Redis 6 tops the urgency queue today, with a remote code execution flaw and a TLS use-after-free vulnerability patched across AlmaLinux, RHEL, and SUSE. Debian delivered a massive kernel update addressing over 200 CVEs on Debian 12, while SUSE shipped fixes for 27 GitPython command injection risks and 38 Chromium security bugs. The broader batch covers roughly thirty ImageMagick defects on Ubuntu, routine browser bumps for Firefox and Thunderbird, and critical identity server patches for the 389 Directory ecosystem. Apply the Redis and kernel patches immediately, then schedule reboots for affected SUSE and RHEL hosts before exploit code hits the wild.

Linux Security Roundup: Redis, Kernels, and Chromium Top the Patch List

Major distributions shipped coordinated security updates, and Redis is sitting at the top of the urgency pile. A pair of nasty flaws in Redis 6 are already showing up across four major distributions. If you're running it outside a sandbox, patch it before anyone else does.

The Redis CVEs are the fastest moving targets this cycle. AlmaLinux's advisory explicitly warns that a crafted RESTORE payload chains into an RCE condition, while CVE-2026-81934 exploits a use-after-free bug in the TLS handling. AlmaLinux, RHEL, and SUSE all shipped patches today. SUSE also flagged the same TLS flaw in Redis 7. If your Redis instances are exposed to untrusted networks, consider that an emergency maintenance window.

The Linux kernel updates are less about a single headline flaw and more about a relentless cleanup of privilege escalation paths, information leaks, and denial-of-service triggers. Debian's DLA 4777-1 pulls patches for kernel 6.1.187-1 on Debian 12, touching everything from network bridge validation to SMB client path checks. Fedora kept the main kernel quiet this cycle, but they did patch the real-time variant in AlmaLinux 8 with seven separate fixes for RDMA data handling and network bridges.

SUSE took a different angle with GitPython. The update fixes 27 distinct vulnerabilities, including command injection and remote code execution through config hooks. Python developers relying on it for automation should apply that first. Chromium follows with 38 CVEs, mostly cleaning up use-after-free and type confusion bugs in openSUSE Leap 16.0. It's a rather heavy load for a single cycle, though the distributed nature of the fixes means you don't have to juggle everything at once.

Everything Else That Needs Your Attention

ImageMagick took the volume prize on Ubuntu. USN-8739-1 covers fifteen CVEs that mostly boil down to crafted images triggering crashes or arbitrary code execution. It's not surprising given how often the toolkit gets fed untrusted input. curl, Vim, FFmpeg, and glibc all landed updates on the newer LTS tracks, while Ubuntu 16.04 LTS users are still catching backlogged fixes for PHP 7.0 and Gzip. If you are keeping score, that's a legacy system that desperately needs a migration plan.

Firefox and Thunderbird got routine bumps across RHEL, Debian, and Fedora. Debian's Firefox ESR patch addresses eleven sandbox and privilege escalation flaws. RHEL pushed updates for everything from libvirt to OpenShift Container Platform, with the 389 Directory Server ecosystem drawing critical ratings due to the ongoing interest identity infrastructure generates for attackers. Rocky Linux kept it quiet with a single Low-rated update for httpd:2.4 on Rocky Linux 8. Minor hardening. Not urgent, but still worth running.

A few packages across SUSE and RHEL explicitly require a system reboot before the fixes actually take effect. dracut, Xen, and the Intel CPU microcode updates on SUSE are among them. You will want to schedule those maintenance windows with your team rather than hoping they apply cleanly at runtime.

Patch management is back to being a chore, and it's arguably competing with the workload of any other Wednesday. The good news is that the most dangerous flaws cluster in a few predictable places: Redis, GitPython, the kernel, and ImageMagick. Apply those, verify service health on the patched hosts, and you have covered roughly eighty percent of the risk. Keep in mind that older distributions like Ubuntu 16.04 and Debian Stretch will route through Ubuntu Pro and FreeXian's Extended Life Support instead of standard repositories. Match your package manager to your maintenance track, and you will be fine.

A Detailed Overview of the Updates

AlmaLinux

AlmaLinux shipped another round of security patches, targeting systems running AlmaLinux 8, 9, and 10. The package that demands the most attention is Redis 6. It closes two nasty vulnerabilities, including a remote code execution path triggered by a crafted RESTORE payload and a use-after-free flaw in its TLS handling. If you run Redis outside a sandbox, you will want to apply this one first.

The rest of the batch tracks upstream fixes for the Go standard library and Python's cryptography module. The Go CVEs repeat across git-lfs, skopeo, and the Grafana Performance Co-Pilot plugin, which is expected whenever upstream patches land and get re-packaged. The Python cryptography updates shut down certificate validation holes that allowed duplicate self-signed intermediates or wildcard DNS names to slip past verification. On the system side, the real-time kernel for AlmaLinux 8 receives seven patches covering network bridges, SMB client path validation, and RDMA data handling. Expat rounds out the notifications with a moderate-severity heap overflow and a use-after-free in its XML parser. Run these through your package manager, then double-check service health on the kernel-rt and Redis hosts.

