Today's security updates across Debian, Fedora, Red Hat, Rocky Linux, Slackware, and SUSE are mostly routine, but a few cross into serious territory that needs immediate attention. Debian's zlib patch closes a code-execution hole, SUSE's Flatpak update plugs eleven sandbox escapes, and Red Hat's OpenShift 4.22.22 update earns a Critical rating. A compromised eMudhra certificate threads through both Fedora and SUSE's python-certifi update, while Mozilla's Thunderbird ships a routine-but-expected 66-CVE cleanup. Patch the code-execution and trust-chain issues first, then work through the Rust crate refreshes and module rebuilds on Fedora and Rocky.

Today's daily Linux security roundup spans six distros. Patch the code-execution holes first.

A zlib remote-code-execution hole, a Flatpak sandbox escape, and a Critical-rated OpenShift update are the items you should chase down before the routine stuff.

A fresh round of Linux security updates has rolled out across Debian, Fedora, Red Hat, Rocky Linux, Slackware, and SUSE. Most of it is exactly what you'd expect from a normal advisory cycle. But a few of today's patches reach into arbitrary code execution and sandbox escapes, and those are the ones worth your attention before anything else.

One thread ties several together, and it involves a certificate. eMudhra intermediates show up in both a Fedora revocation and SUSE's python-certifi update, which strips the same bad trust material out of the root store. Mozilla's releases ride in the same neighborhood. The breakdown follows.

Patch the serious stuff first

Start with Debian. It patched zlib, the compression library that quietly powers a ridiculous amount of software. Three holes turned up in the stable (trixie) release, and the fallout ranges from a denial of service to arbitrary code execution if you feed the library input crafted just right. Upgrade to 1:1.3.dfsg+really1.3.1-1+deb13u1, which closes CVE-2026-27171, CVE-2026-76844, and CVE-2026-85091. It's the boring upgrade you should actually do.

On the Enterprise side, Red Hat gave OpenShift Container Platform 4.22.22 a Critical rating in erratum RHSA-2026:95346. Take that one before the rest of the batch, which land at Important. JBoss EAP 8.1.9 (RHSA-2026:95887) and two Keycloak releases, 26.6.8 and 26.4.17, sit there. Critical issues tend to get picked off by attackers first.

SUSE's Flatpak is the single most alarming thing in the whole batch. Flatpak 1.16.6, carried in SUSE-SU-2026:5127-1, ships eleven fixes that touch sandbox escapes, path traversal, a buffer overflow in OCI delta streams, and a privilege-escalation route through revokefs. It's rated important, and it also quietly swapped its build from Autotools to Meson mid-release. That kind of churn usually means something broke and then got fixed. If you run sandboxed apps on SLE, make it your priority.

The certifi update is quieter but more uncomfortable. python-certifi 2026.10.23 in SUSE-SU-2026:5130-1 removes compromised trust material: GLOBALTRUST roots and those same eMudhra intermediates. A pulled certificate won't break anything at boot, but a broken trust chain is exactly the thing you regret after the fact.

And then there's Thunderbird, which brings its own headline. Mozilla 153.5.1 in openSUSE-SU-2026:12224-1 closes 66 vulnerabilities. That number looks brutal until you remember Mozilla ships a release every few weeks with a fresh pile of new CVEs baked in. Much of it is routine per-batch cleanup. A couple still sit in the high range though, so install it anyway.

The longer, more tedious batch

Fedora is where the counts get inflated. Fedora 43 through 45 got a stack of advisories, and three actually bite. WordPress jumped to 6.9.11, led by a remote code execution flaw in the upgrade process that Umut Bayram reported. There's also stored XSS across the block editor and the Customizer, a denial of service in the Interactivity API, and a privacy wobble where a data-removal request could trigger stored XSS. Both Fedora 43 and 44 got the same 6.9.11, plus fresh root certificates after the eMudhra pull.

nginx went to 1.30.6 on Fedora 45, folding in five CVEs: CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, and CVE-2026-97205. The rest of that advisory is mostly module rebuilds riding along. modsecurity, naxsi, brotli, fancyindex, vts, and headers-more all rebuilt against the new core.

