Seven Linux distros rolled out security updates this week, led by SUSE's Critical WebKit2GTK3 patch packing 233 CVEs and pushing the package to 2.54.1. Debian and Ubuntu came hot on the heels of that haul, with Firefox ESR absorbing 59 CVEs and curl plus Bind stacking up 27 and 24 respectively. Exim tops Fedora's October 15 batch with RCE and SMTP smuggling fixes, while Red Hat, AlmaLinux, and Rocky round out a heavy round of kernel, domain-controller, and package patches. The practical advice is to patch the remote-facing stack first, curl, Bind, and exim before everything else—rather than reacting to severity badges alone.

A busy day of Linux security patches lands across seven distros, headed by a 233-CVE WebKit pile

A fresh batch of distro-level security updates has rolled out over the last couple of days, and the through-line today is that some maintainers are comfortable throwing a lot of CVEs at the wall. SUSE's top advisory folded 233 CVEs into a single WebKit2GTK3 bump. Firefox ESR picked up 59 in a Debian notice. And somewhere in the middle of all that, curl and Bind are clearly having their worst stretch in memory.

Here's what actually deserves your attention, and where you should point your package manager first.

SUSE leads the pile

SUSE's only Critical rating this round lands on WebKit2GTK3. Advisory 4676 pulls in the entire upstream WebKitGTK/WPE security bulletin, landing 233 CVEs and pushing the package to 2.54.1 across openSUSE Leap 15.4 and SLE 15 SP4/SP5.

You're not going to read all 233 of them, and you don't have to. Almost all of them trace back to Google Chrome's Skia, ANGLE, and the renderer process. Same old story: sandbox escapes, out-of-bounds writes, use-after-frees.

If you run a GTK desktop and actually look at web content in something, do this one first.

The rest of SUSE's wave wants a reboot, so budget accordingly. Kernel advisories 4660, 4665, and 4668 carry 124, 110, and 86 fixes across the various service packs. SUSE tends to re-run the same fixes across successive service packs, so expect heavy overlap and a restart either way.

Then there's bind. Advisory 4664 carries ten CVEs for Leap 15.4 and SLE 15 SP4, including unauthenticated IXFR deltas applied before TSIG verification and a resolver crash from a use-after-free. The remote-rated entries matter most. Advisory 4657 is the smaller follow-up, three CVEs, different support channel.

Debian's Firefox haul and a baffling keystone miss

Firefox is the story in Debian. firefox-esr absorbed 59 CVEs covering arbitrary code execution, sandbox escapes, information disclosure, mitigation bypasses, and privilege escalation. That's a lot of ways to get owned packed into a single browser release. It's now in trixie at 153.5.0esr-1~deb13u1.

The real oddball in Debian's batch is keystone. DLA-4834-2 is LTS business for Debian 12 bookworm, and the flaw isn't a remote code execution hole at all. The service simply didn't restart after a security upgrade, which means a known-vulnerable process could keep running long after the package was patched. Debian's fix is a post-install script that explicitly restarts Keystone so the patch actually takes hold. It's the most basic fix imaginable, which is exactly why it being missing in the first place is so frustrating.

sogo took XSS, shell injection, password-reset poisoning, and SQL injection under a single CVE. buildstream's issue is a missing-validation quirk in tar sources that let an attacker drop files onto the build host.

Ubuntu had to walk one back

Ubuntu's batch from October 14 is headlined by curl and Bind carrying a lot of trouble at once.

curl took the biggest single hit. USN-8927-1 closes 18 issues against the 26.04 LTS build: use-after-frees that crash or execute code, credential leaks routed through proxies and .netrc files, and HSTS mishaps that quietly downgrade you back to plain HTTP. USN-8932-1 then carries 9 more of the same onto older releases, still propped up mostly by the Ubuntu Pro safety net. Nearly two dozen curl CVEs split across two notices, for what's basically the internet's default download tool.

Bind is where the counts get genuinely absurd. USN-8929-1 packs 24 distinct issues across seven Ubuntu releases, from 26.04 back to 14.04. Cache poisoning, DNSSEC bypasses, DoS bugs, and a zone-transfer hole that lets unauthenticated data slip to secondary servers. OpenSSH and Apache each absorbed nine on their own.

But the best story here is BlueZ. USN-8908-1 fixed a Bluetooth codec handling bug and in the process wrecked the A2DP profile, so wireless earbuds stopped reconnecting. USN-8908-2 simply undoes that damage. The source material calls it an apology in patch form, and honestly, that's fair.

