ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “rootless”

24 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 6Exploit / PoC 4Malware 3Data breach 1Research 1Tools 1Industry 1
SeverityAllcritical 3high 2medium 10low 1info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root

JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.

JFrog researchers found that Parallels Desktop's privileged prl_disp_service daemon on macOS accepts unsigned local clients through a world-writable socket and allows argument injection into a tar command during appliance installation. Injecting the --use-compress-program option makes tar execute an attacker-controlled program as root, and a one-line proof of concept yielded a root shell without needing a running virtual machine. The flaw, dubbed ParaShells, was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon and is fixed in version 27.0.0. No exploitation in the wild has been reported; administrators should inventory and upgrade affected installations and restrict local account access.

Cyber Security Newsupdated · 4h agofirst · 8h agoVulnerability 4 sourcesCVE-2026-90894

Shared Hosting at Risk: LiteSpeed Enterprise Bug Can Grant Root from a Single Tenant

Critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets a low-privilege shared-hosting tenant escape CageFS isolation and gain root; forced update urged.

cPanel warned that a critical privilege-escalation vulnerability in LiteSpeed Web Server Enterprise (fixed in 6.3.7) lets a malicious low-privilege website user bypass account isolation controls including CloudLinux CageFS and gain root on shared-hosting servers, enabling cross-tenant compromise. No CVE, severity rating, or technical details have been published, and it is unclear whether the flaw is being exploited. This is the third root-level LiteSpeed escape on cPanel servers since May, following CVE-2026-48172 and CVE-2026-54420, which were actively exploited and added to CISA's KEV catalog.

Security Affairs · 1d agoVulnerability 2 sourcesCVE-2026-48172CVE-2026-54420

Rootless Docker and Its Hidden Security Trade-Offs

A blog post examines the security trade-offs of running Docker in rootless mode, covering isolation benefits and hidden limitations for defenders.

Ken Muse published a write-up titled 'Rootless Docker and Its Hidden Security Trade-Offs', analyzing the security implications of rootless Docker deployments. The feed provides only the title, so detailed findings are not available in this item, but the piece targets the intersection of containerization and privilege isolation practices.

Lobsters · security · 16d agoResearch1

Omarchy: Any User Process Can Escalate to Root

A security write-up details how any user process on the Omarchy Linux setup can escalate privileges to root.

A post on 0xcc.io describes a local privilege escalation issue in Omarchy, the Arch-based Linux configuration, where any user process can escalate to root. The disclosure appears to describe a design-level weakness in the distribution's security model. No CVE identifier is mentioned in the available text.

Lobsters · security · 16d agoVulnerability

Any user process can escalate to root

A disclosed local privilege escalation flaw allows any user process to escalate to root on the affected system.

A Lobsters-linked security write-up describes a vulnerability in which any user process can escalate its privileges to root. The feed text provides no product name, CVE identifier, CVSS score, or exploitation details, limiting available detail. Local privilege escalation flaws are commonly chained with other issues for full system compromise, so defenders should review the full write-up for affected versions and patches.

Lobsters · security · 16d agoVulnerability

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security News · 1d agoVulnerability

[0day-rubbish] core-admin 1.0.164 (build 16468) Systemic shell command injection via ineffective quote escaping (8.8)

0day Rubbish discloses a CVSS 8.8 shell command injection in core-admin 1.0.164 via ineffective quote escaping, enabling authenticated remote code execution.

0day Rubbish Research Team publicly disclosed a systemic shell command injection (CWE-78) in core-admin 1.0.164 (build 16468). The flaw stems from ineffective quote escaping and scores 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The disclosure does not mention a CVE identifier or observed exploitation in the wild.

Full Disclosure · 8d agoVulnerability1

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Cisco Talos identifies UAT-10147 deploying the SPECTRE implant with cross-platform C2, credential theft, and kernel-level EDR bypass.

Cisco Talos reports that the tracked threat actor UAT-10147 is deploying a newly identified implant named SPECTRE. SPECTRE supports cross-platform command-and-control, process injection, credential theft, and anti-analysis protections. It also includes a Linux rootkit and BYOVD (bring your own vulnerable driver) capability enabling kernel-level EDR bypass, marking an evolution in commodity intrusion tooling.

