Eleven Linux distros shipped security updates in today's roundup, and one SUSE Firefox ESR change alone absorbed a staggering 147 CVEs. Red Hat's scariest move was a Critical patch for edk2 firmware on RHEL 10, where a hole sits below the boot process. Debian included a Telegram Desktop flaw that lets an attacker steal session keys and hijack an account with a single crafted link. Across the board, the same curl and glibc flaws surfaced on Oracle and Ubuntu, so network-facing services are the priority here.

Linux security roundup: SUSE's Firefox ESR update ships 147 CVEs

Eleven distros shipped updates in today's roundup. Between a firmware patch rated Critical and a browser update with a phone-book-length CVE list, there's a reason to open a terminal today.

Today's Linux security roundup is a heavy one. Eleven distros pushed fixes, and a fair chunk of those numbers come from browser bugs Mozilla already patched upstream. A 147-CVE list still closes 147 doors, though, so it's worth sitting down with a coffee and working through it.

The scariest single label went to Red Hat. It dropped a Critical patch for edk2 on RHEL 10 (RHSA-2026:96240). edk2 is the firmware you boot into before the OS even draws a logo, so a hole there outranks most userland flaws. Four advisories hit Critical overall, three of them OpenShift releases (4.14.78, 5.0.1, and a bugfix-only 4.12.103 drop that advertises no security component at all). The other 23 of 27 cluster at Important, with a lone Moderate tier you can fold into a slower patch window.

The curl flaw threads through the whole batch. The HTTP/2 upload use-after-free in multi_done (CVE-2026-92392) shows up on both Oracle Linux 10 and Ubuntu's pile. Same advisory number, different repos.

Same for glibc. Oracle split a single library into two separate advisories (ELSA-2026-76781 for OL 10, ELSA-2026-95618 for OL 9), which is unusual for one library. The bugs are the kind that make admins patch on a weekday, and one ties a privilege escalation to the dynamic linker's $ORIGIN handling. glibc holds up basically everything, so leave nothing on the shelf.

Debian's round has the one you can probably exploit right now. Telegram Desktop carries an IPC record-separator injection bug: build a tg:// link with an unescaped semicolon and you can push calls into the interpret: scheme handler, which then ships local files, including your tdata session keys, to a channel an attacker controls. That's account takeover in a paragraph. It's fixed for Debian 12 bookworm in 4.6.5+ds-2+deb12u1.

SUSE's heavy lifting doesn't stop at Firefox. apr-util picked up a critical rating for five problems, including a SQL injection through apr_dbd_oracle. PackageKit appears three times across three release lines, all circling the same local privilege escalation, with a genuine root exploit rated 9.3 on the 15.5 track. Three advisories for essentially one fix is SUSE backfilling down the release ladder. And the xen update wants a reboot, so plan for that.

The rest of the roundup

Ubuntu's biggest sorting job is Java. Six OpenJDK versions got fixes, each soaking up the high teens to four dozen CVEs that mostly boil down to components failing to authenticate users. Restart anything running against those JDKs after the update, and note that the oldest (8) still reaches back to 16.04 LTS.

Two Ubuntu entries break the usual rhythm, and they're the more interesting ones. The libsoup update (USN-8890-3) is Ubuntu quietly walking back a misstep: an earlier fix caught real HTTP/2 holes but leaked memory in the cookie jar, and this one cleans it up. A separate ca-certificates notice corrects a JKS keystore that kept stale certificates after the system bundle dropped them. Both only reach Pro-supported releases.

AlmaLinux landed its November 9 batch mostly on versions 8 and 9, with a couple on 10. The weight sits on AL8. webkit2gtk3 drags in 19 Skia vulnerabilities, DPDK brings 15 vhost issues that let a guest VM trip the host, and the kernel adds a seven-bug run including a privilege escalation. Ruby shows up in four advisories across 9 and 10, and it's mostly integer overflows in the regex compiler.

Rocky Linux stayed milder. Two Ruby updates (3.3 and 4.0) ride Moderate, Node.js 24 and 22 got straight security fixes, and squid 4 landed a clean proxy patch. But GIMP 2.8 showing up as Important on RL8 makes you raise an eyebrow. A mature image editor getting a multi-pronged patch on an older OS, with python2 dependencies still attached, reads like a strong signal to migrate off that box eventually.

