Ten major Linux distributions shipped critical security advisories today, with Ubuntu leading a massive kernel sweep across every LTS release to patch WiFi mesh injection and AMD Zen 2 cache isolation flaws. Infrastructure tooling also took a hit, as curl, Podman, and BIND received fixes for authentication bypasses, container escape vectors, and cache exhaustion exploits. The runtime layer saw equally heavy CVE counts, featuring a MySQL 8.4 rebase, PHP 8.4 and Python 3.13 hardening against SQLi and tarfile bypasses, and parallel patches for .NET and Go ecosystems. 

Today's Linux Security Roundup: Kernel Patches, Runtime CVEs, and a MySQL Rebase

Ten distributions shipped critical advisories today, with kernel updates, PHP and Python fixes, and a sweeping PostgreSQL cleanup dominating the queue.

If your patching backlog looks concerning, you are not alone. AlmaLinux, Debian, Fedora, Gentoo, Oracle Linux, RHEL, Rocky Linux, Slackware, SUSE, and Ubuntu all pushed security updates today. The headline is a massive kernel patching effort, but the real work sits in your runtimes, databases, and networking tooling.

Kernel Patches and Infrastructure Tools

Ubuntu took the biggest swing, shipping kernel updates across every LTS and cloud flavor from 14.04 all the way to 26.04. The fixes target a re-emergent WiFi mesh packet injection vector, alongside sweeping patches for networking, storage, and the x86 crypto subsystem. NVIDIA and Raspberry Pi kernels are also getting hammered, this time for an AMD Zen 2 cache isolation flaw that could leak data or escalate privileges. You will need to reboot after applying these.

The infrastructure layer did not get off easy either. curl landed fixes for HTTP Negotiate authentication bypasses, OAuth2 bearer token leaks, and SSH host key mismatches across Oracle Linux, RHEL, and Ubuntu. Podman on SUSE closed two container escape vectors: one where a crafted image rewrites host directory ownership, and another that spills host environment variables into containers. BIND 9.18 on Oracle and SUSE got cache exhaustion and NSEC3 validation patches, while Performance Co-Pilot on AlmaLinux and Oracle Linux fixed a privilege escalation path through the linux_sockets PMDA.

Fedora's advisory explicitly calls out the .NET ecosystem, noting that SDKs for versions 8.0, 9.0, and 10.0 all "cleared out ten common CVEs" in a single pass. That is a massive amount of patching for a single day. The long wait for clean builds is finally over, though you should verify your .NET runtime versions before pushing to production.

Runtimes, Databases, and Application Stacks

Databases are getting a serious overhaul today. MySQL 8.4 got rebased to 8.4.11 across AlmaLinux, Oracle Linux, Rocky Linux, and RHEL, pulling 28 vulnerabilities from the July CPU along with it. PostgreSQL on Ubuntu finally addressed a long-running list of issues across versions 14, 16, and 18. The fixes range from unsafe COPY FROM STDIN handling to silent cleartext encryption fallbacks in pgcrypto. Restart your service after the update.

The language runtime ecosystem is where the CVE numbers actually stack up. PHP 8.4 on AlmaLinux, Oracle, and Rocky plugs two nasty bugs: a SQL injection born from pgsql backslash escaping and an arbitrary code execution flaw in bccomp(). Python 3.13 on Fedora and SUSE lands fixes for a CPU exhaustion denial of service in the HTML parser and a tarfile extraction bypass. Go on SUSE locked down nine vulnerabilities each for versions 1.25 and 1.26, mostly targeting ASN.1 recursion limits and XML decode exhaustion.

Browsers and email clients also saw activity today. Chromium on Debian and the bookworm LTS track absorbed a 15-CVE roll for arbitrary code execution and denial of service. Slackware paired Firefox and Thunderbird updates on the 140.14.0 ESR branch, covering protocol hardening and memory safety fixes. Vim on Ubuntu picked up memory corruption patches for JSON decoding and spell file handling, while Wget got a regression correction for a previous CVE patch that should stop downloads from breaking.

Not every advisory requires a reboot, but the kernel and PostgreSQL updates absolutely do. RHEL and Oracle Linux users should also double-check their SAP and EUS channels, since dracut, OpenJDK 11, and mod_md landed in some unexpected places. If you are running older ELS releases, that Java update might be the one you want to target first.

A detailed overview

AlmaLinux

AlmaLinux rolled out a fresh batch of security patches. The release skews heavily toward AlmaLinux 10, with a couple of important fixes landing on AlmaLinux 8 and 9. The real-time kernel update for AL8 tackles nine separate issues, from dangling network pointers to double-free bugs in the iSCSI target. If you run media pipelines, the GStreamer plugin patch quietly plugs three memory-handling flaws that could otherwise eat your RAM.

