Eleven Linux distros shipped overlapping security patches today, and the same three stories repeat across nearly all of them. PHP's two arbitrary code execution flaws (CVE-2026-109618 and CVE-2026-109619) turned up on Arch, Debian, Fedora, Gentoo, RHEL, Rocky, Slackware, SUSE, and Ubuntu. A compromised eMudhra root CA forced distros to blacklist the emSign ECC Root CA and Comodo AAA entries, though patching only one of the affected stores leaves you half-protected. .NET claims the largest Critical ratings with patches for 8.0, 9.0, and 10.0, while Ubuntu's batch also sneaks in a .NET 11 release candidate inside a normal security update.

Eleven distros ship overlapping security patches today: PHP RCE, a compromised root CA, and .NET across the board

A daily sweep of Linux security updates where PHP, a broken root CA, and .NET turn up again and again.

Eleven distros shipped security fixes today. The bug lists overlap hard, which is actually good news. You don't have to chase eleven separate incidents. More like three.

PHP is the one that shows up everywhere. Two arbitrary code execution flaws (CVE-2026-109618 and CVE-2026-109619) turned up on Arch, Debian, Fedora, Gentoo, RHEL, Rocky, Slackware, SUSE, and Ubuntu.

Both let a remote attacker run code as whatever the PHP worker runs as, triggered by a carefully crafted HTTP request. No login. No special access. Just hit the target with the wrong bytes.

The two are cousins, not twins. The first trips when PHP runs out of memory mid-request and treats uninitialized RAM as if it were a valid value. The second means freed memory sticks around long enough to be reused by a later request. Either path ends at arbitrary code execution.

The fixes already existed upstream, which is why the version numbers jump so hard. Upgrade past php 8.5.12, php-legacy 8.3.36, php 8.4.27, or php 8.2.35 and you're done.

Arch went the extra mile, which is ironic. The workaround section reads like it was written for a siege: kill the memory limits, cap request sizes, and wrangle workers with cgroup limits against the OOM bug, plus disable session upload progress for the stale-state one. Still, the advisory is honest about all of it. None of this makes you safe, just a bit harder to hit, so read that far without updating first and you've got bigger problems.

The broken CA and why a half-fix leaves you exposed

The second thing that shows up across nearly every list is a broken certificate authority. eMudhra's intermediate certificates got compromised, and the distros are reacting by blacklisting two entries: the emSign ECC Root CA - G3 and Comodo AAA Services root.

Debian pulls both from ca-certificates and from Firefox. Ubuntu does the same across ca-certificates and nss. Fix only one and you're only half-protected, since the other still points right back at the bad roots.

Keep in mind the timing here. The CA fixes are still trickling into production. On Fedora the Rust webpki crates moved versions to close out the compromise, logged as CVE-2026-111943. On AlmaLinux the patched PHP packages only just hit production on 2026-10-21, so if you haven't re-run an upgrade since then, that's the immediate job.

For what it's worth, most Firefox users were already covered by OneCRL revocation. This mostly catches the folks who disabled RemoteSettings or can't reach the revocation service because of some network rule someone set up.

.NET, Xwayland, and the runtimes that won't stop showing up

.NET takes the biggest Critical ratings today. Five advisories cover 8.0, 9.0, and 10.0 across AlmaLinux, RHEL, and Rocky. Roughly 20 CVEs each, spanning remote code execution, privilege escalation, security-feature bypass, and on the 8.0 build an AD FS spoofing flaw. Anything shipped on these runtimes is worth a redeploy.

Here's the odd detail. Ubuntu's USN-8942-1 pulls in .NET 8.0.32, 10.0.13, and, for reasons that deserve a raised eyebrow, a .NET 11 at 11.0.0~rc2. That's a release candidate. Inside a security patch. .NET 10 turning up this early is already unusual, and a pre-final RC riding along is a whole different species of careless. Check whether those packages are actually installed before you lose any sleep.

Xwayland had a rough stretch too. AlmaLinux logged eight separate RCE-type flaws in one Important advisory: use-after-frees, double-frees, out-of-bounds writes, integer truncation. SUSE, RHEL, and Oracle are all carrying bulk Xwayland CVE batches as well, so if you're running any X server, a reboot is sitting on your calendar.

