Nine Linux distros shipped security updates between November 5 and 6, dominated by a Critical webkit2gtk3 roll-out that quietly absorbed 300+ CVEs across RHEL and AlmaLinux. Beyond the browser bugs, attackers could run code through SUSE's rsyslog template handling, AlmaLinux's 22-CVE .NET 10 batch, and Red Hat's OpenJDK 11 ELS bump. Several entries were more trouble than danger, including Ubuntu's self-reverting fixes that broke Jupyter and a setuid ntfs-3g flaw worth a closer look. Rank the pile by CVSS scores and patch the Criticals first before worrying about the Important long tail.

Nine distros ship a wave of Linux security updates today

Nine Linux distros shipped security updates between November 5 and 6, and the biggest stories are the ones that let attackers run code.

There is a lot to get through. Some of it, patch tonight. Some can wait for the next maintenance window. Let's start with the ones that matter most.

The names you should act on first

The single biggest headline is webkit2gtk3. Red Hat rated it Critical five separate times across RHEL 8 and 9, and AlmaLinux gave it the same tag on EL8. If any box of yours loads web content (and these days that's a lot of boxes), it almost certainly needs this one.

The batch quietly absorbed more than 300 CVEs pulled from Chromium's ANGLE and Skia rendering stacks on top of the WebKit engine itself. That includes sandbox escapes and remote code execution sitting right behind the renderer.

For what it's worth, three hundred CVEs in a single package is a bit much. But that's also exactly why this one climbs to the top of the list.

The RCEs don't stop there. SUSE's rsyslog picks up the only critical rating worth flagging on that side. A malformed RainerScript template can push untrusted data into the omfile module, reuse it as a path component, and hand you code execution as whoever runs the daemon. SUSE also scores the python-Brotli fix in the high 9s after its decoder took an out-of-bounds write. Two for one.

AlmaLinux shipped a different pile. .NET 10.0 picked up 22 vulnerabilities across .NET and ASP.NET Core, rolled out to all three of its OS versions at once. Red Hat pointed the same finger at OpenJDK 11.0.33, a Critical bump for both Linux and Windows builds under Extended Lifecycle Support. Java folks should probably look at this before their coffee gets cold.

The quirks, regressions, and shortcuts

Not everything is a zero-day, and a few entries deserve a closer look.

Debian's ntfs-3g update is worth it for one reason: the package runs setuid root. Any local user able to mount a bad filesystem reaches the vulnerable binaries directly. Fifteen issues there, mostly heap overflows triggered by a crafted NTFS image.

Then there's Ubuntu, which this week reads like a fix-then-fix-again cycle. Three advisories openly admit the earlier patch broke something real. HAProxy, FRR, and Tornado all need the second update in each pair. The Tornado one is arguably the most broadly annoying: its incomplete fix for CVE-2026-103263 broke static-file serving for anyone subclassing StaticFileHandler, and the notice names the obvious casualty. Jupyter.

Slackware kept it quieter. Its openssh update, SSA:2026-309-01, closes a password authentication bypass but only on systems built with PAM turned off. If your SSH stack uses PAM, you can likely keep drinking your coffee. The changelog admits the real root cause lives outside sshd anyway, so this is more damage control than a clean fix.

The Go debugger shows up three times across Rocky's list, twice in Oracle's, and again in both AlmaLinux and Red Hat's updates. The notes are terse: disable DWARF compression. Oracle's move was to switch off the broken feature rather than debug it. That is the kind of shortcut that tends to bite you later.

Keep your eye on SUSE's moderate-rated openSUSE Tumbleweed items flagged "on GA media," meaning fixes still being pushed onto install images you may not have grabbed since release. "Moderate" shouldn't fully ease you. php8 alone bundles two 9.2-rated issues.

An Overview of the Updates

AlmaLinux

AlmaLinux shipped a big batch of errata on November 5 and 6, 2026, spanning AlmaLinux 8, 9, and 10. You're getting 57 advisories in this round, and almost all of them are security patches. If any of the software below runs on a box you care about, most of them will want you to update.

