Today's Linux security roundup brings a sweeping wave of security updates that hit nearly every major distribution, targeting critical infrastructure libraries like Go, OpenSSL, and the Chromium browser family. Oracle and Red Hat shipped Go 1.26.7 to address six new CVEs, Fedora jumped OpenSSL to 3.5.8 resolving ten vulnerabilities, and Ubuntu patched a privilege escalation flaw in sudo-rs alongside a PAM account lockout bypass. AlmaLinux and Rocky Linux pushed extensive patches for Node.js and MySQL, while Debian's libdbi-perl update required a follow-up regression patch after breaking dependent test suites. Run your system updates immediately, as the Gentoo advisory covers 23 CVEs in browser engines and SUSE's python-sqlparse patches address dangerous SQL injection vectors.

Linux Security Roundup: Go, OpenSSL, and Browser Patches Hit Major Distros

Multiple distributions pushed security updates foday, and if your package manager has been quiet, it's worth a check. The batch spans from AlmaLinux's massive MySQL rollout to Gentoo's Chromium advisory, covering everything from kernel tracks to Node.js streams. Nothing earth-shattering, but plenty of reasons to run dnf update or apt upgrade before you open another tab.

Today's Linux security updates roundup brings updates for Go and OpenSSL. Oracle Linux 10 and RHEL both shipped Go 1.26.7, which quietly slips in six CVEs alongside standard bug fixes. If you run Go in production, patch it first. Fedora jumped OpenSSL to 3.5.8, resolving ten separate CVEs. That's a big jump for a library that sits under almost every HTTPS connection you'll ever make.

Gentoo published a high-severity advisory targeting every major Chromium derivative. The fix arrives at version 138.0.7204.92 for Chromium and Chrome, 138.0.3351.65 for Edge, and matching versions for Opera and Vivaldi. The advisory strings together 23 CVEs spanning memory corruption and use-after-free flaws. There is no workaround, so you will need to bump your browsers or leave your security perimeter exposed.

AlmaLinux pushed a steady stream of patches across versions 8, 9, and 10. The bulk of the heavy lifting lands on MySQL 8.4, which absorbed about thirty patches tied to Oracle's July CPU release. Node.js keeps showing up across multiple branches because the same trio of flaws affects every supported release. They cover the permission model bypass, HTTP/2 header block memory exhaustion, and a heap-use-after-free in the protocol handler.

Rocky Linux mirrored some of these updates, including the same Node.js advisories and fixes for iperf3 and xmlrpc-c. The network-facing tools got Important ratings, while standard utilities like tar landed at Moderate. tar is the only package that bothered to fix bugs and add features alongside the security patches, which is a nice change of pace.

What to patch first

Ubuntu pushed patches across nearly every active LTS release, starting at 14.04 and finishing at 26.04. The most notable fixes include a TOCTOU flaw in sudo-rs that lets users with fine-grained editing permissions place files anywhere and potentially escalate privileges. PAM updates address a bug where attackers could wipe failed login counters to dodge account lockouts. You will need to reboot for the PAM patch.

Debian's LTS and security teams shipped a cleanup pass where libdbi-perl is doing the heavy lifting. The original security patch for that Perl database interface module actually broke the test suite for libdbd-csv-perl, which forced a follow-up regression fix. The CSV driver itself wasn't modified, so you end up with two advisories for what amounts to one patch cycle.

SUSE pushed patches for python-sqlparse across three separate advisories. Four vulnerabilities land in each update, ranging from quadratic complexity denial-of-service traps to a backslash escaping flaw that lets crafted SQL slip past the parser. Busybox also took a beating with five advisory entries covering heap and stack overflows inside awk and ash.

Fedora shipped updates for cockpit, which picked up a memory leak fix, and bubblewrap 0.12.0, which lands on Fedora 43 to reset SIGCHLD handling for unprivileged containers. The batch also covers gdk-pixbuf2 and Emacs tramp, closing shell injection vectors in both.

