Tuesday Advisory Working Sheet: Linux Distribution Security Updates Dated 2026-10-26 and 2026-10-27 | ItInsightsWorld Security
Estates rarely slip on the day a weakness is disclosed; they slip on the day a patch line is never matched to a running host. This ITInsightsWorld Security working sheet consolidates the advisory records your update mirrors and internal repositories should have ingested around this Tuesday cycle, using the publication dates carried in the source entries: 2026-10-26 and 2026-10-27. Eight distribution feeds are reproduced line by line — AlmaLinux, Debian, Fedora, Mageia, Oracle, Red Hat, SUSE (including openSUSE) and Ubuntu — so an administrator can reconcile a scanner finding against the vendor entry without opening a dozen portals.
Before you use the tables, be clear about what they contain and what they deliberately do not. Every row exposes four fields only: the advisory identifier, the release label, the package name and the date. No severity rating, CVSS value, exploit status or flaw description is attached to these records, and none is added here. Treat the sheet as a coverage and scope instrument: it answers "did my estate see this line, and on which release label?" rather than "how bad is it?"
Reading the feed: identifier patterns and release labels
The identifier prefix tells you which programme published the line, and the release label tells you how many distinct build targets you have to verify. A single identifier is often reused across several package entries in the same feed, and a single Release cell sometimes lists more than one product label at once — both behaviours change how you build a patch scope, so they are called out in the misconceptions section below.
| Source feed | Advisory ID pattern in this window | Release labels you must match |
|---|---|---|
| AlmaLinux | ALSA (year stamp mostly 2026, with 2022 and 2023 stamps still dated inside this window) | 8, 9, 10 |
| Debian | DLA for the LTS stream, DSA for stable | LTS, stable |
| Fedora | FEDORA-2026-<hash> | F43, F44, F45 |
| Mageia | MGASA-2026-05xx | 10 |
| Oracle | ELSA | OL7, OL8, OL9, OL10 |
| Red Hat | RHSA-2026:<id>-01 | EL8.6, EL8.8, EL9, EL10 |
| SUSE / openSUSE | SUSE-SU-2026 and openSUSE-SU-2026 | SLE15, SLE16.0, SLE6.0, SLE-m5.3, SLE-m5.4, SLE-m5.5, SLE-m6.0, SLE-m6.1, SES7.1, osB15, oS15.4, oS15.5, oS15.6 |
| Ubuntu | USN-89xx-1 | 22.04, 24.04, 26.04, 26.10 |
Red Hat: a focused EL set dated 2026-10-27
The RHSA block in this cycle is narrow and specific: monitoring stack components (grafana and grafana-pcp) on the two archived EL8 point releases, plus three urllib3 lines split by Python runtime across EL9 and EL10. If your platform teams standardise on a python3.12-urllib3 or python3.14-urllib3 package name rather than the older python-urllib3 spelling, this is the group to match first, because the package naming differs between Red Hat and the RHEL-derivative feeds.
| Advisory ID | Release | Package | Date |
|---|---|---|---|
| RHSA-2026:88339-01 | EL8.6 | grafana | 2026-10-27 |
| RHSA-2026:88340-01 | EL8.8 | grafana | 2026-10-27 |
| RHSA-2026:88394-01 | EL8.6 | grafana-pcp | 2026-10-27 |
| RHSA-2026:88395-01 | EL8.8 | grafana-pcp | 2026-10-27 |
| RHSA-2026:85929-01 | EL9 | python3.12-urllib3 | 2026-10-27 |
| RHSA-2026:84578-01 | EL10 | python3.14-urllib3 | 2026-10-27 |
| RHSA-2026:84577-01 | EL9 | python3.14-urllib3 | 2026-10-27 |
Ubuntu: two USN lines that already span four releases
Ubuntu is the most compact entry of the two days, but each line carries four release labels in one cell. A single USN for brotli and a single USN for nginx therefore apply simultaneously to 22.04, 24.04, 26.04 and 26.10 — which means one rollout plan can cover your whole Ubuntu estate, provided the web tier and every image that links the compression library are included in scope.
