Today's Linux security roundups show the same flaws spreading across nearly every major distribution, from nginx and Mozilla to .NET. RHEL leads the chaos with 48 advisories, 40 rated Important, while its gstreamer, corosync, and kernel updates demand priority and a reboot. Fedora's smaller batch bites sharpest, with a patched open62541 library carrying 17 CVEs including arbitrary code execution. Ubuntu, Rocky, SUSE, Slackware, and AlmaLinux round out the day with everything from TLS holes to a 21-vulnerability registry patch, so update in order of severity rather than convenience.

Today's Linux security roundups reveal the same flaws bleeding across every major distro

From nginx to Mozilla to .NET, today's updates touched RHEL, Fedora, Debian, Ubuntu, Rocky, AlmaLinux, SUSE, and Slackware. Most of the fixes are routine. A handful you should patch before you clock out Friday.

A fresh wave of security updates landed across just about every Linux distribution today, spread across everything from Red Hat to Slackware. Most of them are the usual housekeeping. But read across the bulletins and a few of the same vulnerabilities keep showing up, which is a bit of a warning sign on its own.

If you patch in one place and assume the rest are covered, think again. The pattern cuts cleanly across distros.

The recurring nightmares

Let's start with nginx. CVE-2026-42533, the arbitrary code-execution hole in the 1.26 line reachable through crafted HTTP requests, shows up in both AlmaLinux and Debian. Fine so far. But there's the Debian version, and it's the kind of thing that makes sysadmins grumble.

Debian's DSA 6496-2 isn't squashing a new flaw at all. The previous update, 6496-1, shipped a broken backport: it named two private header files as build dependencies that nginx-dev doesn't actually ship, locking out anyone compiling third-party modules. So 6496-2 just repairs the build, in 1.26.3-3+deb13u9. That's a regression on top of a flaw. Not ideal.

The Mozilla fixes run a similar script. Firefox got hit with a clean run of 28, CVE-2026-92005 through CVE-2026-92032. Thunderbird took that same pile and stacked three extra on top, landing at 31. Those numbers show up in both Debian and Slackware, the latter reaching 140.16.0esr on 15.0 while -current jumps ahead to 153.3.0esr. Apply with upgradepkg as root.

.NET is the third guest, crashing just about every table. It lands in AlmaLinux, RHEL, and Rocky, across versions 8.0, 9.0, and 10.0 depending on your release.

Where the real decisions are

If you run RHEL, this is the roundup that'll eat your Friday. Red Hat pushed 48 advisories this round, 40 rated Important and 8 Moderate. Schedule the Important ones first. The Moderate handful is worth deprioritizing, not ignoring.

gstreamer does the most heavy lifting, with its base, bad-free, and ugly-free sub-packages each carrying Important fixes across RHEL 8, 9, and 10, including the SAP and Extended Update Support tracks. If your stack touches media processing or streaming pipelines, these go at the top of the queue.

corosync isn't far behind, collecting five separate advisories across RHEL 9 and 10. That's a lot of cluster-management hits for a single package. None are Critical, so treat them as urgent housekeeping rather than a midnight wake-up call.

kernel picks up four entries too. Budget time for a reboot.

Here's where the application-level stuff gets interesting. OpenShift 4.19.47 bundles bug fixes and security work together, Keycloak gets two version refreshes split between packages and container images, and Postgres on RHEL 9 gets a postgresql:18 fix. Confirm which RHEL version and support profile you actually run before assuming the whole list applies to your fleet. That matters more than you'd expect, since most of these are scoped to particular releases.

Fedora's batch is smaller but sharper. open62541, the OPC UA library, got patched to 1.5.8 on both Fedora 43 and 44, and its changelog carries 17 CVEs. Those range from routine denial-of-service to the ones that make you sit up: a use-after-free in TransferSubscriptions handing you arbitrary code execution, a heap-based buffer overflow giving local code execution to anyone who just talks to the library, and an integer overflow writing past the end of a buffer.

If you build OPC UA clients or servers in C or C++, this one's the priority.

RoundCube is the other big fix. Fedora 43 lands on 1.6.19 while 44 skips ahead to 1.7.4, but both carry the same pile of security work: header injection, stored and reflected XSS, SSRF through the CSS proxy, and remote-content blocker bypasses. It reads like a CFT practice exam, but it's enough on its own to justify the install.

Django 6.1.1 comes to Fedora 44, folding in fixes from the 6.0.6 through 6.0.8 releases. Plus it got reworked to compile with Python 3.15, so there's a build fix tucked in with the security patching.