Other things worth a glance today. OpenSSH shows up in a surprising number of these batches, usually for the SFTP command-line parsing bypass. Unbound eats a whole page on Ubuntu's site with ten CVEs across TCP, DNSSEC, and QUIC. c-ares walked in with eleven DNS memory-corruption flaws on Slackware and another four on Ubuntu. Debian's nginx batch packs five CVEs, including a TLS ticket key gap that could let someone forge sessions or skip client-certificate checks.

On the quieter end, Oracle Linux ships PostgreSQL 18 on OL 9, mostly because pgvector gets patched against an out-of-bounds write that could let someone run arbitrary code.

And RHEL's batch fans out so far across SAP, telecom, and EUS streams that golang appears four times and PHP about half a dozen. That's by design. It means your actual workload depends entirely on which add-ons you subscribed to, so don't assume a single patch covers you.

So what now? The move is simple even if the list is long. Run the normal update commands, verify the version numbers I listed above, and treat the PHP, CA, and .NET fixes as the ones you do today rather than the ones you schedule for next patch cycle.

If you're on anything below PHP 7.4 or 5.5, read the Ubuntu Pro note. Those updates live behind the paid ESM line, so "just update" stops being the whole story once you step onto the extended-support side.

A Detailed Breakdown

Arch Linux

Arch Linux issued two critical advisories that amount to the same problem reported twice. Both php and php-legacy are affected by two arbitrary code execution bugs that let an anonymous remote attacker run code on the box with the privileges of the PHP worker. No special access needed, just carefully crafted HTTP requests.

The fixes already exist upstream, so the obvious fix is to upgrade. php goes to 8.5.12-1, and php-legacy to 8.3.36-1. Anything older is open.

Update schedules don't always cooperate, so Arch bothers to hand out workarounds, and the guidance is almost absurdly thorough for something meant to be temporary. Against the OOM corruption bug you're told to disable the memory limit outright, keep request sizes small, and corral workers with cgroup limits. Against the stale global state bug, disable session upload progress and, on PHP 8.5, disable fatal backtraces. The advisory is at least candid that none of this makes you actually safe, just marginally harder to hit.

Given how much configuration the "stopgap" section demands, anyone who read that far without running the update first probably has other problems.

AlmaLinux

AlmaLinux shipped a large batch of security errata. If you run anything below on this list, a patch is waiting.

.NET takes the biggest hit. Three separate advisories cover 8.0, 9.0, and 10.0, all rated Critical, and each one drags in a similar bag of roughly 20 CVEs spanning remote code execution, elevation of privilege, security-feature bypass, and (for the 8.0 build) an AD FS spoofing flaw. Anything shipped on these runtimes deserves a redeploy.

The kernel shows up twice (AlmaLinux 9 and 10) with a larger-than-usual fix count. The AlmaLinux 10 kernel alone carries 17 CVEs, mostly network-stack wear-and-tear: use-after-frees, races, and a couple for SMB clients. Worth the reboot on anything with a network card.

OpenSSH arrives with three issues, chief among them an SFTP security bypass tied to command-line argument parsing. If you lean on SFTP, close that gap first. Xwayland had a rough week, taking eight separate arbitrary-code-execution-style flaws (use-after-free, double-free, out-of-bounds writes, integer truncation) in one Important advisory.

openssl and Go round out the Important tier, and a handful of smaller packages (hostapd, fetchmail, librsvg2, lrzsz) keep the Moderate and Important columns occupied. The php2shell advisory deserves its own note: patched PHP packages only just reached production on 2026-10-21, so if you haven't re-run your upgrade, do it now. AlmaLinux spelled out the exact steps (dnf upgrade 'php*', then restart php-fpm, or httpd if you're still on mod_php on AlmaLinux 8).

Debian GNU/Linux

Debian's October 21 security batch follows the usual pattern across current stable and long-term-support releases, but two details are worth flagging before you run the upgrade. A pair of memory-state bugs is being fixed all the way down to PHP 7.0, an interpreter Debian hasn't supported in years, and a compromised certificate authority is being neutralized in both Firefox and your own system certificate store.

Git LFS ships a fix for a symlink handling flaw (CVE-2025-26625) that let a malicious repository write files anywhere outside your working tree, which can open the door to remote command execution. The patched version is out for Debian 12 bookworm.

The shared story this week is eMudhra. One of its intermediate CA certificates landed on the blacklist, and Debian is responding on two fronts. Firefox blocks the compromised cert (CVE-2026-113470), while ca-certificates actually strips it out along with the "emSign ECC Root CA - G3" and "Comodo AAA Services root" entries. Most Firefox users were already covered by the OneCRL revocation feature, so this mostly catches people who've disabled RemoteSettings or can't reach the revocation service because of network rules.

