Red Hat's latest RHEL push delivered an unusually high four Critical advisories, two of which hit the RHEL 8 kernel, making kernel and kernel-rt updates the obvious first priority for admins. Debian topped the CVE counts by squeezing 151 flaws into a single Thunderbird advisory and added a 41-CVE Vim update, with ImageMagick, Dovecot, and python-git rounding out a batch best installed immediately. SUSE hid a 9.8-rated curl hole among 21 vulnerabilities in curl 8.14.1, while also rebranding identical kernel CVEs across 11 live patches. Meanwhile, AlmaLinux and Rocky Linux reversed the usual trend by assigning their star severities to older releases, so sorting by severity number can mislead you there.

A heavy week for Linux security updates: Red Hat ships four Criticals, Debian and SUSE stack big fixes

Red Hat's batch tops four Critical alerts, Debian folded 151 CVEs into one Thunderbird update, and SUSE hid a 9.8 curl hole worth installing first. Here's the roundup.

Red Hat's latest security push for RHEL landed four Critical advisories, and that's an unusual number for a single update. All four sit on RHEL 8, and two of them hit the kernel and its real-time variant. If you run that OS, stop reading everything else and patch first.

This week's batch across the major distros is the type you want to actually work through before changing anything. Debian crammed 151 CVEs into a single Thunderbird advisory, SUSE folded 21 separate holes into one curl package, and the rest of the field came along with their own stories. If any of your boxes fetch, resolve DNS, or otherwise talk to a network, most of it applies to you.

Red Hat leads the week

The headline is the four Criticals. The kernel (RHSA-2026:93414) and real-time kernel-rt (93415) drew the top score, alongside webkit2gtk3 (93435) and the idm:client module (93452).

Kernel bugs are exactly why you set down your coffee.

Read that twice. The kernel and kernel-rt fixes go on top of the list before anything else. The webkit2gtk3 alert earns the same urgency since it reaches the RHEL 8.8 SAP and Telecom channels. The idm:client entry is easier to dismiss, and keep in mind that it only hits the 8.4 Advanced Mission Critical and Extended Update Support Long-Life add-ons, so most RHEL 8 boxes won't feel it. A Critical rating does mean the clock is running, though.

The bulk of the batch is Important, covering the expected crowd. libsoup shows up six times, libXtst four times, freerdp four times, and nginx three times, which lines up with .NET 8.0 also landing three times. Kernel and kernel-rt advisories spill over to RHEL 9 and 10 as well. Developer tooling gets its turn with a jackson-family pileup aimed at RHEL 9.4 SAP, plus thunderbird, python-jwt, perl-HTTP-Daemon, pki-core, and opentelemetry-collector.

Only three advisories settled at Moderate: podman and pipewire on RHEL 10, and libkcapi on RHEL 8's SAP and telecom channels. Moderate usually buys you more breathing room, but they still ride the same errata system, so keep them in the same patch window. All 54 advisories are live on Red Hat's site, and a chunk of these target extended-support and long-life add-ons rather than whatever RHEL line you actually run, so mind the channels.

Debian's big numbers

If you run Debian, this is the batch to install before you sleep. Between October 31 and November 2, 2026, Debian shipped security updates that lean hard toward the type you want patched at night.

Thunderbird is the one that makes you stop. Debian squashed 151 CVEs into a single advisory, a number most projects spend a full year turning out. Arbitrary code execution and information disclosure round out the damage, and you probably already have the fix installed.

Vim trails just behind with 41 CVEs. The editor has always collected malformed-file exploits, and this version leans right in, with modelines, spell files, a NetBeans interface almost nobody mentions, and Python completion all landing on the menu. Modelines have been a footgun since forever, so the fact that they keep showing up in a CVE list says something.

ImageMagick (32 CVEs) and aiohttp (26) follow, both pointing at crafted inputs crashing the process, leaking memory, or occasionally handing over code execution. If you process untrusted pictures, treat ImageMagick as non-optional. Dovecot's 24 CVEs are the technically interesting bunch, headlined by a CRIME-style compression oracle, a SQL injection pushed through multi-byte escaping, and SMTP smuggling. That last one is worth a proper read.

