A wave of distro security advisories landedtoday, and the same cluster of flaws is showing up across AlmaLinux, RHEL, Oracle Linux, Rocky Linux, and SUSE. The most urgent target is unbound, which received Critical ratings for DNSSEC remote code execution on nearly every major distribution. Fedora's webkitgtk 2.54.0 jump quietly fixed hundreds of ANGLE and Skia CVEs on top of its listed 26 WebKit bugs. If you run a DNSSEC resolver or a Chromium-based browser on any of these distros, point your patch commands at those two first.

Today's Linux Security Roundup: The Same Four Bugs, Eight Distro Hats

The latest batch of distro security notes is a reminder that upstream vulnerabilities don't care about your package manager. A small set of flaws is showing up across nearly every major Linux distribution today, from AlmaLinux to SUSE, and the recurring names should tell you where to point your attention.

The loudest one is unbound. Critical-rated remote code execution in DNSSEC handling. It landed in AlmaLinux, RHEL, Oracle Linux, Rocky Linux, and SUSE all within the same 24-hour window. If you run a DNSSEC resolver on any of those, the clock is ticking harder than on the rest of this batch.

The unbound problem, and why it's worse than the CVE count

The vulnerability sits in CNAME synthesis, where a resolver can be coaxed into executing code. There are also heap buffer overflows tied to DNSSEC and DNSKEY processing, and at least one path that ends in remote code execution.

That combination is exactly what earns a Critical stamp, and unlike a lot of those ratings, this one has to do. The same three-CVE set appears in both the AlmaLinux 8 and AlmaLinux 10 advisories, then reappears on RHEL 9, RHEL 9.2 for SAP, and RHEL 9.4 for SAP. Oracle Linux has it twice too.

Keep in mind that unbound tends to live quietly behind firewalls, which is what makes this particular class of flaw so useful to an attacker. You patch this ahead of everything else on the list.

The Go standard library, quietly touching everything else

If you skim the full tables, you'll spot something a little uncanny. The same eight Go standard-library CVEs appear in Grafana, then a five-CVE subset of the same group splits between skopeo and buildah. They're mostly denial-of-service and XSS issues threaded through net/mail, net/url, and encoding/xml.

It's a recurring bit of open-source continuity: unrelated tools shipping identical fixes from one upstream stdlib release, quietly letting a single change touch a chunk of the container tooling at once. You probably won't get excited about it. You'll still patch it.

AlmaLinux's perl-DBI entry is the same story on a smaller scale, and perl-DBI shows up again on RHEL, Oracle Linux, and Rocky. Same placeholder-limit fix, CVE-2026-73194, dressed up in different advisory IDs.

The numbers that make you check your browser

Fedora's webkitgtk jump to 2.54.0 is the entry that asks you to verify your desktop isn't exposed. The web engine powers a lot of native Linux apps, so it's living in more places than you'd expect. The changelog lists 26 fixed WebKit CVEs, then quietly admits it also patched a couple hundred ANGLE CVEs and several dozen Skia CVEs.

The notable code change is the web process compositor moving from TextureMapper to Skia, with new APIs for favicons, page zoom, and per-navigation User-Agents. Worth flagging that dropping cairo for 2D rendering breaks some Evolution styles, and the author, Michael Catanzaro, apologizes directly in the notes for it. It's about as charming as a security patch gets.

One detail that never quite lands: several bug summaries describe "unexpected Safari crashes," which is a little jarring for a GTK component.

SUSE's own big number is a kernel update for SLE 15 SP5 RT that quietly packed 84 vulnerabilities into one patch. Most of them are routine network and memory-cleanup weeds, but the sheer volume justifies the reboot. Then there's chromium, with one entry shipping 42 bugs and another 16, both on Chromium 153. If you watch the browser vendors, neither is surprising. Stacking 42 CVEs in a single bump still reads like a fix-this-week rather than fix-next-quarter situation.