PHP gets hit repeatedly. Current stable 8.4 and bookworm's 8.2 both pick up the same two memory bugs (CVE-2026-109618, CVE-2026-109619), each potentially allowing arbitrary code execution. One trips up when PHP runs out of memory mid-request and then treats uninitialized data as valid; the other means freed memory can survive and get reused by a later request. Freexian's Extended LTS line carries the same fixes over to PHP 7.4, 7.3, and 7.0, since these flaws don't respect end-of-life dates.

Two packages make the strongest case for a quick reboot. nginx bundles five CVE fixes in one release, spanning buffer overflows, a mishandled HTTP/3 frame, a use-after-free, and a TLS ticket key sync gap that could let someone forge sessions or skip client-certificate checks. BIND 9 gets four vulnerabilities closed, ranging from denial of service to remote code execution. If you host either, treat these as top priority.

Fedora Linux

Fedora pushed a fairly long line of security advisories on October 21-22, and most of them landed on both Fedora 44 and Fedora 43. That double coverage just means you have more dnf upgrade commands to run, though the underlying fixes are identical either way.

The certificate stuff is the part worth paying attention to. Mozilla's CA bundle got reshuffled in ca-certificates, dropping emSign's Root CA C1 and adding a handful of code-signing roots. Around the same time the Rust webpki crates (rustls-webpki, webpki-roots, webpki-root-certs) all moved versions to close out the eMudhra intermediate CA compromise, listed as CVE-2026-111943. If your Rust projects do any real HTTPS, those are the ones to grab first.

PHP 8.5.12 shuts two remote code execution holes, one driven by memory corruption and the other by stale global state. The KDE file manager gets its own CVE-2026-110236 fix, which is a real deal since a crafted folder name could have triggered arbitrary command execution. The Estonian digital-signing tools both get patched: qdigidoc for arbitrary file overwrite through path traversal, libdigidocpp for signature forgery. nicotine+ takes a hit for a decompression-bomb denial of service, and perl's ExtUtils-Typemaps-Default eats two more DoS bugs. CairoSVG rounds out the batch on Fedora 43 with a crash tied to crafted SVG paths.

Then there's linux-firmware, which is just a bulk bump of driver firmware across AMD, Qualcomm, Intel, and various Wi-Fi cards. No CVE attached. You'll want it if a device is misbehaving, otherwise it can wait.

Gentoo Linux

Gentoo has put its own advisory on the same PHP holes. GLSA 202610-02 rates the findings High severity, with the worst case being remote code execution. The two CVEs listed are CVE-2026-109618 and CVE-2026-109619, which line up exactly with the RCE fixes shipped in the Fedora php-8.5.12 update, so if you already took care of the Fedora box you've basically seen this content twice.

Gentoo is not only worried about the newest PHP here. It lists all four current branches, so you have to check which one you run and match it to the right fixed release rather than assuming a single version covers you. No workaround exists beyond upgrading, which should come as no surprise for a hole this bad.

Oracle Linux

Oracle Linux just shipped a wide batch of advisories across its 8, 9, and 10 releases. If you run any of them, patching is the obvious move. The batch runs to 28 updates, and only one is a straight bug-fix and enhancement pass rather than a security fix. That's sg3_utils on OL 10, sitting low on the priority list since it only adds a manpage correction and a SCSI string tweak.

Everything else carries a security tag, with severity ranging from a single Critical down through several Moderate items. By count, that's 21 Important, 5 Moderate, 1 Critical, and 1 non-security advisory.

The lone Critical lands on webkit2gtk3 for Oracle Linux 8. It's a browser engine, so you only need to care if you render web content through it. The 11 CVEs packed into one package do justify the Critical rating, though.

The rest is fairly standard exploit material: buffer overflows and denial-of-service conditions, most of them living inside protocol dissectors. Wireshark carries the most, with eight CVEs spread across its dissectors, and openexr follows with five. bubblewrap is the one worth a second glance, since the same path-traversal fix (CVE-2026-87766) appears across all three OS releases.

A few details worth flagging. The ca-certificates entries (CVE-2026-111943 and CVE-2026-113470) show up identically on 8, 9, and 10 but really just blacklist two certs from eMudhra, so expect little drama. The urllib3 fixes land on both OL 9 and OL 10, and the OpenSSH update bundles three CVEs even though Oracle rated it only Moderate. PostgreSQL 18 on OL 9 is arguably the most useful change, mostly because it ships pgvector patched against an out-of-bounds write that could let someone run arbitrary code.