| Advisory ID | Release | Package | Date |
|---|---|---|---|
| USN-8956-1 | 22.04 24.04 26.04 26.10 | brotli | 2026-10-26 |
| USN-8955-1 | 22.04 24.04 26.04 26.10 | nginx | 2026-10-26 |
Debian: LTS housekeeping plus a stable line for valkey
The Debian side of this Tuesday window splits cleanly by stream. Three DLA records close out the LTS branch for an SVG editor, an embedded update framework and a mail client, while one DSA record on 2026-10-27 touches stable with valkey — worth checking if that key-value service runs in front of your application tier or inside your caching layer.
| Advisory ID | Release | Package | Date |
|---|---|---|---|
| DLA-4862-1 | LTS | inkscape | 2026-10-26 |
| DLA-4864-1 | LTS | swupdate | 2026-10-26 |
| DLA-4863-1 | LTS | thunderbird | 2026-10-26 |
| DSA-6586-1 | stable | valkey | 2026-10-27 |
Fedora: shared build identifiers across F43, F44 and F45
Fedora is where automation usually miscounts. One FEDORA-2026 identifier appears against several package names at once — for example a single hash line covers helix together with rust-dua-cli, rust-gengo-bin, rust-gitui and stgit, another covers perl-Plack and perl-Plack-Middleware-ReverseProxy, and one brotli build on F45 is also listed as perl-Alien-Brotli. Kernel, nsd, libical, unshield, dolphin, mingw-python3, webkitgtk and the Perl toolchain all appear inside the same two-day window, so a per-identifier de-duplication routine should still install every affected subpackage.
| Advisory ID | Release | Package | Date |
|---|---|---|---|
| FEDORA-2026-6a639d1308 | F45 | brotli | 2026-10-26 |
| FEDORA-2026-2add2065d0 | F43 | dolphin | 2026-10-27 |
| FEDORA-2026-957c1e5c9d | F43 | helix | 2026-10-27 |
| FEDORA-2026-e2538282de | F44 | helix | 2026-10-27 |
| FEDORA-2026-fb4288290c | F43 | kernel | 2026-10-27 |
| FEDORA-2026-cd5f04a397 | F44 | kernel | 2026-10-27 |
| FEDORA-2026-13d6a67e0d | F43 | libical | 2026-10-27 |
| FEDORA-2026-feebb9861c | F44 | libical | 2026-10-27 |
| FEDORA-2026-aa5c18e9be | F44 | mingw-python3 | 2026-10-27 |
| FEDORA-2026-447c66a9bc | F43 | nsd | 2026-10-27 |
| FEDORA-2026-24b48c1f89 | F44 | nsd | 2026-10-27 |
| FEDORA-2026-6a639d1308 | F45 | perl-Alien-Brotli | 2026-10-26 |
| FEDORA-2026-1f56c920d8 | F43 | perl-Plack | 2026-10-27 |
| FEDORA-2026-1a8f37b585 | F44 | perl-Plack | 2026-10-27 |
| FEDORA-2026-1f56c920d8 | F43 | perl-Plack-Middleware-ReverseProxy | 2026-10-27 |
| FEDORA-2026-1a8f37b585 | F44 | perl-Plack-Middleware-ReverseProxy | 2026-10-27 |
| FEDORA-2026-957c1e5c9d | F43 | rust-dua-cli | 2026-10-27 |
| FEDORA-2026-e2538282de | F44 | rust-dua-cli | 2026-10-27 |
| FEDORA-2026-957c1e5c9d | F43 | rust-gengo-bin | 2026-10-27 |
| FEDORA-2026-e2538282de | F44 | rust-gengo-bin | 2026-10-27 |
| FEDORA-2026-957c1e5c9d | F43 | rust-gitui | 2026-10-27 |
| FEDORA-2026-e2538282de | F44 | rust-gitui | 2026-10-27 |
| FEDORA-2026-957c1e5c9d | F43 | stgit | 2026-10-27 |
| FEDORA-2026-e2538282de | F44 | stgit | 2026-10-27 |
| FEDORA-2026-3a7914c436 | F43 | unshield | 2026-10-27 |
| FEDORA-2026-1a569ece37 | F44 | unshield | 2026-10-27 |
| FEDORA-2026-60c7186f5a | F44 | webkitgtk | 2026-10-27 |
Mageia: the release 10 MGASA batch
Mageia contributes one flat scope — release 10 — but a mixed surface: mail and calendar components (evolution), rendering and codec libraries (freetype2, ghostscript, libjxl, libde265), a clustering transport (kronosnet), a scheduling library (libical), several Perl modules (perl-DBI, perl-ExtUtils-Typemaps-Default, perl-Imager), an editor (vim), a browser engine (webkit2) and a catch-all packages line. Desktop and build hosts are the natural first targets here.
