Linux distros including AlmaLinux, RHEL, SUSE, Debian, Fedora, Rocky, and Ubuntu all shipped security updates in late October, with a .NET critical cluster on AlmaLinux being the standout for ASP.NET Core systems. RHEL and SUSE also pushed Critical-rated advisories for python-pillow and other packages, though SUSE deliberately downgraded a 353-CVE Chromium build to Moderate while criticalizing low-scoring Django flaws. Chromium dominated the rest of the month, with both Fedora and SUSE releasing mass-CVE updates, while Debian cleared a staggering 150 CVEs in a single Thunderbird advisory. Notably, every Ubuntu Brotli fix targets older LTS releases but is tagged "Available with Ubuntu Pro," meaning a bare upgrade won't apply them without the paid service.
Linux security roundup: .NET criticals, mass Chromium CVEs, and an Ubuntu Pro catch
AlmaLinux, RHEL, SUSE, Debian, Fedora, Rocky, and Ubuntu all shipped updates in late October. No single distro stole the show, but a .NET critical cluster, some mass-CVE Chromium builds, and one Ubuntu notice that quietly demands a Pro account are the parts most worth your attention.
AlmaLinux delivered its usual end-of-month errata batch on October 30, and this round leans hard on .NET. Eight Critical advisories hit the 8.0, 9.0, and 10.0 runtimes. The CVEs read like a menu of ASP.NET Core failure modes: remote code execution, elevation of privilege, security-feature bypass, tampering. Aim your package manager at ALSA-2026:86168 through 86172 first, then 86192, 86193, and 86195.
The kernel owns the other headline, though it's the curious kind. CVE-2026-98432 is a use-after-free in IPv4 TCP connection setup, scored a meaty 9.8, and needs no privileges or user interaction to exploit. The patched kernels sit in the testing repo. More unusually, AlmaLinux is asking people to help verify them before they hit production. That's a less common move than you'd expect off a distro security announcement.
This critical cluster isn't confined to AlmaLinux. RHEL 8 picks up a Critical on python-pillow (RHSA-2026:93077), while the RHEL batch itself carries three Criticals: python-pillow, ipa against RHEL 7's Extended Lifecycle Support, and Satellite 6.19. Read that last one yourself. The body copy rates Satellite 6.19 as Important even though its headline says Critical, and a mismatch like that is one you can't shrug off.
SUSE put four Criticals on its late-October round: rsyslog, Django, roundcubemail, and perl-Dancer2-Plugin-Auth-Extensible. It's also the one clearly refusing to let the CVSS numbers run the show. The 353-CVE Chromium update lands as Moderate, while Django's four flaws, which cap at a 5.3, get Critical. Most of the volume targets openSUSE Leap 16.0. And yes, the rsyslog advisory there drags along a roughly 400-line changelog that reads more like a development diary than a security note. Keep in mind that python-CairoSVG, roundcubemail, and Chromium each got separate announcements for different product lines, so no single patch covers everything.
The rest of the updates
Fedora closed out late October with parallel sweeps for 43 and 44. The headline is Chromium. Both picked up version 156.0.8078.73, bundling 52 security fixes spanning memory corruption, use-after-free, and input-validation holes across V8, Skia, ANGLE, and Media. The package summary still runs the old "a browser Google doesn't want you to use" joke, though with this many CVEs the browser probably wants you to install it. SUSE's own Chromium story is bigger in the raw numbers, a Moderate update quietly shipping 353 CVEs. Browser releases always pile up like this, so the count is more interesting than scary.
Rocky rolled out its own batch, and the standout is a Critical on cjose, a thin C wrapper around the JOSE library, on Rocky Linux 9. Whether that badge reflects a real fire drill or just an aggressive CVSS score is something to check against the actual CVE list. There's also a data-entry snag worth flagging: RLSA-2026:92209 shows up for both the kernel and the SIG Cloud 8 kernel. That reads more like a duplicated identifier than two separate advisories, so verify it before you trust the paperwork.
On the Debian side, the two trixie releases matter most. DPDK picked up 15 CVEs spanning denial of service to memory corruption. And Thunderbird is where the number gets silly. Debian listed roughly 150 CVEs against a single mail client in one advisory, a backlog-clearing spree that usually means Mozilla pulled everything it could lay hands on. That's one mail client. 150 CVEs.
Keep in mind that Debian's housekeeping is where the long-term-support sloppiness shows. antiword carries heap out-of-bounds writes and an integer divide-by-zero bug that Debian hadn't assigned a CVE to yet. It's the usual state of things on the LTS track.
Then there's Ubuntu. It's patching yet another flaw in Brotli, the lossless compression tool, and this time the fixes land only on older LTS releases. USN-8956-2, dated October 27, closes out work that USN-8956-1 originally shipped in a more limited form. If you're still on 16.04, 18.04, or 20.04 LTS, you need to act.
