SUSE's openSUSE Leap 16.0 leads today's batch with a Critical webkit2gtk3 update carrying 243 vulnerabilities, while its kernel adds 401 more across a massive changelog. Red Hat isn't far behind, posting two Critical WebKit fixes plus 32 total errata, most tied to packages that need separate builds per lifecycle path. Debian's LTS sweep pushes 260-plus kernel CVEs and PHP credential flaws under two advisory numbers, and Ubuntu's PyJWT fix addresses six researchers' distinct token-forging methods in one standard update. Meanwhile Fedora, Oracle, and a lighter Slackware round out the day, with Oracle's 200-CVE UEK advisory hinting at a caught-up backlog.

SUSE hands out a 243-vulnerability WebKit, RHEL posts two Critical fixes

It was a rough morning chasing security updates, and several distros shipped heavy batches today. SUSE, Red Hat, Debian, and Ubuntu all had releases land, and a couple of them will have you clearing space on the calendar.

The biggest pile lands in SUSE's openSUSE Leap 16.0 release, where webkit2gtk3 picked up 243 vulnerabilities under a single Critical advisory. That's a lot of CVEs for one library. Most are the usual memory-corruption fare, the kind that lets a malicious web page reach past its sandbox.

The kernel update isn't far behind. SUSE closed 401 vulnerabilities plus 413 non-security bugs, which means that changelog is closer to "emptied an entire garage" than "dusted the shelves." If you're tracking these by hand, you'll want a coffee.

WebKit is the running theme

It keeps coming back, and Red Hat didn't mess around either, posting two Critical fixes for webkit2gtk3 across RHEL 9 and RHEL 8. A browser engine reachable from a desktop GUI is an obvious target, so yeah, patch that first. SUSE rated its own WebKit fix Critical too, which happens about as often as a clean test run in releases like these.

On the lighter end, Ubuntu's notice for PyJWT has the better backstory. Six researchers independently found six different ways to forge authentication tokens against the library. That's a lot of distinct reports for a single Python package, though the fixes themselves are unremarkable.

The root problem: PyJWT failed to validate its keys across several code paths, mostly around HMAC verification. One finding diverged though. A remote attacker could redirect key-set fetches to leak sensitive information instead of forging a token, so not every report was a clean authentication bypass. Ubuntu issued USN-8916-2 as a backfill for the earlier USN-8916-1, applying the same fixes to Ubuntu 26.10. You don't need to chase individual versions, since a standard system update pulls in the corrected PyJWT for all six issues at once. Keep in mind that CVE-2026-102267 was the redirect-related one, the info-disclosure quirk rather than a straightforward bypass.

It's worth pausing on why WebKit shows up so much. It renders web content inside tons of desktop apps, so any gap is broadly reachable. Not exactly a rare target.

A kernel-sized backlog

Debian's LTS and Freexian Extended LTS sweep is built around a single kernel, three PHP versions, and one package that got patched, broke, and got patched again. The kernel does the heavy lifting. Debian LTS (DLA 4841-1) ships version 6.1.190-1 for bookworm, sweeping well over 200 CVEs spanning 2023 through 2026. Freexian's extended-LTS arm (ELA-1850-1) covers the same kernel for stretch, buster and bullseye, patching essentially the same list under a different advisory number. You're getting the same remediation twice, which is the whole business model of keeping kernels this old alive.

PHP gets the extended-LTS treatment across 7.0, 7.3 and 7.4, and the TLS and credential issues are the standouts. The http stream wrapper hands over credentials when a request crosses host, port or scheme on redirect. The IPv6 FastCGI access check compares only the first 12 bytes of a 16-byte address, so matching a /96 prefix can slip past listen.allowed_clients. TLS verification also falls back to Common Name validation after a subjectAltName mismatch, tripping RFC 6125. For the record, that last one bites when you point PHP at an untrusted or compromised MySQL server. Specific attack surface, not a blanket risk.

