Red Hat pushed past 230 errata across RHEL 7 through 10 today, with ten Critical advisories driving OpenShift, Ansible Automation Platform, and freerdp updates while the rest of the Important pile stays dominated by Java and .NET. Ubuntu's biggest single move was USN-9046-1, folding 73 CVEs into a MySQL update that shipped full upstream releases to 26.10 and 26.04 LTS but backported only security fixes to 24.04 and 22.04 LTS. Debian, Fedora, and Gentoo led their rounds with ImageMagick absorbing dozens of CVEs, Firefox 160.0 landing on Fedora 44 and 45, and curl carrying an absurd 71 CVEs on Gentoo. If you're triaging on a tight budget, patch the RHEL Critical set, Ubuntu's MySQL, Gentoo's curl, and SUSE's critical Pillow fix first, since SUSE alone shipped 34 CVEs in a single Pillow advisory.

Red Hat ships 230 advisories today as Ubuntu clears a massive MySQL round

MySQL, ImageMagick, curl, and libsoup3 headline a patch-heavy day across the major Linux distros.

It's a busy day for security updates, and not in a pleasant way for anyone with a maintenance window to spare. Red Hat pushed past 230 errata across RHEL 7 through 10. Ubuntu folded 73 CVEs into a single MySQL notice. Gentoo bolted 71 CVEs onto one curl bump. Debian, Fedora, SUSE, Oracle, Rocky, and Slackware all dropped their own batches on top.

Let's cut through the noise and figure out what you should actually patch today.

What needs patching right now

Ten RHEL advisories landed as Critical, and those are the ones that move. OpenShift 4.15.71, Ansible Automation Platform 2.4, 2.5, and 2.6 all went out together, alongside fence-agents, webkit2gtk3, freerdp on RHEL 10, cockpit-image-builder, and two OpenJDK 8u512 builds. If any of it runs in your estate, patch it today. The rest can wait.

Java is eating a surprising chunk of the Important pile. java-1.8.0-openjdk covers RHEL 7, 8, and 9 on top of that separate 8u512 pair, and .NET spans from 8.0 all the way to 11.0. freerdp does the same dance, sitting in Important on RHEL 9 but Critical on RHEL 10.

Here's a filing quirk worth knowing. Kernel, nginx, gstreamer1, grafana, and several perl modules reissue across nearly every version, then get duplicated onto the extended support variants. You'll also spot four separate advisories for a single JBoss 7.4.26 version, with OpenShift 4.15.71 showing up twice, once Critical and once Important. Same fixes. You just match a version number to your inventory instead of hunting.

The biggest holes today

Debian's batch is dominated by ImageMagick, absorbing a long tail of CVEs that runs from CVE-2020-25664 and CVE-2020-27752 through roughly 33 more CVE-2026 entries. It's the usual story: that software still turns a harmless image into a remote-code-execution vector. The fixes backport from bullseye into buster, and the vendor insists your apps won't break. One snag stands out. The verbose output of identify now carries an extra field, so any script mangling that human-readable output will start choking. Switch to the -format option for machine-readable output.

Octavia pulls in three CVEs that reach the nastier end of the spectrum, handing out RCE and authorization bypass. SPIP closes an unauthenticated RCE. Both are the flavor of news you'd rather not wake up inside.

Fedora's most visible update is Firefox 160.0, landing on 44 and 45. The packages worth your attention are libsoup3 and Pillow. libsoup3 eats a dozen CVEs: heap overflows in the WebSocket path, an HTTP/2 crash, and a digest-authentication replay that walks someone past login. Pillow packs four of its own, including a Ghostscript argument injection that can become RCE.

Gentoo rolled four advisories between November 11 and 12, all at High severity with the standard worst-case verdict of arbitrary code execution. curl is the headline, with an absurd 71 CVEs bolted onto one advisory and no workaround. It's a lot of vulnerabilities for a version bump, but curl ships small and the fix is a clean upgrade, so this is more annoying than dangerous. libpcre2 is the one advisory with actual advice: don't feed it attacker-controlled regex. ImageMagick and libheif each carry a wall of GHSA references, 61 and 84 respectively, with no workarounds either.

Oracle Linux pushed five advisories. The most involved is Node.js 22 on Linux 9, jumping to 22.23.2 with a long tail of CVEs and dependency bumps. The vim fix is more pointed, a Vimscript injection in netrw that triggers when an unescaped filename gets filtered through s:NetrwMarkFile(). It's the sort of thing that bites when you're just trying to sort a directory listing.