Here's the wrinkle worth flagging before you bother. Every fix in this notice is tagged "Available with Ubuntu Pro." A bare apt upgrade may well ignore them. If your machine doesn't already have a Pro account attached, plan some time to wire that up.
A Breakdown of the Updates
AlmaLinux
AlmaLinux pushed its usual end-of-month errata batch on October 30, and this round leans hard on .NET. Eight advisories across the 8.0, 9.0, and 10.0 runtimes came down as Critical, carrying a combined pile of CVEs that read like a menu of everything that can go wrong in ASP.NET Core: remote code execution, elevation of privilege, security-feature bypass, tampering. The critical cluster (ALSA-2026:86168, 86169, 86170, 86171, 86172, 86192, 86193, 86195) is where you want to aim your package manager first.
The kernel owns the other headline, but of the curious kind. CVE-2026-98432 is a use-after-free in IPv4 TCP connection setup, scored a meaty 9.8, and needs no privileges or user interaction to exploit. Patched kernels sit in the testing repo, and the team is actually asking people to help verify them before they reach production. That is a less common move than you might expect from a distro security list.
The rest of the batch is steadier work. Apache httpd (ALSA-2026:92616) is carrying twelve fixes, a few of which allow arbitrary code execution or HTTP response smuggling, which is the particular flavor of bad you want to avoid in something with "web server" in its resume. python-pillow gets a Critical advisory of its own (ALSA-2026:93077) for the usual suspects: TIFF and FlashPix decoding plus a Ghostscript call that smells strongly of RCE. BIND shows up twice, each time with four CVEs, and Java 21 gets the usual multi-vulnerability treatment across all three supported distros.
A healthy share of this week's notes is carryover. The container-tools, virt, and JDK 21 advisories are mostly 2020 through 2024 CVEs being closed out on AlmaLinux 8, normal plumbing you only need to care about if you actually run those modules.
| Package | Distro(s) | Severity | Alert ID(s) & Date | What needs a fix |
|---|---|---|---|---|
| .NET 8.0 / 9.0 / 10.0 (Critical cluster) | 8, 9, 10 | Critical | 86168, 86169, 86170, 86171, 86172, 86192, 86193, 86195 (10-30) | 19-23 CVEs each. RCE and EoP in ASP.NET Core, info disclosure, MessagePack/array overflows, AD FS spoofing. Includes CVE-2026-102870 (ASP.NET Core RCE). |
| .NET 8.0 / 9.0 / 10.0 / 11.0 (Important) | 8, 9, 10 | Important | 92420, 92427, 92431, 92511 (AL8); 92429, 92432, 92492 (AL9); 92428, 92430, 92438 (AL10) (10-30/31) | Each carries CVE-2026-114148 (ASP.NET Core EoP). 8.0 adds brotli decode overflow (CVE-2026-111497). 11.0 adds EoP CVE-2026-62909. |
| Kernel (testing, asking for volunteers) | 8, 9, 10 | Critical (9.8) | CVE-2026-98432 (10-30) | Use-after-free in IPv4 TCP setup. Patched kernels in testing repo before production release. |
| Apache httpd (2.4) | 8 | Important | 92616 (10-30) | 12 fixes, including arbitrary code execution via oversized Host header, response smuggling, auth bypass, and several DoS conditions. |
| python-pillow | 8 | Critical | 93077 (10-30) | Heap buffer overflows in TIFF and FlashPix decoding; Ghostscript argument injection that can reach RCE. |
| python-pillow | 8 | Important | 92639 (10-30) | 10 DoS issues: recursion, double free, out-of-bounds access, infinite loops in PDF and image decoding. |
| BIND | 10 | Important | 92419 (10-30) | 4 CVEs: DoS via crafted DNS, GSS-TSIG replay RCE, assertion failures in redirect and RPZ processing. |
| BIND | 9 | Important | 93072 (10-31) | Same four BIND CVEs as the AL10 release. |
| OpenJDK 21 | 8, 9, 10 | Important | 88349 (AL8, AL9); 90504 (AL10) (10-30) | ~39 "Enhance CVEs" across TLS, LDAP, XML, HTTP clients, image handling, Kerberos, and more. |
| Tomcat | 8 | Important | 92869 (10-30) | 6 fixes: auth bypasses, SNI validation issues, and access-control problems. |
| dogtag-pki (IdM PKI) | 10 | Important | 92408 (10-30) | 3 CVEs in RESTEasy and Jackson: image-decode DoS, CORS credential reflection, regex backtracking. |
| aspell | 8, 9 | Important | 92615 (AL8), 92458 (AL9) (10-30) | One CVE each: arbitrary code execution via a crafted dictionary file. |
| Kernel | 10 | Moderate | 22395 (10-30) | 6 fixes: ublk queue freeze, nfsd client locking, memory unpoison bug, e1000e heap overflow, mt76 list corruption, i40e validation. |
| Kernel | 8 | Moderate | 8246 (10-30); 16919 (10-30); 21917 (10-30) | Three separate advisories. Covers rtw89, nfsd, net_sched, SCTP, i40e, and ARM firmware. |
| curl | 9 | Moderate | 92907 (10-30) | mTLS connection reuse can bypass security checks (CVE-2026-8932). |
| gcc-toolset-15-gcc | 8 | Moderate | 90915 (10-30) | One CVE: use-after-free in binary heap erase_if. |
| virt:rhel / virt-devel:rhel | 8 | Moderate | 1759 (10-30) | Backports qemu-kvm and libvirt; NTFS/ntfs-3g heap overflows plus QEMU use-after-free. |
| container-tools:rhel8 | 8 | Moderate | 1650 (10-30) | runc mount race, container-image manifest memory use, volume overwrite. |
| container-tools:1.0 | 8 | Important | 1926 (10-30) | buildah tar file can overwrite local files during image build. |
| java-21-openjdk | 8 | Moderate | 1828 (10-30) | Old JDK 21 CVEs: crash on long exception, C1 integer overflow, HTTP/2 reverse DNS lookup. |
Debian GNU/Linux
Debian's security team and FreeXian's LTS arm put out another round of fixes this week, so if your servers have been running on fumes since last month, this is a heads-up worth taking.
