SUSE led today's Linux security roundup with nearly 190 CVEs across 17 updates, most of them funneling through Mozilla Thunderbird 153.5's 86 vulnerabilities. Red Hat issued 40 advisories for RHEL 8, 9, and 10, with bubblewrap alone accounting for ten of them as container sandboxing updates swept every support channel. Ubuntu came in with roughly 53 vulnerabilities spanning 5 notices, while curl and OpenSSH drew the most attention with 18 and 9 CVEs respectively. Administrators should prioritize the updates repeated across multiple vendors, webkit2gtk3, curl, OpenSSH, and reboot-required kernel patches, before tackling the rest.

Linux Security Roundup: Thunderbird leads today's patch pile

SUSE shipped nearly 190 CVEs on its own this morning, curl and OpenSSH hit Ubuntu hard, and Red Hat patched bubblewrap ten times in a single day.

Let's lead with the number that should get someone to open a terminal right now. SUSE's October 19 announcement alone carried nearly 190 CVEs across 17 updates, and most of the damage was Thunderbird's fault. Mozilla Thunderbird 153.5 absorbed 86 vulnerabilities in one bump, reading like a grab-bag of the familiar post-Chromium-audit leftovers: use-after-frees, sandbox escapes, JIT miscompilations. SUSE folded a pile of libexpat fixes into the same package, so XML parsing through Thunderbird's dependencies gets patched at no extra charge.

The rest of SUSE's "important" tier was more modest. libsoup2 took 15 CVEs, a couple of them WebSocket heap overflows. Kubernetes got rebuilt against a newer Go release without naming a single CVE, quietly keeping containerized Go apps honest for another month. Three separate kernel live patches for SLE 15 SP5 fixed the same four bugs at different build numbers, which is just the reality of live patching rather than a sign of three distinct emergencies. On openSUSE Tumbleweed, the standout was velociraptor, the log-analysis tool, which took 40 CVEs by itself. ffmpeg picked up 11, mixing fresh 2026 holes with stragglers from 2023 and 2024.

SUSE's Thunderbird haul and Red Hat's bubblewrap

Red Hat issued 40 security advisories across RHEL 8, 9, and 10, with bubblewrap alone accounting for ten of them. That's a lot of movement for one tool, even though it does power a great deal of container sandboxing work. Coverage hit every support track you can name, from base RHEL 8 through the SAP Solutions and Extended Update Support channels, so if you run containers on RHEL this is one you don't skip.

The kernel updates are what actually reshuffle your maintenance window. A pair are security-only, but three more bundle fixes with bug fixes and enhancements, like RHSA-2026:85773, :85774, and :85321, so reboots are on the table wherever they land. The rest are the usual crowd: gd, pcs, python3, emacs, and the Java serialization trio of jackson-databind, resteasy, and the MicroShift entry, which ships as a full 4.16.73 release rather than a single-package bump and doesn't name a specific RHEL channel. Only five advisories in the whole batch came in at Moderate: glibc, hostapd (two of them), libreswan, and the Satellite 6 client packages.

Fedora was a little earlier to market, pushing its batch of updates first thing today. Most of it is exactly what you'd expect from the genre: find the hole, patch the hole, ship it. The biggest noise came from curl and Chromium. curl 8.15.0-12 for Fedora 43 closes five vulnerabilities, including an mTLS connection-reuse mismatch, an OpenLDAP SASL auth bypass a MITM can slide through, and an OpenSSL provider use-after-free. Chromium 155.0.8059.84 packs ten fixes, and its package description doesn't even bother pretending it's anything but what it is: "A WebKit (Blink) powered web browser that Google doesn't want you to use." Noted.

python3.15 landed at 3.15.0 on both Fedora 43 and 44, carrying a use-after-free on SSLContext and a certificate-verification bypass through wrap_bio. Standard TLS fare, but the kind that bites. haveged 1.9.26 is arguably the most honest entry in the batch, fixing two regressions its own maintainers introduced earlier this year: a 100% CPU spin when --no-command is set, and an initramfs switch-root failure that could strand a boot in emergency mode. BIND and its LDAP plugin got patched from a git snapshot because upstream 9.18 is end-of-life, which is worth a raised eyebrow. You're getting fixes from a branch nobody really keeps alive. Grab it if you run DNS, but don't overthink it. And if you don't use Rust, skip the rustls rebuild chain entirely.