The rest is mundane, and that's fine

Most of this batch is the kind you install without reading. Red Hat pushed 40 errata in one digest, and almost all of them sit at Important, with only two Moderate slips through for glib2 and rrdtool. The kernel takes the biggest slice, spanning RHEL 8 and 9 including the older Extended Lifecycle Support tracks, with two more going to the real-time build.

RHEL 6 still appears on that list, patched through the ELS extension, which is its own gentle reminder of how long these long-lived releases actually run.

Oracle Linux had one line that earned an eyebrow raise. Its cockpit-image-builder advisory says it "switch to old frontend," a phrasing that usually means someone rolled a broken change back instead of actually fixing it. Minor. But you can feel the resignation in it.

Slackware stacked nine issues into PHP 8.2.34, spanning FPM, OpenSSL, Phar, and SOAP. A FastCGI ACL bypass that lets IPv6 addresses slip past listen.allowed_clients is the kind you actually worry about.

Debian's OpenSSL fix for bookworm is the other one worth a look. CVE-2026-75803 is a case where an empty ciphertext can read as a successful decryption if you finish the operation the wrong way. That kind of thing tends to end badly.

What you should actually do

Point your usual patch commands at the two Critical targets first: unbound, everywhere it appears, then the Chromium updates if you use a Chromium-based browser. The webkitgtk change on Fedora is in the same bucket once you accept that it also quietly fixed hundreds of ANGLE and Skia issues. Everything else on Important can wait a day or two.

The Updates in Detail

AlmaLinux

AlmaLinux circulated a batch of security errata across versions 8, 9, and 10 in late September 2026. Most land at the standard "Important" severity, but two entries carry a Critical rating that you should sort through first.

The PostgreSQL:15 patch for AlmaLinux 9 is the crowded one, carrying 16 CVEs. Most boil down to arbitrary code execution: integer wraparound, heap buffer overflows, type confusion, a couple more via plperl and pltcl on 32-bit installs, plus a privilege escalation hiding in EXTRACT() deparse. Anyone running that database should treat this as a mandatory reboot.

Two unbound updates get the Critical stamp, and this isn't gratuitous alarmism. Both cover the DNSSEC resolver and hand out remote code execution in CNAME synthesis, alongside two heap buffer overflows tied to DNSSEC and DNSKEY handling. If your stack leans on unbound, apply these ahead of everything else.

The rest is more mundane. Grafana picks up the same eight Go standard-library CVEs across all three versions, and skopeo and buildah each borrow a five-CVE subset of the same set. They're mostly denial-of-service and XSS issues spread through net/mail, net/url, encoding/xml and the like. It's a recurring bit of open-source continuity: unrelated tools shipping identical Go fixes, quietly letting one upstream stdlib release touch a chunk of the container tooling. You probably won't get excited, but you'll patch them anyway.

AlmaLinux 8 also gets two kernel updates, one for the regular build and one for the real-time variant. They cover use-after-free races, PPPoE and SCTP memory corruption, and out-of-bounds reads in the NVMe and SCSI stacks. The two share several patches, so you're essentially closing the same holes twice under different names.

Debian GNU/Linux

Debian's been handing out security patches all week, and if you're running anything older than the current stable release, there are a few you'll want to install. The batch mostly covers the usual suspects: a crypto toolkit, a database, an office suite, and two JSON-y tools with their own little dramas.

The big one is OpenSSL for bookworm. Six CVEs, several of which touch the Certificate Management Protocol, and at least one, CVE-2026-75803, where an empty ciphertext can look like a successful decryption if you finish the operation the wrong way. That kind of thing tends to end badly, so this is genuinely worth a reinstall.

Redis picked up two fixes for bookworm, including a use-after-free in TLS handling that would have let an unauthenticated remote attacker run commands as the Redis server. That's the kind of bug you don't want sitting around.