The two trixie releases are the ones that matter most. DPDK, the packet-processing library, picked up 15 CVEs spanning denial of service to memory corruption. Crafted packets or a misbehaving guest can chew through it depending on which features you have turned on. The patched build is 24.11.8-0+deb13u1.
Thunderbird is where the number gets silly. Debian listed somewhere around 150 CVEs against a single mail client in one advisory, a backlog-clearing spree that usually means Mozilla pulled everything it could lay hands on. The fixes cover arbitrary code execution and information disclosure, landing in 1:153.6.0esr-1~deb13u1.
The older stuff is quieter but still worth installing. antiword, the tool that turns MS Word documents into text, PDF, and XML, carries heap out-of-bounds writes and an integer divide-by-zero bug. Debian hadn't assigned CVE numbers yet, which is the usual sloppiness you get on the long-term support track. It is fixed at 0.37-16+deb12u1 for bookworm. cyrus-sasl2 had a heap buffer overflow in its DIGEST-MD5 authentication plugin caused by a buffer size that never got recomputed (CVE-2026-107161), fixed at 2.1.28+dfsg-10+deb12u1.
FreeXian picked up the same two issues for stretch, buster, and bullseye, still hanging on under extended LTS.
| Package | CVEs | Issue | Fixed version | Distribution | Advisory |
|---|---|---|---|---|---|
| dpdk | 15 | Denial of service and memory corruption from crafted packets or guest requests | 24.11.8-0+deb13u1 | trixie | DSA-6597-1 |
| Thunderbird | ~150 | Arbitrary code execution and information disclosure | 1:153.6.0esr-1~deb13u1 | trixie | DSA-6598-1 |
| antiword | None yet | Heap out-of-bounds writes and integer divide by zero | 0.37-16+deb12u1 | bookworm | DLA-4870-1 |
| cyrus-sasl2 | CVE-2026-107161 | Heap buffer overflow in the DIGEST-MD5 plugin | 2.1.28+dfsg-10+deb12u1 | bookworm | DLA-4871-1 |
| antiword | None yet | Heap out-of-bounds writes and integer divide by zero | 0.37-11+deb9u1 (stretch), 0.37-14+deb10u1 (buster), 0.37-16+deb11u1 (bullseye) | stretch / buster / bullseye | ELA-1873-1 |
| cyrus-sasl2 | CVE-2026-107161 | Heap buffer overflow in the DIGEST-MD5 plugin | 2.1.27~101-g0780600+dfsg-3+deb9u3 (stretch), 2.1.27+dfsg-1+deb10u3 (buster), 2.1.27+dfsg-2.1+deb11u2 (bullseye) | stretch / buster / bullseye | ELA-1874-1 |
Fedora Linux
Fedora closed out late October with a pair of parallel security sweeps, one for Fedora 43 and one for Fedora 44, and the biggest story is Chromium. Both distros picked up version 156.0.8078.73, and that build bundles 52 security fixes. That number is almost more than you can read in the advisory, spanning memory corruption, use-after-free, and input-validation holes across V8, Skia, ANGLE, Media, and a dozen other pieces of the engine. The package's own summary still runs the old "a browser Google doesn't want you to use" joke, but with this many CVEs the browser probably wants you to install it.