| Advisory ID | Release | Package | Date |
|---|---|---|---|
| MGASA-2026-0554 | 10 | evolution | 2026-10-27 |
| MGASA-2026-0547 | 10 | freetype2 | 2026-10-26 |
| MGASA-2026-0545 | 10 | ghostscript | 2026-10-26 |
| MGASA-2026-0546 | 10 | kronosnet | 2026-10-26 |
| MGASA-2026-0552 | 10 | libde265 | 2026-10-27 |
| MGASA-2026-0553 | 10 | libical | 2026-10-27 |
| MGASA-2026-0548 | 10 | libjxl | 2026-10-26 |
| MGASA-2026-0543 | 10 | packages | 2026-10-26 |
| MGASA-2026-0551 | 10 | perl-DBI | 2026-10-27 |
| MGASA-2026-0544 | 10 | perl-ExtUtils-Typemaps-Default | 2026-10-26 |
| MGASA-2026-0550 | 10 | perl-Imager | 2026-10-27 |
| MGASA-2026-0555 | 10 | vim | 2026-10-27 |
| MGASA-2026-0549 | 10 | webkit2 | 2026-10-26 |
SUSE and openSUSE: the widest release matrix in this Tuesday set
SUSE is the feed where matching logic breaks most often, because a single advisory line enumerates many product labels at once — a kernel record can list SLE6.0 SLE-m6.0 SLE-m6.1 in the same cell, and the runc line spans SLE15 SLE5.3 SLE5.4 SLE5.5 SLE-m5.3 SLE-m5.4 SLE-m5.5 SES7.1. Trust anchors appear repeatedly (ca-certificates-mozilla on three current branches), alongside container infrastructure (containerd, runc, podman, kubernetes-old), remote access and authentication pieces (openssh, cyrus-sasl, python-PyJWT, python-social-auth-core), name resolution (unbound), language toolchains (gcc7, gcc13, go1.26, go1.27) and the X11 client libraries (libX11, libXi, libsoup).
| Advisory ID | Release | Package | Date |
|---|---|---|---|
| SUSE-SU-2026:24373-1 | SLE-m6.0 | ca-certificates-mozilla | 2026-10-27 |
| SUSE-SU-2026:24383-1 | SLE-m6.1 | ca-certificates-mozilla | 2026-10-27 |
| SUSE-SU-2026:24361-1 | SLE16.0 | ca-certificates-mozilla | 2026-10-26 |
| openSUSE-SU-2026:0360-1 | osB15 | chromium, gn | 2026-10-27 |
| SUSE-SU-2026:24372-1 | SLE-m6.0 | cifs-utils | 2026-10-27 |
| SUSE-SU-2026:24381-1 | SLE-m6.1 | containerd | 2026-10-27 |
| SUSE-SU-2026:24362-1 | SLE16.0 | cpupower | 2026-10-26 |
| SUSE-SU-2026:24380-1 | SLE-m6.1 | cyrus-sasl | 2026-10-27 |
| SUSE-SU-2026:24367-1 | SLE-m6.0 | gcc13 | 2026-10-27 |
| SUSE-SU-2026:24363-1 | SLE-m6.0 | gcc13 | 2026-10-26 |