LibreOffice and jq are both fixed for trixie. LibreOffice's eight CVEs are your typical "open a malformed document and regret it" class, denial of service, information disclosure, maybe arbitrary code execution. jq is a follow-up: the previous security patch for trixie broke module loading, so this one fixes the fix. Something got registered before its own dependencies, and any module reached only transitively fell over with an assertion failure. You've probably noticed if this bit you.

Meanwhile the libdatetime-timezone-perl update is less urgent, all it does is pull in the tzdata 2026c timezone changes across stretch, buster, and bullseye, but it's still worth doing since your clock could otherwise be off.

Fedora Linux

Fedora pushed a batch of updates on 2026-09-25, and most of them are the kind you install without reading and move on with your day. One of them is an exception, and it involves the kind of CVE count that makes you want to check whether your browser is currently open.

The standout is webkitgtk jumping to 2.54.0. This is the web engine that powers a lot of native Linux apps, so it tends to live in more places than you'd expect. The changelog lists 26 fixed WebKit CVEs right there in the advisory, then admits in plain text that it also quietly patched "a couple hundred or so ANGLE CVEs and several dozen Skia CVEs." That's a security update wearing a maintenance coat. The notable code changes: the web process compositor moves from TextureMapper to Skia, damage handling got tightened up, and there are a few new APIs for favicons, page zoom, and per-navigation User-Agents. Worth flagging that removing cairo for 2D rendering means some Evolution styles break. The author, Michael Catanzaro, apologizes directly in the update notes, which is about as charming as a security patch gets. One funny detail: several of the bug summaries describe "unexpected Safari crashes," which is a little jarring for a GTK component.

The rest of the batch is far quieter. squid gets a straight-up version bump to 7.7 with no further elaboration, as if just showing up is the whole story. rust-cryptoki and pcs land on both Fedora 44 and 43, with pcs doing the most actual work by rebasing onto a newer major version and dropping its Ruby dependencies (ethon and ffi) in favor of curb. mingw-gdk-pixbuf and 389-ds-base are the boring-but-necessary backports: two CVEs patched into the image library, and a pile of SASL, PBKDF2, and replication vulnerabilities sorted out in the directory server.

Oracle Linux

Oracle Linux delivered another round of advisories spanning OL7 through OL10, and this batch leans hard on security fixes. Twenty-one updates in total cover everything from kernel networking and DNS resolution to database engines and the bits of your stack you'd rather not think about.

A couple of items dominate the pile. The OL9 kernel (5.14.0-687.51.1) ate a full round of netfilter fixes, where a single author showed up with an entire shelf of patches, alongside a large batch of ice NIC driver corrections and 13 flagged CVEs plus many more handled inline. FreeIPA on OL9 lands as Critical with eight CVEs, including a privilege-escalation path and an unauthenticated credential grab. That is the kind of thing you want landed fast.

Unbound shows up twice, both Critical, both about heap corruption and buffer overflows in the DNSSEC machinery. Postgres gets a broad sweep on OL8 across the :12, :15, and :16 modules, and OL9 gets its own separate Postgres:13 patch. perl-DBI also turns up on both OL8 and OL9 with the same placeholder-limit fix.

On the quieter side are the scap-security-guide updates for OL8, OL9, and OL10, which are basically STIG profile refreshes plus a little reference-fixing and some OpenELA renaming. If CIS or STIG alignment is on your checklist, pay attention. Otherwise treat them as background noise.

One line earned an eyebrow raise: cockpit-image-builder "switch to old frontend." That phrasing usually means upstream broke something and they rolled it back instead of fixing it. Minor, but you can feel the resignation.

Red Hat Enterprise Linux

Red Hat just posted one of those end-of-week bulk security rounds, pushing out 40 errata for Red Hat Enterprise Linux in a single notification digest. The one entry that should make you move quickly is unbound. Red Hat rated three of them (the DNS resolver) as Critical, landing on RHEL 9, RHEL 9.2 for SAP, and RHEL 9.4 for SAP. That's the package to patch first. Everything else in the batch sits at "Important," with only two Moderate updates slipping through: glib2 on RHEL 9.6 EUS and rrdtool on the same track.