Beyond the browser, the updates are mostly the kind of maintenance churn you don't think about until something breaks. A cluster of Rust ecosystem packages got rebuilt, largely in response to the rustls advisory set (RUSTSEC-2026-0346 through 0349), a faster-hex bump, and the eMudhra intermediate CA compromise. python-nh3 and rust-ammonia went in lockstep to ammonia 4.1.8, closing a MathML-based cross-site scripting hole. keepassxc moved to its 2.8.0 release and quietly dropped 32-bit builds, EPEL 8 support, and a pile of unused dependencies. knot-resolver, mutt, and Evolution all landed on new upstream or backported security fixes, the last of which plugs a local-file disclosure in calendar components. Nothing dramatic. Everything you actually want running stays patched.
| Package | New version | Fedora release | Advisory ID | What changed |
|---|---|---|---|---|
| chromium | 156.0.8078.73-1 | 43 and 44 | FEDORA-2026-5a48e58a5e / ...9418af6472 | 52 security fixes (memory corruption, use-after-free, input validation across V8, Skia, ANGLE, Media, and more) |
| keepassxc | 2.8.0-2 | 43 | FEDORA-2026-4d8f0cddef | 2.8.0 release; dropped 32-bit, EPEL 8, and several unused deps |
| mutt | 2.4.3-1 | 43 and 44 | ...02968c013c / ...d849fe6fa1 | Version bump; closes memory corruption via crafted Content-Type header (CVE-2026-107570) |
| rust-ammonia | 4.1.8-1 | 43 and 44 | FEDORA-2026-501e3b2abf / ...481989221d | Update to 4.1.8; fixes XSS via MathML namespace (CVE-2026-63430) |
| python-nh3 | 0.2.21-10 (43); 0.3.7-2 (44) | 43 and 44 | Same as rust-ammonia above | Rebuilt against ammonia 4.1.8 for three RUSTSEC advisories |
| rustup | 1.29.0-9 | 43 and 44 | FEDORA-2026-abaa7b5b1e / ...dabbed40d7 | Rebuilt with rustls 0.23.46 (fixes four RUSTSEC advisories) |
| rust-trustfall-rustdoc-adapter | 61.0.3-1 | 43 and 44 | FEDORA-2026-6b7650cc3c / ...8e6e09deb9 | Version bump; part of cargo-semver-checks rebuild chain |
| rust-trustfall-rustdoc-adapter60 | 60.0.3-2 | 43 and 44 | Same as above | Rebuild for rustls, faster-hex, and the eMudhra CA compromise |
| rust-trustfall-rustdoc-adapter57 | 57.1.3-2 | 43 and 44 | Same as above | Same rebuild as the adapter60 line |
| rust-cargo-semver-checks | 0.51.0-6 | 43 and 44 | Same as above | Rebuilt with updated deps for CVE-2026-111943 and the RUSTSEC set |
| knot-resolver | 5.7.9-1 | 44 | FEDORA-2026-0e1dcc3e9e | New upstream release with security fixes |
| evolution-data-server | 3.60.2-2 | 44 | FEDORA-2026-df461d043b | Backported fix for local file disclosure in calendar (CVE-2026-110777) |
| evolution | 3.60.2-3 | 44 | Same as evolution-data-server above | Same backported calendar fix |
Red Hat Enterprise Linux
Red Hat just pushed a fresh batch of errata out to RHEL customers, and if any of these touch your stack, the weekend patching is about to get interesting. Most of the advisories land on the Important side of the severity scale, with three rated Critical. The boilerplate is standard Red Hat, but a couple of specifics deserve a real look.
Start with the Critical set. python-pillow (RHSA-2026:93077) hits RHEL 8 as Critical, as does ipa (RHSA-2026:93071) against RHEL 7's Extended Lifecycle Support. Then there is Satellite 6.19 (RHSA-2026:92861), which carries a Critical headline even though its own body copy rates it Important. Read that entry yourself instead of trusting the subject line, since that mismatch is not something you can shrug off.
The rest is a pile of Important fixes, and .NET is where most of the volume sits. The runtime appears across versions 8.0, 9.0, 10.0, and 11.0, slotted into RHEL 8, 9, and 10 as separate advisories. If your apps run on it, that is the pile to clear. python-botocore follows a similar pattern, showing up four times as it rides through OpenStack Platform 13, 16.2, and 17.1, plus OpenStack Services on OpenShift 18.0.