Fedora's exim comes first

Fedora's batch from October 15 starts with exim. The mail transfer agent got two separate advisories, one for Fedora 44 and one for Fedora 43, both bumping it to 4.100.1. Four CVEs land in this one, and they're the nastier variety: arbitrary code execution through a hostile Proxy-Protocol header, SMTP smuggling during DATA processing, an info leak through a rogue proxy, and a use-after-free in GnuTLS settings. If your mail server proxies at all, this is the patch you apply before anything else.

Python 3.14.8 follows on Fedora 43 across two packages. It's the largest CVE pile of the day at seven, though the advisory only describes two: a certificate verification bypass in SSLContext.wrap_bio() and a use-after-free in a server-side SSLContext. The remaining five are listed without much fanfare, which is a familiar pattern when upstream hasn't published full write-ups yet. FreeRDP rounds out the day at 3.32.1, which reads more like a routine version roll than a vulnerability stamp. Nothing ties it to a specific CVE.

The rest of the day

AlmaLinux pushed sixteen advisories across versions 8, 9, and 10, all stamped October 14, with fifteen marked Important and one Moderate. The Moderate one is tftp, which you probably don't run anyway unless you're booting diskless machines. The ones worth paying for are the code-execution fixes: PostgreSQL's restore path, the PKI certprofile import trusting unsanitized profile content, and flatpak-builder handing over host code execution through a git am hook. The kernel updates carry the most individual CVEs, with AlmaLinux 9's kernel topping out at fourteen.

Red Hat shipped another batch, and it earns a second glance because of how many Critical ratings show up. Seven advisories sit at Critical, with the loudest cluster hitting Red Hat Identity Management across RHEL 9.2, 9.4, and 9.6. If your shop runs domain controllers or anything near Active Directory integration, those are the ones to schedule first. Red Hat also rated cjose Critical on RHEL 10.0 EUS, which makes sense given how often that small C library shows up in authentication paths.

Rocky Linux kept it lean with five errata, four of which target Rocky Linux 10. The kernel update is the biggest of the batch, and the fifth entry is where things get busy: a single advisory, RLSA-2026:82858, rides across 22 Python 3.6-era packages. If you're still running Python 3.6 on Rocky 8, there's a fair amount to install, but it lands as one patch instead of 22.

Slackware stayed simple. SSA:2026-287-01 bumps libarchive from 3.8.9 to 3.8.10 across both 15.0 and -current. Grab the MD5 sums from the advisory and verify your downloads. You've got no real way of knowing whether a file arrived intact any other way.

A Detailed Breakdown of Today's Updates

AlmaLinux

AlmaLinux pushed a sizable batch of security errata across versions 8, 9, and 10, all stamped October 14, 2026 (one leaked out the day before). Sixteen advisories in total, fifteen marked Important and one Moderate. The Moderate one is the tftp update, which you probably don't run anyway if you're booting real machines rather than diskless ones.

The ones worth your attention are the code-execution fixes. PostgreSQL's restore path lets an attacker run code, and the PKI certprofile import does exactly the same thing by trusting unsanitized profile content. flatpak-builder hands over host code execution through a git am hook when it pulls in patch sources. librabbitmq gets a heap buffer overflow, and the rest is the usual pile of denial-of-service and out-of-bounds memory bugs that make up the bulk of any distro cycle.

The kernel updates carry the most individual CVEs, with AlmaLinux 9's kernel tops at fourteen, mostly networking and filesystem hardening. If you run the realtime kernel, there's a separate update for it, slightly trimmed because it doesn't include the CIFS fix.

Debian GNU/Linux

Four security advisories rolled out of Debian on October 14, and one of them is the sort of thing that makes you wonder how it slipped through.

The keystone update (DLA-4834-2) is LTS business for Debian 12 bookworm, and it's the oddball. The flaw isn't a remote code execution hole. The service simply didn't restart after a security upgrade, which means a known-vulnerable process could keep running long after the package was patched. Debian's remedy is a post-install script that explicitly restarts Keystone so the fix actually takes effect. It's the most basic fix imaginable, which is exactly why it being missing in the first place is frustrating.

Firefox gets the actual haul. firefox-esr absorbed 59 CVEs spanning arbitrary code execution, sandbox escapes, information disclosure, mitigation bypasses and privilege escalation. That's a LOT of ways to get owned packed into a single browser release. It's now in trixie at 153.5.0esr-1~deb13u1.

sogo, the groupware server, took XSS, shell injection, password-reset poisoning and SQL injection under a single CVE (CVE-2026-93453), fixed in trixie at 5.12.1-3+deb13u3.