Four carry a Critical rating, and two of them are the ones worth your attention right now. .NET 10.0 picked up 22 vulnerabilities spread across .NET and ASP.NET Core, and the fix rolled out to all three operating system versions at once. The other Critical is a webkit2gtk3 update for EL8 that quietly absorbed more than 300 CVEs from Chromium's ANGLE and Skia rendering stacks, on top of the WebKit engine itself. That's a wall of CVEs that still manages to include sandbox escapes and remote code execution sitting behind the renderer.

The Important tier has some meat too. glibc for AlmaLinux 9 closes a TOCTOU race in the dynamic loader that hands out arbitrary code execution, which is the more interesting flavor of Important. PostgreSQL grabbed three separate RCEs over missing input validation, and MariaDB across the 10.11 and 11.8 tracks fixed an RCE through wsrep_notify_cmd while getting rebased to 10.11.18 and 11.8.8 with Galera pushed to 26.4.27. You'll also spot the usual Mozilla stacking, where the same batch of browser fixes shows up in both a Firefox advisory and a separate Thunderbird one.

There's routine work in here as well, PHP chipping away at signed-character and NULL-pointer issues across 8.2, 8.3, and 8.4, tesseract doing what it always does with heap overflows, a couple of Go (delve) DoS and MITM fixes, and older advisories resurfacing for software long past its prime, like a 2021 Node.js 14 patch and an old Tomcat fix. The full breakdown is below, ordered by severity.

Debian GNU/Linux

The Debian Long-Term Support team pushed five security updates on November 5th. If you're running any of these on an older Debian release, patching yourself beats waiting for someone else to do it for you.

The biggest buckets of trouble sit in Chromium and OpenJDK 11. Chromium (DLA-4882-1) closes 20 CVEs covering arbitrary code execution, denial of service, and information disclosure. No granular details per vulnerability, which is normal when you're sweeping in a batch of browser bug fixes.

OpenJDK 11 is where the crowd actually gathered. ELA-1881-1 runs on the Extended LTS track maintained by FreeXian rather than the free LTS line, and it squashes roughly 44 CVEs for a runtime you'd assume would be on its last legs. The possible outcomes stretch from denial of service to bypassing sandbox restrictions, and that last one is what makes a pause worthwhile.

ntfs-3g (DLA-4883-1) is the update with the sharpest edge. Fifteen issues, mostly heap buffer overflows you trigger by crafting an NTFS image, plus a couple of denial-of-service reads and out-of-bounds memory reads. The part that bites: ntfs-3g runs setuid root, so any local user able to mount a bad filesystem can reach the vulnerable binaries. The advisory mixes assigned CVEs with TEMP placeholders that simply haven't gotten real numbers, along with a few GitHub Security Advisory IDs. One detail worth keeping: an upstream hard-fail that made file and directory creation break was reverted, though its run-list bounds fix stayed.

The final two are smaller and CVE-less. puppet-agent (DLA-4884-1) closes a gap from missing event-data validation that could allow code execution on the Puppet server. trapperkeeper-authorization-clojure (DLA-4885-1) fixes hostname ACL validation that let a Puppet client reach the catalogue of a different host. Both land in Debian 12 bookworm.

Fedora Linux

Fedora rolled out a fairly large security update round at once, spanning Fedora 43, 44, and 45. The maintainers clearly batched these rather than chasing each one separately, since most of the same packages show up on all three release lines.

The heaviest pile is the zstd compression library, where a single Rust update addresses fifteen separate RUSTSEC advisories across zstd-sys, zstd-safe, and the zstd crate themselves. Compat packages ride along for older version lines. Fixing unsoundness in low-level bindings is the unglamorous kind of work that keeps the whole language from looking bad, so this is probably the pile you actually want to install.

A separate wave hits the Perl web stack. Starman, Plack, HTTP-Headers-ActionPack, and MIME-tools all picked up fixes, mostly denial-of-service and filter-bypass holes. The MIME-tools update is the sprawling one, correcting a stack of boundary-parsing bugs and quietly capping some defaults (max_parts and max_depth now top out at 1000 and 64 instead of being unlimited). Most users won't feel the change, but you'll want to know if you'd ever pushed those limits yourself.