Kernel work rounds things out, with kernel-rt for both RHEL 8 and RHEL 9.2 SAP, alongside a couple of plain kernel updates for RHEL 8 and a telecom-flavored RHEL 8.8 pairing. Utility packages fill in the gaps: mrtg, xdg-dbus-proxy, rsyslog, and bind9.18 all got security passes. Red Hat also released container images for Service Interconnect 2.2.4, which reads more like a version bump than a vulnerability fix, so treat it differently.
| Errata ID | Product | Target | Severity |
|---|---|---|---|
| RHSA-2026:93047 | kernel-rt | RHEL 9.2 (SAP) | Important |
| RHSA-2026:93045 | Red Hat OpenStack Platform 17.1 (python-botocore) | OpenStack 17.1 (Wallaby) | Important |
| RHSA-2026:93044 | Red Hat OpenStack Platform 16.2 (python-botocore) | OpenStack 16.2 (Train) | Important |
| RHSA-2026:93046 | OpenStack Services on OpenShift 18.0 (python-botocore) | RHOSO 18.0 (Antelope) | Important |
| RHSA-2026:93043 | Red Hat OpenStack Platform 13.0 (python-botocore) | OpenStack 13 (Queens) | Important |
| RHSA-2026:92492 | .NET 8.0 | RHEL 9 | Important |
| RHSA-2026:92428 | .NET 8.0 | RHEL 10 | Important |
| RHSA-2026:92420 | .NET 8.0 | RHEL 8 | Important |
| RHSA-2026:93071 | ipa | RHEL 7 ELS | Critical |
| RHSA-2026:93065 | Ansible Automation Platform 2.4 | AAP 2.4 | Important |
| RHSA-2026:92997 | kernel | RHEL 8.8 (SAP & Telecom) | Important |
| RHSA-2026:92993 | kernel | RHEL 9.2 (SAP) | Important |
| RHSA-2026:92432 | .NET 10.0 | RHEL 9 | Important |
| RHSA-2026:92429 | .NET 9.0 | RHEL 9 | Important |
| RHSA-2026:92511 | .NET 11.0 | RHEL 8 | Important |
| RHSA-2026:92861 | Satellite 6.19 | Satellite | Critical (headline) / Important (body) |
| RHSA-2026:92438 | .NET 10.0 | RHEL 10 | Important |
| RHSA-2026:92430 | .NET 9.0 | RHEL 10 | Important |
| RHSA-2026:92431 | .NET 10.0 | RHEL 8 | Important |
| RHSA-2026:92427 | .NET 9.0 | RHEL 8 | Important |
| RHSA-2026:92209 | kernel | RHEL 8 | Important |
| RHSA-2026:92208 | kernel-rt | RHEL 8 | Important |
| RHSA-2026:92071 | mrtg | RHEL 9.2 (SAP) | Important |
| RHSA-2026:91843 | mrtg | RHEL 8.8 (SAP & Telecom) | Important |
| RHSA-2026:91845 | mrtg | RHEL 8.4 (AMC & EUS) | Important |
| RHSA-2026:91624 | xdg-dbus-proxy | RHEL 9.2 (SAP) | Important |
| RHSA-2026:91626 | xdg-dbus-proxy | RHEL 10.0 EUS | Important |
| RHSA-2026:91582 | rsyslog | RHEL 8.6 (AMC & EUS) | Important |
| RHSA-2026:91342 | Red Hat Service Interconnect 2.2.4 (images) | OpenShift images | Important |
| RHSA-2026:93077 | python-pillow | RHEL 8 | Critical |
| RHSA-2026:93072 | bind9.18 | RHEL 9 | Important |
Rocky Linux
Rocky Linux has rolled out another batch of errata, and a handful of them are worth your attention if you run a supported release. The standout is a "Critical" rating on cjose, a thin C wrapper around the JOSE library, on Rocky Linux 9. Whether that badge reflects an actual fire drill or just an aggressive CVSS score is something you'd confirm against the CVE list. One update targets Rocky Linux 10, which is still a new release for the distro, so you likely aren't running much of it in production yet.
The rest is the usual churn. Firefox gets the security treatment across versions 8, 9, and 10. Curl is fixed twice, on 8 and 9, though it's worth you noticing that one is tagged "Important" while the other is only "Moderate." The .NET Foundation runtimes show up constantly, with 8.0, 9.0, 10.0, and even the new 11.0 appearing across the distro versions. Kernel updates also land, including the real-time and cloud SIG variants.
There's a data entry snag worth flagging. RLSA-2026:92209 shows up for both the Rocky Linux 8 kernel and the SIG Cloud 8 kernel, which reads more like a duplicated identifier than two genuinely separate advisories. You might want to verify that before you trust the paperwork.
