the initrd, and if you boot through LILO or elilo, make sure the bootloader actually points at the new kernel before you pull the trigger on a restart. The 32-bit installs want the SMP kernel variant if the box has more than one core, so run uname -a first to check.

There are thirteen packages across the 32-bit and 64-bit trees. MD5 sums are included, since Slackware still expects you to verify.

SUSE Linux

A fresh pile of SUSE security advisories hit the 22nd and 23rd of October, and roughly a quarter of them are the kind that make you want to run zypper patch before reaching for coffee. The biggest by raw count live in browser engine and Mozilla territory, where numbers like 237 and 138 CVEs look almost absurd until you remember how an entire Chromium release lands inside a packaged library.

Two webkit2gtk3 releases carry the critical tag. SUSE-SU-2026:4858 pulls in 237 CVEs in one broad sweep, while SUSE-SU-2026:4868 adds seven more. Most are the expected memory-corruption and sandbox-escape family, though a selection lets an already-compromised renderer process reach parts it shouldn't. If you run a SUSE desktop, this is your Monday.

PHP got a double serving. php8 (SUSE-SU-2026:4852) is the tidy one, just two CVEs for memory corruption leading to RCE. php7 (SUSE-SU-2026:4853) sweeps 12 CVEs through the door at once, which makes sense given how long 7.4 has been around to accumulate grime. Both fixes touch CVE-2026-109618 and CVE-2026-109619.

Kernel live patches landed for both SP4 and SP6. SP4 got two (52 and 56) and SP6 got three (26, 29, 30). They cover nearly the same ground, so grab whichever matches your branch and skip the rest. CVE-2026-63795 is the scariest of the group, landing a clean 10.0 on NVD's scale.

OpenSUSE Tumbleweed's GA media round reads like a grab bag. Firefox took 77 CVEs, Thunderbird took 138, and Go showed up twice (1.26 with 13 fixes, 1.27 with 15). expat, coreutils, cups-filters, guava, amazon-ecs-init, cyrus-sasl, python-soupsieve, Django5, and a datamodel generator each took their small slice. Somewhere in there, both podman and the distribution package were simply rebuilt against the current Go security release, which is SUSE's polite way of saying the whole chain needed refreshing.

Ubuntu Linux

Three Ubuntu Security Notices shipped, all touching software you're plausibly running right now. The fixes range from "reboot tonight" to "upgrade whenever you get a minute," and telling them apart will save you a surprised face later.

Start with zlib. Ali Firas found the compression library mishandled certain non-blocking write operations, which lets a single crafted input produce a heap buffer overflow. From there you can get denial of service or arbitrary code execution, and zlib sits underneath an uncomfortable amount of the internet, so this is the one to prioritize even if you've never touched compression settings directly.

Tornado collected six CVEs for not validating crafted HTTP requests and network inputs properly, and two of them trace back to 2023 and 2024, so this isn't a fresh batch of holes so much as old ones finally getting fixed. A remote attacker can trigger denial of service, leak sensitive data, or slip past access controls. It's the familiar "server trusted input it shouldn't have" story, with no real ingenuity on either side.

OpenVPN is the odd one. A mistake in how it reads certificate subject fields means an authenticated remote user can impersonate another user. Being inside first is required, so the blast radius is smaller than the other two, but impersonation is a more useful prize for whoever's behind the keyboard than a plain DoS.

Everything is a standard apt upgrade away from fixed, so you don't need to chase down individual packages. Two things worth flagging. Tornado's older LTS releases, 22.04 down through 16.04, only get patched through Ubuntu Pro, which leaves free-support machines able to reach 26.10, 26.04, and 24.04. With OpenVPN a plain update doesn't finish the job: restart the service after updating, or the patch won't actually stick.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all