HAProxy shows up twice. The bookworm version (DLA 4842-1) closes a HTTP/3 parsing bug (CVE-2026-33555) that mishandles body size and content-length and can open the door to request smuggling. Worth remembering that feature isn't enabled by default in Debian's bookworm packages, so the smuggling path is more theoretical than an emergency.

Fedora's batch for 43 and 44 is the familiar ritual: bump a library, run it, forget about it. WebKitGTK leapt to 2.54.1 and dragged along an uncomfortable number of CVEs, plus what the release notes politely call "a couple hundred or so ANGLE CVEs and several dozen Skia CVEs." The maintainer even apologized for messing up some styling in Evolution. Chromium's own release (155.0.8059.84 on Fedora 44) carries ten CVEs, and that's the one to chase if you run Chromium.

Oracle Linux shipped across its 7 through 10 lines, and the real weight sits in the UEK sweeps. ELSA-2026-500398 stacks more than 200 CVEs on the 5.15.221 LTS line. One advisory carrying that many is a tell that Oracle's been catching up on a backlog. RHEL rounds out today's news with 32 errata: two Critical, five Moderate, the rest Important. Several packages show up three or four times under different errata numbers, tied to different lifecycle paths like SAP Solutions, Extended Update Support, and the long-life add-ons. That split is expected, since a package often needs a separate build per supported lifecycle.

Slackware went the opposite direction, dropping a single-package fix for libXtst (SSA:2026-290-01) for Slackware 15.0 and -current. It addresses two CVEs in the parse_reply_call_callback function, closing what reads like a classic out-of-bounds handling issue in the RECORD feature. Nothing dramatic, but you'd rather not be sitting on it if anything lets untrusted X traffic reach your display server.

A Detailed Breakdown

AlmaLinux

AlmaLinux pushed a kernel security update for version 10 (ALSA-2026:83207), rated Important and dated October 18, 2026. It closes 20 CVEs—mostly use-after-free and memory-corruption holes in the networking stack, plus scattered hits across USB, WiFi, Bluetooth, and audio drivers—and layers two bug fixes on top (i40e/ice VF bonding and a missing ionic driver backport). All the CVEs carry 2026 stamps, so the advisories are still catching up to the details.

Debian GNU/Linux

This week's Debian LTS and Freexian Extended LTS security sweep is built around a single kernel, three PHP versions, and a package that got patched, broke, and got patched again.

The kernel does the heavy lifting. Debian LTS (DLA 4841-1) ships version 6.1.190-1 for bookworm, sweeping up well over 200 CVEs spanning 2023 through 2026. Privilege escalation, denial of service and information leaks make up most of the roster. Freexian's extended-LTS arm (ELA-1850-1) covers the same 6.1.190-1 kernel for stretch, buster and bullseye, and it patches the same sprawling list. You're getting essentially the same remediation under two different advisories, which is the whole business model of keeping kernels this old alive.

HAProxy shows up twice, once per supported release. The trixie fix (DSA 6570-1) closes two denial-of-service flaws that still don't have CVE numbers. The bookworm LTS version (DLA 4842-1) is the more curious one: Martino Spagnuolo reported a HTTP/3 parsing bug (CVE-2026-33555) that mishandles body size and content-length and can open the door to HTTP request smuggling. It's worth that these features aren't enabled by default in Debian's bookworm packages, so the smuggling path is more theoretical than an emergency.

cifs-utils is a fix for a fix. The original cifs-utils advisory shipped a regression that broke the sec=krb5 and cruid mount options, so this second advisory exists purely to repair the mess it made.

Xen (DSA 6571-1) collects its usual hypervisor roundup of nine CVEs covering privilege escalation, information disclosure and denial of service.

