55
USN-8679-2: Vim vulnerability
Ubuntu's USN-8679-2 updates Vim for Ubuntu 26.04 LTS, fixing a tags-file handling flaw that could allow arbitrary code execution.
Ubuntu Security Notice USN-8679-2 extends the Vim fix from USN-8679-1 to Ubuntu 26.04 LTS. The vulnerability stems from incorrect handling of certain tags files, which an attacker could exploit to execute arbitrary code. This is a routine distribution security update with no exploitation reported.
22
USN-8670-3: curl vulnerability
Ubuntu issued USN-8670-3 updating curl for Ubuntu 26.04 LTS to fix a flaw where wrong client certificates could be used on reused connections.
Ubuntu Security Notice USN-8670-3 extends the curl fix from USN-8670-1 to Ubuntu 26.04 LTS. The flaw, discovered by Joshua Rogers, involves incorrect handling of connection reuse when client certificate settings change, potentially causing the wrong client certificate to be presented. The issue can lead to authentication mix-ups rather than remote code execution.
22
60
Thelio Mira AI Linux Workstation: 192 GB GPU Memory
System76 launches the Thelio Mira AI Linux workstation from $3,299 with dual NVIDIA RTX Pro 6000 GPUs and 192 GB GPU memory for local AI workloads.
System76's Thelio Mira AI is a locally built (Denver, Colorado) Linux workstation for AI training, fine-tuning, and inference, starting at $3,299. Configurations go up to a 16-core AMD Ryzen 9000 CPU, 192 GB DDR5 RAM, and dual NVIDIA RTX Pro 6000 Blackwell GPUs delivering 192 GB of (ECC) GPU memory with liquid cooling, dual PCIe 5.0 x16 slots, and up to three M.2 NVMe drives. It ships with Pop!_OS 24.04 LTS or Ubuntu and is positioned as a way to avoid recurring cloud GPU costs.
15
USN-8739-1: ImageMagick vulnerabilities
Canonical released USN-8739-1 fixing five ImageMagick flaws that could cause denial of service or arbitrary code execution.
Ubuntu security notice USN-8739-1 patches five ImageMagick vulnerabilities: CVE-2026-56366, CVE-2026-56368, CVE-2026-56371, and CVE-2026-56373 allow denial of service via crafted images on Ubuntu 14.04 through 22.04 LTS. CVE-2026-56370 affects Ubuntu 22.04 LTS and 26.04 LTS and could allow denial of service or arbitrary code execution. Users should apply the updated ImageMagick packages to affected releases.
25
60
USN-8743-1: PHP vulnerabilities
Ubuntu fixes three PHP flaws, including SQL injection in the PostgreSQL extension (CVE-2026-17543) and an out-of-bounds write in bccomp().
Ubuntu Security Notice USN-8743-1 patches three vulnerabilities in PHP. CVE-2026-17543 involves incorrect backslash escaping in the PostgreSQL extension enabling SQL injection. CVE-2026-17544 is an out-of-bounds write in bccomp() that could cause denial of service or arbitrary code execution on Ubuntu 26.04 LTS, and CVE-2026-7260 causes unbounded recursion via circular symlinks in phar archives.
28
USN-8737-1: GNU C Library vulnerabilities
Ubuntu patches GNU C Library flaws including a strfmon buffer overflow and tdelete out-of-bounds access that could enable code execution.
Ubuntu issued USN-8737-1 fixing multiple GNU C Library vulnerabilities. CVE-2026-19499 is a buffer overflow in the strfmon function when handling right-justification padding, affecting only Ubuntu 26.04 LTS. CVE-2026-19542 is an out-of-bounds stack array access in the tdelete function. An additional issue involves incorrect memory handling in wordexp with the WRDE_APPEND flag. All issues could potentially cause denial of service or arbitrary code execution.
25
USN-8739-2: ImageMagick vulnerabilities
Ubuntu releases USN-8739-2, extending ImageMagick fixes for four CVEs including possible arbitrary code execution to Ubuntu 24.04 LTS.
USN-8739-2 provides the ImageMagick fixes from USN-8739-1 for Ubuntu 24.04 LTS. The flaws stem from incorrect handling of certain images that could allow an attacker to cause a denial of service or possibly execute arbitrary code. The affected CVEs are CVE-2026-56366, CVE-2026-56368, CVE-2026-56371, and CVE-2026-56373.
15
60
PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
PostgreSQL fixed CVE-2026-6471 (CVSS 7.2), a 12-year-old logical decoding flaw letting replication-role accounts execute arbitrary code as the database OS user.
PostgreSQL patched CVE-2026-6471 (CVSS 7.2), a flaw present since logical decoding shipped in 9.4 (2014) that lets an account with the REPLICATION attribute run arbitrary code as the database server's OS user when wal_level is logical. Versions before 18.6, 17.11, 16.15, 15.19, and 14.24 are affected; exploitation requires such an account, which backup, CDC, and monitoring tooling routinely holds. The fix adds an output_plugin_libraries whitelist, so administrators using non-default plugins such as wal2json and decoderbufs must add them and reload configuration after updating. Cyera Research, whose write-up names the flaw PostGREShell, demonstrated escalating a replication user to superuser with persistence; no PoC or KEV entry existed as of September 4.
60
2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")
Linux kernel flaw CVE-2026-31431 ('Copy Fail', CVSS 7.8) allows unprivileged users to gain root via AF_ALG; a public PoC is out and most distros remain unpatched.
Disclosed on 29 April 2026, CVE-2026-31431 is a local privilege escalation in the Linux kernel's algif_aead module (AF_ALG crypto API), CVSS 7.8, stemming from a 2017 in-place optimisation. By chaining an AF_ALG socket operation with splice(), an unprivileged user can write 4 bytes into an arbitrary page-cache page, e.g. corrupting a setuid binary like /usr/bin/su to obtain a root shell. It affects virtually all kernels built since 2017, including Ubuntu 20.04-24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16; the mainline fix landed 1 April 2026 but no vendor packages were available as of 30 April. CERT-EU recommends the interim mitigation (disable algif_aead) and blocking AF_ALG via seccomp, prioritising Kubernetes nodes and CI/CD runners.
68