SUSE's most critical entry is Pillow, the only critical fix in the pile, covering 34 separate vulnerabilities including some that allow RCE. If you render images from sources you don't fully trust, apply this first. openssl-1_1 shows up more than you'd think, but that's mostly SUSE carrying the same five-CVE fix across several service packs. Still worth doing if you're stuck on the 1.1 branch, which is on its way out regardless.

Rocky Linux is clearing its queue with 19 advisories across Linux 9. runc, bubblewrap, and the nodejs:26 updates sit at the top given what they run under. The honest part: each advisory reads like it came off the same template. You get the severity rating and a link to the errata page, and the specifics live over there, not in the summary. Treat the tags as a quick filter and open the full advisory if you want the real CVE detail.

Slackware rounded things out with httpd, tigervnc, and git for both 15.0 and -current. The httpd update pushes Apache to 2.4.71 and closes three holes, headlined by a heap corruption and RCE in assign_headers. That's the kind of thing that shouldn't exist in November 2026. Git moves to 2.50.2 on 15.0 and 2.56.1 on -current, and the changelog carries a notably blunt aside: "It's probably time to bump this to a version that has security support."

Ubuntu finished the round with MySQL, and it came in big. USN-9046-1, dated November 11, closes 73 CVEs across MySQL 8.0, 8.4, and 9.7. You probably won't read 73 CVE descriptions, and you don't need to. The pattern is the same as last time: heap overflows, out-of-bounds reads, privilege escapes, and the assorted ways to make the server crash or leak data.

The newer lines get full upstream releases. Ubuntu 26.10 jumped to MySQL 9.7.4, and 26.04 LTS went to 8.4.13. The LTS lines took a different route, with 24.04 and 22.04 getting backported patches to 8.0.46. Keep in mind that Ubuntu warns these backports can carry unexpected features, so don't treat a unattended-upgrades pass as totally inert on those two.

A Detailed Breakdown of the Updates

Debian GNU/Linux

Debian shipped a batch of security updates on November 11, 2026, and ImageMagick is clearly the one they spent the most time on. It's absorbing a long tail of CVEs, and you already know how this software turns a harmless image file into a remote-code-execution vector without breaking a sweat. This round backports fixes from bullseye into buster, and the vendor insists your existing apps will keep working. There's one snag worth remembering: identify -verbose now carries an extra field, so any script that mangles that human-readable output will start choking. Switch to the -format option for machine-readable output, as upstream suggests. They also bumped ruby-mini-magick and ruby-rmagick along the way.

The rest of the batch is OpenStack housekeeping plus a couple of standalone packages. aodh (telemetry alarming) and watcher (cloud optimization) both clear the same CVE-2026-76878, information disclosure on both ends. octavia, the load balancer, pulls in three CVEs that reach the nastier end of the spectrum, handing out remote code execution and authorization bypass alongside the usual leaked-data complaints. dnspython gets patched for a denial-of-service hole, and SPIP, the CMS, closes a door on unauthenticated remote code execution, which is the flavor of news you'd rather not wake up inside.

Most of these landed in Debian 12 bookworm. SPIP headed to the stable trixie release instead.

Fedora Linux

Fedora pushed a security batch on November 12, 2026 across Fedora 43, 44, and 45, and you'll notice some packages showing up more than once because each release gets its own advisory. Firefox 160.0 is the visible one, landing on 44 and 45 with whatever upstream bundled into that release. GNOME users get epiphany, which takes three hits: a race that skips the TLS warning screen, a clipboard permission prompt that over-grants camera and mic access, and a TAR-based extension install that can clobber user files through hard links.

The packages worth your attention are libsoup3 and Pillow. libsoup3 absorbs a dozen CVEs, from heap buffer overflows in the WebSocket path to an HTTP/2 crash and a digest-authentication replay that walks someone past login. Pillow packs four CVEs of its own: a Ghostscript argument injection that can become remote code execution, two heap overflows, and a memory-expansion denial of service. tpm2-tss ships one named CVE plus a long fix list, with several still labeled "CVE-ID requested," which is at least candid about the names upstream hasn't finalized. pipx takes the whole pile treatment, since 1.18.12 addressed 24 separate problems upstream.

Some of this isn't a CVE at all. rsync ships a regression fix for the "Operation not supported" errors that appeared when preserving permissions, python-crate-ingredients removes the compromised emSign Root CA from its trust store, and python3.9 forces the bundled pip to trust your system certificates. Freerdp just updates to 3.33.1 and switches on an XDG AAD auth helper, which reads more like a feature than a patch. The two JDK lines, 25 and 27, both took the usual October CPU beatdown.

udns and perl-HTTP-Parser-XS carry the same path-truncation flaw across 43, 44, and 45, while php-getid3 and Nokogiri mirror the same fixes per release. Everything installs the usual way, through dnf upgrade --advisory.