Here's one that stops you mid-scroll: openSUSE Tumbleweed shipped git-bug 13 CVEs. That's a lot to drop on a Git tool most people have never run, let alone heard of. It's the kind of entry that looks alarming in a changelog and then quietly stops mattering for your stack.

Slackware split krb5 into four builds (i586/x86_64, plus stable 15.0 and -current) because it still keeps its tracks apart. That's just four downloads and four MD5 hashes to verify against. Twenty-one CVEs, so grab it before someone else does.

A Detailed Breakdown

AlmaLinux

If you get on the AlmaLinux errata mailing list, this batch reads about as thrilling as you'd expect. They pushed a round of security updates on November 9th, with a few stragglers dated November 6th, landing mostly on AlmaLinux 8 and 9 and a couple on version 10. Severity ratings swing from Moderate to Important, and while nothing here screams "shut everything down," a few of them are the sort you'd want to schedule before going back to your coffee.

The real weight is on AlmaLinux 8. The webkit2gtk3 update drags in 19 Skia vulnerabilities, a lot of memory corruption and use-after-free bugs that quietly make browsers less pleasant. DPDK sits right behind it with 15 vhost issues, several of which let a guest VM reach over the sandbox wall and trip the host, which is never a good time. The kernel brings a seven-bug batch including a privilege escalation and a pile of IPv6 fixes, and util-linux rounds out the Important-rated group with partition and mount holes.

Ruby shows up in four separate advisories across versions 9 and 10, and most of it is integer overflows in the regex compiler plus one double-free. Not the sexiest set of flaws, but regex parsing touches a lot of code paths, so it still pays to stay current. Curl, squid, qt5, nodejs, and the container tools make up the rest, each carrying its own handful of problems.

Debian GNU/Linux

Debian has been pushing security fixes left and right, and this round runs the whole gamba, from a desktop messaging app to a Java runtime old enough to have predates your current setup. The Telegram Desktop update is the one worth your attention, mostly because nothing screams "secure chat app" quite like a hole that lets a stranger upload your session keys into their own channel.

Telegram Desktop had an IPC record-separator injection bug. Build a tg:// link with an unescaped semicolon and you can push calls into the interpret: scheme handler, which then ships local files, including your tdata session keys, to a channel an attacker controls. That is account takeover in a nutshell. It's fixed for Debian 12 bookworm in 4.6.5+ds-2+deb12u1.

OpenJDK 8 is the odd one out, and by odd I mean ancient. Oracle stopped offering free public updates years ago, yet FreeXian's extended LTS program keeps patching it. This round covers 39 CVEs touching denial of service, information disclosure, unauthorized access, and sandbox restrictions. If you are still running Java 8, you are likely already living with the tradeoffs.

Tomcat 10 took the bigger hit, which is less entertaining. Nineteen separate CVEs open the door to denial of service, authentication bypass, and disclosure of sensitive information. Debian threw in its usual "upstream releases may change limits and behavior" disclaimer, so you may want to glance at your apps before you upgrade.

Finally, the Symfony PHP framework picked up 16 CVEs covering access-restriction bypasses, information disclosure, XML external entity injection, and denial of service, fixed for trixie in 6.4.50+dfsg-0+deb13u1.

Fedora Linux

Fedora pushed a fresh batch of security updates Tuesday, and it reaches across three releases. If you're on Fedora 43, 44, or 45, there's a patch waiting for you one way or the other. The main event is a kernel rebase to 7.3.3 landing on all three, joined by a grab bag of package refreshes that mostly means someone found enough bugs to justify a security bump.

The most glaring item in the pile is perl-CGI. The module took a 5.02 bump and folded in 19 CVEs in a single release, covering everything from regex-backtracking denial-of-service through cookie injection, open redirects, and path traversal. That's a lot to put in one package, but it does mean you patch it once. If you still serve CGI in production in 2026, you have your reasons, and they're now covered.

Python got its usual treatment: Fedora 43 moves to 3.14.10 and Fedora 45 to 3.15.2, both picking up the tarfile filter bypass and the distrust of compromised eMudhra intermediate certificates. The kernel change itself is more ordinary, bringing driver work that leans hard into Raspberry Pi 5 support alongside the standard tree-wide fixes.

On Fedora 45, one advisory ID covers a pile of Rust crate rebuilds. That looks alarming in a changelog but is really just dependency churn, though it pulls in zip (three RUSTSEC fixes), ruff, ty, and a rebuilt afterburn for the same eMudhra distrust. bind, libmodulemd, and perl-Starlet round out the batch with their own discrete sets of problems. You can pull any of these with dnf upgrade --advisory plus the advisory ID, though a plain dnf update catches them all.

