Six major distros shipped fresh security fixes today, with Ubuntu stacking 48 notices and Red Hat delivering 82 advisories across RHEL 7 through 10. Ubuntu's Pillow update took a particularly heavy hit with 39 CVEs, while RHEL's fence-agents patch warrants attention since it controls node power in clusters. Debian's batch centers on Firefox ESR with roughly 80 patches and a 23-CVE Apache 2 fix, and Fedora bundled nine Rust crypto crates plus major updates for RabbitMQ and strongSwan. Several fixes require a reboot, so admins should scan their platform versions, flag the Critical entries, and schedule downtime accordingly.

Linux Security Roundup: Ubuntu Stacks 48 Notices, RHEL Ships 82 Advisories

A daily sweep of fresh security fixes across Debian, Fedora, RHEL, Rocky, SUSE, and Ubuntu. A few of these deserve more than a quick click.

Ubuntu's Pillow update took 39 hits. That's buffer overflows in the TIFF and JPEG decoders plus a Ghostscript argument injection that chains into command execution. Keep in mind Pillow is used everywhere, from web apps to imaging pipelines, so this is arguably the single most actionable fix of the day. All of it already sits in the repos for Ubuntu 24.04 and newer.

Red Hat's headline is the 82-advisory count across RHEL 7 through 10. Ten are Critical. The one you actually want to chase is the fence-agents patch on RHEL 9.8 EUS. Those packages control node power in a cluster, so a hole there means someone could quietly reboot your whole infrastructure.

Red Hat also handed us a genuine curiosity. Several 7.6.14 Single Sign-On advisories are titled "Critical" while the body text rates the impact as "none." A Critical patch with no security impact is a contradiction. It doesn't quite make sense, and it's the kind of labeling glitch that makes you question the whole severity system. Two of the SSO updates are just package refreshes. One is an OpenShift image. One comes from the Customer Portal, where it politely rates itself "Important" instead.

Debian's batch is all about the browser and mail client, which is where you really don't want to be running untrusted content. Firefox ESR got roughly 80 CVEs patched across bookworm, trixie, and even aging bullseye — the last of those only through FreeX's paid extended-LTS program. Thunderbird came along with the same pile plus five extra.

Apache 2 is the other Debian headline. The bookworm LTS fix covers a 23-CVE list including remote code execution, authentication bypass, and HTTP request smuggling. If you're still on bookworm with a public-facing web server, that long tail is the part that bites. The rest of the Debian pile is a mixed bag: Django closed a cache bug that served private responses to the wrong people, node-shell-quote can be tricked into shell injection, and mutt took a heap overflow through a malicious email header.

A cluster and a couple of reboots

Fedora's batch is a fine example of security work that stays invisible until it isn't. Nine Rust crypto crates shipped together under one advisory, RUSTSEC-2026-0387, tightening the constant-time math inside crypto-bigint. The same set is duplicated verbatim on Fedora 43 and 44. No single piece is dramatic. The whole cluster just moves because they're all married to one lower-level crate.

Then the CVEs cluster by whoever happened to be shipping that day. RabbitMQ took seven advisories in one 4.2.9 backport. strongSwan rode in with eleven CVEs around its VPN code. The Jackson stack moved as a unit to kill six problems, including an @JsonIgnore bypass in Java records.

A few bite in ways people notice. PyMuPDF picked up an arbitrary-code-execution overflow in annotation handling. pylint took a hit for RCE through untrusted cache deserialization. Libvirt closes an integer overflow in a page-management RPC that turns into a heap overflow. Xen is getting a full buffet of hypervisor fixes too, some still carrying CVE numbers from years ago because the flaws themselves are old even when the patch is brand new.

Then there are the quiet rebuilds that fix nothing you can name. routinator was rebuilt against webpki-roots to drop an emSign root CA. ignition was re-linked against a patched Go toolchain so it quietly accepts the fix for a compromised eMudhra certificate chain. The source code didn't change. The binary did. Head here if a changelog ever tells you exactly that and you want to know what actually moved underneath.

Rocky Linux put most of its weight on version 10, which took about half the batch. 24 Important, 4 Moderate, a single Low. The kernel and kernel-rt updates want a reboot, so schedule downtime up front. The mysql:8.4 update secretly covers mecab and perl-DBD-MySQL as well, so don't assume a database-only name means a database-only change.

SUSE's headline is python-Twisted for SLES. It's rated important, covers seven vulnerabilities, and the worst of them is CVE-2026-83813, a DNS spoofing hole in twisted.names from missing source address validation. SUSE scored it a 9.2. If you run Twisted-based network code, this is the one to install. The rest of the SUSE batch is openSUSE Tumbleweed, all moderate, and tidy is tidy.