| Advisory ID | Package | Severity | Rocky Linux Version | Details |
|---|---|---|---|---|
| RLSA-2026:92145 | cjose | Critical | 9 | Security |
| RLSA-2026:92368 | curl | Important | 8 | Security, bug fix, enhancement |
| RLSA-2026:92474 | python3.12-urllib3 | Important | 8 | Security |
| RLSA-2026:92639 | python-pillow | Important | 8 | Security |
| RLSA-2026:92616 | httpd:2.4 | Important | 8 | Security, bug fix, enhancement |
| RLSA-2026:92615 | aspell | Important | 8 | Security |
| RLSA-2026:92208 | kernel-rt | Important | 8 | Security, bug fix, enhancement |
| RLSA-2026:92511 | .NET 11.0 | Important | 8 | Security, bug fix, enhancement |
| RLSA-2026:92431 | .NET 10.0 | Important | 8 | Security, bug fix, enhancement |
| RLSA-2026:92420 | .NET 8.0 | Important | 8 | Security, bug fix, enhancement |
| RLSA-2026:92427 | .NET 9.0 | Important | 8 | Security, bug fix, enhancement |
| RLSA-2026:92209 | kernel | Important | 8 | Security, bug fix, enhancement |
| RLSA-2026:92869 | tomcat | Important | 8 | Security |
| RLSA-2026:89756 | firefox | Important | 8 | Security, bug fix, enhancement |
| RLSA-2026:82295 | hplip | Important | 8 | Security |
| RLSA-2026:92458 | aspell | Important | 9 | Security |
| RLSA-2026:91057 | libXrender | Important | 9 | Security |
| RLSA-2026:91365 | libX11 | Important | 9 | Security |
| RLSA-2026:90812 | cjose | Important | 9 | Security |
| RLSA-2026:92378 | nodejs:24 | Important | 9 | Security, bug fix, enhancement |
| RLSA-2026:91719 | ignition | Important | 9 | Security |
| RLSA-2026:91580 | webkit2gtk3 | Important | 9 | Security |
| RLSA-2026:91223 | libXtst | Important | 9 | Security |
| RLSA-2026:89757 | firefox | Important | 9 | Security, bug fix, enhancement |
| RLSA-2026:92432 | .NET 10.0 | Important | 9 | Security, bug fix, enhancement |
| RLSA-2026:92429 | .NET 9.0 | Important | 9 | Security, bug fix, enhancement |
| RLSA-2026:92492 | .NET 8.0 | Important | 9 | Security, bug fix, enhancement |
| RLSA-2026:92430 | .NET 9.0 | Important | 10 | Security, bug fix, enhancement |
| RLSA-2026:91366 | libX11 | Important | 10 | Security |
| RLSA-2026:92419 | bind | Important | 10 | Security |
| RLSA-2026:92408 | dogtag-pki | Important | 10 | Security |
| RLSA-2026:92438 | .NET 10.0 | Important | 10 | Security, bug fix, enhancement |
| RLSA-2026:92428 | .NET 8.0 | Important | 10 | Security, bug fix, enhancement |
| RLSA-2026:89758 | firefox | Important | 10 | Security, bug fix, enhancement |
| RXSA-2026:90365 | kernel | Important | SIG Cloud 9 | Security, bug fix, enhancement |
| RXSA-2026:92209 | kernel | Important | SIG Cloud 8 | Security, bug fix, enhancement |
| RLSA-2026:61241 | pipewire | Moderate | 10 | Security |
| RLSA-2026:91490 | ansible-collection-redhat-leapp | Moderate | 9 | Security |
| RLSA-2026:91056 | libXi | Moderate | 9 | Security |
| RLBA-2026:22541 | emacs | Moderate | 10 | Bug fix, enhancement |
| RLSA-2026:92907 | curl | Moderate | 9 | Security |
SUSE Linux
SUSE ran a pretty wide net this round, and the batch lands in late October 2026. The obvious headline is Chromium, which shows up twice: a moderate-rated update quietly bundling 353 CVEs, plus a separate important update for 52 more. Browser releases always look like this, with a pile of lower-severity fuzzing catches on top of each other, so the raw number is more interesting than it is scary. Then there are four genuine criticals worth prioritizing first: rsyslog, Django, roundcubemail, and perl-Dancer2-Plugin-Auth-Extensible.
A fair amount of the volume traces back to the same three packages. The golang.org/x/net HTTP/2 bugs reappear across coredns, cadvisor, kubevirt, and trivy (CVE-2026-78669 and CVE-2026-97032), while rustls-webpki turns up in shadowsocks and the AWS Nitro Enclaves CLI. Patch the Go web stack once and a handful of these disappear together.
SUSE clearly isn't letting the CVSS numbers call the shots. The 353-CVE Chromium update lands in "moderate," while Django's four vulnerabilities, which max out at 5.3, get critical. Most of the action targets openSUSE Leap 16.0, with a handful hitting Leap 15.x and SLES 15 SP6/SP7. Watch for overlap: python-CairoSVG, roundcubemail, and Chromium each got separate announcements for different product lines, so assume no single patch covers every system you run.