Oracle Linux

Oracle Linux just pushed one batch of security advisories across its entire supported range, so if you run OL 7 through 10, at least one package here needs your attention. The pattern is familiar: the newest and oldest software get patched in the same breath.

glibc is the headline, and Oracle deliberately split it into two moderate advisories, one for OL 10 and one for OL 9, which is unusual for a single library. The bugs are the kind that make people patch immediately: a denial-of-service from a long DNS search domain, stack overflow in wordexp tilde expansion, buffer overflow in strfmon padding, and privilege escalation tied to the dynamic linker's $ORIGIN handling. The OL 9 advisory also carries a linker $ORIGIN privilege escalation for AT_SECURE programs. glibc underpins basically everything, so this is not the sort of thing to leave sitting on the shelf.

curl on OL 10 is marked important for an HTTP/2 upload use-after-free in multi_done. Nothing dramatic in the description, but it lives in the network stack, and a broken HTTP/2 upload is exactly the kind of failure you notice only after something breaks.

The two oVirt advisories (OL 8 and OL 9, both important) share the exact same recipe: CXF bumped to 3.6.13, bundled with 12 CVEs against ovirt-engine-wildfly. Twelve vulnerabilities riding one framework update is a lot, though the fix is just a dependency pin to WildFly 24.0.1-4, which is almost painfully simple.

The rest is routine. The OL 8 kernel update folds in a batch of networking use-after-free fixes (net/smc, openvswitch, RDMA/rxe, sctp) alongside new Oracle signing keys. Tesseract on OL 8 resolves six CVEs around malformed LSTM traineddata and sloppy vector reads. perl-YAML closes two long-dormant arbitrary-code-execution holes from 2017 and 2019. gdb closes an out-of-bounds write in read_member_functions.

Firefox is where the counts go silly. Oracle pushed two separate OL 7 ESR updates in one round, and the 140.17.0 build alone carries 43 CVEs. The 140.16.0 advisory adds 28 more. These are browser bugs Mozilla already fixed upstream, but the sheer length of the list is its own argument for updating. A phone book of CVEs on OL 7 is a lot to swallow in a single week.

Red Hat Enterprise Linux

Red Hat cleared its errata queue this cycle with 27 advisories, and if you glance at the severity labels you'll see most of them cluster at Important. The one that actually deserves a wake-up call is a Critical patch for edk2 on RHEL 10 (RHSA-2026:96240). edk2 is the firmware layer you boot into before the operating system even shows up, so a hole there is worse than most. Four advisories hit Critical overall, and three of those are OpenShift releases: 4.14.78, 5.0.1, and a bug-fix-only drop for 4.12.103.

The Important tier is where the bulk of the work lives. OpenSSL shows up twice, for RHEL 9.4 SAP and the extended-lifecycle track on RHEL 7. Node.js gets hit from nearly every angle, with separate updates for the 22 and 24 module streams on RHEL 9 and 10 plus a nodemon bump. You'll also see tesseract for the SAP and Telecom flavors of RHEL 8.8 and 8.6, along with everything from gd on the ancient RHEL 6 ELS track to dpdk, cockpit, and qt5-qtdeclarative.

Four advisories sit at Moderate. Those are the ones you can reasonably fold into a slower patch window: glibc, patch, and two Ruby releases for RHEL 10. A single one (the 4.12.103 OpenShift drop) doesn't advertise a security component at all, which is a nice change of pace if not much to worry about.

Rocky Linux

Rocky Linux has pushed a fresh batch of errata, and most of it is the kind of maintenance you were probably going to apply anyway. Seven distinct advisories make up this round, split between Rocky Linux 8 and 9.

The standout for most shops is likely the two Ruby updates. ruby:3.3 and ruby:4.0 both land as Moderate severity, covering security, bug fixes, and enhancements. The 4.0 release is worth a look since it ships next to 3.3, which means you've got a genuinely modern runtime to work with if you build on these modules. The mysql2 and pg gems ride along in that same update, so anyone talking to MySQL or Postgres gets patched as a side effect.

The Important-rated advisories are where I'd actually clear some screen time. Node.js 24 gets a straight security fix, while Node.js 22 picks up the fuller treatment with security, bug fixes, and enhancements on top of a nodemon bump. Squid 4 also gets a clean security update, which matters if you run a proxy, and Go gets patched through the go-toolset.