Gentoo Linux

Gentoo pushed four security advisories between November 11 and 12, and every single one lands at "High" severity with the standard worst-case verdict of arbitrary code execution. None of these are going to keep you up at night, but they're worth acting on before someone else does.

The unlucky packages are also the kind you likely run whether you like it or not. curl showed up with an absurd 71 CVEs bolted onto one advisory, none of them having a workaround. That's a lot of vulnerability for a version bump, though curl does ship a small form factor and the fix is just a clean upgrade. libpcre2 is the one advisory with actual advice: don't feed it attacker-controlled regex. ImageMagick and libheif are the image-processing workhorses here, each carrying a wall of GHSA references—61 and 84, respectively—alongside their CVE lists, and neither offers a workaround either.

All four fix on a hard version floor, so you're really just watching a package manager.

Oracle Linux

Oracle Linux handed out five security advisories this round, and they spread wider than you might expect. Linux 9 gets Node.js 22 pushed all the way to 22.23.2, a jump that drags in a long tail of CVEs and dependency bumps. Linux 8 is left to pick up vim, util-linux, the Go toolchain, and libimobiledevice, the library that handles the iPhone and iPad connection.

Here's what actually changed in each one.

Node.js 22 on Linux 9 (ELSA-2026-96234) tops the list and it's the most involved. Oracle fixed an out-of-bounds write in the bundled Brotli decoder, then quietly stacked undici, sqlite, npm's tar and brace-expansion, and nghttp2 on top. That's roughly 30 CVEs folded into a single advisory. A lot of moving parts for one package, but at least it means fewer separate security alerts for you to triage.

The vim fix (ELSA-2026-98119) is more pointed. A Vimscript injection in the netrw plugin triggers when an unescaped filename gets filtered through s:NetrwMarkFile(), letting code run if you open the wrong kind of path. It's the sort of thing that bites when you're just trying to sort a directory listing.

util-linux (ELSA-2026-96212) carries three CVEs: a use-after-free in nested partition probing, a TOCTOU hole in mount via ancestor directory swaps, and unvalidated EBR data. These are the kinds of issues that tend to sit closer to root than your average advisory.

libimobiledevice (ELSA-2026-98105) gets a double free in service_receive, which turns into a denial of service. Skip the patching if you don't hack on iOS gear from Linux, but it's cheap enough that you might as well.

The Go toolset update (ELSA-2026-95638) bumps golang to 1.26.10 with Delve at 1.26.1, and tosses in an experimental fipsnoenforceems GODEBUG var for good measure. If you're not building Go on Linux 8, this can wait.

Red Hat Enterprise Linux

Red Hat's errata queue was unusually full this week, and it stayed full. The batch runs RHEL 7 through 10, plus every extended and specialized variant you can bolt onto them, so reading the whole thing feels like working your way through a phonebook. There are over 230 advisories, and they don't distribute evenly across severity.

Ten land as Critical, and those are the ones that actually move. OpenShift 4.15.71, Ansible Automation Platform 2.4, 2.5, and 2.6 all go out at once, alongside fence-agents, webkit2gtk3, freerdp on RHEL 10, cockpit-image-builder, and the two OpenJDK 8u512 builds (portable and Windows). If any of those run in your estate, they get patched today, and the rest can wait.

The remainder of the Important pile is where the volume lives. Java eats up a surprising amount of it, with java-1.8.0-openjdk covering RHEL 7, 8, and 9 on top of that separate 8u512 pair, and freerdp plays the same game, sitting in Important on RHEL 9 but Critical on RHEL 10. .NET is nearly everywhere from 8.0 to 11.0, and there are a pair of RHEL AI 3.4 and 3.0 ffmpeg CVE fixes coming through the AIPCC alert path rather than the usual channel.

Kernel, nginx, gstreamer1, perl-DBI, perl-CGI, grafana, and mod_http2 keep reissuing across almost every version, and those same fixes get duplicated onto the extended support variants (EUS, AMCU, SAP, Telecommunications). Those reissues just mean you can match a version number to your inventory instead of hunting. You'll also spot filing quirks, like four separate advisories for one JBoss 7.4.26 version and OpenShift 4.15.71 showing up twice, once Critical and once Important.

