Linux distributions pushed significant security errata, highlighted by SUSE addressing 41 CVEs in rsync and Debian locking down xrdp to block unauthenticated probes. Gentoo users must urgently update OpenRGB after advisories revealed remote code execution flaws that could allow attackers to gain root access via the default public daemon bind. AlmaLinux and Rocky Linux both upgraded the Go toolchain to version 1.26.7, patching denial-of-service and cross-site scripting vectors across standard library packages. Meanwhile, Ubuntu and Oracle Linux rolled out critical kernel updates for mainline and SAP systems, while also fixing PAM lockout bypasses and nginx HTTP/2 bomb vulnerabilities respectively.

Linux Security Roundup: rsync, xrdp, and OpenRGB get hit hard as patches land

Major distributions pushed significant erratas, ranging from a mass sweep of 41 CVEs in rsync to critical remote code execution flaws in OpenRGB. If you haven't queued your patch manager yet, there's plenty of ground to cover across the stack.

SUSE took the biggest swing this week. The rsync update addresses 41 separate vulnerabilities, including symlink races, command injection, and heap overflows. SUSE-SU-2026:21650-1 bumps the package to version 3.4.1 for openSUSE Leap 16.0. It's a lot of CVEs for a tool that's been a transfer workhorse since the late 90s, though rsync has historically earned the benefit of the doubt on legacy behaviors. If you're running rsync as a service, grab this one immediately.

Debian locked down xrdp with fixes for 16 CVEs that let unauthenticated attackers probe the RDP server. The updated package disables alternate shell execution unless you explicitly set AllowAlternateShell. The [vnc-any] session type is now commented out by default, which blocks a class of unauthenticated probes that have annoyed admins for years. Debian also updated bubblewrap, which drops setuid root support entirely. This reshapes how Flatpak sandboxes behave. Administrators should consult README.Debian.gz for the new defaults.

Ubuntu pushed a livepatch update covering 35 CVEs across mainline kernels for releases ranging from 16.04 to 24.04. The fixes touch ksmbd, rxrpc, nfsd, usbip, AppArmor, procfs, and netfilter. Cloud and Raspberry Pi kernels require a reboot and a DKMS rebuild due to ABI bumps. Ubuntu also fixed PAM for a quirk where certain services reset failed login counters during the account phase, effectively defeating lockout policies. openCryptoki got patched for integer underflows that could let a token-group user escalate privileges.

Keep in mind that rsync is rarely the only thing running in a sync chain. The SUSE advisory recommends checking dependent tools alongside the rsync update.

Developer stack and toolchains

Gentoo flagged two high-severity advisories for OpenRGB. The daemon has two remote command execution holes that let a network attacker grab root access if you run it with the default public bind. OpenRGB lists no workaround, which leaves you with one viable path: update the package and stop exposing the service to your local network. If you're keeping score, CVE-2026-18794 and CVE-2026-59682 are the identifiers to watch.

AlmaLinux and Rocky Linux both pushed the Go toolchain to version 1.26.7+1. The update patches six CVEs across standard library packages like encoding/asn1, encoding/xml, net/url, crypto/tls, and net/http. Most are denial-of-service vectors hiding in the usual suspects, though the html/template patch closes a cross-site scripting gap from malformed input.

If you run Go in FIPS mode on AlmaLinux 9, there is a specific fix for CGO thread blocking on RAND_bytes that you will want to grab. The Go 1.26 update lands via ALSA-2026:60304 on AlmaLinux 9 and RLSA-2026:60305 on Rocky 8.

Oracle Linux updated nginx:1.26 on OL9 to address HTTP/2 bomb vulnerabilities and memory disclosure flaws. The OL8 nginx:1.24 row picked up fixes for heap overflows and MP4 processing crashes. If you're running web servers, prioritize those rows before the desktop stack.

Next, the Fedora 43 update bumps rust-h2 from 0.4.16 to 0.4.17. The change patches RUSTSEC-2026-0258, a low-severity issue tracked as FEDORA-2026-c3233bfa3f. If you're running HTTP/2 clients or servers built on this crate, pull the update through dnf soon. The package itself is just the standard HTTP/2 implementation, but keeping it current prevents dependency chains from surprising you.