The Rust crate refresh is the tedious part of all this. constant_time_eq moved to 0.6.1, typed-path to 0.13.0, lzma-rust2 to 0.23.0, ppmd-rust to 1.5.2, and a rustls 0.23.46 rebuild covering four RUSTSEC advisories. You'll find that same bump slapped across zip in three major versions, blake3, totp-rs, sccache, and regorus.

Two smaller things deserve a mention. The Goose AI agent got a backport on Fedora 43 for a shell-history and environment leak through its terminal integration. Sofia-sip closed an out-of-bounds read plus an oversized MIME boundary denial of service. Oh, and there's a Jupyter stack update filed under the security banner that fixes no vulnerability at all, so don't go hunting for a hole that isn't there.

Rocky Linux wants you to know it has six advisories, not ten. The source page lists duplicate rows, so it looks longer than it is. The real items sit at Important: GIMP 2.8 (RLSA-2026:95482) and the Go toolset (RLSA-2026:95638), the latter of which still touches the delve debug tool. Tesseract is also Important, and then nodejs packaging and mod_auth_openidc land at Moderate, with qt5-qtsvg rounding it out at Low.

GIMP 2.8 earning an Important rating is its own small joke about legacy software outliving its usefulness. Delve, for the record, remains unbothered.

Slackware went with the standard Apache playbook. httpd 2.4.70 under advisory SSA:2026-310-01 covers Slackware 15.0 and -current, which comes out as four separate packages since -current's i686 build and 15.0's i586 build don't share a file. The MD5 sums are in the advisory. When you're done with upgradepkg, stop rc.httpd and start it again. Leave the old process running, and you've done the whole thing for nothing.

A Detailed Overview of the Updates

Debian GNU/Linux

Debian just rolled out a security patch for zlib, the compression library that quietly underpins a ridiculous amount of software. Three separate holes turned up in the code, and the fallout range is not reassuring: at best a denial of service, and in theory arbitrary code execution if someone feeds the library something crafted just right.

The fix sits in version 1.3.1 for the stable (trixie) release. The recommendation to upgrade is exactly the boring-but-useful part of any security advisory, so that's the part you should actually act on.

Fedora Linux

Fedora pushed a stack of security advisories, and if you're running anything from Fedora 43 up to 45 there's a fresh update waiting. Three of them actually matter: WordPress, nginx, and a dependency chain you may not have realized you were carrying.

WordPress jumped to 6.9.11, and this is the fullest release in the batch. The worrisome hole is a remote code execution flaw in the upgrade process itself, which someone by name reported (Umut Bayram, if you want to attribute it). The rest is mostly stored XSS across the block editor, the Customizer, and a couple of other areas, plus a denial of service in the Interactivity API and a privacy wobble where data-removal requests could be crafted to trigger stored XSS. Both Fedora 43 and 44 are getting the same 6.9.11, and the release also swaps in updated root certificates after the eMudhra revocation.

nginx went to 1.30.6 on Fedora 45, folding in five CVEs. If you run a server behind a WAF, much of the surrounding churn is really just the module rebuilds riding along: modsecurity, naxsi, brotli, fancyindex, vts, headers-more, and js-challenge all got rebuilt against the new core. The actual fixes live in nginx.

The third thread is the Rust crate refresh, which is where the batch gets tedious rather than alarming. constant_time_eq moved to 0.6.1, typed-path to 0.13.0, lzma-rust2 to 0.23.0, and ppmd-rust to 1.5.2, which closes a denial of service from an infinite loop. Several crates were rebuilt against rustls 0.23.46 to cover four RUSTSEC advisories and to answer the eMudhra intermediate CA compromise. You'll see this same set of bump notes slapped across zip (in three major versions at once), blake3, blake2b_simd, totp-rs, sccache, kryoptic, and regorus.

Two smaller items. Goose, the on-machine AI agent, got a security backport on Fedora 43 for a shell history and environment leak through its terminal integration. And sofia-sip, the SIP library, got patched for an out-of-bounds read plus the oversized MIME boundary denial of service that already had it in the crosshairs.