| SUSE-SU-2026:4913-1 | SLE15 | gcc7 | 2026-10-26 |
| SUSE-SU-2026:24359-1 | SLE16.0 | go1.26 | 2026-10-26 |
| SUSE-SU-2026:24360-1 | SLE16.0 | go1.27 | 2026-10-26 |
| SUSE-SU-2026:24374-1 | SLE-m6.0 | google-osconfig-agent | 2026-10-27 |
| SUSE-SU-2026:24371-1 | SLE6.0 SLE-m6.0 | kernel | 2026-10-27 |
| SUSE-SU-2026:24364-1 | SLE6.0 SLE-m6.0 | kernel | 2026-10-26 |
| SUSE-SU-2026:24379-1 | SLE6.0 SLE-m6.0 SLE-m6.1 | kernel | 2026-10-27 |
| SUSE-SU-2026:24375-1 | SLE6.0 SLE-m6.0 SLE-m6.1 | kernel | 2026-10-27 |
| SUSE-SU-2026:4912-1 | SLE15 oS15.6 | kubernetes-old | 2026-10-26 |
| SUSE-SU-2026:24365-1 | SLE-m6.0 | libX11 | 2026-10-27 |
| SUSE-SU-2026:24366-1 | SLE-m6.0 | libXi | 2026-10-27 |
| SUSE-SU-2026:24368-1 | SLE-m6.0 | libsoup | 2026-10-27 |
| SUSE-SU-2026:24382-1 | SLE-m6.1 | openssh | 2026-10-27 |
| SUSE-SU-2026:24378-1 | SLE-m6.1 | podman | 2026-10-27 |
| SUSE-SU-2026:24377-1 | SLE-m6.1 | python-PyJWT | 2026-10-27 |
| openSUSE-SU-2026:0359-1 | osB15 | python-nltk | 2026-10-26 |
| openSUSE-SU-2026:0358-1 | osB15 | python-social-auth-core | 2026-10-26 |
| SUSE-SU-2026:4915-1 | SLE15 oS15.4 | rekor | 2026-10-26 |
| SUSE-SU-2026:4911-1 | SLE15 SLE5.3 SLE5.4 SLE5.5 SLE-m5.3 SLE-m5.4 SLE-m5.5 SES7.1 | runc | 2026-10-26 |
| SUSE-SU-2026:4918-1 | SLE15 SLE5.5 SLE-m5.5 oS15.5 | suseconnect-ng | 2026-10-27 |
| SUSE-SU-2026:24376-1 | SLE-m6.1 | unbound | 2026-10-27 |
AlmaLinux: the ALSA backbone across releases 8, 9 and 10
The ALSA feed is the broadest single-source block of the two days, because it stacks three major releases with the same package families: DNS (bind, bind9.18), the compression library (brotli), the container tool chain (buildah, podman, skopeo, oci-seccomp-bpf-hook and the container-tools module streams), client software (firefox, thunderbird), observability (grafana), a web server (httpd), IPsec (libreswan), the kernel plus its realtime variant (kernel, kernel-rt), the X server, and several interpreted runtimes shipped as modules or alternates (nodejs:14, nodejs:18, python3.9, python38:3.8 and python38-devel:3.8, golang, python-urllib3, xz, lrzsz, libX11, freeipmi, flatpak, gcc).