The rest is quieter. eog picked up two PNG-reader overflow fixes, and nss didn't actually patch a bug so much as pull three compromised eMudhra emSign root certificates out of the trust store entirely, which is why you may have seen an "untrusted certificate" error flicker on screen lately. Then there's python-git, with 38 CVEs built around command injection, path traversal, config injection, and secrets leaking through environment-variable expansion. If your automation ever touches git URLs or untrusted repos, install this promptly.

SUSE and the rebranded live patches

SUSE shipped another round of fixes late last week, and curl is the one worth your time. Advisory 4954 folds 21 holes into a single curl 8.14.1 package for openSUSE Leap 15.4 and SLE 15 SP4/SP5.

A chunk of them are the kind you'd walk right into: cookie jar corruption, host-verification bypasses when a redirect sends you to SFTP, a password leak in CURLINFO_EFFECTIVE_URL, and use-after-frees that surface over HTTP/2 upload. Scores range from SUSE's own 2.1 up to NVD's 9.8, the usual advisory inflation when the two orgs can't agree on a number. If any box on your network fetches anything at all, this goes on first.

Node.js 22.23.4 (advisory 4957) carries seven fixes, led by a 9.8 RCE in the Brotli decoder and another round of the same TLS certificate-validation holes the project keeps circling back to.

The remaining important-rated crowd is kernel work, and this is where it gets a little funny. SUSE issued 11 live patches across SLE 15 SP4, SP5, and SP6, each one stacking the same SUNRPC, nfsd, and sctp fixes onto a fresh patch number. You'll end up with the identical CVEs, just rebranded. buildah and suseconnect-ng got rebuilt against the current Go security release without their own CVE lists, and openSUSE Tumbleweed picked up a grab-bag of moderate updates including ansible-core across five version branches, forgejo, fuseiso, and hashcat.

The older releases need attention too

There's a wrinkle worth flagging before you sort by severity number. Both Rocky Linux and AlmaLinux handed the harsher Critical flag to their older releases. Rocky's Pillow security update is flagged Critical but only touches Rocky Linux 8, while its BIND patch for Rocky Linux 9 lands at Important. The lower-numbered OS update isn't the more urgent one here.

AlmaLinux is even blunter. Its only two Criticals sit on the older side of the house: the regular kernel and the real-time kernel for AlmaLinux 8 both shipped to fix a single ipv4 RCU memory bug. If you run kernels on 8, patch those before anything else.

The genuinely fresh fixes are the ones for the newer releases. java-17-openjdk for AlmaLinux 9 is rated Important with 36 JDK fixes folded into one erratum, all wearing the same generic "Enhance [component]" label. util-linux for AlmaLinux 10 picked up nine issues, including a SUID mount nosuid/noexec bypass and a partition-parser integer overflow. Podman picked up just one Moderate flag about arbitrary file writes when importing OCI archives.

A couple of smaller notes round out the week. Oracle Linux pushed advisories spanning OL7 through OL10, though OL7 has just a single Java update and OL10 has exactly one, Tomcat. Its lone Critical is the mod_auth_openidc update for OL8, driven by a cjose issue where AES-CBC-HMAC JWE encryption ends up using an all-zero Content Encryption Key. If you do OpenID Connect through Apache, that one deserves the front of your queue. Slackware shipped a libarchive update, advisory SSA:2026-304-01, tracking version 3.8.11 for Slackware 15.0 and -current. Not the flashiest release you'll see this week, but libarchive feeds into enough software that leaving it unpatched is a poor trade.

A Breakdown of the Updates

AlmaLinux

Your AlmaLinux inbox is sitting on a wall of errata, and the useful part is buried near the top. The genuinely fresh fixes are the ones for the newer releases; the rest is older business catching up.

The biggest single item is java-17-openjdk for AlmaLinux 9, rated Important and dated November 1. Oracle folded 36 JDK fixes into one erratum, all wearing the same generic "Enhance [component]" label. TLS handshakes, Kerberos, the HTTP client, font rendering, JPEG loading. It reads like a menu of things you never worry about until one catches fire.

The Mozilla pair is where the numbers get silly. Firefox and Thunderbird both jumped to ESR 153, and between them they absorbed well over a hundred CVEs split across sandbox escapes, use-after-frees, and privilege escalations. Firefox has the larger attack surface, but Thunderbird runs on the same engine, so most fixes overlap. If either touches a desktop, treating them as mandatory is just common sense.