Red Hat Enterprise Linux

If you run any RHEL 8 or 9 box, this is the round you'll want to work through. Red Hat handed out roughly 45 security advisories in a single batch, and almost all of them score "Important." The raw CVSS points aren't spelled out in these blurbs, so you can't tell from the summary alone why one advisory gets the same grade as another, but the grading itself is the actionable part.

Two things in here also bundle more than just a security fix. The two OpenShift releases — 4.19.52 and 4.22.18 — and Ansible Automation Platform 2.6 all come with bug fixes and enhancements on top of the patches. If you're on any of those, you pick up the extra work for free. The rest are security-only, which is the norm.

A chunk of the updates fan out across several RHEL minor versions and support streams, and that's where the patching actually gets fiddly. golang appears four times, PHP about half a dozen times once you count every module and minor version, kernel gets five entries (including a real-time build), and librsvg2, sudo, pki-core, grafana-pcp, and go-toolset all get mirrored across SAP, telecommunications, and Extended Update Support streams. Red Hat does this by design, but it means your actual workload depends on which add-ons you subscribed to.

Only five advisories in the batch are Moderate: jackson-core, two fetchmail entries, and two cockpit-machines updates. Everything else is Important, and a lot of that Important rating points at things you run daily, so treat this as routine maintenance rather than a cleanup of the obscure packages.

Rocky Linux

Rocky Linux just pushed 31 errata across Rocky Linux 8, 9, and 10 in one sweep. You probably want to clear a spot on your patching list.

The main event is .NET. Five advisories cover it, three rated Critical, spanning .NET 8.0, 9.0, and even 10.0, which is a version most of this fleet won't recognize yet. Worth saying plainly: .NET 10 showing up this early is unusual, so you may want to check whether that package is actually installed on your box before you lose sleep. The advice holds anyway. Patch those three Criticals.

Everything else is steadier work. bubblewrap appears three times (RL 8, 9, and 10), all Important, joined by kernel and kernel-rt doing their standard security-plus-bugfix-plus-enhancement routine. The rest is a grab bag of things you rely on and occasionally forget about: librsvg2, golang, php (four entries: plain php, php8.4, and the php:8.2 and php:8.3 module bundles), openssh, hostapd, fetchmail, lrzsz, rust-sequoia-sq, glycin-loaders, and cockpit-machines.

Severity splits 5 Critical, 19 Important, and 7 Moderate. The Moderate batch won't break your build. hostapd and openssh are the ones worth a real glance, and openssh landing at "moderate" feels a little generous, but Moderate is a distro call, not your call, so treat the label as a floor rather than a ceiling.

Slackware Linux

Slackware's security team rolled out six package updates for 15.0 and -current, and if you map them out you'll see they're mostly one story told three ways. The common thread is trust: python-certifi and ca-certificates both refresh the CA certificate store, and Firefox plus Thunderbird get rebuilt specifically so they actually pick up those fresh root certs. The rest are more conventional.

The two certificate packages are plain version bumps with little fanfare. Nothing screams from them, and that's kind of the point. They're the plumbing, and you usually only think about plumbing when it stops working. python-certifi lands at 2026.10.19 and ca-certificates at 20261020. If you verify SSL connections from Python or a browser, both are worth installing.

Firefox and Thunderbird got rebuilt rather than upgraded here. The 15.0 builds are the 140.17.0esr line and -current is on 153.5.1esr, but the change itself is just a rebuild against the system libraries so the new CA certificates show up. You're not getting new browser features, just a browser that trusts the right servers.

c-ares is where this batch gets loud. It's the DNS resolution library, and it walked in with 11 security advisories covering memory corruption, a pile of use-after-free flaws, a buffer overflow, uninitialized IPv6 memory, and a particularly grubby trick where a DNS reply from a server you never queried gets accepted. For a library whose entire job is handing back answers, trusting the wrong one is career-ending. It's now at 1.34.9.

PHP is the one update that wants you to actually do something after upgrading. It plugs a critical remote code execution bug (state corruption via bailout) that reaches back across 7.4.33, 8.0.30, 8.1.34, and 8.2.35. The advisory is identical across all four, which makes sense: it's the same interpreter, just different release trains. After you install, you have to restart Apache, and Slackware spells that out in the install block. Don't skip it, and if you're still on 7.4 for some stubborn reason, at least you know this covers you.