| Advisory ID | Release | Package | Date |
|---|---|---|---|
| ALSA-2026:90328 | 10 | bind | 2026-10-26 |
| ALSA-2026:89745 | 9 | bind | 2026-10-26 |
| ALSA-2026:89746 | 9 | bind9.18 | 2026-10-26 |
| ALSA-2026:90449 | 10 | brotli | 2026-10-27 |
| ALSA-2026:90501 | 8 | brotli | 2026-10-27 |
| ALSA-2026:90495 | 9 | brotli | 2026-10-27 |
| ALSA-2026:90424 | 9 | buildah | 2026-10-27 |
| ALSA-2023:6938 | 8 | container-tools:4.0 | 2026-10-26 |
| ALSA-2023:7202 | 8 | container-tools:4.0 | 2026-10-26 |
| ALSA-2026:89760 | 8 | container-tools:rhel8 | 2026-10-26 |
| ALSA-2026:76764 | 10 | firefox | 2026-10-26 |
| ALSA-2026:76850 | 8 | firefox | 2026-10-26 |
| ALSA-2026:76761 | 9 | firefox | 2026-10-26 |
| ALSA-2026:89849 | 10 | flatpak | 2026-10-26 |
| ALSA-2026:89859 | 8 | flatpak | 2026-10-26 |
| ALSA-2026:89850 | 9 | flatpak | 2026-10-26 |
| ALSA-2026:89905 | 10 | freeipmi | 2026-10-26 |
| ALSA-2026:89754 | 8 | freeipmi | 2026-10-26 |
| ALSA-2026:89753 | 9 | freeipmi | 2026-10-26 |
| ALSA-2026:89830 | 8 | gcc | 2026-10-26 |
| ALSA-2026:22121 | 9 | golang | 2026-10-26 |
| ALSA-2026:89732 | 10 | grafana | 2026-10-26 |
| ALSA-2026:54184 | 9 | grafana | 2026-10-26 |
| ALSA-2026:89744 | 9 | grafana | 2026-10-26 |
| ALSA-2026:89860 | 10 | httpd | 2026-10-26 |
| ALSA-2026:89816 | 8 | kernel | 2026-10-26 |
| ALSA-2026:89083 | 8 | kernel | 2026-10-26 |
| ALSA-2026:90365 | 9 | kernel | 2026-10-27 |
| ALSA-2026:87805 | 9 | kernel | 2026-10-26 |
| ALSA-2026:89814 | 8 | kernel-rt | 2026-10-26 |
| ALSA-2026:89082 | 8 | kernel-rt | 2026-10-26 |
| ALSA-2026:89730 | 8 | libX11 | 2026-10-26 |
| ALSA-2026:89923 | 10 | libreswan | 2026-10-26 |
| ALSA-2026:90492 | 8 | libreswan | 2026-10-26 |
| ALSA-2026:89748 | 9 | libreswan | 2026-10-26 |
| ALSA-2026:89755 | 9 | lrzsz | 2026-10-26 |
| ALSA-2023:1743 | 8 | nodejs:14 | 2026-10-26 |
| ALSA-2023:1583 | 8 | nodejs:18 | 2026-10-26 |
| ALSA-2026:89752 | 10 | oci-seccomp-bpf-hook | 2026-10-26 |
| ALSA-2026:90362 | 9 | podman | 2026-10-27 |
| ALSA-2026:90759 | 8 | python-urllib3 | 2026-10-27 |
| ALSA-2026:90494 | 9 | python-urllib3 | 2026-10-27 |
| ALSA-2026:89742 | 9 | python3.9 | 2026-10-26 |
| ALSA-2022:7581 | 8 | python38:3.8 and python38-devel:3.8 | 2026-10-26 |
| ALSA-2026:89761 | 10 | skopeo | 2026-10-26 |
| ALSA-2026:90462 | 9 | skopeo | 2026-10-27 |
| ALSA-2026:80674 | 10 | thunderbird | 2026-10-26 |
| ALSA-2026:80694 | 9 | thunderbird | 2026-10-26 |
| ALSA-2026:89747 | 8 | xorg-x11-server | 2026-10-26 |
| ALSA-2026:89749 | 9 | xz | 2026-10-26 |
Oracle: ELSA coverage from OL7 through OL10
Oracle mirrors much of the same ALSA/RHSA shape but adds its own scope, and that overlap is exactly where duplicate tickets are created. Beyond the shared bind, brotli, kernel, firefox, flatpak, freeipmi, grafana, httpd, libreswan, libX11, lrzsz, xz, skopeo, buildah, python3.9 and xorg-x11-server families, this window carries trust-store updates (ca-certificates on OL8 and OL9), mail transport (postfix on OL7), resolver services (unbound on OL7), Node.js shipped under a different naming convention (nodejs22, nodejs24 and the nodejs:22 module stream), Perl module streams (perl:5.32, perl-DBI:1.641) and the vector-enabled PostgreSQL packages (postgresql16-pgvector, postgresql18-pgvector).
