Search: “linux kernel”

6 items in the last 24h

Vercel's $1M sandbox challenge surfaced two Linux kernel networking defects—one leaking host kernel memory, one crashing hosts—with CVEs pending.

Vercel ran a two-week, $1 million sandbox escape challenge (Aug 18–Sep 1) on its Firecracker-based microVM sandbox, receiving 1,285 reports and committing ~$325k in payouts (1 Critical, 7 High, 15 Medium, 49 Low validated so far). No attacker accessed real customer data. The most important filing found two independent Linux kernel networking stack defects—one leaks host kernel memory, the other deterministically crashes the host—with wide implications for cloud providers isolating workloads via the same kernel layer. Fixes are under private review with CVEs pending; Vercel also plans to open-source its agentic report-triage agent built on the Eve framework running Kimi K3.

SecurityWeekSep 15, 16:00 UTC · 21h agoVulnerability1

Building a Linux GPU Driver for the M4 Mac Mini in One Month

Two developers built a fully OpenGL ES 3.0 compliant Linux GPU driver for the M4 Mac Mini in one month via clean-room reverse engineering.

Niklas and the author reverse engineered Apple's AGX GPU firmware ABI and user-space components in about a month, a process that normally takes years, producing an OpenGL ES 3.0 conformant driver fast enough to run Minecraft at 200fps on an M4 Mac Mini. The work was done transparently using hypervisor traces without examining Apple binaries, following clean-room practices, and included a custom shader compiler, command stream builder, and a full Linux kernel driver for the firmware ABI. The A18 Pro firmware ABI proved significantly more complex than the M1's, with 1.5x as many structs and twice as many pointers. All experiments and provenance evidence were published in public agx-re repositories.

Hacker News · AISep 15, 19:30 UTC · 18h agoResearch HN 40↑ · 5 comments

Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover

Two unauthenticated CVSS 9.8 code-injection and PHP object injection flaws in The Events Calendar plugin expose 200,000+ WordPress sites to RCE and takeover.

Defiant identified two critical vulnerabilities in The Events Calendar WordPress plugin, which has over 600,000 active installations. CVE-2026-78159, unauthenticated code injection during single-event HTML processing, was patched in version 6.17.3.1 on August 25; CVE-2026-78006, unauthenticated PHP object injection via event comments, was patched in 6.17.4.1 on September 10. Both independent chains lead to remote code execution and full site compromise. Roughly 240,000 sites run versions vulnerable to both flaws, and about 300,000 downloads between September 10 and 14 suggest half of installations may still lack the second fix.

SecurityWeek11:32 UTC · 2h agoVulnerability 3 sources CVE-2026-78159 CVE-2026-78006

Enterprises Warned of Attacks Exploiting WSO2 Vulnerability

Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.

WatchTowr's honeypot network recorded the first exploitation attempt of CVE-2026-5430 on September 13, roughly two months after the CVE record was published in early August. The flaw, patched by WSO2 in April with an advisory in May, carries a maximum CVSS score of 10 and allows JWT authentication bypass via tokens signed with unsupported algorithms, enabling unauthorized access and full account takeover. A forged JWT observed in the wild granted access to API backend endpoints, credentials, and consumer keys and secrets for every registered application. WSO2's API Manager, API Control Plane, Traffic Manager, and Universal Gateway are affected, and the platform serves nearly 1,000 enterprise customers in banking, government, telecom, and logistics.

SecurityWeek08:39 UTC · 5h agoExploit / PoC in the wild 2 sources CVE-2026-54302· 1 read

Oracle Patches 800+ Vulnerabilities in September 2026 Security Update

Oracle's September 2026 Critical Patch Update fixes 800+ vulnerabilities, including over 100 critical flaws and 240+ remotely exploitable without authentication.

Oracle released 673 new security patches in its September 2026 Critical Security Patch Update, resolving 672 unique CVEs across 17 risk matrices plus 130+ additional CVEs. More than 100 flaws are critical severity and over 240 are remotely exploitable without authentication. Oracle E-Business Suite received the largest batch with 159 patches, followed by Fusion Middleware (153, including 78 unauthenticated remote flaws) and Hyperion (102). Oracle reports no exploitation of these specific flaws but warns attackers routinely exploit unpatched Oracle products.

SecurityWeekupdated 13:03 UTC · 55m agofirst 08:06 UTC · 5h agoAdvisory 2 sources

Why I'm still bearish on LLMs after Navier-Stokes

Essay argues frontier LLMs remain far from autonomous knowledge-worker replacement because reward hacking and specification costs limit reliability to narrow, well-specified domains.

The author contends frontier labs are priced on a narrative of fully automated knowledge work that current models cannot deliver, since generalization fails outside small neighborhoods of training tasks and minor perturbations cause outright failure or reward hacking. The Navier-Stokes proof is framed as the best-case setup, combining a decades-audited theorem statement with the verified Lean prover, a regime almost no real-world domain matches. Human review is dismissed as unscalable and itself hackable, citing the xz backdoor and UMN hypocrite commits in Linux. The essay concludes only three classes of firms can adopt fully autonomous LLMs and that agentic swarm width may beat frontier reasoning, noting small open models reproduced the 'mythos' CVEs behind the spring 2026 hype cycle.

Hacker News · AISep 15, 17:37 UTC · 20h agoAI industry HN 50↑ · 13 comments