A Detailed Overview of the Updates

Debian GNU/Linux

Debian pushed a chunky batch of security patches, so if anything in the list below runs under your load, you owe yourself a five-minute update.

Firefox is where the drama is. Firefox ESR got roughly 80 CVEs patched across bookworm, trixie, and even aging bullseye via FreeX's paid extended-LTS program. Thunderbird came along with the same pile, plus five extra. Those are your browser and email client, the two places you really don't want running untrusted content.

Apache 2 is the other headline. The trixie stable touch fixes three CVEs, but the bookworm LTS fix covers a 23-CVE list that includes remote code execution, authentication bypass, and HTTP request smuggling. If you're still on bookworm with a public-facing web server, that long tail is the part that bites.

The rest is a mixed bag worth scanning: Django closed a memory-exhaustion hole on base64 uploads and a Vary-header cache bug that served private responses to the wrong people. node-shell-quote can now be tricked into executing shell commands or stalling under quadratic work. mutt took a heap overflow through a malicious email header on top of a handful of smaller fixes. Tomcat 10 picked up request-smuggling and DoS hardening. nova and parted are the quiet DoS-only fixes.

Fedora Linux

Fedora pushed a batch of security fixes across three releases at once, so if you run any of this software you probably want to schedule a dnf upgrade. The updates land on Fedora 43, 44, and 45, and nearly all of them are closing holes people can actually exploit rather than the occasional polish release.

A chunk of this batch is really one update wearing a lot of hats. Rust maintainers shipped a matching set of nine crypto crates together (crypto-bigint, elliptic-curve, num-bigint, num-modular, ctutils, zmij, and num-prime) pinned to a single advisory, RUSTSEC-2026-0387, which tightens the constant-time math inside crypto-bigint. You will see that same set duplicated verbatim on F43 and F44. It is the kind of dependency update where no single piece is dramatic on its own, but the whole cluster moves because they are all married to one lower-level crate.

The CVEs cluster by whoever happens to be shipping that day. RabbitMQ took the biggest single hit, with seven advisories jammed into one 4.2.9 backport, ranging from memory-exhausting parsers to a stale OAuth impersonator tag that let revoked users linger on a connection. strongSwan rides the same wave with eleven CVEs around its VPN code, and the Jackson stack (core, databind, modules-base, and the bill-of-materials POM) moved as a unit to kill off six problems spanning denial-of-service traps and an @JsonIgnore bypass in Java records.

A few stand out because they bite in ways people notice. PyMuPDF gets patched for an arbitrary-code-execution overflow in annotation handling, and pylint takes a hit for arbitrary code execution through untrusted cache deserialization. Libvirt's fix closes an integer overflow in a page-management RPC that turns into a heap overflow. Xen is getting an entire buffet of hypervisor fixes, some carrying CVE numbers from years ago because the vulnerabilities are old even when the patch is brand new.

Then there are the quiet rebuilds that fix nothing you can name. routinator was rebuilt against webpki-roots to drop an emSign root CA, and ignition was re-linked against a patched Go toolchain so it quietly accepts the fix for a compromised eMudhra certificate chain. The source code did not change. The binary did. Worth knowing when the changelog tells you exactly that.

The list runs long, and the table below breaks down what each package actually did.

Red Hat Enterprise Linux

Red Hat shipped another errata batch, and this one is unusually large. The digest covers eighty-two advisories across RHEL 7 through 10, with a few product updates folded in. Most land on the "Important" scale. Eight are "Moderate," one is "Low," and ten carry a "Critical" title.

The Criticals are the ones worth your attention. Five Satellite async updates (6.16, 6.17, and 6.18) show up, along with a fence-agents patch on RHEL 9.8 EUS and an OpenStack manila fix. The fence-agents one is the kind you don't want to skip: those packages control node power in a cluster, so a hole there means someone could quietly reboot your whole infrastructure.

There is a wrinkle in the Single Sign-On releases. Red Hat titles several 7.6.14 advisories "Critical," yet the body text rates the security impact as "none." A patch with no security impact and a Critical label is a contradiction that doesn't quite make sense. Two of the SSO updates are just package refreshes for RHEL 7, 8, and 9. One is an OpenShift image aimed at older container platforms, and one comes straight from the Customer Portal, where it notes the impact as "Important" rather than "none."

Cockpit, Red Hat's web console, turns up far more often than you'd expect for something you're supposed to configure once and forget. It spans RHEL 8, 9, and 10 plus the EUS tracks. The Fedora 45 digest for it names two CVEs tied to local privilege escalation through bad symlink handling in the public-key helper, which is a path an attacker could actually climb. krb5, xfsprogs, glib-networking, and rhc each get several errata, mostly spread across the EUS and mission-critical tracks. Curl gets a Low rating this round and xz lands at Moderate, which still draws a glance given its checkered history.

