The latest Linux security roundup highlights critical updates to ca-certificates across major distributions, which includes the distrust of eMudhra's intermediate CA and the removal of emSign roots that could disrupt pinned services. Numerous remote code execution (RCE) vulnerabilities were also identified, notably affecting PostgreSQL, hplip on AlmaLinux 8, Apache httpd on Oracle Linux 9, and issues in php8 and Emacs on SUSE. Users are advised to prioritize applying the ca-certificates updates before addressing the RCE vulnerabilities and any associated package rebuilds driven by Go CVEs. Overall, while many updates were released, focusing on these critical patches will ensure system security without overwhelming administrators with the sheer volume of advisories

Linux Security Roundup: Critical ca-certificates Fixes Across All Major Distros

Critical ca-certificates advisories landed today across nearly every major distro, distrusting eMudhra's intermediate CA and dropping emSign roots that can break pinned services. A shared cluster of Go CVEs drove rebuilds across grafana-pcp, podman, ipp-usb, and go-toolset, though much of it is the same binary with a newer compiler. Several genuine RCE bugs stand out, including pgvector index-build code execution, hplip's dozen CVEs on AlmaLinux 8, Apache httpd's eleven CVEs on Oracle Linux 9, and SUSE's php8 and Emacs TRAMP holes. Clear the cert fixes first, then chase the RCE-worthy packages, since the Go and cert churn alone cover a large chunk of what shipped today.

Linux Security Roundup: Critical ca-certificates Fixes Across All Major Distros @ Linux Compatible