Debian also patched gimp with 16 CVEs for arbitrary code execution from malformed image files, wireshark with 36 CVEs for protocol parser flaws, and Chromium with seven CVEs across trixie and bookworm. The Chromium updates on bookworm are notable since that's the LTS track.

The Full Advisory Index

AlmaLinux

AlmaLinux pushed four security errata on August 27, 2026, and the headline is the Go toolchain update for both AlmaLinux 8 and 9. You are looking at the exact same six CVEs patched across both versions, mostly denial-of-service vectors hiding in standard library packages like encoding/asn1, encoding/xml, net/url, crypto/tls, and net/http. The html/template patch also closes a cross-site scripting gap from malformed input. If you run Go in FIPS mode on AlmaLinux 9, there is a specific fix for CGO thread blocking on RAND_bytes that you will want to grab. The Go stack moves to version 1.26.7+1.

On the Java side, AssertJ gets a moderate severity patch for an XXE flaw that leaks data and causes denial of service. The system-level update closes a symlink traversal privilege escalation in the attr utilities on AlmaLinux 9, which means getfattr and setfattr are finally locked down against crafted paths. Six CVEs across a single standard library release is substantial, and standard libraries are usually the first thing attackers target. Apply the Important updates first.

Debian GNU/Linux

Debian pushed another batch of security advisories on August 27, 2026, covering eight packages in Debian 13 trixie and a Chromium backport for Debian 12 bookworm. The list reads like a standard security sweep: xrdp takes the biggest hit with sixteen CVEs that let unauthenticated attackers probe the RDP server, bubblewrap gets a symlink traversal fix that actually reshapes how Flatpak sandboxes behave, and wireshark rounds out the network tooling with yet another wave of protocol parser flaws. GIMP and libdbi-perl catch malformed file and path traversal bugs, while cockpit, suricata-update, and Chromium handle their usual code execution and denial-of-service risks. Two fixes here genuinely change behavior: xrdp now disables alternate shell execution unless you explicitly opt in, and the VNC proxy session type is commented out by default to block unauthenticated probes. Bubblewrap also drops setuid root support entirely in this release. Upgrading the usual suspects keeps your patching cycle honest.

Fedora Linux

Fedora 43 just pushed a package bump for rust-h2, moving it from 0.4.16 to 0.4.17. The main reason to care here is a low-severity security patch tracked as RUSTSEC-2026-0258. If you're running HTTP/2 clients or servers built on this Rust crate, you should pull the update through dnf soon. The package itself is just the standard HTTP/2 client and server implementation, nothing flashy, but keeping it current is the kind of maintenance that keeps dependency chains from surprising you.

Gentoo Linux

Gentoo published four high-severity security advisories. The bulk of the patching targets Chromium-based browsers. If you run Chrome, Edge, Opera, or Vivaldi, you are probably sitting on a stack of unpatched flaws spanning cross-site scripting, use-after-free bugs, and memory corruption issues. The advisory numbers walk you through three separate browser rollouts, each one flagging a fresh wave of common vulnerability identifiers and pushing you toward a newer minor version that is already sitting in the repository.

OpenRGB grabs the second headline with two remote command execution holes that let a network attacker grab root access if you run the daemon with the default public bind. The team lists no workaround, which leaves you with exactly one viable path: update the package and stop exposing that service to the rest of your network.

The table below breaks down every advisory, the affected packages, the version cutoffs that trigger the patches, the exact versions that close the holes, and the CVE identifiers that back each release.

Oracle Linux

Oracle Linux rolled out a fresh wave of advisories across versions 8, 9, and 10. If you run OL9, your immediate attention should go to nginx:1.26, which finally addresses those HTTP/2 bomb and memory disclosure flaws, alongside a tidy attr rebase that patches a symlink traversal escalation. The desktop stack gets a long-overdue fix that syncs stylus button ordering with the compositor, and Podman picks up a mirror fallback for image pulls plus a rework of its CNI/Netavark detection logic. The UEK kernel row is a grab bag of driver cleanups and scheduler tweaks, but the vhost-scsi use-after-free and mlx5 networking patches are the ones worth actually reading.