| Advisory ID | Release | Package | Date |
|---|---|---|---|
| ELSA-2026-90328 | OL10 | bind | 2026-10-26 |
| ELSA-2026-89745 | OL9 | bind | 2026-10-26 |
| ELSA-2026-89746 | OL9 | bind9.18 | 2026-10-26 |
| ELSA-2026-500514 | OL10 | brotli | 2026-10-26 |
| ELSA-2026-500512 | OL8 | brotli | 2026-10-26 |
| ELSA-2026-500513 | OL9 | brotli | 2026-10-26 |
| ELSA-2026-88262 | OL10 | buildah | 2026-10-26 |
| ELSA-2026-88550 | OL8 | ca-certificates | 2026-10-26 |
| ELSA-2026-88459 | OL9 | ca-certificates | 2026-10-26 |
| ELSA-2026-89756 | OL8 | firefox | 2026-10-27 |
| ELSA-2026-89757 | OL9 | firefox | 2026-10-26 |
| ELSA-2026-89849 | OL10 | flatpak | 2026-10-26 |
| ELSA-2026-89859 | OL8 | flatpak | 2026-10-27 |
| ELSA-2026-89905 | OL10 | freeipmi | 2026-10-26 |
| ELSA-2026-89754 | OL8 | freeipmi | 2026-10-26 |
| ELSA-2026-89753 | OL9 | freeipmi | 2026-10-26 |
| ELSA-2026-89732 | OL10 | grafana | 2026-10-26 |
| ELSA-2026-89744 | OL9 | grafana | 2026-10-26 |
| ELSA-2026-89860 | OL10 | httpd | 2026-10-26 |
| ELSA-2026-88477 | OL10 | kernel | 2026-10-26 |
| ELSA-2026-89730 | OL8 | libX11 | 2026-10-26 |
| ELSA-2026-89923 | OL10 | libreswan | 2026-10-26 |
| ELSA-2026-89748 | OL9 | libreswan | 2026-10-26 |
| ELSA-2026-89755 | OL9 | lrzsz | 2026-10-26 |
| ELSA-2026-500516 | OL10 | nodejs22 | 2026-10-26 |
| ELSA-2026-500515 | OL10 | nodejs24 | 2026-10-26 |
| ELSA-2026-500517 | OL9 | nodejs:22 | 2026-10-26 |
| ELSA-2026-89752 | OL10 | oci-seccomp-bpf-hook | 2026-10-26 |
| ELSA-2026-85916 | OL8 | perl-DBI:1.641 | 2026-10-26 |
| ELSA-2026-85917 | OL8 | perl:5.32 | 2026-10-26 |
| ELSA-2026-57174 | OL7 | postfix | 2026-10-26 |
| ELSA-2026-88359 | OL10 | postgresql16-pgvector | 2026-10-26 |
| ELSA-2026-88360 | OL10 | postgresql18-pgvector | 2026-10-26 |
| ELSA-2026-89742 | OL9 | python3.9 | 2026-10-26 |
| ELSA-2026-89761 | OL10 | skopeo | 2026-10-26 |
| ELSA-2026-72199 | OL7 | unbound | 2026-10-26 |
| ELSA-2026-89747 | OL8 | xorg-x11-server | 2026-10-26 |
| ELSA-2026-89749 | OL9 | xz | 2026-10-26 |
Triage checklist: queue these groups first in the Tuesday window
- Internet-facing name and web services: bind, bind9.18, nsd, unbound, httpd, nginx — every one of these has an entry inside the 2026-10-26 / 2026-10-27 window on at least one platform.
- Kernel lines that need a reboot slot: kernel on releases 8, 9, 10, OL10, F43, F44, SLE6.0/SLE-m6.0/SLE-m6.1, plus the separate kernel-rt entries on AlmaLinux 8 — plan the maintenance window per restart, not per advisory.