The only two Criticals sit on the older side of the house. The regular kernel and the real-time kernel for AlmaLinux 8 both shipped to fix a single ipv4 RCU memory bug. If you run kernels on 8, patch those before anything else.

AlmaLinux 10 got a util-linux pack with nine issues, including a SUID mount nosuid/noexec bypass and a partition-parser integer overflow. Worth getting ahead of. Podman picked up just one Moderate flag about arbitrary file writes when importing OCI archives.

The notification also re-shipped a mountain of old AlmaLinux 8 errata from 2020 through 2025: mariadb, ruby across multiple minor versions, Python across nearly every version still shipping, httpd, webkit2gtk3, GNOME, and virt:rhel. A lot of it is already stale.

Debian GNU/Linux

If you run anything on Debian, this is the batch to patch before you touch sleep. Debian shipped a run of security updates between October 31 and November 2, 2026, and most of them are the type you want installed before you go to bed.

The one that actually makes you stop is Thunderbird. Debian squashed 151 CVEs into a single advisory for the email client, which is a number most projects spend a year turning out. Arbitrary code execution and information disclosure round out the damage report, and you probably already have this installed.

Vim is not far behind with 41 CVEs. The editor has always attracted its share of malformed-file exploits, and this version leans right in: modelines, spell files, a NetBeans interface almost nobody mentions, and Python completion all land on the menu. Modelines have been a footgun since forever, so the fact that they keep showing up in a CVE list says something.

ImageMagick (32 CVEs) and the aiohttp framework (26) follow, both pointing at crafted inputs crashing the process, leaking memory, or occasionally handing over code execution. ImageMagick especially: if you process untrusted pictures, treat this as non-optional.

Dovecot's 24 CVEs are the technically interesting bunch. Alongside the usual denial-of-service noise, there is a CRIME-style compression oracle that lets an attacker confirm whether a guessed message body matches a secret (with the minor downside that compressed traffic is now slightly less efficient), a genuine SQL injection pushed through multi-byte escaping, and SMTP smuggling. That one is worth a proper read.

The rest is quieter. eog (Eye of GNOME) got two PNG-reader overflow fixes, and nss didn't actually patch a bug so much as pull three compromised eMudhra emSign root certificates out of the trust store entirely. If you recently saw an "untrusted certificate" error flicker on screen, this is the reason.

The libcaca advisory is worth a raised eyebrow. Freexian's Extended LTS split the fixes across two advisories: the old buster release inherits an older 2021 CVE on top of a fresh overflow, while stretch and bullseye only carry the newer flaw. Two advisories, one library, and a CVE that has clearly been hanging around.

Then there is python-git (GitPython) with 38 CVEs built around command injection, path traversal, config injection, and secrets leaking through environment-variable expansion. If your automation ever touches git URLs or untrusted repos, install this promptly.

Oracle Linux

Oracle Linux just pushed a batch of security advisories, and you can expect at least one to touch something you actually run. The spread covers OL7 through OL10, though OL7 is barely hanging on with a single Java update and OL10 has exactly one entry (Tomcat). Most of the weight lands on OL8 and OL9.

The headlines follow the usual pattern: authentication bypasses, denial of service, and the occasional arbitrary code execution. Two packages are worth your attention. The nodejs:24 rollout on both OL8 and OL9 carries 13 CVEs, but only the Brotli decoder out-of-bounds write gets spelled out in the changelog, with the rest folded into "bundled library fixes." The httpd:2.4 update for OL8 lists 12 CVEs but only names five in the description, so the public CVE list reads as more complete than the explanatory notes.

If you run any .NET apps, there's a small quirk: both the OL8 and OL9 .NET 8.0 and 9.0 updates flag "Add support for Oracle Linux" as a change on top of the version bumps. That reads less like a bug fix and more like packaging paperwork.

The lone Critical is the mod_auth_openidc:2.3 update for OL8, driven by a cjose issue where AES-CBC-HMAC JWE encryption ends up using an all-zero Content Encryption Key. If you do OpenID Connect authentication through Apache, that one deserves the front of your priority queue. The OL8 kernel update also looks like more signing and certificate housekeeping than actual exploits, with the real security content tucked behind a handful of KVM, SCSI, and network header fixes.

