Four distros pushed security patches this morning, with Python emerging as the clear target across Fedora's six interpreter releases and SUSE's batch of 20 advisories. Debian shipped two fixes for trixie, with Tor notably going out before a CVE was assigned while vips took a nine-CVE hit. Red Hat rolled out ten advisories for RHEL 8 through 10. Meanwhile, Ubuntu's Perl DBI fix stretches all the way back to the classic 14.04 LTS, requiring Ubuntu Pro for the oldest trees.

Today's Linux security roundup: Python takes the biggest hit and Tor ships without a CVE

Fedora, SUSE, Red Hat, Debian, Rocky, and Ubuntu all pushed patches this morning. Python is the recurring victim, and Tor has been updated with multiple security fixes

Linux distros shipped a wide batch of security updates this morning, and if you're hunting for a theme, Python is it. Fedora rolled out six interpreter releases, SUSE's Tumbleweed batch patched nearly two dozen packages mostly around python313 and python314, and the same CVE shows up in Fedora's SSLContext fix. Red Hat, Debian, Rocky, and Ubuntu each had their own rounds too. A couple of details are worth pausing on.

Fedora covered both Fedora 43 and 44, and Python clearly ate the biggest slice. Python 3.13 quietly picked up seven CVEs, while 3.10 and 3.11 each grabbed eight. The one that keeps reappearing across all three is CVE-2026-19445, a use-after-free in the server-side SSLContext that trips when a sni_callback switches contexts. Python 3.10 carries an extra expat XML DoS hole (CVE-2026-7210) that the newer branches already got fixed.

Then there's the rest of the Fedora batch, which is less alarming but still patchable. markdownlint-cli2 moved to 0.23.3 to close a DoS gap in smol-toml where a malformed TOML document crashes the linter. libical picked up a parsing-based DoS fix, and the secrets manager openbao climbed to 2.6.4 on a pile of upstream advisories plus a privilege fix in its service file. The kernel mostly reads as a display and hardware checklist: AMD fixes, a Raspberry Pi BCM2712 addition, a couple XFS tweaks, and a notably early reversion of the af_alg_restrict sysctl on the 43 and 44 trees. Nothing looks like a live zero-day. But if you run a Raspberry Pi 5 or push AMD GPUs, you probably want it installed.

Two Python stacks, one decade of bugs

SUSE's Tumbleweed round is where this morning's patch gets its widest spread. Count them out and there are 20 advisories, every one tagged moderate, and most pointing squarely at Python 3.13 and its 3.14 sibling. You're looking at remote code execution, memory corruption, and information disclosure across web frameworks, HTML parsers, database drivers, and image libraries. All of it hit the general availability repos, so a normal update catches it.

Some packages want your attention first. PyYAML carries CVE-2020-14343 scored 8.8, a bug that has historically let attackers read files or run code through a malicious YAML payload. The C++ toolchain (cpp13/gcc13) took an 8.6 for CVE-2026-102010, a respectable hole that forces you to rebuild your whole toolchain. PyJWT absorbed nine vulnerabilities. Jinja2 picked up six.

Here's where it gets odd, because these bugs span more than a decade. Some date back to 2012, 2015, and 2016. openSUSE is apparently fine with fixing a path traversal in Beaker and an old XSS in jQuery UI right alongside chasing 2026 CVEs, which strikes me as the right instinct. If you run any Python stack, grab the FontTools, PyMySQL, and Azure Identity patches first.

Two packages bring the heaviest install footprint. libpng16 drags in a dozen subpackages and the gcc13 build is enormous, so expect the update to move more packages than you planned. Run the batch through your repo and you're covered.

The rest of the batch

Debian pushed two updates to stable trixie, and both messages come down to one word: upgrade. Tor gets the short version: multiple holes in its low-latency anonymous communication stack, but notably no CVE assigned yet even though the patch is already shipping. That gap is worth a raised eyebrow. Fixed in 0.4.9.14-0+deb13u1. The vips update is the meatier one, with nine CVEs spanning denial-of-service, memory-safety problems, and other damage from specially crafted image files. Fixed in 8.16.1-1+deb13u2.