The rest is a grab bag of individual patches. Scribus 1.6.7 closes six CVEs, all pointing at arbitrary code execution through malformed image files. Tailscale took a battering of SSH vulnerabilities. WordPress 7.1.4 is a full-blown security release, with remote code execution during upgrades, a pile of stored XSS issues, and a root-certificate swap dragged in from the eMudhra mess. Goose leaks shell history and environment variables through its terminal integration, which is a mildly inconvenient thing for software whose job is to run code on your machine. And gpsd picked up yet another command injection fix, because those have a habit of multiplying.

Oracle Linux

Oracle Linux shipped a batch of advisories that span five operating system versions, from the veteran Linux 7 all the way up to Linux 10. If you run anything on that older OS, the ones you should actually care about are two kernel updates (9 and 10), a Firefox ESR bump on Linux 7, and a "Critical" rating for its automation manager. The rest is the usual mix of timezone refreshes and housekeeping.

The kernel updates are the big ones, and they carry more paperwork than fixes. Both 5.14.0-687.66.1 and 6.12.0-211.74.1 spend much of their changelog reshaping signing certificates, UKI signing, and aarch64 key handling. The real CVE fixes are buried in the second half, covering use-after-free bugs in sctp, resctrl, and openvswitch, plus a handful of s390 and XFS items. Read that as a normal kernel update if you ignore the crypto admin tasks.

Firefox on Linux 7 absorbed roughly 30 CVEs in one push to 140.14.0 ESR. Oracle keeps patching that aging release, which is either diligence or inertia and probably a bit of both. The same rolling pile-of-bugs pattern shows up in the gimp:2.8 update for Linux 8, which collects fixes going back quite a way.

The only badge wearing "Critical" is ol-automation-manager on Linux 9, where Oracle bumped PyJWT and backported two Pillow fixes, so skip it if you don't run that tooling. A "Moderate" cockpit-files update on Linux 10 simply stops dereferencing symlinks when pasting files or creating directories, a small but sensible change.

delve appears twice (Linux 9 and 10) with the same terse note: disable DWARF compression, because it had issues. Oracle's move was to switch off the broken feature rather than debug it. The tzdata refresh hit all four OS versions with identical news, no more leap seconds, Cuba pinning its clock at -04, and some cleaned-up 1960s Brazil data.

Red Hat Enterprise Linux

Red Hat just pushed another sweep of security advisories, and if your patch calendar looks like most ops teams, this is the batch you will circle in red. There are 43 updates here, spanning RHEL 6 all the way to RHEL 10, and the bulk sit at the "Important" tier. A few deserve your immediate attention.

webkit2gtk3 is the heavy hitter this round. It shows up five times, every one rated Critical, hitting RHEL 8 and 9 across the usual mix of Update Services for SAP Solutions, Extended Update Support, and the Telecommunications Update Service. If you run anything that loads web content, this lands near the top of your list. Java folks are under the same pressure: OpenJDK 11.0.33 gets a Critical bump for both its portable Linux and Windows builds under Extended Lifecycle Support, and there is a separate Important Java 11 OpenJDK ELS fix reaching across RHEL 7, 8, and 9.

Then there is Red Hat Satellite, and this one trips people up. Five Satellite advisories show up here, covering 6.16 through 6.19 plus the client itself. Their titles all read "Critical," but the body text mostly rates the actual security impact as "Important." The title is not a free pass, so treat the body rating as the real number.

The rest is the everyday long tail. You have qt5-qtbase again (several hits, all Important), Python 3.6 module updates scattered across the older RHEL 8 lines, and bind for the RHEL 6 and 7 ELS holdouts. There is also a scattering of oddballs to spot: goose, tesseract, flatpak, thunderbird, resteasy, ruby:2.5, and a Go debugger that arrives in an archive literally sharing its name with a verb you probably shouldn't use. Two land at Moderate: cockpit-files on RHEL 10 and glibc on RHEL 9.

The kernel is not forgotten. You get Important fixes for the mainline 7 ELS build and a realtime variant on the same line, alongside several kpatch updates for live-patching both SAP and non-SAP RHEL 8 and 9 systems.

So the tally is 29 Important, 12 rated Critical, and 2 Moderate. Patch the Critical pile first, then decide whether the Important stack can hold until your next maintenance window.

