The recent Linux security roundup reveals that eleven Linux distributions have released overlapping security patches addressing critical vulnerabilities, including two remote code execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619) that affect multiple systems like Arch, Debian, and Ubuntu. Additionally, a compromised eMudhra root certificate authority has led to several distributions blacklisting the affected entries, although fixing only one of them leaves systems partially protected. The updates also include a significant batch of .NET patches affecting versions 8.0, 9.0, and 10.0, with Ubuntu's release even including a .NET 11 release candidate in a security update. Overall, users are encouraged to promptly apply these updates, especially for PHP, the compromised CA, and .NET vulnerabilities, to ensure their systems remain secure

Linux Security Roundup: PHP RCE, Compromised CA, and .NET CVEs Across 11 Distros

Eleven Linux distros shipped overlapping security patches today, and the same three stories repeat across nearly all of them. PHP's two arbitrary code execution flaws (CVE-2026-109618 and CVE-2026-109619) turned up on Arch, Debian, Fedora, Gentoo, RHEL, Rocky, Slackware, SUSE, and Ubuntu. A compromised eMudhra root CA forced distros to blacklist the emSign ECC Root CA and Comodo AAA entries, though patching only one of the affected stores leaves you half-protected. .NET claims the largest Critical ratings with patches for 8.0, 9.0, and 10.0, while Ubuntu's batch also sneaks in a .NET 11 release candidate inside a normal security update.

Linux Security Roundup: PHP RCE, Compromised CA, and .NET CVEs Across 11 Distros @ Linux Compatible