The rest of the board

Ubuntu's round includes python-cryptography (USN-8776-1), which you'll actually act on. Four issues split across two releases, with 26.04 picking up a PKCS#7 timing side-channel that could hand an attacker the encryption key, a wildcard DNS hole in CA certificate validation, and a denial-of-service from duplicate certificates in a chain. The rest land on 18.04.

Be aware that half these fixes sit behind Ubuntu Pro for the older LTS releases. "Standard system update" is generous language for 18.04 or 14.04 without Pro. Some CVEs also shipped only to older codenames while newer releases dodged them entirely, which is just how these patches tend to land.

Perl (USN-8736-2) is a follow-up closing two regex holes on 24.04: heap overruns on large inputs and a branch-handling bug that could slip past pattern-matching security checks. Valkey, the Redis fork, pulled three CVEs covering broken TLS handling, a RESTORE stream payload issue (authenticated only), and cluster slot migration. Two are denial-of-service. The TLS one opens the code-execution door.

Guix rounds it out with a privilege-escalation bug on 22.04 and 24.04 that specifically wants you to restart guix-daemon after patching.

Rounding out today's roundups, Rocky Linux leaned on kernel and .NET, with 12 of its 16 advisories rated Important and the real-time kernel variant earning its own Important advisory. SUSE went for a registry patch that resolves 21 vulnerabilities in the upstream distribution plus an openvt privilege-escalation bug in kbd. Slackware stuck to the Mozilla sweep, and AlmaLinux's day was dominated by a double-hit .NET disclosure-and-privilege flaw alongside an Important tesseract heap out-of-bounds write on version 8.

If you're keeping score, the practical move is the same one every day: run your updates, but do it in order of severity rather than convenience. The Important ones don't wait.

A Detailed Overview of the Updates

AlmaLinux

Ten AlmaLinux errata landed on a single day, and .NET is the one you should patch before anything else. It took a double hit: an information disclosure hole (CVE-2026-58649) that reaches across the whole 8.0 through 10.0 line, plus an elevation-of-privilege flaw (CVE-2026-69806) that only bites 9.0 and 10.0. The whole .NET story splits into six advisaries on its own. The 8.0 versions read as moderate, so they're lower on your list.

rsyslog got pinged twice for the same crash bug (CVE-2026-19654) in its optional imptcp input, letting an unauthenticated remote peer bring the daemon to its knees. Its own grading puts AL9 at Low and AL10 at Moderate for what's essentially the same issue, a quirk worth a raised eyebrow.

The rest are one-offs. firewalld picks up a moderate advisory (CVE-2026-4948) because a local unprivileged user can flip firewall state through a D-Bus setter that never bothered to check who was knocking. nginx:1.26 gets a moderate hit for arbitrary code execution through crafted HTTP requests (CVE-2026-42533), and tesseract, the OCR engine, takes the single Important on AlmaLinux 8, opening via a heap out-of-bounds write through a trained .traineddata file (CVE-2026-73066).

Debian GNU/Linux

Another sweep of Debian security advisories came out, and if you run any of these packages, you'll want to patch. Most target trixie (the current stable), with one freexian LTS carryover covering older Debian releases.

The nginx entry is the funny one, and not in a good way. DSA 6496-2 isn't squashing a new flaw. The previous update (6496-1) shipped a broken fix: the backported patch for CVE-2026-42533 named two private header files as build dependencies that nginx-dev doesn't actually ship, so anyone compiling third-party modules against it was locked out. This advisory just repairs the build, in 1.26.3-3+deb13u9.

The rest are the usual suspects. Thunderbird takes the heaviest beating with 31 CVEs, enough to execute arbitrary code, and firefox-esr carries 28 overlapping ones that also cover information disclosure and privilege escalation. Tor gets the light treatment, denial of service only, though its CVE has no identifier yet, which is a little strange for something worth upgrading. mkvtoolnix has a buffer overflow in its ODML parser that could let arbitrary code run on malformed .mkv files. Freexian's jbig2dec advisory, aimed at stretch, buster, and bullseye, closes a denial-of-service hole from missing input sanitizing in the JBIG2 decoder.

Fedora Linux

Fedora shipped a batch of security updates across Fedora 43 and 44 on September 17, covering six packages. Most of them plug holes someone could actually use against you, so it's worth a look before you forget to run updates again.

