Linux distributions pushed significant security updates today with BIND facing widespread exploitation attempts as AlmaLinux and Ubuntu released patches for cache poisoning and DNSSEC validation flaws. MySQL 8.4 jumped versions while AlmaLinux shipped a rebased build to address roughly two dozen issues touching the optimizer and replication engine, and RHEL rolled out updates for OpenShift and MicroShift. Ubuntu's release drew attention for a messy nginx revert after an initial regex fix caused breakage in the wild, alongside patches for .NET, libheif, and legacy curl packages. Other critical advisories include SUSE closing 19 holes in Erlang, Debian's Firefox ESR update with 28 CVEs, and Gentoo's urgent push for remote code execution fixes in quickjs-ng and libssh2.

Linux Security Roundup: RHEL, Ubuntu, Debian Push Critical Patches; nginx Fix Reverted

Linux distributions are rolling out a heavy batch of security updates this week, and the servers running BIND, MySQL, or nginx need your attention immediately. AlmaLinux, RHEL, Debian, and Ubuntu all pushed patches, covering vulnerabilities ranging from privilege escalation to remote code execution. If you haven't run your package manager in a few days, it's time.

BIND is taking a serious hit across the ecosystem. AlmaLinux shipped six separate CVEs for BIND 9.18 on AlmaLinux 9, covering wildcard RPZ bypasses, DNSSEC validation flaws, and cache poisoning. Ubuntu followed with eight CVEs for bind9 across 22.04, 24.04, and 26.04. The issues touch NSEC3 impersonation, resource exhaustion, and validation quirks. If you run a recursive resolver or rely on Response Policy Zones, skipping this update is a bad idea.

MySQL 8.4 is jumping versions in the AlmaLinux build. The distro pushed a rebased release moving from 8.4.10 to 8.4.11 to address roughly two dozen issues touching the optimizer, replication, and InnoDB engine. RHEL followed suit with MySQL 8.4 updates for RHEL 8 and 9. OpenShift also got a bump, with RHEL shipping 4.19.43 for both OpenShift and MicroShift. Keep in mind that OpenShift and MicroShift updates usually require maintenance windows.

Ubuntu's nginx mess

The nginx situation on Ubuntu is the kind of thing that happens when patches land faster than QA can validate. Ubuntu initially shipped USN-8563-3 to fix a regex handling bug that could crash the server or run arbitrary code. Days later, they admitted the patch broke things in the wild and pulled it back with USN-8563-4. Ubuntu said the revert is pending a cleaner solution. If your stack relies on nginx, watch the Ubuntu security list closely until a replacement arrives.

Beyond nginx, Ubuntu listed eight separate security notices. .NET 8 and 10 picked up four fixes for HTTP request smuggling, sensitive data leakage, and a privilege escalation bug in the diagnostics IPC layer. libheif, Cap'n Proto, and libssh2 rounded out the batch with memory handling and bounds checking fixes. Curl and libpng also received updates that reach back to Ubuntu 14.04. If you are still running machines on that release, you already know the score.

The rest of the field

AlmaLinux's twelve errata include some nasty bugs beyond BIND and MySQL. Performance Co-Pilot has four CVEs, including a command injection path that escalates to root and an unauthenticated endpoint that sidesteps access controls. CVE-2026-16524 gives you command execution, and CVE-2026-16527 exposes the /store endpoint. Python got a tarfile extraction filter bypass that lets code escape the destination directory. sg3_utils has a udev property injection that enables arbitrary command execution via sg_inq --export. Not exactly a good time to be ignoring patch cycles.

SUSE is going hard on Erlang. SUSE-SU-2026:3645-1 closes 19 holes, including DNS cache poisoning, certificate chain forgery, MITM hostname bypass, and heap overflows in the transport layer. The fixes also address SFTP path leakage and an httpc header leak on redirects. It's a heavy lift, but the CVSS scores justify the urgency. Python 3.11 on SUSE is leaner, targeting two CVEs linked to a regression in http.cookies.

Debian issued four advisories. Firefox ESR (DSA-6451-11) is the headline, with 28 CVEs covering arbitrary code execution, privilege escalation, and same-origin policy bypasses. OpenStack Designate has two tenant-isolation flaws that let one user tamper with another tenant's DNS zones, paving the way for hijacking. Ruby-grape landed a regression patch because a prior ruby-rack security update accidentally tripped a test failure. Sticking to the recommended package versions will keep you covered.

Gentoo has three high-severity updates, and the advisory language makes the situation clear. quickjs-ng has three CVEs for arbitrary code execution, and libssh2 has four CVEs including remote code execution over SSH. There are no workarounds for either. The Emacs advisory flags a flaw that triggers arbitrary code execution just from opening a crafted file. Apply the update. Now.

Rocky Linux is mirroring the RHEL family with patches for .NET 9.0 and 10.0 on Rocky Linux 9, plus updates for Python, MySQL, and GStreamer on Rocky Linux 8. Two advisories hit Moderate severity, but the rest carry the Important tag. Pull up the linked errata if you want to see how nasty the underlying CVEs actually are before you run your package manager.

