Ubuntu re-patches nginx to resolve a regression and close three CVEs, while simultaneously fixing local privilege escalation holes in libinput and dracut that affect the 24.04 and 26.04 releases. SUSE leads the enterprise charge with a Firefox update that quietly closes 139 vulnerabilities across SLE and Micro variants, alongside important patches for clamav and python39. Fedora and RHEL round out the wave with twelve and seventeen advisories respectively, targeting predictable session IDs in perl-Dancer2, memory leaks in perl-Protocol-HTTP2, and widespread nginx fixes across EL8 and EL9. Debian keeps it surgical with a single privilege escalation fix for the L2TP VPN plugin in trixie, though you will need to verify your Ubuntu Pro subscriptions to cover the remaining notices.

SUSE ships Firefox patch for 139 vulnerabilities, Ubuntu recalls its nginx fix

SUSE has pushed a Firefox update that fixes 139 vulnerabilities in a single advisory, and that's the number worth remembering this week. Tacked onto Mozilla's browser are also fixes for mozilla-nspr, mozilla-nss, and rust-cbindgen. Firefox climbs to ESR 153.2.0, the version most enterprises actually run. If any of your SUSE Linux Enterprise systems host a browser, this is the one to patch first.

Today's security wave hits six major distributions, and if you run nginx on Ubuntu, you already know why today feels like déjà vu. Ubuntu pulled and re-shipped a regression-heavy patch, bundling three CVEs into one messy release. It's not isolated. SUSE is chasing its own massive Firefox update, Fedora and RHEL are churning through a dozen advisories each, and Debian keeps it surgical with a single L2TP plugin fix for trixie.

Ubuntu re-fixes nginx, SUSE ships 139-vulnerability Firefox patch

Ubuntu's nginx notice is the headline for a reason. The original fix for CVE-2026-42533 caused a regression, so the team yanked it and shipped a corrected version. You're getting a use-after-free in the Server-Side Includes path, a slice module flaw, and that re-fixed hole all at once. nginx:1.28.3 lands on 26.04, 1.24.0 on 24.04, and 1.18.0 on 22.04. No Ubuntu Pro subscription required. The vendor actually apologized for the regression loop. Fair enough.

Two local privilege escalations close out Ubuntu's batch and demand more attention than the nginx mess. libinput leaves device properties unescaped, which lets a local user inject udev settings and reach root. It lands on 24.04 and 26.04. dracut is worse. A rogue DHCP server on your network can force command injection during boot failure handling, granting root on 26.04 before the OS even finishes loading. Restart Freeciv after its update, and reboot for dracut. Otherwise you're just running old code under a fresh patch number.

A few more remote-facing issues round out the Ubuntu notice. Freeciv and libvips both crash on malformed input, which gives you denial-of-service cases. Konsole runs programs as your login user when you open a crafted URL. cgit still drags a 2018 CVE on Ubuntu 16.04, which says everything about that release's lingering life. Yelp lets help documents run scripts, though you'd need to open a malicious file first. Several of these still sit behind Ubuntu Pro, even on newer releases. If you're tracking costs, keep that in mind.

SUSE filed eight advisories, and the severity split tells you exactly where to look. Five target Tumbleweed at a moderate rating. The three enterprise fixes land at important, and one of them is a monster. SUSE-SU-2026:4156-1 updates Firefox to ESR 153.2.0, pulls in mozilla-nspr, mozilla-nss, and rust-cbindgen, and quietly closes 139 vulnerabilities. Most are use-after-free and privilege escalation bugs. If you're running SLE 15 SP4 through SP7, or any of the Micro or HPC variants, this is your priority patch.

The clamav advisory (SUSE-SU-2026:4180-1) also hits important, bumping the package to 1.5.4. Nine vulnerabilities shut down, mostly memory-safety glitches in zip, PDF, Mach-O, and XAR parsers. One of them, CVE-2025-8088, is from a 2025 batch that simply hadn't reached SUSE's packaging until now. ClamAV lives on untrusted input, so those are the ones you'd rather not have sitting in production.

Fedora, RHEL, and the rest keep systems tidy

Fedora's quietly busy week delivers twelve advisories across Fedora 43 and 44. They boil down to six packages. perl-Dancer2 was building session IDs from low-entropy sources, making "session ID" and "guessable" nearly synonyms. Fedora pinned Crypt::URandom and Math::Random::ISAAC::XS as hard requirements to fix it. perl-DBI carries two CVEs for arbitrary module loading and symlink escapes. perl-Data-Entropy fetched random data over plain HTTP before version 0.010, which somewhat defeats the entire concept of entropy. rust-lru fixes a use-after-free it cheerfully labels obscure, and perl-Protocol-HTTP2 cleans up closed HTTP2 streams that were gradually eating memory.

