Major Linux distributions just released a coordinated wave of security advisories, with rsync bleeding 33 CVEs across Fedora and SUSE while OpenJDK updates target legacy Java runtimes across AlmaLinux, Oracle, Rocky, and Debian. Browsers also face a heavy purge, as Debian cleared 31 CVEs in Firefox ESR and both Fedora and SUSE shipped Chromium fixes for WebGL overflows and V8 type confusion. Ubuntu administrators should brace for a forced reboot, as eight kernel notices across four releases trigger unavoidable ABI changes that will break manually compiled third-party modules. PHP, curl, and kbd also received critical hardening patches to close SQL injection, NTLM regression, and local privilege escalation flaws, making today's package manager runs non-negotiable.

Linux Security Roundup: rsync Bleeds 33 CVEs, Java Gets Patched Everywhere, and Ubuntu Demands Reboots

If your systems haven’t been patched today, you probably won’t have much time to worry about it. Security teams across the major Linux distributions just dropped a coordinated wave of advisories, and the headline story is rsync bleeding 33 CVEs while Java maintainers scramble to push fixes to every supported release.

rsync is clearly having a rough week. Fedora bumped it to 3.5.0 to absorb path traversal, symlink following, and command injection flaws. SUSE handed it the exact same treatment, locking up another 33 CVEs that cover daemon escapes, argument injection, and a TLS handshake hole that essentially turns unauthenticated connections into a welcome mat. Run zypper patch and dnf update immediately. Not optional.

Java is getting hammered across the board. AlmaLinux, Oracle, Rocky, Debian, and SUSE all pushed updates for OpenJDK 8, 17, and 21. The CVEs are mostly the same three shared flaws hitting resource resolution and TLS handling, but Oracle quietly bumped their JDK 25 packages alongside the older releases and added a post-quantum cryptography build bump. If your stack still leans on JDK 8, move on it. The older runtimes are the ones missing the PQC patches.

Browsers cleared out their own mess today. Debian’s Firefox ESR pulled 31 CVEs off the shelf, while Fedora and SUSE both shipped Chromium fixes for 15 browser flaws. WebGL buffer overflows, V8 type confusion, USB race conditions. You know the drill. The same CVEs that hit Chromium also landed in Fedora’s update window, so if you’re running unpatched Chromium anywhere on a workstation or server, you should treat it as an active threat until the package manager finishes its job.

What actually needs rebooting today

Ubuntu’s notice today is a little different, mostly because they made it impossible to ignore. Eight security advisories across four Ubuntu releases, and every single notice triggers an unavoidable ABI change. That means you need a full reboot. If you compiled third-party kernel modules by hand, budget time to recompile them after the restart. DKMS handles it automatically, but the moment those new headers load, any manual build will break.

The GCP notice also requires an active Ubuntu Pro subscription, which might catch a few legacy cloud administrators completely off guard. Three of the notices share the same WiFi mesh injection flaw, which traces back to a misapplied 2020 patch in the low latency and KVM kernels. It's a rather tedious process, but the kernel ABI changes mean you don't have a choice.

The rest of the batch reads like a standard inventory of legacy tech getting forced into the present. PHP 8.2 and 8.3 across AlmaLinux and Rocky are now defending against SQL injection through ext-pgsql and archive parsing crashes. curl on AlmaLinux 8 untangles a regression that actually broke NTLM authentication over HTTP/1.1. kbd on pretty much every distribution just tightened openvt process matching so local privilege escalation stops being a trivial task.

If you tracked the rsync CVE queue over the past six months, you already knew this batch was coming. The upstream commit history shows the same path traversal and symlink race conditions piling up since early spring. Kubernetes and its container crew on SUSE just got rebuilt against a newer Go security release. Vim on SUSE pulled eight heap and stack overflows. And if you run Ceph or WordPress, Fedora’s advisories cover authentication bypasses and out-of-bounds reads that anyone operating those services would rather fix today than deal with later.

The updates in detail

AlmaLinux

AlmaLinux pushed a fairly packed security batch for AlmaLinux 8, 9, and 10. The biggest headline is the ansible-core patch for version 10. A flag in ansible-galaxy lets an attacker slip in commands that the playbook will happily run, so if you pull roles from untrusted sources you probably want to install that one first. The kernel update for AlmaLinux 8 is also doing heavy lifting, fixing nine separate issues across the network stack, memory counters, SCSI drivers, and SMB mode masking. You will see three separate CVEs rolling out to every supported OpenJDK version, plus a pair of SQL injection and archive parsing flaws hitting PHP 8.2 and 8.3. If you are still running AlmaLinux 8, the curl fix stands out because it also untangles a regression that broke NTLM authentication over HTTP/1.1. The rest is standard maintenance: kbd gets a privilege escalation patch, cups-filters handles a malformed PNG crash, and perl-Date-Manip rounds out the batch with a CPU exhaustion fix. The advisory numbers and full changelogs are linked in the official errata repository if you need to dig into the patch notes.

