Linux Security Roundup for Week 25, 2026

Security 10964 Published 2026-06-21 08:15 by Philipp Esselbach

News

Enterprise distros like Rocky and AlmaLinux require immediate kernel and OpenSSL patches to prevent privilege escalation and cryptographic failures across production servers. Debian and Ubuntu administrators should prioritize the nginx and CUPS security notices, relying on command-line package managers to bypass bloated desktop wrappers and catch dependency conflicts early. Rolling distributions such as Fedora and SUSE release rapid updates for container tools and Python libraries, with SUSE notably offering livepatches that keep critical services running during cryptographic fixes.

How to Handle This Week Linux Security Updates Without Breaking Your Server

This week Linux security updates hit every major distribution, and ignoring them leaves systems wide open to exploitation. The patches cover kernel flaws, OpenSSL vulnerabilities, and dozens of widely used services like PostgreSQL, Nginx, and Firefox.

Readers will learn which advisories demand immediate attention, how to apply them without downtime, and where to look when package managers complain. The focus stays on practical action rather than reading every single advisory code.

Why the Enterprise Forks Need Immediate Attention

The Red Hat ecosystem pushes out massive batches of advisories that often overlap. Rocky Linux, AlmaLinux, and Oracle Linux mirror these fixes almost identically because they share the same upstream codebase. Administrators managing these systems should prioritize the kernel and OpenSSL patches first.

Those components sit at the foundation of every network service. A memory corruption bug in the kernel can drop entire clusters during peak traffic. That exact scenario happens after a bad driver update or a rushed kernel module replacement. OpenSSL updates prevent cryptographic failures that leave encrypted traffic readable to anyone watching the wire.

The advisory codes look intimidating, but the package manager handles the dependencies automatically. Running a standard update routine after verifying the package signatures keeps systems stable. Some older enterprise releases still carry legacy packages that refuse to upgrade cleanly. Those cases usually require a targeted package install rather than a blanket system update. Skipping the kernel fix is never an option. The vulnerability allows privilege escalation through standard system calls.

Navigating the Debian Family Update Queue

Debian and Ubuntu handle security notices differently. The distribution teams publish explicit Ubuntu Security Notices that map directly to CVE identifiers. System administrators on these platforms should check the USN codes before running upgrades.

The nginx and CUPS notices this cycle deserve immediate focus. A denial of service flaw in the web server can tie up worker threads until the machine stops responding to legitimate requests. The CUPS regression update fixes a printing subsystem crash that triggers randomly when processing malformed PDF files. Running the update through the standard package manager resolves the issue without manual intervention.

Handling Rolling and Semi-Rolling Release Patches

Fedora and SUSE distributions push updates with different cadences. Fedora 43 and 44 receive simultaneous security fixes that target newer package versions. The Chromium and Kubernetes advisories require immediate action because container orchestration tools often expose network interfaces to untrusted traffic.

SUSE Tumbleweed and Leap release updates in rapid succession. The OpenSSL livepatches for SUSE systems allow administrators to apply cryptographic fixes without rebooting. That capability matters heavily for high availability environments. Python libraries across both platforms receive routine security bumps. Those updates rarely cause breakage but should still be verified after installation. Running a quick service check after applying library patches confirms that dependent applications loaded the new code correctly. The package managers handle the heavy lifting. Administrators only need to monitor for configuration drift. Ignoring a single dependency warning usually means a service will fail to start on the next boot.

Slackware Updates and Final Checks

The bind and OpenSSL updates this cycle address remote code execution flaws that trigger through crafted DNS queries or malformed TLS handshakes. Applying these fixes manually prevents attackers from gaining shell access on isolated machines. Every distribution requires a final verification step. Checking running service versions confirms that the old binaries actually got replaced. Restarting dependent daemons ensures they load the patched libraries. Skipping that step leaves systems running outdated code despite the update completing successfully. The patching process stays straightforward once the priority packages get installed.

Latest Security Updates by Distribution

Here’s a complete breakdown of the security updates for AlmaLinux, Debian GNU/Linux, Fedora Linux, Oracle Linux, Red Hat Enterprise Linux, Rocky Linux, Slackware Linux, SUSE Linux, and Ubuntu Linux.

AlmaLinux

AlmaLinux recently distributed a wide range of security patches across its eighth, ninth, and tenth versions to harden server environments. The most urgent fix targets a critical HTTP/2 vulnerability that lets attackers trigger denial of service attacks through compression bombs and Slowloris techniques. Beyond the web server issue, the errata resolves severe memory corruption bugs and command injection flaws inside the Linux kernel, OpenSSL toolkit, and PostgreSQL database engine. Additional advisories cover critical flaws in WebKitGTK, Postfix, MySQL, Xorg, Dracut, and Podman to prevent stack buffer overflows and use after free errors.

Debian GNU/Linux

System administrators need to hurry and apply a massive batch of urgent security fixes across their Debian servers. These patches tackle severe vulnerabilities in widely used tools like Apache2, OpenSSL, and LibreOffice that could easily let attackers run malicious code or steal sensitive information. The update cycle also covers critical routing software, browser engines, and multimedia libraries to stop privilege escalation attempts. Ignoring these advisories will leave entire networks wide open to exploitation by threat actors.

Fedora Linux

Fedora 43 and 44 users need to apply urgent security patches right now. A massive collection of critical fixes covers widely used tools like Chromium, OpenSSL, Kubernetes, and numerous Python libraries.

Oracle Linux

Oracle Linux administrators managing the Unbreakable Enterprise Kernel 5.15.0 can now deploy essential fixes through Ksplice Uptrack on OL8 and OL9. These specific patches address several critical flaws that previously left the kernel exposed to potential exploitation. A broader security advisory also demands attention for OL7 and OL8 systems by covering dozens of recent vulnerabilities across Firefox, Apache HTTPD, and OpenSSL.

Red Hat Enterprise Linux

Red Hat Product Security recently distributed multiple batches of advisories targeting RHEL environments from version seven through ten. These patches address critical and important vulnerabilities across essential infrastructure components like the Linux kernel, MySQL, PostgreSQL, and OpenShift.

Rocky Linux

Rocky Linux administrators must urgently apply a wide range of security advisories covering both the eighth and ninth major distributions. These patches fix dangerous vulnerabilities in foundational packages like the core kernel, MySQL, PostgreSQL, and OpenSSL.

Slackware Linux

The Slackware Linux Security Team released a critical patches for Slackware 15. Administrators must install these updates immediately to stop attackers from exploiting known flaws across five core packages. The fix touches essential web browsers alongside vital system libraries and networking tools.

SUSE Linux

SUSE have rolled out a massive wave of security patches across their Tumbleweed, Leap, and enterprise distributions. These updates tackle dozens of critical flaws found in essential software like the Linux kernel, OpenSSL, Python libraries, and various container tools.

Ubuntu Linux

Ubuntu has released a comprehensive series of security notices to patch critical vulnerabilities across dozens of widely used software packages. These urgent updates address serious flaws in the Linux kernel, web servers like nginx and Tomcat, printing systems, and developer tools including Vim and tmux.

How to apply these Linux security updates safely

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all

Run the updates, verify the services, and get back to whatever you were actually trying to build. The networks will wait.

MariaDB 13.1 Preview: Rolling Release Features and Production Risks Explained