RHEL pushed seventeen advisories, fifteen of them rated important. python-lxml, ansible-core, and rsync each appear multiple times across base releases and SAP Solutions streams, but it's the same fix applied in different places. nginx:1.24 and nginx:1.26 sit at moderate for the 9 module stream. The rest include podman, redis, and kernel-rt targeting the 9.6 EUS stream, plus a curious security patch for delve, the Go debugger, riding on the 9.2 SAP Solutions stream. Check the CVSS scores behind each CVE before reshuffling your update queue. The moderate rating for nginx still means you patch it.

Rocky Linux mirrors the RHEL nginx push with three moderate advisories. EL9 gets both 1.24 and 1.26, while EL8 only sees the 1.24 bump. It's roughly what you'd expect from a distro past its prime. Debian keeps it surgical with DSA-6498-1. The L2TP VPN plugin for Network Manager gained two privilege escalation holes, but the catch is that an attacker already needs permissions to create and activate personal VPN connections. Fix a single package, 1.20.20-2+deb13u1, and the trixie threat drops away.

A Detailed Overview of the Updates

Debian GNU/Linux

One Debian Security Advisory came out on September 14, 2026, and it targets something fairly specific: the L2TP VPN plugin for Network Manager. Good news if you've never heard of it, since most people don't live here.

The headline (DSA-6498-1) is straightforward enough. Andres Berbescu found two vulnerabilities in the L2TP connection plugin that let a local user escalate to root. The catch is the fine print: the attacker already needs permissions to create and activate personal VPN connections. So this isn't a "runaway from anywhere" hole. It's still a real privilege escalation for anyone who can get that far, and the fix is a single package upgrade for trixie.

Fedora Linux

Fedora's security notifications got quiet-busy last week, pushing a batch of fixes to both Fedora 43 and Fedora 44. You're looking at twelve advisories, but they really come down to six distinct packages, each reissued across the older and newer release. Six are patched CVEs, and each one still ends with the same two words: just update.

The most awkward of the bunch is perl-Dancer2. The web framework was building session IDs from low-entropy sources whenever its preferred randomness libraries weren't installed, which makes "session ID" and "guessable" nearly synonyms. Fedora pinned Crypt::URandom and Math::Random::ISAAC::XS as hard requirements now, so you can't accidentally ship without good randomness anymore.

Two separate problems landed in perl-DBI. One lets you load arbitrary modules and files through the dbm_type/dbm_mldbm options, and the other let symlinks escape boundaries they shouldn't. There's also a 32-bit Perl test fix, which you probably won't care about unless you actually run a 32-bit Perl install.

The Perl entropy module has its own small absurdity: Data-Entropy was fetching random data over plain HTTP before version 0.010, which somewhat defeats the entire concept of entropy. An encrypted transport might be a good idea for a thing whose name is literally "entropy."

On the Rust side, the lru cache crate carried a use-after-free bug that the advisory cheerfully labels "obscure," which I read as "you need a very specific set of conditions to hit this, but it's still a use-after-free." Worth squashing either way. perl-Protocol-HTTP2 fixes a denial-of-service where closed streams weren't being cleaned up, gradually eating memory. It also fixes a license wording issue, because at some point someone decided the license text needed a polish.

Every update is signed with the Fedora GPG key, and you apply them with dnf upgrade --advisory plus the advisory ID from each notice.

Red Hat Enterprise Linux

Red Hat pushed a fresh batch of security errata across Red Hat Enterprise Linux 8, 9, and 10. The batch contains 17 advisories, and 15 of them land at "Important" severity. Just two rate "Moderate": the nginx:1.24 and nginx:1.26 module updates. A moderate score for something as widely dropped into production as nginx still means you patch it anyway.

A few names repeat, and this isn't a data-entry slip. Red Hat routinely fans one package out across its base releases, its Extended Update Support streams, and its Update Services for SAP Solutions offerings. That's why python-lxml and ansible-core each appear three times and rsync twice. It's the same fix, applied in more than one place, so you'll end up running it more than once.

The remainder are single-target advisories. The ones most people will actually look at include podman, redis, and kernel-rt (the last two both aimed at the 9.6 EUS stream), plus rsync's dual bump, which doubles as a bug-fix and enhancement update. There's also a curious one: a security patch for delve itself, the Go debugger, riding along on the 9.2 SAP Solutions stream.

Before you work through the whole thing, the CVSS scores behind each CVE are worth a click, since the Moderate/Important split doesn't always match what actually breaks in production.