A detailed overview

AlmaLinux

AlmaLinux pushed twelve errata splitting patches across versions 8, 9, and 10. The batch is dominated by security fixes, with severities landing firmly in the Moderate to Important range. BIND takes the heavy hit on the DNS side, absorbing six separate vulnerabilities that touch wildcard policy bypasses, DNSSEC validation shortcuts, and cache poisoning vectors. MySQL follows the July CPU cycle with a long list of fixes, pushing the database from 8.4.10 to 8.4.11 to address roughly two dozen issues across replication, the optimizer, and the InnoDB engine. Performance Co-Pilot brings its own four CVEs, including a command injection path that escalates to root and an unauthenticated endpoint that sidesteps access controls. PHP stays on the lighter side, just patching a denial of service flaw in OpenSSL's AES-WRAP-PAD implementation. Python, PAM, attr, GStreamer, and sg3_utils round out the release with the usual filesystem, authentication, and decoder edge cases. If you run any of these services, the window to apply these patches is narrow.

Debian GNU/Linux

Debian issued four security advisories and if you are managing legacy or LTS systems, you will want to apply them promptly. The batch mixes routine maintenance with some genuinely annoying bugs. Ruby-grape lands a regression patch because a prior security update to ruby-rack accidentally tripped a test failure in grape's Rack::Sendfile code. Firefox ESR takes the center stage with twenty-eight CVEs attached, covering arbitrary code execution, privilege escalation, and same-origin policy bypasses. Swift users need to close two doors to SSRF and denial-of-service attacks. OpenStack's Designate finishes the list with two tenant-isolation flaws that let one user tamper with another tenant's DNS zones, paving the way for hijacking or outages. Sticking to the recommended package versions will keep you covered.

Gentoo Linux

Gentoo issued three high-severity security updates. The quickjs-ng advisory flags three CVEs that could hand an attacker arbitrary code execution through the lightweight JavaScript engine. Libssh2 adds four CVEs to the mix, with the most dangerous case enabling remote code execution over SSH. Emacs closes out the list with an arbitrary code execution flaw that triggers just from opening a crafted file. You are not going to find a creative workaround for quickjs-ng or libssh2, so you have exactly one task: upgrade. The Emacs issue buys you a little breathing room if you stop opening suspicious files, but applying the update remains the only sensible move.

Red Hat Enterprise Linux

Red Hat shipped a fresh wave of security patches covering RHEL 7 through 10. If you manage any of these systems, your update manager will likely light up. The batch leans heavily on infrastructure staples: OpenShift and MicroShift both got bumped to 4.19.43, kernel and kernel-rt updates rolled out for RHEL 8, and the usual suspects like bind, postfix, and ansible-core received their security treatments. OpenJDK dominated the release, with builds for versions 8, 11, 17, 21, and 25 landing for both Linux and Windows targets. Most of these land as Important or Moderate severity ratings, so expect to schedule maintenance windows for the production clusters running OpenShift and the database nodes sitting on MySQL 8.4.

Rocky Linux

Rocky Linux is rolling out a fresh batch of errata for both Rocky Linux 8 and 9. You will find security patches landing for .NET 9.0 and 10.0 on the newer release, alongside Python, MySQL, GStreamer, and a few system utilities on the older branch. Two advisories land at Moderate severity, but the rest carry the Important tag. If you are running any of these packages, applying the patches promptly is the move. CVSS scores back up each advisory, so pull up the linked errata if you want to see how nasty the underlying CVEs actually are before you run your package manager.

SUSE Linux

SUSE pushed two important security patches and if you are running Erlang or Python 3.11 on their 15.x releases, you should probably apply them before someone else does. The Erlang rollout (SUSE-SU-2026:3645-1) is the heavier lift. It closes 19 holes ranging from DNS cache poisoning and certificate chain forgery to a handful of stack and heap buffer overflows in the transport layer. You will also see fixes for SFTP path leakage, an httpc header leak on redirects, and several denial-of-service vectors tied to malformed TLS handshakes and FTP bounce attacks. The affected catalog spans openSUSE Leap 15.3 and SLES 15 SP4 through SP7 across Server, SAP, HPC, and Real Time editions. Packages move to erlang-23.3.4.19-150300.3.39.1.

The Python 3.11 patch (SUSE-SU-2026:3648-1) is considerably leaner, targeting just two CVEs linked to a regression in http.cookies. It rolls out to openSUSE Leap 15.6 and SLES 15 SP6 and SP7 (including the SAP variant). You will get python311-3.11.15-150600.3.65.1 after applying it. Both updates carry an important rating, so plan your patch windows accordingly.

Ubuntu Linux

Ubuntu shipped a midweek patch window covering eight separate security notices, plus a follow-up to a broken nginx fix. The headline story is the pair of nginx advisories. The first one addressed a regex handling bug that could crash the server or run arbitrary code. Days later, Ubuntu admitted that initial patch broke things in the wild and reverted the change pending a cleaner solution. If your stack relies on nginx, you will probably want to watch that track until a replacement lands.

Bind9 rounded out the batch with eight CVEs. Most of them deal with DNSSEC validation quirks, cache poisoning, and memory tracking. If you run a recursive resolver or rely on Response Policy Zones, skipping this update is a bad idea. .NET 8 and 10 picked up four fixes ranging from HTTP request smuggling to an elevation-of-privilege bug in the diagnostics IPC layer. Smaller but still relevant patches landed for libssh, LibTIFF, libheif, and Cap'n Proto. The latter two mostly tackle memory handling and HTTP smuggling edge cases. On the legacy side, curl and libpng received updates that reach all the way back to Ubuntu 14.04. If you are still running machines on that release, you already know the score.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world