Rocky Linux

Rocky Linux is clearing out its errata queue. The newest batch lands on Rocky Linux 9 and spans a grab-bag of packages: container pieces like bubblewrap and runc, library stuff like libX11 and librsvg2, and oddballs like fetchmail and xz. Nineteen advisories total, seventeen tagged "Important" and two rated "Moderate" (fetchmail and xz).

Here's the honest part. Each advisory reads like it came off the same template. Rocky lists the package name, confirms it affects Linux 9, and points you at CVSS scores, but it doesn't actually spell out what broke in the headline. You get the severity rating and a link to the errata page, and the specifics live over there, not in the summary. So treat the severity tags as your quick filter and open the full advisory if you want the actual CVE detail.

If you manage a Linux 9 fleet, the Important-rated items are the ones to patch first. runc, bubblewrap, and the nodejs:26 updates sit at the top given what they run under. Two entries—lrzsz and one of the two nodejs:26 advisories—also bundle bug fixes and enhancements on top of the security work, so those updates pull a bit more weight than a plain patch.

Slackware Linux

Slackware's security team just published another round of patches, and this one covers three packages you're more likely to actually run than some of the more obscure offerings: Apache's httpd, tigervnc, and git. All three arrive for both Slackware 15.0 and -current.

The httpd update (SSA:2026-315-03) pushes Apache to 2.4.71 and closes three holes. The headline is a heap corruption plus remote code execution in assign_headers, which is the kind of thing that simply shouldn't exist in the year we're in. There's also a one-byte stack buffer overwrite in mod_vhost_alias and a NULL pointer deref in mod_md that just takes a child process out entirely.

tigervnc (SSA:2026-315-01) gets rebuilt against xorg-server-1.20.14 with six security fixes, mostly X-related memory mistakes. It carries the longest list of the three, spanning out-of-bounds writes, a shared-memory overflow, and an integer overflow. If you run a VNC session at all, treat this one as the mandatory upgrade.

Git (SSA:2026-315-02) moves to 2.50.2 on 15.0 and 2.56.1 on -current. The changelog includes a notably blunt aside: "It's probably time to bump this to a version that has security support." Six CVEs ride along. If you've been holding onto an old git for years, this is your nudge.

SUSE Linux

SUSE cleared out a sizable batch of security updates across its products, and the severity labels span the whole range, from moderate up to critical. Tumbleweed picked up ten moderate hits spread across various libraries, while the enterprise releases took the harder blows.

The one entry that actually grabs attention is Pillow. It's the only critical fix in the pile, and it patches 34 separate vulnerabilities, some of which allow remote code execution. If you render images from sources you don't fully trust, apply this first. The fixes cover decompression bombs, heap buffer overflows, and an argument injection in the Ghostscript call, which is a lot of ways to make the library misbehave.

openssl-1_1 appears more often than you'd think, but that's mostly because SUSE is carrying the same five-CVE fix across several SLE service packs and their livepatch variants. Still worth doing if you're stuck on the 1.1 branch, which is on its way out regardless.

The remaining important-rated fixes are more routine. psqlODBC picks up 12 issues, mostly buffer overflows plus a SQL injection. skopeo gets five, including a tar trick that could write files outside the intended extraction path. aliyun-cli, the distribution registry, python-M2Crypto, and a few others round out the set. Tumbleweed owners have ten moderate updates waiting; traefik is the biggest at nine CVEs, followed by perl-Plack at six. None are critical, so bundling them into your next zypper patch is the sensible play.

Ubuntu Linux

MySQL got the full quarterly treatment from Ubuntu, and it came in as a big one. USN-9046-1, dated November 11, 2026, closes 73 separate CVEs across MySQL 8.0, 8.4, and 9.7, so this is the usual October Critical Patch Update bleeding into Ubuntu's own notices.

You probably won't read 73 CVE descriptions, and you don't need to. The pattern is the same as last time: heap overflows, out-of-bounds reads, privilege escapes, and the assorted ways to make the server either crash or leak data. The takeaways are the version numbers and which Ubuntu line you're on.

The newer lines get full upstream releases. Ubuntu 26.10 jumped to MySQL 9.7.4, and 26.04 LTS went to 8.4.13. Those are genuine point releases, not just security band-aids, so you get whatever else Oracle bundled in. The LTS lines take a different route. Ubuntu 24.04 and 22.04 got backported patches to 8.0.46, meaning the security fixes were pulled in without the full 8.0.46 feature set. The USN flags its own warning here that backports can carry bug fixes, new features, and possibly incompatible changes, so don't treat a unattended-upgrades pass as totally inert on those two.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world