Oh, and there's a Jupyter stack update for Fedora 44 (notebook, JupyterLab, nbdime, jupytext) filed under the security banner despite not fixing any vulnerability at all. Good to know so you don't go hunting for a hole that isn't there.

Red Hat Enterprise Linux

Red Hat pushed a fresh batch of errata, and one of them carries a Critical rating you shouldn't sleep on. The top item is OpenShift Container Platform 4.22.22, which bundles security fixes, bug patches, and a few enhancements together. The remaining three all land at Important: a refresh for JBoss Enterprise Application Platform 8.1.9, plus two separate Keycloak updates split by version and packaging format.

If any of these sit in production, open the CVE links in the errata to see what you're actually exposed to. The OpenShift update is the one to tackle first, since Critical-rated issues tend to get picked off by attackers sooner rather than later.

Rocky Linux

Rocky Linux just pushed a fresh batch of errata, and if you run Rocky Linux 8 or 9 there are a handful worth patching. The batch tops out at "Important" severity across three packages: the GIMP image editor (still stuck on the 2.8 line, which for anything modern is basically a museum piece), the Go toolchain, and Tesseract OCR. Two more land at "Moderate" - the Node.js packaging module and the OpenID Connect Apache auth plugin - and a Qt SVG security fix closes things out at a low-grade note.

GIMP 2.8 earning an "Important" rating is a good reminder that legacy software outlives its welcome. On the Go side, the update also touches a debug tool called delve, which a lot of you already reach for, so it may be worth a look beyond the security angle alone.

One thing worth flagging: the source lists the same advisories twice. The Node.js and GIMP entries in particular show up verbatim, so the page has more rows than it actually has distinct updates. There are six unique advisories here, not ten.

Slackware Linux

Slackware put out httpd 2.4.70 under advisory SSA:2026-310-01, a security fix aimed at both Slackware 15.0 and -current. It's the standard Apache affair: they patch a hole, bump the version, and expect you to restart the daemon. Nothing spectacular, but if you host anything on Apache you'll want to get on it.

The one mildly interesting detail is that -current ships a 32-bit i686 build while 15.0 uses i586, so the "same update" actually means four separate packages depending on what you're running. Below is the breakdown with the MD5s so you can verify before installing.

To apply it: run upgradepkg as root, then stop and start rc.httpd. Leaving the old process alive after the upgrade defeats the whole point of the security fix.

SUSE Linux

SUSE pushed another round of security fixes into its repos, and the shape of it is pretty familiar. Twelve announcements in this batch, ten of them the standard openSUSE Tumbleweed GA-media generic updates all tagged "moderate." The two Enterprise ones both land higher, at "important."

Thunderbird is the obvious headline: version 153.5.1 closes 66 vulnerabilities. That number looks alarming until you remember Mozilla ships a new release with a fresh pile of CVEs, so much of it is routine per-batch cleanup rather than a single catastrophic hole. A couple still sit in the high range though, and you should install it regardless.

Pillow comes in second place with 14 fixes in the python313 package, mostly denial-of-service issues, a few of them meaningfully high severity. The rest of the Tumbleweed pile is smaller and more scattered, touching DNS (bind), the Spice development libraries, ntpsec, stgit, and a handful of one-or-two-CVE packages you'd only notice if you actually use them.

The two Enterprise updates are where you should actually focus. Flatpak, now at 1.16.6, is rated important and carries 11 fixes covering sandbox escapes, path traversal, a buffer overflow in OCI delta streams, and a privilege-escalation path through revokefs. It also does a genuine version bump and switches its build system from Autotools to Meson, which is one of those chores that matters more than the changelog admits. If you run sandboxed apps on SLE, this is the one to prioritize.

python-certifi is important too and quietly the more concerning of the pair. It removes compromised trust material from the root store - GLOBALTRUST roots and the eMudhra intermediates. A pulled certificate doesn't break anything at boot, but the trust chain is exactly the kind of thing you only regret after the fact.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all