Debian GNU/Linux

Debian’s security team issued a fresh batch of patches, and the Linux kernel update is the obvious headline. Version 6.1.187-1 slaps fixes on more than two hundred CVEs for Debian 12, covering privilege escalation, denial of service, and information leaks. If you are still running older Stretch or Bullseye systems, FreeXian’s Extended Life Support advisory caught you with two separate libssh2 updates that patch out heap over-reads, double frees, and memory leaks triggered by malicious SSH servers. Firefox ESR gets a smaller but still necessary bump for eleven sandbox and privilege escalation flaws. Trixie users should grab a slurm-wlm update to close seven holes ranging from SQL injection to credential verification bypass in an HPC environment, plus fixes for a cache poisoning bug in FORT-validator and a buffer overflow in GStreamer’s OPUS decoder. Apply that kernel patch before researchers start publishing exploits.

Fedora Linux

Fedora Linux 44 received another batch of security patches, and this round covers some territory you actually want to see addressed. tar gets the usual hardening for archive extraction, which continues to be a reliable attack vector for misconfigured backups. libevent takes a direct hit with eight vulnerabilities lined up, mostly revolving around HTTP header smuggling and parser edge cases. openvpn gets a routine upstream bump to 2.7.7 with no additional CVE disclosures attached. The standout is complyctl finally hitting its first stable release, which also means it officially sheds sixteen CVEs tied to SSH handling, HTML parsing, and denial-of-service vectors. If you are running any of these on Fedora 44, a quick dnf upgrade will handle the cleanup.

Red Hat Enterprise Linux

Red Hat just published a massive batch of security advisories, and if you are running any flavor of Enterprise Linux from version 7 through 10, you will want to check your update queue. The list spans roughly eighty packages across multiple long-term support tracks, including OpenShift, MicroShift, and the Directory Server line. Critical ratings stick mostly to the 389 Directory Server ecosystem and its module replacements, which makes sense given how often identity infrastructure becomes a target. The bulk of the traffic is Important, with familiar names like Firefox, Thunderbird, the Linux kernel, libvirt, ignition, and various Python and Redis modules leading the charge. Moderate updates cover expat, glib2, PAM, and XZ, while the lone Low rating goes to httpd:2.4. It is a lot to digest, but the pattern is straightforward. If your stack touches any of these components, you should be planning your maintenance window now rather than hoping a reboot happens on its own schedule.

Rocky Linux

Rocky Linux just slid out a single security advisory this cycle, and it lands where you would expect for a Low rating. RLSA-2026:64794 updates httpd:2.4 across Rocky Linux 8, touching the core module alongside mod_http2 and mod_md. You are looking at preventative hardening or minor flaw corrections rather than an emergency situation, so this can comfortably live in your standard maintenance window. Skipping it past the next cycle still leaves the attack surface slightly wider, which is a habit worth dropping.

SUSE Linux

SUSE rolled out a substantial batch of security patches, targeting SUSE Linux Enterprise across SP4 through SP7, openSUSE Leap 15.4 through 16.0, and Tumbleweed. The release leans heavily on plugging well-worn attack vectors. Python developers relying on GitPython will want to apply the patch first. The update addresses 27 distinct vulnerabilities in that package, including command injection, path traversal, and remote code execution through config hooks. Chromium follows a similar pattern with 38 CVEs resolved, mostly cleaning up use-after-free and type confusion bugs. LXD also ships under a critical rating with nine fixes. Intel's CPU microcode update brings ten CVEs alongside new support for recent Xeon and Core Ultra platforms. NetworkManager, dracut, Redis, and php-composer round out the important-tier patches, covering DHCP command injection, TLS memory corruption, and malicious URL handling. A handful of updates, specifically for dracut and Xen, explicitly require a system reboot before the fixes take effect. You will find version spread across the usual SUSE Linux Enterprise maintenance track, so matching your specific SP level to the announcement ID is the only real housekeeping required.

Ubuntu Linux

Ubuntu pushed another round of security patches, covering everything from legacy PHP builds to glibc and ImageMagick. The notices read like a standard memory management sweep: NULL pointer dereferences, buffer overflows, regex bypasses, and plenty of inputs handled incorrectly across roughly thirty CVEs. If you are still running Ubuntu 16.04 LTS, you have a longer queue to clear, since PHP 7.0 and Gzip only got backported fixes for that release. Newer LTS tracks are not off the hook either, with glibc, Perl, ImageMagick, FFmpeg, curl, and Vim all landing updates. ImageMagick took the volume prize with fifteen separate CVEs that mostly boil down to crafted images triggering crashes, information leaks, or arbitrary code execution. Most of these roll out through a standard apt upgrade, though older releases will route through Ubuntu Pro for the backported package versions.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y