Alpine Linux patches OpenSSL, musl, zlib across four stable branches

Brief written by the FOSSWire AI editor from Alpine Linux How we write

October 21, 2026 1 min read

Key Takeaway

Alpine Linux released security updates for versions 3.21.9, 3.22.7, 3.23.7, and 3.24.3, fixing multiple CVEs in OpenSSL, musl, zlib, and PHP.

Summary

The Alpine Linux project shipped synchronized security updates across all four maintained stable branches. The releases address a compromised eMudhra intermediate CA through updated ca-certificates, a musl libc vulnerability, and numerous OpenSSL CVEs from the September 29, 2026 advisory. Branches 3.23 and 3.24 additionally include PHP security fixes for versions 8.3 through 8.5.

Components patched in this release

ca-certificates: Updated to address the eMudhra intermediate CA compromise
musl: CVE-2026-107891 patched
OpenSSL: Multiple CVEs fixed — CVE-2026-35189, CVE-2026-54872, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782, CVE-2026-84784; CVE-2026-42772 and CVE-2026-54873 excluded from 3.21.9
zlib: CVE-2026-85091 patched
PHP 8.3–8.5: CVE-2026-109618 and CVE-2026-109619 fixed in 3.23 and 3.24 branches only

Why it matters

Alpine's musl-based, container-focused distribution is widely used in Docker images and embedded deployments, making these coordinated multi-branch updates significant for supply-chain security.

Original reference: alpinelinux.org →