On the application side, MySQL 8.4 takes a serious beating with 28 vulnerabilities pulled from the July CPU, paired with a version bump to 8.4.11. PHP 8.4 cleans up two nasty issues: a SQL injection born from pgsql backslash escaping and an arbitrary code execution bug in bccomp(). .NET 9.0 and 10.0 both ship 16 patches each, covering everything from HTTP/2 flood denial of service to authentication bypasses and deserialization exploits. GLib2 rounds out the AL10 fixes with seven buffer over-reads and a path traversal flaw in the D-Bus auth mechanism. The AL9 batch targets infrastructure tooling: ansible-core fixes an argument injection in the galaxy role installer, and Performance Co-Pilot patches four separate holes, including a privilege escalation path through the sockets PMDA.

Debian GNU/Linux

Debian shipped another round of security patches, covering trixie, bookworm, and bullseye. chromium leads the pack with a massive 15-CVE roll for both the current stable release and the LTS track. Arbitrary code execution, denial of service, and information disclosure hit every vendor, which is roughly what you would expect from a browser engine running untrusted web content. libgit2 absorbed six new CVEs tied to SSH command injection, credential leaks, and directory creation outside the working tree. If you route version control over SSH, trixie gets a patched library this week. sabnzbdplus had its web UI password bypass quietly fixed without a CVE assignment yet, so upgrade if you point that newsreader at anything reachable from the internet. python-httplib2 closed two denial of service vectors across three Debian releases, mainly unbounded gzip/deflate decompression and a leftover header parsing bug that shows up whenever an LTS track gets maintained.

Fedora Linux

Fedora 43 just took a serious beating of security patches, with Fedora 44 catching the same updates shortly after. The .NET ecosystem got the most attention, as SDKs for versions 8.0, 9.0, and 10.0 all cleared out ten common CVEs. That is a massive amount of patching for a single weekend. Apache Traffic Server moved to 10.2.0, and the changelog reads like a catalog of memory safety wins. Use-after-free, stack overflows, and crashes have been squashed, which makes this update a priority for anyone running a caching proxy.

Roundcube landed security fixes for its 1.6.18 and 1.7.3 releases, closing holes in SSRF, XSS, RCE, and IMAP command injection. Firefox hit 154.0, bringing a KDE Wayland session restore to Fedora 43 and PipeWire camera stride support to Fedora 44. WordPress 6.9.7 addresses a nasty RCE involving Imagick and Ghostscript, alongside a pre-auth XSS and several privilege escalation issues. Python 3.13.15 patches a CPU DoS in the HTML parser and a tarfile extraction bypass. NTPsec, phpseclib3, Domoticz, libgit2, and i2c-display round out the batch with their own specific fixes. Dokuwiki also receives a backported patch for a "disableactions" mechanism bypass.

Gentoo Linux

Gentoo published a high-severity advisory on August 20, 2026, flagging three security flaws across the acl and attr utilities. If your system runs either package older than the fixed versions, you are looking at a potential local privilege escalation vector. The advisory points to CVE-2026-54369, CVE-2026-54370, and CVE-2026-54371, but keeps the actual exploit mechanics in the linked NVD entries. There is no workaround, and the patch path is straightforward.

Security advisories are rarely exciting reads, but privilege escalation flaws in utilities that handle file permissions are exactly the kind of thing that justifies a high rating. You should run the provided emerge commands before you leave for the day.

Oracle Linux

Oracle just pushed a wide-ranging security patch across all three active branches. OL10 takes the lion's share, landing a full rebase for MySQL 8.4, PHP 8.4, and a massive 6.12 kernel update that closes out several dozen CVEs. OL9 gets .NET 10.0 added to the lineup with official Oracle Linux support, alongside the usual .NET 9.0 routine maintenance. OL8 keeps the older kernel (4.18) and older libraries patched, which is exactly what you would expect from a long-term support stream. The curl, glib2, PCP, and Node.js updates hit all three releases with identical CVE batches, so you will want to roll those out regardless of which version you are managing. BIND 9.18 and PAM also get their due attention for cache exhaustion and timing leak fixes. If you have not run yum update recently, the patch window is open.

Red Hat Enterprise Linux

Red Hat rolled out a fresh round of security advisories, and the volume suggests a busy patch window for systems on Extended Update Support or SAP channels. The headline items are kernel bumps for RHEL 9 and RHEL 10, plus OpenJDK 11.0.32.1 ELS patches for both Linux and Windows builds. If you're running older ELS releases, that Java update might be the one you want to target first.