- Trust anchors and transport security: ca-certificates, ca-certificates-mozilla, openssh, libreswan, cyrus-sasl, python-urllib3, python3.12-urllib3, python3.14-urllib3 — a stale trust store silently breaks TLS validation across an estate.
- Container and orchestration layer: containerd, runc, podman, buildah, skopeo, oci-seccomp-bpf-hook, kubernetes-old, container-tools:4.0, container-tools:rhel8 — golden images need rebuilding, not just package swaps on running nodes.
- Browser and mail engines on user endpoints: firefox, thunderbird, chromium (with gn), webkitgtk, webkit2, evolution — endpoint fleet updates usually lag behind server patching.
- Observability and database services: grafana, grafana-pcp, valkey, postgresql16-pgvector, postgresql18-pgvector — dashboards and data-tier services are frequently excluded from automated patch rings.
- Parsers, codecs and file-format handlers: brotli, xz, freetype2, ghostscript, libjxl, libde265, libical, unshield, inkscape, swupdate — these process untrusted input and reach far more hosts than you expect.
- Toolchains and runtimes baked into CI images: gcc, gcc7, gcc13, golang, go1.26, go1.27, python3.9, python38:3.8 and python38-devel:3.8, nodejs:14, nodejs:18, nodejs22, nodejs24, nodejs:22, perl:5.32, perl-DBI, perl-DBI:1.641, perl-Plack, perl-Plack-Middleware-ReverseProxy, perl-Alien-Brotli, perl-ExtUtils-Typemaps-Default, perl-Imager, mingw-python3, vim, helix, stgit, rust-dua-cli, rust-gengo-bin, rust-gitui, dolphin, lrzsz, xorg-x11-server, libX11, libXi, libsoup, kronosnet, cifs-utils, freeipmi, flatpak, google-osconfig-agent, suseconnect-ng, rekor, python-PyJWT, python-social-auth-core, python-nltk, packages.
- Cross-check RHEL-derived feeds once: the same numeric identifier frequently appears as ALSA, ELSA and RHSA lines — merge them into one internal ticket per host group to avoid duplicate work.
Common misconceptions that quietly reduce patch coverage
- "One advisory ID equals one package." Fedora shows the opposite: FEDORA-2026-957c1e5c9d and FEDORA-2026-e2538282de each cover helix, rust-dua-cli, rust-gengo-bin, rust-gitui and stgit; FEDORA-2026-6a639d1308 lists brotli and perl-Alien-Brotli. De-duplicating by ID alone hides subpackages.
- "An older year in the ID means a stale record." ALSA-2022:7581 and ALSA-2023:1743, ALSA-2023:1583, ALSA-2023:6938, ALSA-2023:7202 all carry a Date of 2026-10-26. Index on the date column, not on the number embedded in the identifier.
- "kernel updated, so kernel-rt is covered." The AlmaLinux 8 rows are separate entries: kernel under ALSA-2026:89816 and ALSA-2026:89083, kernel-rt under ALSA-2026:89814 and ALSA-2026:89082.
- "bind covers bind9.18." Release 9 lists both bind (ALSA-2026:89745) and bind9.18 (ALSA-2026:89746), because the versioned stream is installed independently.
- "A USN is release-specific." USN-8956-1 and USN-8955-1 each state 22.04 24.04 26.04 26.10 in one row; scoping by single release leaves LTS hosts behind.
- "One SUSE line equals one product." runc is published for SLE15 SLE5.3 SLE5.4 SLE5.5 SLE-m5.3 SLE-m5.4 SLE-m5.5 SES7.1 at once, and the kernel lines enumerate SLE6.0 SLE-m6.0 SLE-m6.1 combinations.
- "Package name equals installed name." Module-stream and alternate packaging (container-tools:4.0, python38:3.8, nodejs:14, perl:5.32, nodejs22 versus nodejs:22) means your inventory query must match the stream spelling, and the urllib3 library is spelled differently on Red Hat than on AlmaLinux.