Fedora, AlmaLinux, and everyone else

AlmaLinux shipped eleven errata this morning on October 19 across versions 8, 9, and 10, and only two actually matter. webkit2gtk3 dominates, with two Critical advisories each covering eleven CVEs parked inside Chromium's ANGLE graphics stack, the usual menu of use-after-free, buffer overflow, and out-of-bounds reads. There's also a regression fix for Eclipse IDE's WebKit views breaking on 2.54.0, the one piece that isn't about stopping attackers. The kernel update for version 9 carries eighteen CVEs across networking, Wi-Fi, KVM, audio, and netfilter, and a kernel this stuffed deserves a genuine look. libsoup on version 8 picked up four WebSocket heap overflows, python3.14-urllib3 appears on both 9 and 10 with a parser-driven DoS plus an HTTPS proxy interception hole, and pcs on version 8 re-bundles a 2024 request-smuggling bug you might not have patched yet.

Oracle Linux's most eyebrow-raising call is also webkit2gtk3, landing Critical on OL9 with eleven CVEs. Because rendering HTML inside desktop apps is so common, this update matters to more people than the CVE count implies. Emacs on OL10 picked up a shell injection through tramp and an integer overflow in image loading, while the ovirt-engine release for OL8 is a plain bug-fix build adding multiple IQN support for the host_storage REST API. No CVEs attached, but if you run oVirt it still lands on your queue.

Debian's LTS crew and Freexian's extended LTS both shipped the same two Django fixes across their own supported releases. CVE-2026-77050 is a denial-of-service risk in get_supported_language_variant that now truncates language codes past 500 characters before they reach the cache. CVE-2026-87975 is the more interesting one: model formsets with editable primary keys can delete records outside the intended queryset, though only if you can set the primary key through the form via a OneToOneField, natural key, UUID key, and the like. If your model leans on the default BigAutoField, you weren't in danger.

Rocky Linux barely made a sound today, releasing a single advisory for gimp:2.8 rated Important. The title undersells it, since that module drags along eight components including pygobject2, pygtk2, and python2-pycairo, all on Rocky Linux 8.

Ubuntu shipped five notices covering roughly 53 vulnerabilities, and the common thread is useful in a predictable way: nearly everything is HTTP smuggling, leaked credentials, or denial of service from input nested one layer too deep. curl alone took 18 CVEs, with independent researchers Joshua Rogers, Stanislav Fort, and Bobbeh Rhino doing much of the legwork. OpenSSH brought nine, including a GSSAPI handler that can leak credentials from a previous failed authentication attempt. The catch is that several older fixes now sit behind Ubuntu Pro. If you're still running 16.04 with a PHP app in late 2026, you've got far bigger questions than this patch.

A Detailed Overview

AlmaLinux

AlmaLinux shipped eleven security errata on October 19, 2026 across versions 8, 9, and 10. Two of them actually matter: the webkit2gtk3 updates, both flagged Critical, and the kernel update for version 9.

webkit2gtk3 is where the real action sits. Each Critical advisory covers eleven CVEs, and most of them are arbitrary code execution or information disclosure holes parked inside Chromium's ANGLE graphics stack. The usual menu: use-after-free, buffer overflow, out-of-bounds reads. There's also a regression fix bundled in for Eclipse IDE's WebKit views breaking on 2.54.0, which is the one piece of this update that isn't about stopping attackers. Install these first.

The kernel advisory for version 9 carries eighteen CVEs spread across networking, Wi-Fi, KVM, audio, and netfilter, with a fair number of use-after-free and denial-of-service bugs. Important severity, but a kernel this stuffed deserves a genuine look.

libsoup, also on version 8, picked up four WebSocket heap buffer overflows. python3.14-urllib3 appears on both 9 and 10 with a parser-driven denial of service plus an HTTPS proxy interception hole worth panicking about. And pcs on version 8 re-bundles two Tornado issues, including one request-smuggling bug that dates back to 2024, so if you somehow hadn't patched it before, you're getting nudged now.

The remainder are lower stakes. perl-URI (Moderate) shows up on all three versions with a security bypass that comes from skipping Unicode normalization when parsing hostnames. environment-modules on version 9 lets someone inject commands through malformed module names.

Debian GNU/Linux

Debian's long-term support crew and Freexian's extended LTS program both shipped the same two security fixes for Django, the Python web framework, each across their own supported releases. The CVE list is future-dated (CVE-2026-something, advisory dated October 2026), but the mechanics are straightforward.