On the Tumbleweed GA-media side you get ten moderate fixes, headlined by a 25-vulnerability kernel-devel and a 21-vulnerability ImageMagick. Nothing here is a midnight alarm, though a package that size is exactly the kind of thing that quietly matters. The Python-Brotli fix is the one exception people should notice, since it carries a 9.2-rated remote code execution. rsyslog's advisory also drags along a roughly 400-line changelog that reads more like a development diary than a security note.
| Announcement | Package (version) | Rating | CVEs | Highlights | Platforms |
|---|---|---|---|---|---|
| openSUSE-SU-2026:12168-1 | putty (0.85-2.1) | moderate | 3 | 48850-48852 | Tumbleweed |
| openSUSE-SU-2026:12166-1 | percona-toolkit (3.7.1.4-1.1) | moderate | 10 | incl. CVE-2026-46595 (8.6) | Tumbleweed |
| openSUSE-SU-2026:12165-1 | kernel-devel (7.2.11-1.1) | moderate | 25 | CVE-2026-98385 through 98431 | Tumbleweed |
| openSUSE-SU-2026:12167-1 | pocketbase (0.40.5-1.1) | moderate | 3 | incl. CVE-2026-44166 | Tumbleweed |
| openSUSE-SU-2026:12169-1 | roundcubemail (1.6.19-1.1) | moderate | 16 | 54432/54433, 62641-62644, 74997-75010 | Tumbleweed |
| openSUSE-SU-2026:12164-1 | hugo (0.168.0-2.1) | moderate | 6 | 100347-100352 | Tumbleweed |
| openSUSE-SU-2026:12171-1 | ab-av1 (0.11.7-1.1) | moderate | 1 | CVE-2025-55159 | Tumbleweed |
| openSUSE-SU-2026:12170-1 | ImageMagick (7.1.2.34-1.1) | moderate | 21 | incl. CVE-2026-105081, 109964 | Tumbleweed |
| openSUSE-SU-2026:12163-1 | gh (2.102.0-1.1) | moderate | 7 | 63209, 84304, 84445 | Tumbleweed |
| openSUSE-SU-2026:12162-1 | crun (1.30.1-1.1) | moderate | 3 | 84042, 88264, 88265 (8.8) | Tumbleweed |
| SUSE-SU-2026:4948-1 | python-urllib3_1 (1.26.18) | important | 3 | 97687 (9.1), 97689 | Leap 15.6, SLES 15 SP6/SP7 |
| SUSE-SU-2026:4949-1 | python-CairoSVG (2.7.1) | important | 1 | CVE-2026-107378 (8.7) | Leap 15.4, SLES 15 SP4-SP7 |
| SUSE-SU-2026:4950-1 | suseconnect-ng (1.23.0) | important | 0 | rebuilt against Go security release | Leap 15.4, SLE Micro 5.3-5.4 |
| openSUSE-SU-2026:22202-1 | chromium (156.0.8078.73) | important | 52 (+1 bug) | use-after-free, memory corruption | Leap 16.0 |
| openSUSE-SU-2026:22207-1 | perl-Mozilla-CA (20261020) | important | 1 | CVE-2026-113812, emSign cert denied | Leap 16.0 |
| openSUSE-SU-2026:22204-1 | stgit (2.7.0) | important | 4 | 109349-109351, 91986 | Leap 16.0 |
| openSUSE-SU-2026:22203-1 | tailscale (1.104.1) | important | 1 | CVE-2026-33747 (8.4) | Leap 16.0 |
| openSUSE-SU-2026:22198-1 | vlc (3.0.24) | important | 1 | CVE-2026-56711 | Leap 16.0 |
| openSUSE-SU-2026:22201-1 | hauler (2.1.2) | important | 2 | 114437, 78669 | Leap 16.0 |
| openSUSE-SU-2026:22197-1 | gosec (2.30.0) | moderate | 1 | CVE-2026-97032 | Leap 16.0 |
| openSUSE-SU-2026:22200-1 | cadvisor (0.60.6) | important | 2 | 78669, 97032 | Leap 16.0 |
| openSUSE-SU-2026:22199-1 | epiphany (48.5) | important | 2 | 77679 (ZIP slip), 77682 (XSS) | Leap 16.0 |
| openSUSE-SU-2026:22195-1 | roundcubemail (1.6.20) | critical | 18 | incl. CVE-2026-113386 | Leap 16.0 |
| openSUSE-SU-2026:22196-1 | python-Django (5.2.4) | critical | 4 | 87890 (SSRF follow-up) | Leap 16.0 |
| openSUSE-SU-2026:22189-1 | shadowsocks-rust (1.25.0) / libev (3.3.6) | important | 6 | 25541, 93599-93602 | Leap 16.0 |
| openSUSE-SU-2026:22194-1 | coredns (1.15.0) | important | 2 | 78669, 97032 | Leap 16.0 |
| openSUSE-SU-2026:22190-1 | perl-Dancer2-Plugin-Auth-Extensible (0.714) | critical | 1 | CVE-2026-15689 | Leap 16.0 |
| openSUSE-SU-2026:22188-1 | python-pypdf (6.19.0) | moderate | 8 | 113786-113795 | Leap 16.0 |
| openSUSE-SU-2026:22192-1 | libmikmod (3.3.11.1) | important | 3 | 105837-105839 | Leap 16.0 |
| openSUSE-SU-2026:22183-1 | python-Brotli (1.2.1) | important | 2 | 111497 (9.2 RCE) | Leap 16.0 |
