Linux Security Weekly: What to Patch Now
Linux security weekly is back, and this episode covers what to patch right now across Cockpit, Marimo, Ubuntu and SUSE kernel updates, plus fresh X.Org and Xwayland fixes.
If you run Linux at home, in a homelab, or in production, this video focuses on the practical habits that keep systems secure: patching quickly, reducing exposure, rebooting when required, and verifying that fixes actually landed.
In this roundup, I break down why the Cockpit management-plane flaw matters, how attackers are exploiting Marimo to deploy Linux-capable malware, why routine kernel patching is not complete until the reboot happens, and why older graphics components still deserve attention.
CHAPTERS
00:00 Introduction - Practical Linux security habits
00:51 Cockpit CVE-2026-4631 - Why exposed admin tools matter
02:08 Marimo CVE-2026-39987 - Active exploitation and NKAbuse
03:27 Ubuntu and SUSE kernel advisories - Patch, reboot, verify
04:31 X.Org and Xwayland vulnerabilities - Legacy components still matter
05:29 Conclusion - Maintenance work, not incident response
ISSUE LINKS
Cockpit CVE-2026-4631 (Red Hat): https://access.redhat.com/security/cv...
Ubuntu USN-8186-1: https://ubuntu.com/security/notices/U...
SUSE kernel advisory 2026-1279-1: https://linuxsecurity.com/advisories/...
Marimo exploitation report: https://www.bleepingcomputer.com/news...
X.Org and Xwayland fixes: https://9to5linux.com/xorg-server-21-...
Phoronix X.Org coverage: https://www.phoronix.com/news/X.Org-S...
REMEDIATION COMMANDS
Cockpit exposure and patching
Check whether Cockpit is installed and listening:
systemctl status cockpit.socket cockpit.service
ss -tulpn | grep 9090
ssh -V
Patch Cockpit on RHEL-family systems:
sudo dnf update cockpit -y
sudo systemctl restart cockpit
Patch Cockpit on Debian or Ubuntu:
sudo apt update && sudo apt install --only-upgrade cockpit -y
sudo systemctl restart cockpit
Example firewall restriction for Cockpit on port 9090:
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.50.0/24" port protocol="tcp" port="9090" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port protocol="tcp" port="9090" drop'
sudo firewall-cmd --reload
Review SSH Match exec usage:
sudo grep -R "Match .*exec" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
Marimo patching and triage
Check installed version:
python3 -m pip show marimo
pip3 show marimo
Upgrade Marimo:
python3 -m pip install --upgrade marimo
Check exposure:
ss -tulpn | grep -E '2718|8080|8000|marimo'
Look for persistence and suspicious files:
systemctl list-unit-files --type=service | grep -Ei 'agent|kagent|marimo'
crontab -l
sudo ls -la /etc/cron.*
sudo find /tmp /var/tmp /usr/local/bin ~/.local/bin -type f -mtime -7 | sort
If you need to cut access quickly:
sudo ufw deny 2718/tcp
sudo ufw status verbose
Triage processes, logs, and connections:
ps auxf
journalctl --since '7 days ago' | grep -Ei 'curl|wget|bash -c|systemd|cron|marimo|kagent'
ss -tpn
Ubuntu and SUSE kernel patching
Ubuntu patch and reboot:
sudo apt update
sudo apt full-upgrade -y
sudo reboot
Ubuntu post-reboot verification:
uname -r
dkms status
journalctl -b -p warning..err | grep -Ei 'dkms|module|nvidia|zfs|vbox'
SUSE patch flow:
sudo zypper refresh
sudo zypper patch -y
uname -r
rpm -qa | grep '^kernel' | sort
Check whether reboot is still pending:
[ -f /var/run/reboot-required ] && cat /var/run/reboot-required || echo 'No reboot flag file present'
needs-restarting -r
X.Org and Xwayland checks
Check whether packages are installed:
apt list --installed | grep -Ei 'xorg|xwayland'
rpm -qa | grep -Ei 'xorg|xwayland'
Patch through the package manager:
sudo apt update && sudo apt upgrade -y
sudo dnf update -y
sudo zypper up -y
dpkg -l | grep -Ei 'xserver|xorg|xwayland'
FOLLOW TON DOES LINUX
Website: https://tondoeslinux.com
Facebook: / tondoeslinux
Twitter/X: @tondoeslinux
JOIN THE DISCUSSION
Which of these do you check first in your own setup: exposed admin tools, developer tooling, pending kernel reboots, or older desktop packages you forgot were still installed?
If you found this useful, subscribe to Ton Does Linux and More! for practical Linux news, reviews, tutorials, and real-world admin guidance.
#Linux #LinuxSecurity #OpenSource #SysAdmin #CyberSecurity
Nesta página do site você pode assistir ao vídeo on-line Linux Security Weekly: What to Patch Now duração hora minuto segundo em boa qualidade , que foi baixado pelo usuário Ton Does Linux and More! 20 Abril 2026, compartilhe o link com seus amigos e conhecidos, no youtube este vídeo já foi visto 1,352 vezes e gostou 88 espectadores. Boa visualização!