The first flaw, CVE-2026-77050, is a denial-of-service risk in get_supported_language_variant. Feed the method a pile of long language codes and they'd get cached before any length check, potentially blowing up your process memory. Django now rejects or truncates codes past 500 characters before they reach the cache. It's the kind of bug that sits quietly until someone decides to be annoying about it.

CVE-2026-87975 is the more interesting one. Model formsets with editable primary keys let forged POST data delete records outside the intended queryset or spin up new ones through edit-only formsets. This only opens up when you can set the primary key through the form, a OneToOneField, a natural key, a UUID key, and so on. If your model leans on the default BigAutoField, you weren't in danger.

Both advisories chase the same two CVEs, so the real story is just distribution logistics: the identical patch, released through Debian's standard LTS line for bookworm and through Freexian's extended LTS line that reaches back to stretch. Upgrade if you're running any of these.

Fedora Linux

Fedora pushed a batch of security updates yesterday, and most of it is exactly what you'd expect from the genre: find the hole, patch the hole, ship it. A few entries stand out, so here's the rundown.

The biggest noise comes from curl and Chromium. curl 8.15.0-12 for Fedora 43 closes five separate vulnerabilities, including an mTLS connection-reuse mismatch, an OpenLDAP SASL auth bypass a MITM can slide through, and an OpenSSL provider use-after-free. Chromium 155.0.8059.84 packs ten fixes, and the package description doesn't even bother pretending it's anything but what it is: "A WebKit (Blink) powered web browser that Google doesn't want you to use." Noted.

python3.15 lands at 3.15.0 on both Fedora 43 and 44, carrying two SSL holes you'd rather not have: a use-after-free on SSLContext and a certificate-verification bypass through wrap_bio. Standard TLS fare, but the kind that bites.

haveged 1.9.26 is the most honest entry in the batch. It fixes two regressions its own maintainers introduced earlier this year: a 100% CPU spin when --no-command is set, and an initramfs switch-root failure that could strand a boot in emergency mode. The changelog reads like a walk through a minefield, which it was.

BIND and its LDAP plugin are patched from a git snapshot because upstream 9.18 is end-of-life. That's worth a raised eyebrow: you're getting fixes from a branch nobody really keeps alive. Grab it if you run DNS, but don't overthink it.

rustls 0.23.46 fixes four RUSTSEC advisories and set off a rebuild chain. rust-routinator and rust-rbw each jumped a release number for no reason other than a dependency shifted. If you don't use Rust, skip it. Xwayland and the X.Org server absorbed the same pile of CVEs, so Wayland users should apply the Xwayland side.

Oracle Linux

Oracle Linux pushed another round of errata this week, and the severity tags span the whole spread: one Critical, several Important, a few Moderate, and a plain bug-fix. The one that actually warrants a raised eyebrow is webkit2gtk3 on OL9. It lands as Critical and brings eleven CVEs along, which is the usual browser-engine complaint, but rendering HTML in a lot of desktop apps means this update matters to more people than the CVE count implies.

The OL9 xorg-x11-server pull picked up five CVEs, and the OL8 libsoup update has four heap buffer overflows, all bunched around WebSocket handling. Emacs on OL10 got hit as well, with a shell injection through tramp and an integer overflow in image loading, plus a Flymake trusted-content gap. perl-URI turns up twice, once on OL9 and once on OL10, patching the same hostname-encoding hole in Unicode normalization.

Everything here is not a security fix. The ovirt-engine release for OL8 is a straightforward bug-fix build: it adds multiple IQN support for the host_storage REST API and corrects how locked entities get handled. No CVEs attached, but if you run oVirt it still lands on your update queue. And environment-modules on OL9 had command injection lurking in bash Tab completion. Tiny attack surface, though command injection is never a "leave it for later" item.

Red Hat Enterprise Linux

Red Hat pushed another big batch of errata, and it covers a lot of ground. This round carries 40 security advisories spanning RHEL 8, 9, and 10. Almost everything lands on the "Important" rating, with just five coming in at Moderate: glibc, hostapd (two advisories), libreswan, and the Red Hat Satellite 6 client packages.

bubblewrap is the standout. Red Hat issued ten advisories for it, hitting every support track you can name from base RHEL 8 through the SAP Solutions and Extended Update Support channels. That is a lot of movement for one tool, though it does power a great deal of container sandboxing work.

The kernel updates are the ones that reshuffle your maintenance window. A pair are security-only, but three more bundle fixes with bug fixes and enhancements (RHSA-2026:85773, :85774, :85321), so reboots are on the table wherever they land. The rest are the usual crowd: gd, pcs, python3, emacs, and the Java serialization stuff (jackson-databind, resteasy). The MicroShift entry is a full 4.16.73 release rather than a single-package bump, and it doesn't name a specific RHEL channel.