And buildstream, the build automation tool, had a missing-validation quirk in tar sources that let an attacker drop files onto the build host. That's CVE-2026-82331, fixed in trixie at 1.6.9-2+deb13u1.

Fedora Linux

Fedora pushed a batch of security fixes on October 15, and exim is the one worth your attention first. The mail transfer agent got two separate advisories, one each for Fedora 44 and Fedora 43, both bumping it to 4.100.1. Four CVEs land in this one, and they are the nastier variety: arbitrary code execution through a hostile Proxy-Protocol header, SMTP smuggling during DATA processing, an information leak routed through a rogue proxy, and a use-after-free in GnuTLS settings that paves the way for denial of service. If your mail server proxies at all, this is the patch you apply before anything else.

Python 3.14.8 follows, landing on Fedora 43 across two packages—the interpreter itself and its docs, which is why they share an advisory ID. This is the largest CVE pile of the day at seven, though the advisory only actually describes two. One is a certificate verification bypass in SSLContext.wrap_bio() when server_hostname goes unchecked, and the other is a use-after-free in a server-side SSLContext that switches contexts mid-flight. The remaining five are listed without much fanfare, which is a familiar pattern when upstream hasn't published full write-ups yet. FreeRDP rounds out the day on Fedora 43, creeping to 3.32.1. It reads more like a routine version roll than a vulnerability stamp, and nothing in the advisory ties it to a specific CVE.

All of these install through the usual dnf upgrade --advisory <ID> path, and the packages carry the Fedora GPG signature as expected.

Red Hat Enterprise Linux

Red Hat shipped another batch of security errata, and this one earns a second glance because of how many Critical ratings it carries. The lineup follows a well-worn script: kernel bumps, a pile of Identity Management fixes, and Firefox updates, all wearing the usual "Important" badge.

Seven advisories sit at Critical. The loudest cluster hits Red Hat Identity Management (ipa) across RHEL 9.2, 9.4, and 9.6, with a matching pair aimed at the idm:DL1 module on RHEL 8 and 8.8. If your shops run domain controllers or anything near Active Directory integration, these are the ones to schedule first. Red Hat also rated cjose Critical on RHEL 10.0 EUS, which makes sense, since that small C library for JOSE/JWS tends to live in authentication paths.

Most of the rest are Important, Red Hat's shorthand for patch before it becomes a story. That grouping includes several real-time kernel-rt updates for RHEL 8 and the SAP channel, multiple Firefox releases across SAP and the AMCUSS/EUS tracks, and hplip changes for RHEL 9 and 10. Your usual printer-driver headaches, nothing exotic.

A single Moderate entry closes it out: environment-modules on RHEL 8, the tool most people only notice when something breaks.

The container products showed up too. OpenShift Container Platform 4.19.51 and the Red Hat build of MicroShift 4.18.57 both shipped package and image updates that fold security fixes in alongside routine bug fixes and enhancements. Both are Important.

Every advisory points to its CVSS scores and CVE references in the References section, so you can calibrate your urgency once you read the details rather than reacting to the badges alone.

Rocky Linux

Rocky Linux just pushed a batch of security errata, and four of the five target its latest release, Rocky Linux 10. The kernel update is the most substantial of the lot, landing as an "Important" severity patch that bundles bug fixes and enhancements alongside the actual security holes it's plugging. The other three Linux 10 packages are pcre2 and python-tornado, both "Important," plus curl, which comes in at "Moderate" so it's a notch less urgent—but you still shouldn't leave it sitting in the drafts folder.

The fifth entry is where things get busy. RLSA-2026:82858 rides a single advisory across 22 Python 3.6-era packages for Rocky Linux 8, ranging from SQLAlchemy and scipy to virtualenv and PyMySQL. If you're still running Python 3.6 on Rocky 8, there's a fair amount to install, but it arrives as one patch rather than 22 separate ones.

Each advisory lists CVSS base scores so you can judge how badly each vulnerability bites before you decide what to pull in first.

Slackware Linux

Slackware's security team put out an update for libarchive, the archive-handling library that happens to turn up more often than you might expect. The advisory, SSA:2026-287-01, bumps the library from 3.8.9 to 3.8.10 across both Slackware 15.0 and -current. Slackware describes this release as a mix of security fixes, bugfixes, and minor features, but the actual reason to install it is clearly the security half.

Getting set up is the usual routine. Run upgradepkg as root and you're done. If you're on 15.0, reach for the i586 or x86_64 build. The -current line splits into i686 and x86_64. Grab the MD5 sums from below and verify your downloads, since you've got no real way of knowing whether a file arrived intact any other way.