The open62541 OPC UA library is the obvious headline. Fedora patched it to 1.5.8 on both releases, and the changelog carries 17 CVEs. Those range from ordinary denial-of-service issues to the ones that make you sit up: arbitrary code execution through a use-after-free in the TransferSubscriptions service, a heap-based buffer overflow handing local code execution to anyone who just talks to the library, and an integer overflow that writes past the end of a buffer. If you build OPC UA clients or servers in C or C++, this one's the priority.

RoundCube is the other big fix. Fedora 43 lands on 1.6.19 while 44 skips ahead to 1.7.4, but both carry the same pile of security work. You're getting the standard webmail hit parade: header injection, stored and reflected XSS, SSRF via the CSS proxy, and remote-content blocker bypasses through SVG and CSS escapes. The whole list reads like a CFT practice exam, but it's enough on its own to justify the install.

Django 6.1.1 comes to Fedora 44, folding in CVE fixes rolled up from the 6.0.6 through 6.0.8 releases. That includes a denial-of-service from deeply nested geometry collections, a server-side file-write and request forgery via spatial lookups, cookie exposure issues, and a couple of header injection bugs. It also got reworked just to compile with Python 3.15, so there's a build fix tucked in with the security patching.

The rest are smaller. The MongoDB PHP driver (php-pecl-mongodb2) hits 2.1.9 on both releases for an out-of-bounds read in BSON decoding that leaks memory. And python-jwcrypto reaches 1.6.0 on Fedora 44 for what Fedora calls low severity fixes. "Low severity" doesn't mean skip it, but it sits at the bottom of the pile regardless.

Everything installs the usual way with dnf and is GPG-signed, which is the baseline you'd expect anyway.

Red Hat Enterprise Linux

Red Hat pushed out another batch of errata for RHEL, and if you run anything production-grade you'll probably want to patch before clocking out Friday. There are 48 advisories in this round, 40 tagged Important and 8 rated Moderate. The Important ones are the ones to schedule first; the Moderate handful isn't worth ignoring, just worth deprioritizing.

gstreamer does the most heavy lifting here. Its three sub-packages, base, bad-free, and ugly-free, each pick up Important security fixes spread across RHEL 8, 9, and 10, including the SAP and Extended Update Support tracks. If your stack touches any media processing or streaming pipelines, these updates land squarely in your queue.

corosync isn't far behind, collecting five separate advisories across RHEL 9 and 10, SAP variants included. That's a lot of cluster-management hits for one package. None are Critical, so treat them as urgent housekeeping rather than a midnight wake-up call. kernel picks up four entries as well, spanning security-only bumps and full security-plus-bugfix-plus-enhancement releases for RHEL 8.6, 9.2, 9.4, and 9.6. Budget time for a reboot.

The Moderate items worth a glance are coreutils, unbound, libsoup, and .NET 8.0. coreutils specifically is the kind of package you don't casually shrug at, though Red Hat only rated this one Moderate, which usually means the exploitable surface is narrower than the package name implies.

The application-level updates carry the most real-world decisions. OpenShift 4.19.47 bundles both bug fixes and security work, Keycloak gets two version refreshes (26.4.16 and 26.6.7) split between packages and container images, and Edge Manager lands new 1.1.4 and 1.2.1 builds. Postgres users on RHEL 9 get a postgresql:18 fix, Cryostat gets one on RHEL 9, and both .NET 8.0 and .NET 9.0 see releases. microcode_ctl and opentelemetry-collector cover firmware and observability respectively.

Most of these are scoped to particular RHEL versions and support profiles, so confirm which version and profile you actually run before assuming the whole list applies to your fleet.

Rocky Linux

Rocky Linux has published a fresh batch of security advisories, and if you run any recent version you probably owe yourself a system update. The batch spans kernel, .NET, PostgreSQL, Grafana, and a couple of other everyday packages across RL8, RL9, and RL10.

Kernel packages carry the weight. The real-time variant earns its own Important advisory, and the standard kernel sits in the same bucket on RL8 and RL9, so shops running the -rt build shouldn't skip it.

.NET gets nearly as much attention as the kernel, with 8.0, 9.0, and 10.0 each getting fixes depending on your release. PostgreSQL 18 and its assorted modules show up too, alongside Grafana, rsyslog, and leapp-repository for upgrade tasks.

Severity-wise most of the batch sits in the Important category, 12 of the 16 advisories, typically the kind of flaw you'd rather not leave open. Only one drops to Low (a rsyslog bump on RL9) and three land in the Moderate range. Don't ignore the Moderate .NET 8.0 patches on RL9 and RL10, though they likely won't keep you up at night.