Rocky Linux

Rocky Linux kept it quiet this round, releasing just a single security advisory: RLSA-2026:84744 for gimp:2.8, rated Important. The title undersells it though, because gimp:2.8 is really a module that drags along a whole cluster of packages. This one covers eight components, including pygobject2, pygtk2, python2-pycairo, and the gimp module itself, all rolling out to Rocky Linux 8.

SUSE Linux

SUSE shipped a batch of security advisories on October 19 that together add up to nearly 190 CVEs across 17 updates, and Thunderbird is doing most of the heavy lifting. Mozilla Thunderbird 153.5 picked up 86 vulnerabilities, which mostly reads like a grab-bag of the usual browser bugs: use-after-frees, sandbox escapes, JIT miscompilations, that sort of thing. SUSE bundled in a pile of libexpat fixes in the same announcement, so if you parse XML through Thunderbird's dependencies you get those patched at the same time.

The rest of the "important" tier is more modest. libsoup2, the HTTP library a lot of desktop apps lean on, absorbed 15 CVEs, a couple of them heap buffer overflows you trip over over a WebSocket connection. Kubernetes got rebuilt against a newer Go security release, which quietly keeps containerized Go apps honest for another month without naming a single CVE. And SUSE rolled three separate kernel live patches for SUSE Linux Enterprise 15 SP5, all four fixing the exact same problems but at different kernel build numbers (121, 130, 141). That is just the reality of live patching, since each kernel micro-revision wants its own patch, not a sign the kernel had three distinct emergencies.

If you are on openSUSE Tumbleweed, most of your updates land in the "moderate" bucket. The standout is velociraptor, a log analysis tool that took in 40 CVEs on its own. ffmpeg caught up on eleven, mixing fresh 2026 holes with leftovers from 2023 and 2024, and a Chromium update takes 11 as well. Smaller bumps cover podman, Python 3.15 on its third release candidate, and a couple of Perl modules that probably do not even have a home on your machine.

Ubuntu Linux

Ubuntu shipped five security notices, covering roughly 53 vulnerabilities across the stack you most likely have running somewhere. The common thread is predictable in a useful way: nearly everything is HTTP smuggling, leaked credentials, or denial of service from input nested one layer too deep. Patch this and move on.

The Go update is the sprawling one, at 12 CVEs, and about half of them live in the HTTP and HTTP/2 machinery. The interesting one is a checksum-database tile check that slipped, meaning a module proxy you trust could quietly hand out tainted content. The rest are the usual suspects: unlimited recursion in the ASN.1 and XML parsers, an off-by-one in TLS KeyUpdate handling, and HTTP client connections being returned to the idle pool after a rejected CONNECT so an attacker can poison them. Fix is 1.22.2 for 24.04, 22.04, and 20.04.

curl gets its own pile of 18 CVEs and most of the independent-researcher credits, with Joshua Rogers, Stanislav Fort, and Bobbeh Rhino doing the heavy lifting. The scariest are the credential leaks and the use-after-frees that can escalate to arbitrary code execution. libcurl can spill a username and password back through CURLINFO_EFFECTIVE_URL, a libssh2 host-key mismatch gets misreported as a missing key (which is precisely how a MITM slips in), and HTTP/2 uploads can use-after-free mid-copy. There is also a WebSocket out-of-bounds read on the GnuTLS build. This one only lands on 26.10 as a follow-up to an earlier notice.

OpenSSH brings 9 CVEs and one genuine head-turner: the sshd GSSAPI handler can leak the credentials from a previous failed authentication attempt. Add an ssh username injection vector, an sftp path-traversal on recursive copy, and a DST bug that makes certificate expdrift, and it is a lot to swallow in a single SSH build. Ubuntu 26.10 only, moving to 10.5p1.

The other two are smaller. cifs-utils has a single privilege-escalation hole where a credentials file can be tricked into injecting mount options into a privileged mount. libXtst has three, though two are 2016-era bugs still parked on 16.04, and the newest lets a malicious X server crash your clients. One thing worth flagging: several older fixes now sit behind Ubuntu Pro. Patching PHP 7.4 and below, or the last two libXtst CVEs on 16.04, means you have to be paying for Extended Security Maintenance. If you are still on 16.04 running a PHP app in late 2026, you have far bigger questions than this patch.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y