PHP gets the extended-LTS treatment across 7.0, 7.3 and 7.4. The standouts here are the TLS and credential problems. The http stream wrapper hands over credentials when a request crosses host, port or scheme on redirect, and the IPv6 FastCGI access check compares only the first 12 bytes of a 16-byte address, so matching a /96 prefix can slip past listen.allowed_clients. TLS verification also falls back to Common Name validation after a subjectAltName mismatch, which violates RFC 6125. The 7.3 and 7.4 builds additionally take on CVE-2025-1218, a mysqlnd packet overread that only bites when you point PHP at an untrusted or compromised MySQL server.

Fedora Linux

Fedora pushed a batch of security updates for Fedora 43 and 44 this week, mostly the familiar ritual: bump a library to whatever upstream finally patched, run the update, forget about it. A few of them are worth your actual attention.

The standout is WebKitGTK. It leapt to 2.54.1 and dragged along an uncomfortable number of CVEs, spanning the main WebKit code plus what the release notes politely call "a couple hundred or so ANGLE CVEs and several dozen Skia CVEs." The maintainer, Michael Catanzaro, even slipped in an apology for mucking up some styling in Evolution. You likely won't notice the breakage until one of your mail templates looks slightly wrong.

Chromium's own release (155.0.8059.84, if you're brave enough to run it on Fedora 44) carries ten CVEs covering the usual suspects: memory corruption, use-after-free, improper input validation. That's the one to chase if you're on Chromium.

The rest is quieter but still useful. libheif, the HEIF/AVIF workhorse that also handles iPhone HEIC images, moved to 1.23.6 across both Fedora 43 and 44, closing a gap that bug trackers had been nagging about for a while. mongo-c-driver and its libbson sibling went to 1.30.13 to fix Decimal128 parsing, a buffer reserve check, empty-document writes, and a SCRAM authentication snafu. knot, the DNS server, picked up unspecified upstream fixes, and aom, the AV1 codec, reached 3.15.2 after a heap overflow in the encoder's first-pass stats. Smaller still: rust-faster-hex picked up a buffer-overflow fix, GitPython got a security patch, and Thunderbird 158.0 plus FreeRDP 3.32.2 are straightforward version bumps.

Update all of it with dnf upgrade --advisory and the right advisory ID below, or let your normal update cycle handle it.

Oracle Linux

Oracle shipped another round of kernel updates across its Linux lines, and the practical question is whether your box is close enough to current to skip them. This batch spans Oracle Linux 7 through 10, and most advisories ship both x86_64 and aarch64 packages. It mixes base kernels with the Unbreakable Enterprise Kernel, with one Python 3.6 advisory folded in on top.

The biggest headline numbers land in the base kernels: 20 CVEs in the OL10 update (ELSA-2026-83207) and 18 in the OL9 one (ELSA-2026-83156). The real weight sits in the UEK sweeps though. The OL7 and OL8 UESK advisory (ELSA-2026-500397) packs fixes for 29 CVEs across nine sub-releases, and the OL8/OL9 UESK advisory (ELSA-2026-500398) stacks more than 200 CVEs on top of the 5.15.221 LTS line. One advisory carrying that many is a tell that Oracle has been catching up on a backlog.

What's inside them is fairly standard kernel damage control. Use-after-free bugs and out-of-bounds reads do most of the talking, with networking and crypto making up the rest. KVM shows up repeatedly, and the SUNRPC, NFSD, and SVCRDMA group keeps reappearing because NFS-over-RDMA has a long history of leaking memory. The base kernel updates also reshuffle certificates and signing keys, so if you boot with secure boot you may need to adjust your shim and key setup to match.

The Python 3.6 advisory (ELSA-2026-82858) reads more like maintenance. It backports CVE-2026-88029 into PyMongo and bumps several modules to clear the path toward the RHEL 9 upgrade. Python 3.6 is old enough that this is damage control, not a reason to celebrate.