- "Every feed publishes on the same calendar day." firefox is dated 2026-10-26 on AlmaLinux 8, 9 and 10 but 2026-10-27 for OL8 (ELSA-2026-89756), and brotli splits across 2026-10-26 and 2026-10-27 within the same window. A one-day sync job will show false gaps.
- "If it is a desktop package it can wait." Client engines and libraries in this set (thunderbird, firefox, chromium, webkit2, webkitgtk, vim, xz, inkscape, evolution) are precisely the paths most often reached by user-supplied content.
Frequently asked questions
Does this sheet tell me how severe each update is?
No. The source records carry only an advisory identifier, a release label, a package name and a date. Severity, impact statements and affected version ranges live in the upstream advisory text of each feed, so open the record for the identifier you intend to deploy rather than inferring urgency from this table.
Why are two dates in scope, and what about a host that missed the window?
The records gathered here are dated 2026-10-26 and 2026-10-27 — the two publication days of this Tuesday cycle. A host that was offline during either day is still unpatched against the corresponding line, so re-scan after the sync rather than assuming the package cache reflects both days.
Should I open one ticket per advisory or per feed?
Per host group. Because identical numeric identifiers surface as ALSA, ELSA and RHSA entries, one ticket per identifier per environment prevents duplicated approvals, while the Release cell tells you which images, nodes and endpoints belong to that ticket.
How do I verify that a container host is actually patched?
Check the runtime components individually. Lines for containerd, runc, podman, buildah, skopeo, oci-seccomp-bpf-hook and the container-tools module streams can land on different dates within the same window, and a rebuilt image must be redeployed before the node reports the new package version.
What is the fastest way to prove coverage to an auditor?
Store the four fields as evidence. A signed export of these rows — advisory ID, release, package, date — matched to your asset inventory for the 2026-10-26 / 2026-10-27 Tuesday window gives a reviewer a reproducible statement of which vendor lines you accepted, deferred or excluded.
Do I need to patch distributions I do not run?
No, but confirm the negative. If your inventory lists only Ubuntu and Debian hosts, the AlmaLinux, Oracle, Red Hat, SUSE, Fedora and Mageia rows still document that the same libraries — brotli, bind, kernel, firefox, xz, unbound — moved across the ecosystem in this cycle, which is useful context for third-party appliances built on those bases.
Action recommendations before the next cycle closes
- Freeze the two-day dataset. Snapshot the AlmaLinux, Debian, Fedora, Mageia, Oracle, Red Hat, SUSE and Ubuntu rows for 2026-10-26 and 2026-10-27 as your patch baseline for this window.
- Reconcile the Release column against real labels. Map 8, 9, 10, LTS, stable, F43, F44, F45, OL7, OL8, OL9, OL10, EL8.6, EL8.8, EL9, EL10, SLE-m6.0, SLE-m6.1, SLE16.0, SLE6.0, SLE15, SLE-m5.3, SLE-m5.4, SLE-m5.5, SES7.1, osB15, oS15.4, oS15.5, oS15.6, 22.04, 24.04, 26.04 and 26.10 to CMDB entries before approving changes.
- Expand every multi-package identifier. Install all subpackages listed under a shared ID rather than the first matching name.
- Separate restart from non-restart work. Group kernel and kernel-rt entries into their own maintenance slot so the rest of the batch is not blocked behind a reboot.
- Rebuild images, then redeploy. Container tool chain and library changes (brotli, xz, python-urllib3, containerd, runc) only take effect for hosts created from the refreshed template.
- Record deferrals with an owner and an expiry. Any line intentionally skipped — a legacy OL7 host, an LTS box on an extended support plan, a desktop app such as inkscape or dolphin — should carry a named owner and a review date.
- Re-scan and diff. Compare scanner output against the table after both days are ingested; the residual list is your true exception register, and it feeds the next Tuesday review.
A two-day advisory window is only as useful as the discipline you attach to it: match the identifier, match the release label, match the exact package spelling, then prove the version changed. Keep this sheet open beside your inventory export during the next maintenance window, and the difference between "the vendor published an update" and "the estate is actually closed" becomes measurable instead of assumed.