Kernel claims the biggest slice. Ten kernel errata span basically every flavor of RHEL 8 and 9, including the older Extended Lifecycle Support tracks. Two more go to kernel-rt, the real-time build, for SAP and RHEL 7. You'll also find three OpenShift Container Platform releases (4.14.74, 4.15.69, and 4.16.71) bundled with their usual mix of package patches and bug fixes, alongside standalone fixes for libxml2, tesseract, python-cryptography, perl-DBI, openssl, and firefox.

And look: RHEL 6 is still on this list. Red Hat keeps patching it through the Extended Lifecycle Support extension, which is its own little reminder of how long these long-lived releases actually run.

Rocky Linux

Rocky Linux has pushed a batch of security advisories, and if you run any of these packages it's worth a look. The updates span Rocky Linux 8, 9, and 10, with most landing at the "Important" severity level. Two get the "Critical" stamp, and those are the ones to prioritize.

The clearest standout is ipa on Rocky Linux 9, which does more than just patch holes—it folds in bug fixes and enhancements alongside the security work. unbound on Rocky Linux 10 also picks up the Critical rating. The rest are straightforward security-only patches.

You'll find two kernel updates in here as well: a standard one for Rocky Linux 9 and a real-time variant (kernel-rt) for Rocky Linux 8. Note that the advisory text doesn't spell out individual CVSS scores or list specific CVEs, but each one links out to the CVE list where those details live.

Slackware Linux

Slackware hasn't been shy about stacking problems into this PHP release. The 8.2.34 package for Slackware 15.0 (with 8.5.11 heading for -current) addresses nine separate security issues, spanning FPM, OpenSSL, Phar, SOAP, and the standard stream wrappers. A handful of them are the kind you actually worry about: a FastCGI ACL bypass that lets IPv6 addresses slip past listen.allowed_clients, a SOAP server path that recurses until it collapses, and a cross-origin credential leak riding along on HTTP redirects.

The version number says more than 8.2.34 has any right to. Nine distinct fixes in one point release usually means the bugs were found quickly and patched quickly, which is precisely the rhythm you want from a security update.

SUSE Linux

A steady stream of SUSE and openSUSE security notices went out Thursday, clustered almost entirely around openSUSE Leap 16.0 and SLE 15. Sixteen of the 37 entries rate important or higher, and a couple of them are worth a look before you start typing zypper patch.

The single biggest number is SUSE-SU-2026:4347-1, a kernel update that quietly packed 84 vulnerabilities into one patch for SLE 15 SP5 RT. Most of those are routine network and memory-cleanup weeds, but the sheer volume justifies the reboot. The two chromium entries play the same game more openly: one ships 42 bugs (critical), the other 16 (important), both on Chromium 153. You can't call either surprising if you watch the browser vendors, but stacking 42 CVEs in a single browser bump still reads like something to fix this week rather than next.

Two entries earn the critical tag for reasons beyond raw count. apptainer (SUSE-SU-2026:21927-1) bundles a gRPC and crypto-library refresh that includes an authentication bypass, which is the flavor of flaw you would rather not have parked under a firewall. The second kernel live-patch round (SUSE-SU-2026:4342-1, Live Patch 29) retreads the same four kernel vulnerabilities as Live Patch 27 minus one, so if you already applied the earlier patch most of the ground is covered.

A few things to keep in mind. The govulncheck-vulndb announcement (openSUSE-SU-2026:21897-1) advertises 91 vulnerabilities, but this is really a database refresh for a Go vulnerability scanner, not 91 flaws sitting in your own stack. The util-linux update ships two breaking changes for unprivileged users around path canonicalization, so scripts leaning on X-mount.nocanonicalize may need a second glance. The ffmpeg-7 and python-GitPython chunks bring 26 fixes each on top of upstream releases, which is more than most people decode in a single sitting.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all