Dracut dominates the list with updates for RHEL 10.0 EUS, RHEL 9.6 EUS, RHEL 9.4 SAP Solutions, and RHEL 9.2 SAP Solutions. You'll also see mod_md hitting RHEL 9.6 EUS, RHEL 9.4 SAP, and RHEL 9.2 SAP. SAP users have a clear checklist here. php:8.3 lands for RHEL 9 and php:8.2 for RHEL 8, so application teams using those versions should plan accordingly.

OpenShift 4.12.96 and 4.13.70 are getting tagged with Important advisories, though the security impact rates as Low. Still, the overall rating warrants a look. Other packages making the cut include curl for RHEL 8, postgresql for RHEL 9.2 SAP, webkit2gtk3 for RHEL 8.4, mrtg across RHEL 9 and 10, and rh-podman-desktop for RHEL 10. Yelp gets a security update for RHEL 7 ELS, and osbuild-composer is updating for RHEL 9.6 EUS.

Rocky Linux

Rocky Linux just pushed a fresh batch of errata across versions 8, 9, and 10, and if you are running production systems, you will want to patch before your Monday morning. The release splits evenly between the three major branches, delivering ten Important severity ratings and five Moderate ones. You are getting security fixes for familiar pillars like PHP (across 8.2, 8.3, and 8.4), MySQL 8.4, Java (both 17 and 21), Ansible Core, and Perl. A handful of these also bundle bug fixes and performance tweaks, so this is not strictly a vulnerability sweep. The newer 10 branch gets updates for libcupsfilters, yggdrasil, and glib2, while the PHP bundles on versions 8 and 9 drag along every relevant PECL extension they can find, which is a bit of a kitchen sink approach. GStreamer and mecab-IPAdic round out the queue. Run your standard update cycle and you should be clear.

Slackware Linux

Slackware's security team rolled out paired patches for Firefox and Thunderbird, both landing on the 140.14.0 ESR branch. If you are running Slackware 15.0 or -current, you will want to pull these before the items on the referenced CVE list get actively exploited. The advisories do not spell out the individual vulnerabilities, but they reference a long list of identifiers spanning CVE-2026-74934 through 74990. That usually means standard protocol hardening and memory safety fixes. You can apply both with a straightforward upgradepkg as root. The OSU Open Source Lab keeps the mirrors running, which saves you the headache of tracking down local mirrors for a distro that does not chase flashy package managers.

SUSE Linux

SUSE just pushed another round of security patches, and the scale varies depending on what you run. OpenSSL livepatches land on the 15.6 branch to close a HollowByte denial of service vector in the TLS handshake. Podman addresses two CVEs on the SP4 and Micro tracks, including one where a crafted image can tweak host directory ownership and another that spills host environment variables into containers. Python 3.11 finally gets a fix for an HTTP cookie regression, while Python 3.13 ships eight fixes targeting the tarfile module, FTP client, and HTML parser.

The real action sits on openSUSE Leap 16.0. Go developers get parallel patches for both 1.25 and 1.26, locking down nine vulnerabilities each, mostly around ASN.1 recursion limits, XML decode exhaustion, and TLS handshake message caps. Firefox ESR 140.14.0 takes the moderate rating but quietly patches thirty-one vulnerabilities ranging from WebGL site isolation flaws to same-origin policy bypasses. KubeVirt grabs a massive twenty-five CVE sweep tied directly to Go's crypto and net libraries. If you maintain ctop, gitea-tea, forgejo-cli, or python-pytest-html, the routine is already familiar. Run the zypper commands, verify the package versions, and keep moving.

Ubuntu Linux

Ubuntu released a massive security roundupand the headline is the Linux kernel. Almost every LTS release and cloud flavor from 14.04 through 26.04 is getting patched, mostly for a re-emergent WiFi mesh attack and a sweeping list of fixes across networking, storage, and architecture subsystems. You will need to reboot after applying these. NVIDIA and Raspberry Pi kernels are also getting hammered with patches, including fixes for AMD processor cache isolation and floating-point divider issues that could leak data or escalate privileges.

Outside the kernel, PostgreSQL is finally addressing a long list of vulnerabilities across versions 14, 16, and 18. The issues range from unsafe COPY operations and silent cleartext encryption to heap buffer overflows in PL/Perl and row security bypasses. If you run PostgreSQL, restart the service after applying the update. Netty gets two fixes for HTTP/2 control frame handling and CRLF injection, which matters if you parse untrusted traffic. Vim picks up fixes for memory corruption when decoding JSON, handling spell files, and processing shell arguments during keyword lookups. Wget is getting a correction for a regression introduced in a previous advisory, which should keep your downloads from breaking after a clean install.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world