Cisco Talos · 27d agoThreat actor in the wild

Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation

Cisco warns CVE-2026-76461 (CVSS 9.8), an unauthenticated root RCE in Secure Email Gateway AsyncOS, is actively exploited in the wild.

Cisco confirmed that CVE-2026-76461, a CVSS 9.8 email-parsing flaw in Secure Email Gateway AsyncOS, is being exploited in the wild since September 2026, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges via crafted emails containing malicious SQL statements. All physical and virtual SEG configurations are affected; Secure Email and Web Manager and Secure Web Appliance are not. CISA added the flaw to the KEV catalog with a September 17 federal remediation deadline, and Cisco released IoCs while noting root access lets attackers remove them.

SecurityWeekupdated · 3h agofirst · 1d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461CVE-2025-20393CVE-2026-20079+1 CVEs2

Linux Detection Engineering - Fileless Execution

Elastic Security Labs reproduces five Linux fileless execution patterns, including memfd_create staging and in-memory kernel module loads, and maps each to Elastic Defend rules.

Elastic Security Labs reproduced five Linux fileless execution patterns using its FENIX tooling: memfd_create staging, interpreter one-liners, deleted binaries, and in-memory kernel module loads. Each pattern is mapped to the Elastic Defend detection rules that catch it. The post is part of the team's ongoing Linux detection engineering series.

Elastic Security Labs · 15d agoResearch

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Kaspersky reports APT group HoneyMyte upgraded its CoolClient backdoor with a kernel-mode Windows rootkit hiding processes, files, and network connections.

Kaspersky researchers discovered a new variant of the HoneyMyte CoolClient backdoor equipped with a kernel-mode Windows rootkit driver. The rootkit hides malicious processes, files, and network connections from security tools and threat analysts, significantly increasing the backdoor's stealth. The report documents an upgrade to the APT group's backdoor tooling with a kernel-level implant.

Kaspersky Securelist · Aug 14, 2026Threat actor in the wild

Citrix UniconOS dual boot turns Windows endpoints into their own recovery device

Citrix released UniconOS dual boot in Release 7 2607, turning Windows endpoints into self-recovery devices after ransomware, failed updates or OS corruption.

Citrix announced dual boot in UniconOS Release 7 2607, which installs an isolated, hardened recovery environment alongside Windows in a separate partition protected by secure boot. If Windows is unavailable, users reboot into UniconOS and reconnect to applications via Citrix DaaS and SecurAccess with Chrome Enterprise. The capability is aimed at reducing reliance on spare hardware and central reimaging during ransomware or update failures, with automatic enrollment in UniconOS Management for fleet-wide boot policies.

Help Net Security · 22d agoTools

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.

Palo Alto Networks Unit 42 describes post-exploitation techniques in which an attacker with root on a compromised Kubernetes node spoofs Linux cgroup metadata used by the SPIRE agent during workload attestation, tricking it into issuing a co-located workload's SPIFFE Verifiable Identity Document to an attacker-controlled process. The research shows the core trust assumption of machine-identity systems—that the node is trusted—collapses once root is obtained, exposing all cryptographic identities scoped to that node. Unit 42 released an open-source tool, Spooffe, for defenders to test identity exposure, and notes the technique has not been observed exploited in the wild.

Palo Alto Unit 42 · 6d agoResearch1

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

Lazarus exploits Windows AFD.sys zero-day CVE-2026-68820 in Operation Dream Job to deploy Troy backdoor at defense firms.

Check Point attributes Operation Dream Job attacks to Lazarus Group exploiting CVE-2026-68820 (CVSS 7.0), a privilege escalation flaw in Windows AFD.sys patched in August 2026 Patch Tuesday. The campaign targets defense and aerospace firms in France, Germany, Brazil, and India via trojanized PDF viewers and DLL side-loading, deploying backdoors Troy, ForestTiger, and the FudModule 3.1 kernel rootkit. Attackers also compromise WordPress, SharePoint, and Roundcube servers as C2, using CVE-2025-49113 and the RelayShell PHP web shell.

The Hacker News · Aug 15, 2026Threat actor in the wildCVE-2026-68820CVE-2025-491132

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.

Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.

CSO Online · 6d agoMalware in the wildCVE-2025-53521

GNU GRUB 2.14: serial-MMIO lockdown bypass in Canonical-signed gcdx64.efi

Canonical-signed GRUB2 serial command accepts arbitrary MMIO addresses, letting local attackers with grub.cfg control bypass Secure Boot lockdown.