OL8 catches up with a security overhaul for abrt that locks down four separate CVEs covering file handling, TOCTOU flaws, and journal injection. nginx:1.24 gets its own round of patches for heap overflows and MP4 processing crashes, while the gstreamer plugin base rounds out the security fixes. The OL10 lineup brings httpd, nodejs24, polkit, and assertj-core security patches, plus a couple of crypto policy toggles that re-enable CBC modes under FIPS:OSPP. You should probably patch your web servers and container tooling first, then move down the list if you are running desktop or media workloads.

Red Hat Enterprise Linux

Red Hat just pushed out a fresh batch of security advisories, and if you are running RHEL 9.2 through 10, your patch manager has work to do. The headline story here is the kernel. Four separate advisories lock down the mainline and real-time kernels across the SAP Solutions channel and Red Hat's Extended Update Support track. That concentration suggests a coordinated CVE cleanup rather than a single zero-day panic, but the "Important" rating means you should prioritize these over the rest. The libxml2 and OpenJDK 25 patches land on the moderate tier, which typically points to routine vulnerability remediation. You will still want to cross-reference the CVSS scores in the references section to see which ones actually touch your attack surface, but the kernel updates are the ones that deserve immediate attention.

Rocky Linux

Rocky Linux just pushed a fresh batch of errata across its major releases. The bulk of the work lands on Rocky 8 and 9, with a single golang update hitting Rocky 10. Kernel patches carry the "Important" flag across the board, which is standard practice given how often the vendor categorizes system-level components. Developers tracking Go toolchains and the real-time kernel should apply those right away. The mingw-openssl and assertj-core fixes sit at low to moderate severity, so you can probably schedule those around maintenance windows. Every advisory includes CVSS scoring if you want to check the exact vulnerability details before running dnf update.

SUSE Linux

SUSE just pushed another round of security patches across its enterprise and distribution lines, and if you are running openSUSE Leap 16.0, you have a lot of ground to cover. The headline here is the rsync update, which quietly fixed 41 separate vulnerabilities spanning symlink races, command injection, and heap overflows. That is the kind of mass cleanup that usually comes after a few too many late-night code reviews. You will also notice wicked showing up three separate times for Leap 15.5, 15.6, and SLE 15 SP4 through SP6, all addressing out-of-bounds reads in its DHCPv4 capture parser plus a new remote shell injection vector in the 15.6 branch. The rest of the list covers expected maintenance: gh jumps to 2.98.0 with five new fixes, java-11-openjdk and c-ares get their quarterly dose of CVEs on Tumbleweed, and texlive finally gets patched for the same synctex use-after-free that earlier hit evince. If you run SLE 15 SP7 or Leap 15.6, the librest0_7 update swapping out an insecure PRNG for OAuth PKCE is worth your time.

Ubuntu Linux

Ubuntu issued another round of security patches, and this one leans heavily on the kernel. The main event is a livepatch update for the standard kernels across Ubuntu 16.04 through 24.04, closing 35 CVEs that touch ksmbd, rxrpc, nfsd, usbip, AppArmor, procfs, and a handful of other subsystems. If you run cloud, FIPS, or Raspberry Pi kernels, you are looking at separate updates for Azure, GCP, IBM, Oracle, and the Pi builds. Those carry the usual ABI bump, which means any out-of-tree modules you compiled will need rebuilding. If you've been hand-compiling kernel modules, grab a coffee.

Beyond the kernel, openCryptoki got patched for integer underflows and symlink mishandling that could let a token-group user escalate privileges. PAM also received a fix for a quirk where certain services reset failed login counters when calling the account phase without authenticating first, which effectively defeats lockout policies. You can handle the openCryptoki and PAM fixes with a standard apt upgrade, but the cloud and specialized kernels will require a reboot. The mainline kernels can stay on a livepatch if you prefer.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world