All six are on the Slackware FTP mirror for both 32-bit and 64-bit, you'll need root and upgradepkg, and MD5 sums are provided for every build so you can sanity-check before you install.

SUSE Linux

SUSE pushed a large pile of security fixes into the wild this week, and the tallies alone will make you want to schedule a maintenance window. The headline numbers come from two Firefox releases. SUSE's update (4834) rides across SLE 15 SP4 through SP7, while the openSUSE roll-out (22139) targets Leap 16.0, and both carry the full 85-vulnerability Firefox ESR 153.5.0 package plus a libexpat refresh. Chrome shows up twice as well: the Tumbleweed chromedriver GA-media fix (12091) bundles an awkward 246 CVEs, and the backported chromium jump to 155.0.8059.84 (0352) covers ten.

The individual holes are more interesting than the sums. php8 arrives with two 9.2-rated flaws that SUSE directly ties to remote code execution. cifs-utils closes a credential-file parsing path that lets injection slip mount options past the filter. cyrus-sasl appears three times across the SP4, SP5, and SP6 families with the same 7.5-rated heap overflow in add_to_challenge(), which lets a malicious server crash or take over DIGEST-MD5 clients. bind takes the brunt among name servers, ten CVEs including one that applies an unauthenticated IXFR delta before TSIG verification, and ImageMagick quietly collects 37, which is a surprising number of ways to die while opening a picture.

There is a cluster of kernel live patches, so you can fix these without a reboot. SP5 receives Live Patches 43 and 44, while SP6 gets 17, 22, and 23, all clearing the same five kernel CVEs. CVE-2026-63795 lands a perfect 10.0 from NVD, so that 9p one is worth your attention.

A few updates are rebuilds rather than new logic. buildah and rootlesskit simply recompile against the current Go security release, and a string of "GA media" notes for Tumbleweed (bouncycastle with 14 CVEs, libsoup with 10, Django 4 with four, plus one-offs like qemu, gimp, git-bug, and python310) clean out holes already shipped on install media. Full breakdown follows.

Ubuntu Linux

Ubuntu's security team has stacked up another batch of advisories, and this one reaches further than you'd assume. Thirteen USNs landed between October 19 and 21, 2026, spanning everything from the .NET runtime to a DNS resolver most people have never configured.

PHP is hit twice this round. USN-8948-1 covers the modern branches (8.1, 8.3, 8.5) with fixes for an out-of-memory bug that let a remote attacker run arbitrary code, and a worker-reuse state bug doing the same. USN-8948-2 ships the identical patch to versions 7.4 down to 5.5.9. That last number is a genuine eye-row: 5.5.9 is old enough to predate "PHP: Hypertext Preprocessor." These sit behind Ubuntu Pro on 14.04 through 20.04, so "just update" stops being the whole story once you step onto the ESM side.

Two notices describe the same underlying problem, just filed in separate envelopes. The emSign ECC Root CA-G3 and Comodo AAA Services roots had compromised intermediates, so Ubuntu stripped them from both ca-certificates (USN-8944-2, reaching back to 14.04) and nss (USN-8947-1). Fixing only one leaves you half-protected, since the other still points at the bad roots.

Unbound eats the most room on the page, with ten CVEs spread across TCP handling, DNSSEC, DNSCrypt, QUIC, and EDNS. Denial-of-service is the dominant threat, though a cache-poisoning hole is in the mix too. U-Boot, libsoup3, and c-ares cover the rest of the network-facing surface, and U-Boot and libsoup are follow-up notices for 26.10 only, marked by the "-2" in their advisory numbers.

A couple of details are worth a skeptical squint. The .NET update ships .NET 11 at 11.0.0~rc2, a release candidate, inside what is nominally a security patch. One Ghostscript issue carries no CVE number at all. Minor sloppiness, but it is the kind of thing that slips through.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Arch Linux (pacman)

Arch Linux relies on pacman as its package manager and follows a rolling-release model, so there are no major version milestones to upgrade to; just a steady stream of continuous updates that keep the system current. Before upgrading, refresh the local package database with sudo pacman -Sy; the -y flag forces a sync with the configured mirrors so pacman can see the latest available versions. Running the sync and upgrade as two separate steps is generally safer than combining them, because a single sudo pacman -Syu command can occasionally upgrade core packages before the database fully updates, which may leave the system in an inconsistent state.

sudo pacman -Sy 
sudo pacman -Su

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world