Red Hat rolled out ten advisories this round, patching everything from Emacs to Flatpak to RestEasy across RHEL 8 through 10. Nine land at the "Important" tier, leaving a lone "Moderate" for compat-openssl11 on RHEL 9. The affected software is about as ordinary as a server fleet gets: Emacs, Thunderbird, GIMP, GD, Flatpak, and two OpenSSL compatibility shims. Several landed under specialty lines like Extended Update Support and SAP Solutions, which narrows who actually has to move. All ten carry 2026 datestamps, a detail that suggests either you're reading this months ahead of schedule or someone at Red Hat mis-set the calendar.

Rocky Linux pushed five updates, the bulk on Rocky Linux 10. Two are tagged "Important": cjose, a small C library for JSON Web Signature work, and dovecot, your local mail delivery agent. Neither is the kind of thing you notice until it's broken, which is partly why they're flagged higher. The remaining three go to glibc, so if you run that library you've got homework coming.

On the far end of the support calendar, Ubuntu published USN-8912-1, a single bugfix notice for the Perl DBI module (libdbi-perl). Two holes in the same library trace back to one researcher, Harsh Raj Singhania, who handed the maintainers two problems at once: a missing attribute check that leaves the door open for arbitrary code execution (CVE-2026-78030), and a string-handling mistake that triggers a denial of service (CVE-2026-88816). Ubuntu lists every LTS line from 26.04 down to 14.04, and 14.04 is old enough to qualify as a classic. The four aging trees: 20.04, 18.04, 16.04, and 14.04, won't get the fix through a plain update. You need Ubuntu Pro enrolled to pull the fixed versions. If you're on 22.04 or newer, a standard update does the job.

Your move is the same as it always is: push the updates. If you're unsure which CVE actually matters for your setup, the advisory IDs are all in the release notes, and a quick search in your package manager will point you at the right package.

A Detailed Breakdown of all Updates

Debian GNU/Linux

Debian pushed two security updates to stable (trixie): one for Tor, the anonymous-network tool, and another for vips, the image processing library. In both cases the message is the same; upgrade.

Tor gets the shorter treatment. Debian reports multiple security holes in its low-latency anonymous communication stack, but notably has no CVE number to point to yet, even though the patch is already shipping. If you run Tor on a trixie box, that gap is worth a raised eyebrow. Fixed in 0.4.9.14-0+deb13u1.

vips is the more meaty one, with nine CVEs spanning denial-of-service, memory-safety problems, and other damage triggered by specially crafted image files or data. If your setup processes untrusted images, that is the attack surface worth your attention. Fixed in 8.16.1-1+deb13u2.

Fedora Linux

Fedora shipped a sweep of security advisories for both Fedora 43 and 44, and Python clearly took the biggest hit. Six interpreter updates moved across the two releases, with 3.13 quietly picking up seven CVEs while both 3.10 and 3.11 grabbed eight apiece. The one that keeps reappearing across all three is CVE-2026-19445, a use-after-free in the server-side SSLContext that fires when a sni_callback switches contexts. Python 3.10 also carries a separate expat XML denial-of-service hole (CVE-2026-7210) that the newer branches appear to have already fixed.

The smaller packages are less alarming but still worth your attention. markdownlint-cli2 went to 0.23.3 to close a DoS gap in smol-toml where a malformed TOML document can crash the linter (CVE-2026-85730). libical picked up a patch for a matching parsing-based DoS (CVE-2026-88383), and the secrets manager openbao climbed to 2.6.4 on the strength of several upstream GHSA notices, plus a fix for a privilege problem in its service file.

Then there's the kernel, which is mostly a display and hardware laundry list. Fedora 44's 7.2.9 build is a long tail of AMD display fixes, Raspberry Pi BCM2712 additions, a couple of XFS tweaks, and a notably early reversion of the af_alg_restrict sysctl on the F43/44 trees. Nothing looks like a live zero-day, but if you run a Raspberry Pi 5 or push AMD GPUs, you probably want it installed.