A vulnerability in Canonical's grub-efi-amd64-signed (gcdx64.efi, GRUB 2.14) exposes a serial command that accepts a caller-supplied 64-bit MMIO base address. The lockdown path does not restrict this command even when lockdown=y under UEFI Secure Boot, and the serial implementation does not validate that the requested register span belongs to a real UART rather than ordinary RAM. A local attacker with control of GRUB's boot configuration can abuse this to bypass the Secure Boot lockdown.

oss-security · 3d agoVulnerability2

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Researcher Chaotic Eclipse published a PoC bypassing Microsoft's CVE-2026-50656 Defender patch, enabling SYSTEM-level code execution on fully patched Windows systems.

Security researcher Chaotic Eclipse released a proof-of-concept for ShieldBreak, a Microsoft Defender zero-day that fully bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition in the Malware Protection Engine (mpengine.dll) allowing SYSTEM-level code execution. The PoC was tested on Windows 11 25H2 and Windows Server 2025 with a 100% success rate, and Windows 10 is also vulnerable though not supported by the PoC; the flaw may also leak 8 bytes of memory. Microsoft's MSRC had criticized the researcher's repeated uncoordinated disclosures, including YellowKey (BitLocker bypass), GreenPlasma, and LegacyHive (User Profile Service LPE).

Security Affairs · Aug 12, 2026Exploit / PoCCVE-2026-50656

TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage

Researchers present TPMSpy, a platform-agnostic method validating TPM Measured Boot via low-level tracing, finding inconsistent Linux systemd measurements that break remote attestation and LUKS decryption.

An arXiv paper (2609.05011) introduces TPMSpy, a method that analyzes virtualized system–TPM interactions to independently reconstruct and validate TPM Event Logs without relying on the quoting mechanism, applicable to open and closed systems and demonstrated on Linux and Windows. A longitudinal analysis of Linux systems running systemd versions 245–258 (2020–2025) found wide divergence in Measured Boot usage, undocumented behavioral changes, and no common usage pattern. The authors report inconsistent measurement of user-space systemd services, which prevents reliable remote attestation and LUKS disk decryption on affected systems.

arXiv cs.CR · 12d agoResearch

New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender

Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC bypassing ShieldBreak patches to gain System privileges on Windows.

The researcher known as Nightmare Eclipse released a PoC zero-day exploit dubbed ShieldCrash against Microsoft Defender on fully patched Windows systems. The exploit grants arbitrary file read with System privileges and can be used to drop the SAM database. It bypasses Microsoft's September 3 fixes for ShieldBreak (CVE-2026-69414), which itself bypassed patches for the RoguePlanet race condition (CVE-2026-50656). Microsoft has been contacted for comment and has not yet responded.

SecurityWeekupdated · 6d agofirst · 6d agoExploit / PoC 3 sourcesCVE-2026-50656CVE-2026-694141

[0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)

0day Rubbish disclosed an unauthenticated SOAP API flaw in DBxtra .NET 13.1.1.0 enabling xp_cmdshell command execution, rated CVSS 9.8.

The 0day Rubbish Research Team disclosed an unauthenticated remote code execution vulnerability in DBxtra .NET 13.1.1.0, classified as CWE-306 (missing authentication). The flaw is reachable via the unauthenticated SOAP API and abuses SQL Server's xp_cmdshell to run operating system commands. It is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No CVE identifier or exploitation evidence was provided in the disclosure.

Full Disclosure · 8d agoVulnerability 2 sources

New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root

cPanel patched CVE-2026-67401, an SQL injection in EmailTrack letting an account with mail privileges run code as root on the server.

cPanel released an advisory on September 8 for CVE-2026-67401, an SQL injection in EmailTrack that allows an authenticated account holder with mail-related privileges to create files and execute code as root. All supported cPanel and WHM release lines (11.110, 11.134, 11.136, 11.138 and WP Squared 11.138.1.9) are affected, with fixed builds published for each. No public exploit or exploitation has been reported and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog. The advisory carries no CVSS score, and the CVE record had not been published as of September 9.

The Hacker News · 7d agoVulnerabilityCVE-2026-67401