Red Hat Enterprise Linux

Red Hat just pushed a sizable security batch at RHEL, and unlike the usual fare it actually delivered four Critical patches. If you run RHEL 8 kernels, read that sentence twice before anything else.

The Criticals are all sitting on RHEL 8. Kernel (RHSA-2026:93414) and its real-time sibling kernel-rt (93415) both drew the top score, alongside webkit2gtk3 (93435) and the idm:client module (93452). That last one is easy to skip since it only reaches the 8.4 Advanced Mission Critical and Extended Update Support Long-Life add-ons, so it won't bump most RHEL 8 boxes. But a Critical rating means the clock is ticking on it regardless.

The bulk of the batch is Important, and it covers the expected crowd. libsoup shows up six times, libXtst four times, freerdp four times, nginx three times (as does .NET 8.0), with .NET 9.0 landing twice. Kernel and kernel-rt advisories also roll out to RHEL 9 and 10. Developer tooling gets its turn too: a jackson-family pileup aimed at RHEL 9.4 SAP, thunderbird and a webkit-style fix, plus python-jwt, perl-HTTP-Daemon, pki-core, and opentelemetry-collector.

Only three advisories bottomed out at Moderate: podman and pipewire on RHEL 10, and libkcapi on the RHEL 8 SAP/telecom channels. Moderate typically gives you more breathing room, but these still ship on the same errata system, so they belong in the same patch window anyway.

All 54 advisories are live on Red Hat's errata site. Mind the channels: a chunk of these go to extended-support and long-life add-ons, so don't assume every row applies to whatever RHEL line you actually run.

Rocky Linux

Rocky Linux just pushed two security updates, and they're in different severity buckets. The BIND DNS server patch comes in at "Important" for Rocky Linux 9, while the Python Pillow graphics fix lands at "Critical" but only touches Rocky Linux 8. That split, the harsher flag going to the older release, is worth a glance before you assume the lower-numbered OS update is the more urgent one.

BIND is a workhorse for DNS resolution on a lot of server setups, so treating the "Important" rating as more than a formality makes sense. Pillow is used pervasively in Python environments too, which partly explains why it got the higher score. Both notices point you to individual CVE entries with CVSS base scores if you want the granular detail rather than trusting the headline severity.

Slackware Linux

Slackware has shipped a libarchive update, tracked as security advisory SSA:2026-304-01, covering both Slackware 15.0 and -current. It's version 3.8.11, described by the project as a bundle of security fixes, bugfixes, and a handful of minor features layered on top of 3.8.10. Not the flashiest release you'll see this week, but libarchive feeds into enough software that leaving it unpatched is a poor trade.

The new .txz packages sit on Slackware's FTP server, signed and paired with MD5 checksums so you can sanity-check the download before installing. Upgrade as root with upgradepkg, and there's a GPG key page if you'd rather confirm signatures instead of trusting a hash.

SUSE Linux

SUSE shipped another round of security fixes late last week, and curl is the one worth your time. Advisory 4954 folds 21 separate holes into a single curl 8.14.1 package for openSUSE Leap 15.4 and SLE 15 SP4/SP5. A chunk of them are exactly the kind you'd walk into: cookie jar corruption, host-verification bypasses when a redirect sends you to SFTP, a password leak in CURLINFO_EFFECTIVE_URL, and use-after-frees that surface over HTTP/2 upload. Scores range from SUSE's own 2.1 up to NVD's 9.8, which is the usual advisory inflation when the two organizations can't agree on a number. If any box on your network fetches anything at all, this goes on first.

Node.js 22.23.4 (advisory 4957) carries seven fixes, led by a 9.8 remote code execution in the Brotli decoder and another round of the same TLS certificate-validation holes the project keeps circling back to. The rest of the important-rated crowd is kernel work. SUSE issued 11 live patches across SLE 15 SP4, SP5, and SP6, each one stacking the same SUNRPC, nfsd, and sctp fixes onto a fresh patch number. You'll end up with the identical CVEs, just rebranded. buildah and suseconnect-ng got rebuilt against the current Go security release without their own CVE lists, and openSUSE Tumbleweed picked up a grab-bag of moderate updates including ansible-core across five version branches, forgejo, fuseiso, and hashcat.

If you want the full itemized list, here is every update.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all