Then there's GIMP 2.8, which shows up as an Important security, bug fix, and enhancement update. That particular entry makes you raise an eyebrow: a mature, old-line image editor getting a multi-pronged patch on an older OS. Not complaining, but the python2 dependencies (pycairo, pygtk2, pygobject2) are a strong signal this is legacy machinery you might want to migrate off eventually.

Slackware Linux

Slackware is rolling out new krb5 packages for both Slackware 15.0 and -current, bumping the package to version 1.22.3 and patching a list of vulnerabilities long enough to make your eyes glaze over. The advisory names 21 distinct CVEs, so if Kerberos authentication is anywhere in your infrastructure, this is one you'll want to grab before someone else does.

The package ships as four separate builds because Slackware still splits its i586/x86_64 tracks and keeps stable 15.0 and -current apart. That just means four downloads and four MD5 hashes to verify. Install it as root with upgradepkg, and you're done.

SUSE Linux

openSUSE and SUSE shipped a steady stream of security advisories, and one of them alone carries 147 vulnerabilities. The Firefox Extended Support Release update (SUSE-SU-2026:5145-1) is the one you want to open first. Mozilla patched a wave of use-after-free bugs, sandbox escapes, and privilege escalations across nearly every component, and SUSE bundled them into a single change rolled out to a dozen SLE release lines plus openSUSE Leap 15.4. The base Firefox version is 153.6.0 ESR, and the nasty CVEs sit in the 8-to-9 range. If you run ESR on an SLE host, this is the patch to install.

The moderate Tumbleweed batch is where most of the noise lives. Four Tomcat releases (9, 10, and 11) get fixed in parallel for the same set of issues, alongside standalone updates for Ruby, libunbound, git-bug, buildpacks-cli, zk, main-line Firefox, and tekton-cli. git-bug is the outlier here, absorbing 13 CVEs, which is a lot to dump on a tool most people have never used.

On the serious side, apr-util pulls in a critical rating for five problems including a SQL injection through apr_dbd_oracle and two heap buffer overflows in the Redis and memcached clients. dpdk22 gathers twelve, mostly in the vhost and vhost-crypto paths, and needs attention on the 15 SP5 track.

PackageKit shows up three separate times across three release lines, all circling the same two bugs: a local privilege escalation where any user can call InstallFiles with the SIMULATE flag without a polkit check, plus a ZYpp rollback hole and, on the older 15.5 line, a genuine local root exploit rated 9.3. Three advisories for essentially the same fix is SUSE backfilling down the release ladder, so apply whichever ones apply to your box.

The rest is smaller but not worth skipping. udisks2 closes a local privilege escalation via as-user option spoofing, poppler fixes integer overflows in JBIG2 and TrueType parsing, and xen collects nine issues including an arbitrary read/write via grant copy. The xen update wants a reboot, so build that into your plan.

Ubuntu Linux

Ubuntu pushed a sizable pile of security notices on November 9-10, 2026, and Java users have the most to sort through. Six OpenJDK versions got fixes (8, 11, 17, 21, 25 and 27), each absorbing anywhere from the high teens to four dozen CVEs that mostly boil down to components failing to authenticate or authorize users. That leaves a remote attacker able to read or tweak sensitive data, or occasionally just crash the whole thing. The older the JDK, the further back it reaches: OpenJDK 8 still covers 16.04 LTS, while the not-yet-LTS 27 only touches 26.10.

Apache HTTP Server is its own story in USN-9016-1, listing 17 separate issues but landing on the 10th rather than the 9th. Most target 26.10 plus the LTS branches, and the roster of named researchers reading a bit like a bug-bounty hall of fame suggests someone actually put work in here.

Two entries break the usual routine. The libsoup fix (USN-8890-3) is Ubuntu quietly backing away from its own misstep: the earlier update fixed genuine HTTP/2 and proxy holes but introduced a memory leak in the cookie jar, and this one cleans it up. The ca-certificates notice is a correction too, fixing a JKS keystore that kept stale certificates after the system bundle dropped them. Both only reach Pro-supported releases.

The rest follow the expected shapes. libnfs and libheif both allow code execution or crashes from crafted input, with libheif being the one to watch if you open suspicious HEIF files as your login user. FreeRDP, Fetchmail and pyasn1 finish the batch, pyasn1 chewing through CPU with quadratic-time parsing across everything back to 14.04 LTS. Restart any running Java apps after updating the JDK packages.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all