Slackware rolled out a patch for pcre2 across 15.0 and -current, bumping the library to 10.48. The official changelog keeps it brief, pointing users at six separate GitHub advisories. Run upgradepkg as root and verify the MD5 hashes before it touches your system.

Keep in mind that Red Hat's kernel updates continue to take the brunt of the "Important" ratings across RHEL 8, 9, and 10. OpenShift is getting similar treatment, with four minor versions all picking up important fixes. Match each advisory to your specific OS stream and errata channel before rolling anything out.

The Updates in Detail

AlmaLinux

AlmaLinux pushed a steady stream of security patches across AlmaLinux 8, 9, and 10. You are looking at roughly two dozen errata, and the bulk of the heavy lifting lands on MySQL, Node.js, Ruby, and PHP. The MySQL 8.4 update quietly absorbed about thirty patches tied to Oracle's July CPU release, covering everything from the Optimizer and Replication to InnoDB and the X Plugin. Node.js keeps showing up across multiple branches because the same trio of flaws (CVE-2026-58043, CVE-2026-56846, and CVE-2026-56848) affects every supported release. They cover the permission model bypass, HTTP/2 header block memory exhaustion, and a heap-use-after-free in the protocol handler. Ruby and PHP round out the list with injection and denial-of-service flaws in net-imap and pgsql/phar, while tar and gzip serve as a reminder that archiving utilities still find creative ways to overwrite files or leak memory if you feed them something unusual. Nothing earth-shattering, just the kind of maintenance you want applied before you build anything in production.

Debian GNU/Linux

Debian’s LTS and security teams just shipped a cleanup pass across several maintained packages, and the libdbi-perl update is doing the heavy lifting. The original security patch for that Perl database interface module actually broke the test suite for libdbd-csv-perl, which forced a follow-up regression fix. The CSV driver itself wasn't modified, so you end up with two advisories for what amounts to one patch cycle.

The rest of the batch reads more straightforward. cyrus-imapd took the brunt of the ACL bypass issues, letting authenticated users read, delete, or force mail into other people's inboxes. The URLAUTH token flaws are particularly sloppy, especially since those tokens kept working after a user's permissions were revoked. lemonldap-ng patches an OAuth2 state replay bug that lets attackers piggyback into SSO sessions if you're running GitHub or LinkedIn auth. keystone rounds it out with three authorization bypass and information disclosure flaws in the OpenStack identity layer. All of these land on Debian's supported branches, so if any of them sit on your stack, the patch window is open.

Fedora Linux

Fedora shipped a fresh round of security advisories for Fedora 44 with one patch landing on Fedora 43. The batch covers the usual suspects: cockpit gets a memory leak fix alongside routine translation work, gdk-pixbuf2 patches a malformed JPEG parser, and Emacs tramp closes a shell injection vector in its user field. OpenSSL takes the biggest chunk of the advisory, jumping to 3.5.8 and resolving ten separate CVEs. Python users should patch linkify-it-py to dodge quadratic complexity attacks, while python-llm pulls in its upstream 0.33 release alongside a lingering code injection reference. Intel's rendering stack (openvkl and rkcommon) both fix a heap overflow, and bubblewrap 0.12.0 lands on Fedora 43 to reset SIGCHLD handling for unprivileged containers.

Gentoo Linux

Gentoo published a high-severity advisory, targeting every major Chromium derivative. The fix arrives at version 138.0.7204.92 for Chromium and Chrome, 138.0.3351.65 for Edge, 122.0.5643.17 for Opera, and 7.5.3735.44 for Vivaldi. The advisory strings together 23 CVEs spanning memory corruption, use-after-free flaws, and sandbox boundary issues, which tracks with the typical quarterly browser patch rhythm. There is no workaround, so you will need to bump your browsers to the listed versions or leave your security perimeter exposed. You can pull the updates through Portage with a standard emerge command pointing at the matching package and version.

Oracle Linux

Oracle Linux 10 just posted two new advisories, and if either libxml2 or Go is in your dependency tree, dnf update should be on your schedule before you open another tab. The libxml2 advisory is a straightforward moderate-severity security patch for a single CVE. The Go advisory does the heavy lifting, jumping the language to 1.26.7 and quietly slipping in six CVEs alongside bug fixes and a couple of enhancements. You get the full x86_64 and aarch64 treatment on both, with source RPMs available if you build your own toolchains. If you run Go in production, patch it first.