You don't need to work through all eighty-two lines to get value from this. Scanning for your platform versions and flagging the Criticals is the sensible move. The table below lists every advisory in the batch.

Rocky Linux

Rocky Linux shipped a fresh batch of errata advisories across versions 8, 9, and 10, and there's more here than you'd expect from an ordinary Tuesday. The weight of it lands on Rocky Linux 10, which picked up about half of all the advisories, spanning everything from cockpit-podman to wireshark. Rocky Linux 8 gets six updates, including a kernel patch and a proper gcc security fix, while Rocky Linux 9 gets the short end of the stick with just two.

The severity spread is pretty typical for a batch like this: 24 Important, 4 Moderate, and a single Low. The Low is edk2, which is firmware stuff you'll probably never notice unless you boot a VM with custom firmware. A few advisories pull in extra packages under their headline name, so the mysql:8.4 update actually covers mecab and perl-DBD-MySQL if you happen to run them. Don't assume a database-only name means a database-only change.

Two things are worth a closer look. The kernel and kernel-rt updates are the ones that genuinely want a reboot, so schedule downtime for those. Then there's a paired set of go-fdo-client and go-fdo-server advisories, which suggests whoever runs that remote device identity stack should patch first and file the ticket later. The Node.js 26 update rolls security, bug fixes, and enhancements into one bundle, which is a convenience if you were already on 26 and a scheduling headache if you weren't.

SUSE Linux

SUSE rolled out its usual mix of security fixes, and the headline is the python-Twisted update for SUSE Linux Enterprise. It's rated "important," it covers seven vulnerabilities, and it's the only one here that actually warrants an eyebrow raise rather than a quick click. The worst of the lot is CVE-2026-83813, a DNS spoofing hole in twisted.names from missing source address validation. SUSE scored it a 9.2, NVD a still-slick 8.1, so if you run any Twisted-based network code, this is the one to install. The other six are mostly denial-of-service conditions: a negative-size IMAP search, a memory-exhausting XML stream parser, an unbounded IRC buffer, a Telnet negotiation blowup, an HTTP request smuggling bug, and a ReDoS from a misused re.compile() in the wildcard regex helper.

The rest of this batch is openSUSE Tumbleweed, all moderate, all delivered on GA media. It reads like a sampling of whatever Go-based tooling people have lying around: prometheus, cadvisor, hauler, gosec, goose, github-mcp-server, plus Google's guest and osconfig agents and a distribution-registry bump. Fewest fixes is one CVE each; distribution-registry grabbed four. Nothing here is going to keep you up at night, but tidy is tidy.

Ubuntu Linux

Ubuntu pushed out a fairly large batch of security fixes between November 10 and 12, and 48 separate notices piled up across those three days. The batch splits into two halves worth keeping straight. The first covers current releases and carries the higher-severity flaws you would actually patch today. The second is mostly older software living on long past standard support, with a good number of fixes that ship only through Ubuntu Pro for 16.04 and 18.04.

The current-release fixes matter most right now. .NET, Pillow, Apache HTTP Server, and the GNU C Library each shipped a multi-CVE update. Pillow alone took 39 hits, spanning buffer overflows in the TIFF and JPEG decoders up through a Ghostscript argument injection that lets an attacker chain things into command execution. That .NET fix quietly bundled 15 CVEs, and glibc came with seven, including a setuid $ORIGIN race that hands a local attacker elevated privileges. Apache rounded it out with five, covering mod_dav lock handling, mod_http2 heap corruption, and a CGI redirect hole that executes code. None of these are theoretical, and all of them already live in the repos for Ubuntu 24.04 and newer.

The rest of the pile is older. The single worst offender is the set of long-lived CVEs resurfacing on ESM systems: Babel and Ruby OpenID give remote code execution, Action Pack lets an attacker write files onto your web server, and libjwt's non-constant-time HMAC comparison hands forged tokens to anyone patient enough to time a response. Then there are the quieter holes that make life annoying rather than catastrophic, like the HTTP request-smuggling bug in gevent, a Kerberos ACL on Debian-LAN that lets any local user change other people's passwords, and TigerVNC treating certificate exceptions as trusted CAs. Leave these sitting around and you are banking on someone never finding them.

Two kernel updates need a plan before you just run the upgrade. USN-9021-1 (Raspberry Pi kernel on 26.04) and USN-9066-1 (HWE kernel on 22.04) both require a reboot, and both carry the familiar ABI-change warning that forces you to recompile any third-party modules you built by hand. If you run out-of-tree drivers, budget a few minutes of frustration.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y