Rocky Linux

Rocky Linux has posted a batch of errata across releases 8, 9, and 10, and most of it is exactly the kind of security patching you want to install before someone writes an exploit against you. Eleven items land on the "Important" tag and three sit at "Moderate." Kernel updates show up on both 9 and 10, with a real-time kernel (kernel-rt) covering 8.

Two things are worth flagging. The debugger package delve appears three times across the list, nested in the go-toolset refresh on 8, then standalone on 9 and 10. The mod_auth_openidc fix for 8 is also listed twice, so there's no need to patch it twice, just once. Most of the batch is 2026-cycled errata, with that one mod_auth_openidc entry lagging back to 2023. The linked CVE list carries CVSS scores for every vulnerability, which is how you should rank the "Important" fixes against the "Moderate" ones instead of rebooting everything on a hunch.

Slackware Linux

Slackware has pushed an openssh update (SSA:2026-309-01) for 15.0 and -current. The headline fix is a password authentication bypass in sshd, but there's a qualifier that should give most people pause-free relief: it only bites systems built and run with PAM support turned off. Slackware's changelog admits the actual root cause lives outside sshd, yet they're patching it anyway since the daemon is the reachable entry point. If your SSH stack uses PAM, you can likely keep drinking your coffee.

A smaller change rides along in the same package: rc.sshd no longer tries to generate an obsolete DSA key. Install the upgrade as root with upgradepkg, then restart the daemon via rc.sshd, otherwise you'll be running a patched package file that nothing is actually using.

SUSE Linux

SUSE published a fresh pile of security advisories, and two of them clear the remote code execution bar that's worth breaking a maintenance window for.

rsyslog takes the only critical rating, and it earns it. A malformed RainerScript template can push untrusted data into the omfile module's dynaFile handling and reuse it as a path component, which is a fairly direct route to running code as whoever runs the daemon. The same advisory quietly closes a second hole, a RainerScript replace() length wrap.

The python-Brotli fix is cut from the same cloth: its decoder had an out-of-bounds write that remote attackers can turn into code execution, which is why SUSE also scores it in the high 9s.

The remainder is a big block of moderate-rated openSUSE Tumbleweed updates flagged "on GA media" — meaning SUSE is still pushing fixes onto install images you may not have grabbed since release. Don't let "moderate" put you fully at ease though. The php8 package alone bundles two 9.2-rated issues, and perl-Cpanel-JSON-XS quietly absorbs 15 CVEs. owntone is the odd one out: SUSE hasn't published CVSS scores for it yet.

As it happens, some of these overlap. CVE-2026-111943 (the 7.4-rated issue in regclient) shows up again in the go1.26 update, and CVE-2026-78663 appears in both kyverno and go1.26, so those systems have more than one update on their plate.

Ubuntu Linux

Today's Ubuntu security notices read like a fix-then-fix-what-you-broke cycle. Three of them are follow-up advisories openly admitting the earlier patch broke something real, so anyone running HAProxy, FRR, or Tornado needs the second update in each pair, not just the first.

USN-8972-2 goes back to the HAProxy denial-of-service holes from USN-8972-1: HTTP/2 PING frames and HTTP/1.1 chunked requests that could exhaust CPU. The fix landed, but on Ubuntu 22.04 LTS it broke certain chunked requests, and now that's repaired. haproxy reaches 2.4.30.

FRR (USN-7230-3) had the worst story. The fix for CVE-2024-55553, where a socket buffer overflow forced full route revalidation, left RPKI processing half-dead: FRR takes the first RPKI update and then stops, so routes never get revalidated as RPKI data changes. On Ubuntu 20.04 LTS the BGP daemon wouldn't even start with RPKI enabled.

Tornado (USN-8952-2) is arguably the most broadly annoying. Its incomplete fix for CVE-2026-103263 broke static-file serving for anything subclassing StaticFileHandler, and the notice names the obvious casualty directly: Jupyter. The original advisory covered denial of service, information exposure, and access-control bypass.

The ca-certificates update (USN-9001-1) is the honest small bug here. Strip a CA from the system bundle and the JKS keystore used by Java keeps trusting it anyway. Nothing lets an attacker in on its own, but your trust store is quietly out of sync in two formats. It reaches Ubuntu 26.10, 26.04, 24.04, and 22.04.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all