Debian GNU/Linux

Debian rolled out four security patches, covering everything from web browsers to Java runtimes. Firefox ESR took the heaviest hit, clearing thirty-one CVEs across Debian 11 and 12. The vulnerabilities span the typical attack surface: arbitrary code execution, privilege escalation, information leaks, and same-origin policy bypasses. SPIP, the PHP publishing engine, got patched against an unauthenticated remote code execution flaw that apparently needs no CVE number just yet. GStreamer's bad plugins collection picked up five CVEs that could crash your media pipeline or execute code if you open a malformed file. OpenJDK 21 also cleared three issues, mostly denial-of-service and information disclosure paths. Systems running Debian 11 through 13 should pull these updates through apt before anyone else decides to run them for you.

Fedora Linux

Fedora just pushed a broad security sweep across Fedora 44 and Fedora 43. The update window covers everything from the Linux kernel to WordPress, and the focus is squarely on plugging remote execution and memory safety holes. The headline move is rsync jumping to 3.5.0, which quietly absorbs 33 CVEs ranging from path traversal to command injection. That version bump makes you wonder why you kept skipping the changelog. Chromium also cleared out 15 browser flaws, and Microsoft shipped the same ten .NET vulnerabilities across the 8.0, 9.0, and 10.0 runtimes. Fedora is now tagging kernel updates as security releases by default, so you will see stable kernel bumps land without waiting for upstream to assign a CVE. Python developers should grab the 3.13.15 update to patch a tarfile extraction bypass and an HTML parser denial-of-service. Ceph, WordPress, and BlueZ round out the list with authentication flaws and out-of-bounds reads that anyone running these services would rather fix today than deal with later.

Oracle Linux

Oracle shipped a fresh round of security advisories across its Linux line, and the bulletin follows the usual mid-cycle pattern: kernel, Java, MySQL, and a handful of smaller utilities all getting patched. The heavy lifting lands in the kernel updates for OL8 through OL10, which bundle roughly three dozen CVEs. You will see fixes for Samba client double-frees, Intel and AMD GPU out-of-bounds writes, netfilter overreads, memfd seal bypasses, and a few vhost and blk-mq race conditions. Oracle also disabled UKI signing and refreshed module signing keys across those releases.

MySQL 8.4 on OL8 and OL9 got bumped to 8.4.11 alongside more than two dozen CVEs covering data corruption, access control holes, and parser crashes. If you are running databases, you should pull that update first. The Java ecosystem gets another round of PQC build bumps alongside three shared CVEs, so stacks still leaning on JDK 8 or 17 need to move. Smaller but still worth your attention: perl:5.32 on OL8 closes an arbitrary code execution flaw in IO-Compress and a DoS in Archive-Tar, ansible-core on OL10 plugs a git config injection bug in galaxy role installs, and sssd on OL7 hardens the Kerberos localauth plugin. Even kbd on OL9 and OL10 got a conservative match fix for openvt to stop process listing from crossing boundaries. Everything lands in Unbreakable Linux Network, so your normal yum update or dnf update command will sort it out without ceremony.

Rocky Linux

Rocky Linux just pushed another round of security and maintenance patches, and you should probably run dnf update if your Rocky 8, 9, or 10 systems haven't been patched yet. The advisory batch splits between Moderate and Important ratings, with the kernel landing updates on all three release tracks, which is the kind of patch you rarely complain about. PHP gets its turn too: version 8.2 is updated on Rocky 8 and 8.3 on Rocky 9, both bringing security fixes alongside routine enhancement and bug work. Java shops get bumped versions for both OpenJDK 8 and the newer OpenJDK 25, while real-time kernel users on Rocky 8 pick up their own separate advisory. Standard utilities like kbd, mrtg, curl, cups-filters, and perl-Date-Manip round out the release. Each advisory points to the CVE list where you can pull the exact CVSS base score for every vulnerability involved.

SUSE Linux

SUSE shipped a fresh batch of security patches this week, and rsync is clearly having a rough time. That single advisory locks up 33 CVEs, covering daemon escape routes, symlink races, argument injection, and a TLS handshake hole that turns unauthenticated connections into a free pass. Chromium takes the "critical" slot for 15 browser flaws, while Kubernetes and its container crew (podman, buildah, cosign) just got rebuilt against a new Go security release. You will also find patches for sccache, vim, redis, the libjxl image library, pytest-html, and Go 1.27rc3 itself. If any of these packages sit on your SUSE Linux Enterprise 15 or openSUSE Leap/Tumbleweed systems, running zypper patch is not optional right now.

Ubuntu Linux

Ubuntu shipped eight security notices today. The patch set targets Linux kernels across four Ubuntu releases, ranging from the legacy 16.04 FIPS build to the bleeding-edge 6.17 NVIDIA kernel. You should plan for a full reboot, since every single notice triggers an unavoidable ABI change. That means any third-party kernel modules you compiled by hand will break the moment the new headers load. If you managed those through DKMS or the standard metapackages, an upgrade handles it for you. If you built them manually, budget time to recompile them after the restart.

The most practical stand-alone fixes involve a WiFi mesh injection flaw tied to a misapplied 2020 patch (CVE-2025-27558), which shows up in the Low Latency and KVM kernels. The GCP notice brings in two AMD-specific microcode issues covering speculative register leaks and Zen 2 operation cache isolation, alongside a decades-old NTFS buffer overflow that still slips through validation. The rest is a standard deluge of networking, storage, and architecture subsystem fixes. Keep in mind that three of these notices (GCP, KVM, and FIPS) require an active Ubuntu Pro subscription, which might catch some legacy cloud administrators off guard.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y