Red Hat Enterprise Linux

Red Hat just pushed a heavy batch of RHEL security errata, 32 of them across the supported releases. Most land at the Important level, five sit at Moderate, and two are Critical. Both Critical fixes hit webkit2gtk3, the toolkit that renders web content inside desktop apps, with a separate advisory each for RHEL 9 and RHEL 8. That's the one you'll probably patch first, since a browser engine reachable from a GUI tends to be a juicier target than the rest of the pile.

The Important category is where most of your packages live, including openssl, kernel, gd, postgresql, rsyslog, and a dozen Python libraries. Several of these ship fixes for more than one branch of RHEL, so don't be surprised if the same package shows up three or four times under different errata numbers. gd, perl-URI, python-lxml, rsyslog, and kernel all appear multiple times, each tied to a specific release path like SAP Solutions, Extended Update Support, or the long-life add-ons. That split is expected, since a package often needs a separate build per supported lifecycle.

Two details are worth a glance. postgresql still earned a security fix on RHEL 7's Extended Lifecycle Support, so whatever you're running on the oldest supported branch isn't exempt from this round. Kernel picked up two advisories on its own, one for the Advanced Mission Critical and long-life EUS crowd, another for the SAP and Telecommunications update paths.

Slackware Linux

Slackware's security team dropped a single-package fix for libXtst, the X11 library that handles input extension work like the RECORD feature. The advisory, SSA:2026-290-01, pushes version 1.2.6 for both Slackware 15.0 and -current, aimed at two vulnerabilities in the parse_reply_call_callback function.

The actual fixes are worth a read, because they describe the failure mode directly: the parser now checks element size against the remaining reply buffer and rejects zero-progress RECORD reply elements. That reads like a classic out-of-bounds or buffer-handling issue, which is exactly the kind of thing you'd rather not be sitting on if anything lets untrusted X traffic reach your display server.

SUSE Linux

SUSE just pushed a big security batch for openSUSE Leap 16.0, and the numbers are enough to make you clear your calendar. The one worth pausing over is webkit2gtk3, tagged critical with 243 vulnerabilities jammed into a single advisory. Critical ratings show up about as often as a clean test run in these releases, so this stands out. Most of that pile-up is the usual memory-corruption fare, the kind that lets a malicious web page reach past its sandbox.

The Linux kernel update is nearly as big on its own, closing 401 vulnerabilities plus 413 non-security bugs. That many changelog entries is less "dusted the shelves" and more "emptied an entire garage in one weekend." NVIDIA's G07 driver picked up 81 fixes, chromium got its second pass this cycle with another 47 issues split across two advisories, and openssl-3 took a heavy dose of 11 problems, from QUIC accounting gaps to timing side channels.

Under the heavy hitters sits everything you probably run without a second thought. Go picked up two maintenance releases with 15 and 13 issues between them. Image and document libraries, from libheif to librsvg to ghostscript, took their share of parser damage. Mail and VPN clients, openvpn, mutt and fetchmail, got patched, along with a cluster of Python dependencies. A few advisories carry no CVE at all, ntfs-3g_ntfsprogs being pure bug work, and SUSE folded four kernel fixes into two live patches for SLE 15 SP4 so you can apply them without rebooting. The table below breaks down every advisory, sorted by severity.

Ubuntu Linux

PyJWT is the Python library most people reach for when they need to sign and verify JSON Web Tokens, and according to Ubuntu's latest security notice it had enough bugs that six separate researchers found six different ways to forge authentication tokens. That's a lot of distinct reports for one package, though the fixes themselves are unremarkable.

Ubuntu issued USN-8916-2, which is mostly a backfill for the earlier USN-8916-1, applying the same fixes to Ubuntu 26.10. The root problem is that PyJWT failed to validate its keys across several code paths, mainly around HMAC verification. One of the six quirked differently: a remote attacker could redirect key-set fetches to leak sensitive information instead of forging a token, so not every finding was a straightforward authentication bypass.

You don't need to chase down individual package versions. A standard system update pulls in the corrected PyJWT for all six issues at once.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all