Search: “Amazon Linux”

8 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 114 Exploit / PoC 68 Malware 59 Ransomware 42 Threat actor 21 Data breach 17 Policy & legal 16 Industry 12 Phishing & fraud 9 Research 7 AI industry 6 AI research 4 AI tools & infra 4 Tools 3

SeverityAll critical 190 high 81 medium 64 low 32 info 19

2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")

Linux kernel flaw CVE-2026-31431 ('Copy Fail', CVSS 7.8) allows unprivileged users to gain root via AF_ALG; a public PoC is out and most distros remain unpatched.

Disclosed on 29 April 2026, CVE-2026-31431 is a local privilege escalation in the Linux kernel's algif_aead module (AF_ALG crypto API), CVSS 7.8, stemming from a 2017 in-place optimisation. By chaining an AF_ALG socket operation with splice(), an unprivileged user can write 4 bytes into an arbitrary page-cache page, e.g. corrupting a setuid binary like /usr/bin/su to obtain a root shell. It affects virtually all kernels built since 2017, including Ubuntu 20.04-24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16; the mainline fix landed 1 April 2026 but no vendor packages were available as of 30 April. CERT-EU recommends the interim mitigation (disable algif_aead) and blocking AF_ALG via seccomp, prioritising Kubernetes nodes and CI/CD runners.

CERT-EU Advisoriesupdated Sep 7, 09:12 UTC · 8d agofirst Apr 29, 00:00 UTC · Apr 29, 2026Exploit / PoC 6 sources CVE-2026-31431

Nearly every Linux system built since 2017 vulnerable to ‘Copy Fail’ flaw

The RecordMay 1, 12:17 UTC · May 1, 2026Exploit / PoC in the wildCVE-2026-31431

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026Exploit / PoC in the wildCVE-2026-31431 CVE-2022-27666 CVE-2026-43284+1 CVEs

Tic Tac Toe with a twist

Kaspersky SecurelistOct 10, 09:00 UTC · Oct 10, 2014Exploit / PoC in the wild

Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

Sysdig documents a skilled human attacker exploiting Marimo pre-auth RCE CVE-2026-39987 (CVSS 9.3), reaching an SSH bastion in eight seconds without AI tooling.

Sysdig detailed exploitation of CVE-2026-39987 (CVSS 9.3), a pre-authenticated RCE affecting all Marimo versions that came under active exploitation within hours of disclosure. A human operator used a hand-written Python script to harvest an AWS key from Secrets Manager and SSH into a bastion host in eight seconds, issuing 850+ commands over nine hours. Separately, Hunt.io disclosed an XMRig cryptomining campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection. Operation CameraSwarm, linked to a single operator, compromised over 14,000 Dahua IP cameras using CVE-2021-33044 and CVE-2021-33045.

The Hacker NewsSep 15, 11:52 UTC · 18h agoExploit / PoC in the wild 4 sources CVE-2026-39987 CVE-2021-33044 CVE-2021-33045