Rocky Linux

Rocky Linux just pushed three nginx security advisories, and if you're running the module on anything below 1.26, this is worth a glance. All three sit at a Moderate severity rating, so they aren't the kind of thing that should make you drop everything, but they aren't nothing either.

The spread is a little uneven. Rocky Linux 9 is getting both a 1.26 and a 1.24 update, while Rocky Linux 8 only sees a single 1.24 release. That's roughly what you'd expect, since the older distro is well past prime and the 1.24 line is still getting patched while the 1.26 line gets its own treatment.

Every advisory ties its CVEs to CVSS base scores, so you can judge how loudly each one actually screams before reshuffling your update queue.

SUSE Linux

SUSE filed eight security advisories in one push, and the ratings tell you most of the story. Five of them target openSUSE Tumbleweed and land at "moderate"; three are enterprise fixes rated "important," which is the tier that actually deserves your time.

The headliner is SUSE-SU-2026:4156-1. It's pitched as a Firefox update, but that undersells it, because it also drags in mozilla-nspr, mozilla-nss, and rust-cbindgen and carries 139 fixed vulnerabilities. Firefox climbs to ESR 153.2.0, the version most shops actually run. SUSE names the full roster of affected systems, from SUSE Linux Enterprise Server 15 SP4 through SP7 to the Micro and HPC variants, so if any of those host a browser this is the one to patch first. A good share of those 139 are use-after-free and privilege escalation bugs, which is the more interesting flavor of the two.

The clamav advisory (SUSE-SU-2026:4180-1) also reaches important and takes the package to 1.5.4. It shuts up nine vulnerabilities that are mostly memory-safety glitches in the archive and document parsers: zip, PDF, Mach-O, and XAR all show up. ClamAV lives on untrusted input, so those are the ones you'd rather not have sitting there. One of them, CVE-2025-8088, is from a 2025 batch that simply hadn't reached SUSE's packaging until now.

The python39 fix (SUSE-SU-2026:4174-1) is important too, with nine CVEs that lean toward the toolchain: pip's ZIP handling, tarfile path traversal, unicodedata normalization, and HTMLParser CPU exhaustion. Five of them either drop files where they shouldn't or burn a core doing nothing. Coverage is narrower here, hitting only openSUSE Leap 15.3 and SLE 15 SP5.

The remaining five are the Tumbleweed crowd, all moderate. Tomcat appears twice: tomcat11 at 11.0.25 and the older tomcat at 9.0.121, each absorbing the same eleven CVEs, which makes sense given they're two majors of the same server. Python shows up a second time as python311 (4 issues) and python312 (2 issues), both sharing CVE-2021-4189 and CVE-2026-9669. The stray is libBasicUsageEnvironment2, part of the live555 multimedia stack, fixing a single CVE but worth a glance since those libraries turn up in streaming and IoT gear. The moderate rating reflects how easy the bugs are to exploit, not how worthless the fixes are. Rolling releases ship patches fast, but they also ship with the bugs exposed to whoever runs them, so treat these as routine housekeeping.

Ubuntu Linux

Ubuntu's September 14 security batch spans eight notices and covers the usual spread: remote code execution, denial of service, and a couple of "please actually reboot" gotchas. Two things stand out. First, several of these still sit behind Ubuntu Pro even when the release in question isn't old. Second, one vendor—nginx—actually apologized for the headache it caused, and for good reason.

The nginx notice is the messy one. Ubuntu's first fix for CVE-2026-42533 caused a regression, so they pulled it back out and shipped a corrected patch in its place. That same notice closes two more holes, a use-after-free in the Server-Side Includes path and a flaw in the slice module, so you're getting three CVEs bundled together here.

The rest of the remote-facing issues vary in nastiness. Freeciv and libvips both simply crash on malformed input (network traffic, and a TIFF being saved as HEIF, respectively), so those are denial-of-service cases. Konsole is worse: it runs programs as your login user when you open a crafted URL. cgit is the oddball, still affecting only Ubuntu 16.04 and carrying a CVE from 2018, which says more about how long 16.04 has lingered than about the flaw itself.

The two that deserve the most attention are local. libinput doesn't escape device properties, letting a local user inject udev settings and reach root, while dracut can be pushed by a rogue DHCP server on the nearby network into running commands as root during boot-failure handling. Both land on newer releases (libinput on 26.04 and 24.04, dracut on 26.04) and neither requires Ubuntu Pro. Yelp finishes the set by letting help documents run scripts, which only bites you if you actually open a malicious file.

Patch what you can. For anything marked with a ~esm1/+esm1 suffix or an "Available with Ubuntu Pro" line, you'll need an active Pro subscription. Restart Freeciv after the update, and reboot for dracut, otherwise you're just running old code under a fresh patch number.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y