SUSE Linux

SUSE rolled out a batch of security advisories, and exactly one of them carries a critical rating. WebKit2GTK3 is the culprit. Advisory 4676 folds in the full upstream WebKitGTK/WPE WebKit security bulletin and pulls in 233 CVEs. You are probably not going to read all 233 of them, and you really shouldn't have to. Nearly all trace back to Google Chrome's Skia, ANGLE, and the renderer process, with the usual suspects: sandbox escapes, out-of-bounds writes, and use-after-frees. The package jumps to 2.54.1 across openSUSE Leap 15.4 and SLE 15 SP4/SP5. If you run a GTK desktop and actually look at web content, this is the one to do first.

Two separate kernel updates ride along in this wave, and both want a reboot. Kernel 4660 targets SLE 15 SP6 and Leap 15.6 with 124 fixes. Kernel 4665 is the real-time variant on SLE 15 SP5 RT and Leap 15.5 at 110. Kernel 4668 finishes the set for SLE 15 SP4 and Leap 15.4 with 86. SUSE tends to re-run the same fixes across successive service packs, so you'll see heavy overlap between them. None of it is panic-worthy, but budget a restart.

DNS gets hit twice, for two different reasons. Advisory 4664 is the bigger worry: ten bind CVEs for Leap 15.4 and SLE 15 SP4, including unauthenticated IXFR deltas applied before TSIG verification and a resolver crash from a use-after-free. The second bind update, 4657, is smaller with three CVEs but covers a different support channel (Leap 15.3 and SLE 15 SP6). The remote-rated ones on the ten-CVE bulletin matter most.

The rest of the "important" updates are narrower: glibc (4656) fixes four issues including a privilege-escalation TOCTOU in the dynamic loader, python312 (4659) lands at 3.12.15 with three CVEs, libtcnative (4658, that's Apache Tomcat Native) bumps to 2.0.16 to close a TLS-handshake DoS and downgraded certificate checks, xorg-x11-server (4663) mops up ten display-server bugs, and the amazon-cloudwatch-agent (4662) gets a single CVE. The podman update (4655) is mostly a rebuild against the latest Go security release, so there's not much to unpack there.

Then comes the moderate bucket. Ten separate Tumbleweed advisories patch individual Python packages on the GA media: paramiko, oletools, openpyxl, orjson, pydrive2, and a handful of smaller libraries. Most of these CVEs date from 2019 to 2024, so rating them moderate is fair. You likely don't need to rush, and since each only touches one package, they're quick fixes if you happen to use any of them.

Ubuntu Linux

Ubuntu's security team rolled out another batch of patches yesterday, and the short version is that curl and Bind are carrying a lot of trouble right now. Eight advisories landed on October 14 (with one fix landing the day before), covering everything from your local curl installation to a boot loader most people have never even heard of.

curl took the biggest single hit. USN-8927-1 closes 18 issues against the 26.04 LTS build. You get the usual spread: use-after-frees that crash the program or execute code, credential leaks routed through proxies and .netrc files, and a couple of HSTS mishaps that quietly downgrade you back to plain HTTP. USN-8932-1 then carries 9 of those same vulnerabilities onto older releases (22.04 down to 14.04), still propped up mostly by the Ubuntu Pro safety net. That's nearly two dozen curl CVEs split across two notices, which is a lot to file for what's basically the internet's default wget.

Bind is where the counts get genuinely absurd. USN-8929-1 packs 24 distinct issues across seven Ubuntu releases, from 26.04 back to 14.04. Cache poisoning, DNSSEC bypasses, denial-of-service bugs, and a zone-transfer hole that lets unauthenticated data slip to secondary servers. If you're still running an old LTS Bind server, this one needs attention.

OpenSSH (USN-8928-1) and Apache (USN-8931-1) each absorbed nine. OpenSSH's most pointed flaw is a malformed username that opens the door to command injection, alongside a GSSAPI state bug that could hand an attacker leftover credentials from a prior failed login. Apache leans toward response smuggling and auth bypasses, plus a WebDAV property leak that's a curiosity at best.

A handful of smaller advisories round out the batch. urllib3 (USN-8926-1) picked up three Python-side problems, mostly pinned to 26.04. U-Boot, the embedded boot loader, took four, including two that reach code execution at a stage most people never think about. And BlueZ's advisory on the 13th reads like an apology in patch form: USN-8908-1 fixed Bluetooth codec handling but wrecked the A2DP profile, so wireless earbuds stopped reconnecting properly. USN-8908-2 simply undoes that damage.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all