Red Hat Enterprise Linux

Red Hat rolled out ten security advisories this round, patching everything from Emacs to Flatpak and RestEasy across RHEL 8 through 10. Nine land at the "Important" tier (Red Hat's second-highest, more than enough to justify a reboot but nowhere near "Critical"), leaving a lone "Moderate" for compat-openssl11 on RHEL 9.

The affected software is about as ordinary as a server fleet gets: the Emacs and Thunderbird clients, GIMP, the GD graphics library, Flatpak plus its builder, two OpenSSL compatibility shims, and RestEasy for Java apps. Several of these patched under specialty lines like Extended Update Support and the SAP Solutions track, which narrows down who actually needs to move.

Rocky Linux

Rocky Linux just pushed out five updates, and the bulk of them land on Rocky Linux 10. Two are tagged "Important," which is the advisory rating they use before you start reading CVE descriptions and deciding how fast to patch. The rest are "Moderate," and you're basically getting three of them for glibc alone, so if you're running that library you have homework.

The "Important" ones cover cjose, a small C library for JSON Web Signature stuff, and dovecot, your local mail delivery agent. Neither is the kind of thing you notice until it's broken, which is partly why they're flagged higher. The glibc updates are the boring-but-necessary kind: security fixes mixed in with bug fixes and a couple of enhancements, so you get everything in one pass rather than three separate reboot reminders.

SUSE Linux

Tumbleweed handed out another batch of security fixes, and if you count them out there are 20 advisories, every one marked "moderate." Most of them point squarely at Python, patching both python313 and its newer python314 sibling. You are looking at remote code execution, memory corruption, and information disclosure across web frameworks, HTML parsers, database drivers, and image libraries. All of this landed on the general availability repos, so it shows up in a normal update.

A few packages are worth your attention first. PyYAML carries a CVE‑2020‑14343 scored 8.8, which has historically let attackers read files or run code through a malicious YAML payload. The C++ compiler stack (cpp13/gcc13) earned an 8.6 for CVE‑2026‑102010, a respectable hole to force you to rebuild an entire toolchain for. PyJWT absorbed the largest crowd with nine separate vulnerabilities, and Jinja2 picked up six.

The spread of these bugs is where it gets interesting, because they span more than a decade. Some date to 2012, 2015, and 2016. openSUSE is apparently fine with fixing a path traversal in Beaker and an old XSS in jQuery UI at the same time as chasing 2026 CVEs, which strikes me as the right instinct. If you run any Python stack, the FontTools, PyMySQL (8.1), and Azure Identity patches are the ones to grab first.

Two packages bring the heaviest install footprints. libpng16 drags in a dozen subpackages, and the gcc13 build is enormous, so expect the update to move more packages than you planned if you compile anything at all. Run the batch through your repo and you are covered.

Ubuntu Linux

Ubuntu published USN‑8912‑1 this week, and it is a single bugfix notice for the Perl DBI module, the libdbi‑perl package. Two separate holes in the same library both trace back to the same researcher, Harsh Raj Singhania, so one person handed the maintainers two problems at once. The first is CVE‑2026‑78030: the module failed to validate certain attributes, which leaves the door open for arbitrary code execution. The second, CVE‑2026‑88816, is a string‑handling mistake that an attacker could trigger for a denial of service.

What stands out is how far back the fix reaches. Ubuntu lists every LTS line from 26.04 down to 14.04, and 14.04 is old enough to qualify as a classic. The releases that still sit on the older code 20.04, 18.04, 16.04, and 14.04 won't get the patch through a plain update. You need Ubuntu Pro enrolled to pull the fixed versions for those four, which is the usual arrangement for aging LTS trees.

If you are on 22.04 or newer, a standard update does the job. Here is exactly what each line gets.

How to Apply These Linux Security Updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y