| openSUSE-SU-2026:22185-1 | chromium (156.0.8078.47) | moderate | 353 | (just the number) | Leap 16.0 |
| openSUSE-SU-2026:22187-1 | perl-Cpanel-JSON-XS (4.800) | important | 15 | 110672-110688 | Leap 16.0 |
| openSUSE-SU-2026:22181-1 | libsoup (3.6.6) | important | 14 | 102555-102560, 103399 | Leap 16.0 |
| openSUSE-SU-2026:22182-1 | python-CairoSVG (2.7.1) | important | 1 | CVE-2026-107378 | Leap 16.0 |
| openSUSE-SU-2026:22184-1 | rsyslog (8.2608.0) | critical | 4 | 92709 (9.8 RCE) | Leap 16.0 |
| openSUSE-SU-2026:22180-1 | kubevirt (1.9.1) | important | 6 | 13622 (container escape) | Leap 16.0 |
| openSUSE-SU-2026:22177-1 | expat (2.8.5) | important | 9 | 77214, 93990, 102633 | Leap 16.0 |
| openSUSE-SU-2026:22174-1 | gvfs (1.59.90) | important | 1 | CVE-2026-88924 (priv esc) | Leap 16.0 |
| openSUSE-SU-2026:22176-1 | ghostscript (10.08.0) | important | 2 | 101258, 103226 | Leap 16.0 |
| openSUSE-SU-2026:22178-1 | trivy (0.76.1) | important | 3 | 19585, 78669, 97032 | Leap 16.0 |
| openSUSE-SU-2026:22172-1 | ansible-core (2.18.3) | important | 1 | CVE-2026-89091 (8.8) | Leap 16.0 |
| openSUSE-SU-2026:22175-1 | aws-nitro-enclaves-cli (1.5.2) | important | 4 | 93599-93602 | Leap 16.0 |
| openSUSE-SU-2026:22170-1 | cifs-utils (7.4) | important | 1 | CVE-2026-104715 (mount injection) | Leap 16.0 |
| openSUSE-SU-2026:22169-1 | bouncycastle (1.86) | important | 14 | 17507-18040, 71885-71892 | Leap 16.0 |
Ubuntu Linux
Ubuntu is patching yet another flaw in Brotli, the lossless compression tool, and this time the fixes are landing only on its older LTS releases. The notice (USN-8956-2, dated October 27, 2026) closes out work that USN-8956-1 originally shipped in a more limited form. If you're still on Ubuntu 16.04, 18.04, or 20.04 LTS, you need to act.
The bug itself is that Brotli mishandled certain compressed streams. Feed it a crafted file and a remote attacker could potentially crash the process for a denial of service, or worse, run arbitrary code on your machine. Nothing brand new for a compression library, but the kind of hole you'd rather not leave open.
There's one wrinkle worth flagging before you bother: every single fix in this notice is tagged "Available with Ubuntu Pro." A bare apt upgrade may well ignore them. If your machine doesn't already have a Pro account attached, plan some time to wire that up.
| Release | Package | Version |
|---|---|---|
| Ubuntu 20.04 LTS | brotli | 1.0.7-6ubuntu0.1+esm1 |
| Ubuntu 20.04 LTS | libbrotli1 | 1.0.7-6ubuntu0.1+esm1 |
| Ubuntu 20.04 LTS | python3-brotli | 1.0.7-6ubuntu0.1+esm1 |
| Ubuntu 18.04 LTS | brotli | 1.0.3-1ubuntu1.3+esm1 |
| Ubuntu 18.04 LTS | libbrotli1 | 1.0.3-1ubuntu1.3+esm1 |
| Ubuntu 18.04 LTS | python-brotli | 1.0.3-1ubuntu1.3+esm1 |
| Ubuntu 18.04 LTS | python3-brotli | 1.0.3-1ubuntu1.3+esm1 |
| Ubuntu 16.04 LTS | brotli | 1.0.3-1ubuntu1~16.04.2+esm1 |
| Ubuntu 16.04 LTS | libbrotli1 | 1.0.3-1ubuntu1~16.04.2+esm1 |
| Ubuntu 16.04 LTS | python-brotli | 1.0.3-1ubuntu1~16.04.2+esm1 |
| Ubuntu 16.04 LTS | python3-brotli | 1.0.3-1ubuntu1~16.04.2+esm1 |
How to apply these Linux security updates
Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.
Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.
Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.
Debian/Ubuntu (apt)
The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.
sudo apt update sudo apt upgrade -y
Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)
On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.
sudo dnf check-update sudo dnf upgrade -y
or on older releases
sudo yum check-update sudo yum update
SUSE (zypper)
SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.
sudo zypper refresh sudo zypper update -y