A few packages get patched more than once across releases. Grafana shows up on both RL8 and RL9, and .NET 10.0 appears on RL9 and RL10, so check your release numbers before you assume you're covered.

Slackware Linux

Slackware's security team delivered its usual semi-routine Mozilla patch this week, and it wasn't shy with the CVE list. Firefox covers CVE-2026-92005 through CVE-2026-92032, a clean run of 28. Thunderbird takes that same pile and stacks three extra ones on top (92238, 92239, 92240), landing at 31.

Both reach 140.16.0esr on Slackware 15.0, while -current skips ahead to 153.3.0esr. You can apply it with upgradepkg as root. Nothing flashy, but it's the kind of refresh you want in place before someone opens an email they shouldn't have.

SUSE Linux

SUSE shipped a round of security updates, hitting both openSUSE Tumbleweed and its Enterprise line. You're looking at everything from a single low-severity color-management fix to a registry patch that quietly resolves 21 vulnerabilities, so there is enough here to cover just about any setup.

The clamav update is the one to open first. Nine problems got folded into version 1.5.4, mostly scan-parser classics: heap overflows, an integer underflow in the PDF path, and a path-traversal hole in the OneNote handler. If you scan email or archives, this one earns its spot on your list.

distribution took the biggest hit. It is the upstream Docker registry, and SUSE bundled 21 CVEs into a jump to 3.1.1, plus two feature additions and a wall of dependency bumps on top. The loud ones are an HTTP/2 :path header bypass, a Go gRPC authorization hole, and a spread of ssh-module issues. Running your own container registry means this one is non-negotiable.

Then there is kbd, which earns an "important" rating because CVE-2026-72693 in openvt lets a local user climb to root through a missing process-owner check. That is exactly the kind of hole you would rather not leave unpatched.

corosync arrives with two problems: a heap buffer overflow during fragmented message reassembly and an integer overflow that skips length validation on 32-bit systems. Cluster admins, this one is for you.

openvpn finishes the important batch with a remote-authenticated misidentification bug and a crafted-ACK denial of service.

The Tumbleweed side is the quiet neighbor. mistral-vibe and the two Kubernetes APIs (1.34 and 1.35) both land as moderate fixes, and the liblzmasdk26 compression SDK takes a single moderate patch. Nothing screams, but it stays basic maintenance hygiene. lcms2 is the sole low-severity entry, a minimal-rank change to slip into your next normal maintenance window.

Here is how the whole batch breaks down.

Ubuntu Linux

A fresh batch of Ubuntu Security Notices rolled out, spanning everything from "patch next weekend" to "reboot now."

The one most people will actually act on is python-cryptography (USN-8776-1). Four issues are packed across two releases. Ubuntu 18.04 picks up a cipher quirk where immutable buffers return corrupted output. The rest land on 26.04 and include a PKCS#7 timing side-channel that could hand an attacker the encryption key, a wildcard DNS hole in CA certificate validation, and a denial-of-service from duplicate certificates in a chain. That last trio is the kind that makes a security team stop what they're doing.

Perl (USN-8736-2) deserves a first look too. It is the follow-up to an earlier advisory, closing two regex holes on 24.04: heap overruns on large inputs (the usual DoS or worse) and a branch-handling bug that could slip past security checks leaning on pattern matching.

Valkey, the Redis fork, pulled three CVEs. Broken TLS handling under certain conditions, a RESTORE command stream payload issue (authenticated only, so you need to be past the gate first), and cluster slot migration. Two are denial-of-service only; the TLS one opens the code-execution door.

AOM (USN-8772-1), the AV1 codec library, gets heap overflow fixes in its look-ahead processing and SVC encoder validation. A crash is annoying; an attacker writing to arbitrary memory is a different call entirely. It covers 26.04, 24.04, and 22.04.

The quieter batch follows. libheif (USN-8774-1) malfunctions on certain images and image sequences on 26.04 only. OpenSSH (USN-8514-2) is the delayed follow-up that finally extends the scp file-permission fix to 14.04, 18.04, and 20.04, going back to when a root scp could drop setuid files and quietly hand someone the keys to the machine. Guix (USN-8773-1) let local users glimpse build outputs before they were finalized, a privilege-escalation bug on 22.04 and 24.04 that specifically wants you to restart guix-daemon after patching.

Two patterns matter as you plan the rollouts. Half these fixes sit behind Ubuntu Pro for the older LTS releases, so "standard system update" is generous language for 18.04, 20.04, and 14.04 without Pro. Some CVEs also only shipped to older codenames while newer releases dodged them entirely, which is just how these patches tend to land.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y