Red Hat Enterprise Linux

Red Hat shipped another round of security errata, and if your infrastructure runs RHEL or OpenShift, there are patches to apply. The kernel continues to take the brunt of the "Important" ratings, landing across RHEL 8, 9, and 10 alongside specialized tracks like SAP, Telcos, and extended lifecycle support. OpenShift is getting similar treatment, with four minor versions (4.20, 4.21, 4.22) all picking up important fixes in the 4.20.36, 4.21.31, and 4.22.12 releases. If you run PHP or Node.js modules, you will want to pull the php:7.4, php:8.2, and nodejs:22 advisories before they show up in automated scans.

A smaller batch of "Moderate" ratings targets wget across three RHEL versions, libssh on RHEL 8 and 9, tar, and gstreamer. There is also one Fedora 44 update pushing linux-system-roles to 2.4.2, and RHEL 7 Extended Lifecycle Support is still earning its keep with dracut and libXfont2 patches. You should match each advisory to your specific OS stream and errata channel before rolling anything out.

Rocky Linux

Rocky Linux shipped another batch of errata covering versions 8, 9, and 10, and if your package manager has been quiet lately, this round is worth a look. The update cycle rolls out security patches for a familiar set of system utilities and libraries, including dbus-broker, gzip, tar, xmlrpc-c, iperf3, freerdp, glib2, and two Node.js streams. Severity ratings lean Important for the network-facing tools like xmlrpc-c, iperf3, freerdp, and the Node.js modules, while the standard system utilities land at Moderate. tar is the only package that bothered to fix bugs and add features alongside the security patches, which is a nice change of pace. You can pull the full CVE breakdowns straight from the errata links, but running your normal update routine across all three releases will keep things locked down.

Slackware Linux

Slackware has rolled out a security patch for pcre2 across 15.0 and -current, bumping the library to 10.48. The official changelog keeps it brief, pointing users at six separate GitHub advisories to explain what actually needed fixing. You should pull the patch from the main mirror or a nearby community host before those listed vulnerabilities show up in the wild. Running upgradepkg as root gets you set up, and the provided MD5 hashes let you verify the download before it touches your system.

SUSE Linux

SUSE pushed a fresh batch of security patches, and if you run Tumbleweed or a supported Leap/SLES release, there is enough here to justify a quick system check. The headline concerns python-sqlparse, which shows up in three separate advisories across different OS branches. Four vulnerabilities land in each update, ranging from quadratic complexity denial-of-service traps to a backslash escaping flaw that lets crafted SQL slip Python or PHP code past the parser. Busybox also took a beating with five advisory entries covering heap and stack overflows inside awk and ash. The Java OpenJ9, wicked, and python313-uv packages round out the release with moderate fixes that are still worth applying before remote attackers start poking at network parsing logic. You can grab everything through zypper patch or YaST, and the CVSS numbers will tell you which ones actually need to run first.

Ubuntu Linux

Ubuntu pushed a fresh round of security patches across nearly every active LTS release, starting at 14.04 and finishing at 26.04. The notices span late August through early September and cover a wide slice of the stack. Most of the vulnerabilities lean toward denial of service, with crafted inputs triggering CPU burns or crashes in libraries like zlib, ncurses, and pyasn1. A few actually demand your attention. sudo-rs has a TOCTOU flaw in its sudoedit handler that lets users with fine-grained editing permissions place files anywhere and potentially escalate privileges. PAM lets attackers wipe failed login counters to dodge account lockouts, and libevent ships a whole list of bugs including HTTP request smuggling and use-after-free conditions. If your setup touches ASN.1, smartcards, or RSA cryptography, the libgcrypt and pyasn1 updates are the ones to grab first. A standard apt upgrade handles the bulk of the work. You will need to reboot for the PAM patch and restart the SSSD service for the smartcard fix.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world