Search: “linux”

30 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 32 Exploit / PoC 15 Advisory 11 Malware 9 Threat actor 6 Industry 5 AI industry 4 AI safety & security 4 Research 3 AI research 2 Tools 2 AI tools & infra 1 Model release 1

SeverityAll critical 5 high 38 medium 23 low 9 info 20

New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation Attacks

ZcopyReaper (CVE-2026-43502) lets unprivileged local attackers reach root on Linux via an RDS zero-copy cleanup flaw dating to kernel 4.17.

CVE-2026-43502 is a lifetime-management error in rds_message_purge() that mishandles zero-copy sends before socket attachment, corrupting kernel memory and enabling local privilege escalation without capabilities or user namespaces. NebuSec demonstrated the exploit on openSUSE kernel 6.4.0-150600.23.100; vulnerable systems need CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP. The fix landed in mainline commit 44b550d88b26 (Linux 7.1-rc3) with backports to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches. NebuSec also released public exploits for 20 additional Linux kernel vulnerabilities in its CyberMeowfia repository.

Cyber Security NewsSep 14, 13:29 UTC · 2d agoVulnerability CVE-2026-43502

$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws

Vercel's $1M sandbox challenge surfaced two Linux kernel networking defects—one leaking host kernel memory, one crashing hosts—with CVEs pending.

Vercel ran a two-week, $1 million sandbox escape challenge (Aug 18–Sep 1) on its Firecracker-based microVM sandbox, receiving 1,285 reports and committing ~$325k in payouts (1 Critical, 7 High, 15 Medium, 49 Low validated so far). No attacker accessed real customer data. The most important filing found two independent Linux kernel networking stack defects—one leaks host kernel memory, the other deterministically crashes the host—with wide implications for cloud providers isolating workloads via the same kernel layer. Fixes are under private review with CVEs pending; Vercel also plans to open-source its agentic report-triage agent built on the Eve framework running Kimi K3.

SecurityWeekSep 15, 16:00 UTC · 1d agoVulnerability2

Flock cameras are riddled with security vulnerabilities and hardcoded creds

Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.

DDoSecrets published filesystem images from an in-use Flock ALPR camera, obtained by the hacker collective stegan0gram and investigated by 404 Media and Wired. Micah Lee's analysis shows the camera runs Android 8.1 with a security patch level of 2018-06-05 and Linux kernel 3.18.71, missing roughly eight years of Android fixes. The firmware exposes a hardcoded API key for Flock's hpnotiq backend that can retrieve Auth0 client credentials for any camera by MAC address, with credentials stored in plaintext. Likely unpatched flaws include CVE-2021-1905 (Qualcomm Adreno use-after-free) and CVE-2018-9568 (WrongZone kernel socket type confusion); Flock says it received no reports via its disclosure policy.

Hacker News · security22:19 UTC · 1h agoVulnerability 3 sources HN 35↑ · 3 comments CVE-2021-1905 CVE-2018-9568

ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability

ZDI-26-695: Linux Kernel NFSv4 server race condition (CVE-2026-89688, CVSS 8.5) enables remote code execution on nfsd systems with authentication.

ZDI advisory ZDI-26-695 describes a race condition in the Linux Kernel NFSv4 server tracked as CVE-2026-89688 with a CVSS score of 8.5. Remote attackers can execute arbitrary code, but authentication is required and only systems with nfsd enabled are vulnerable. No in-the-wild exploitation is mentioned in the advisory.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-896881

ZDI-26-688: Linux Kernel OpenvSwitch Race Condition Local Privilege Escalation Vulnerability

ZDI discloses Linux Kernel Open vSwitch race condition (CVE-2026-74465) allowing low-privileged local attackers to escalate privileges, CVSS 7.8.

ZDI-26-688 describes a race condition local privilege escalation vulnerability in the Linux Kernel's Open vSwitch implementation, tracked as CVE-2026-74465 with a CVSS rating of 7.8. An attacker must first obtain the ability to execute low-privileged code on the target system. Successful exploitation grants elevated privileges on affected installations.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-744651

ZDI-26-702: Linux Kernel usbnet Driver Race Condition Privilege Escalation Vulnerability

ZDI discloses Linux Kernel usbnet driver race condition (CVE-2025-22050) enabling physically present attackers to escalate privileges without authentication.

ZDI-26-702 covers a race condition privilege escalation vulnerability in the Linux Kernel usbnet driver, assigned CVE-2025-22050 with a CVSS rating of 7.1. A physically present attacker can escalate privileges on affected installations. Authentication is not required to exploit the vulnerability.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2025-22050

ZDI-26-691: Linux Kernel Netlink-based Wireless Configuration Integer Overflow Local Privilege Escalation Vulnerability

ZDI-26-691: integer overflow in Linux kernel netlink wireless configuration (CVE-2026-53182) allows local privilege escalation by attackers already running high-privileged code; CVSS 8.2.

ZDI advisory ZDI-26-691 discloses an integer overflow in the Linux kernel's netlink-based wireless configuration that allows local attackers to escalate privileges on affected installations. Exploitation requires the attacker to first obtain the ability to execute high-privileged code on the target system. ZDI assigned a CVSS rating of 8.2 and CVE-2026-53182.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-53182

ZDI-26-693: Linux Kernel ksmbd Share Configuration Race Condition Remote Code Execution Vulnerability

ZDI-26-693: authenticated race condition in Linux kernel ksmbd share configuration allows remote code execution on ksmbd-enabled systems; CVSS 8.5.

ZDI advisory ZDI-26-693 discloses a race condition in the Linux kernel's ksmbd share configuration that allows remote attackers to execute arbitrary code on affected installations. Exploitation requires authentication, and only systems with ksmbd enabled are vulnerable. ZDI assigned a CVSS rating of 8.5; no CVE is listed in the advisory text.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability1

ZDI-26-687: Linux Kernel Open vSwitch Flow Delete Use-After-Free Information Disclosure Vulnerability

ZDI discloses Linux Kernel Open vSwitch use-after-free (CVE-2026-80994) letting low-privileged local attackers disclose sensitive kernel information, CVSS 6.4.

ZDI-26-687 covers a use-after-free information disclosure vulnerability in the Linux Kernel's Open vSwitch flow deletion handling, tracked as CVE-2026-80994 with a CVSS rating of 6.4. Exploitation requires the ability to execute low-privileged code on the target system. The flaw allows local attackers to disclose sensitive information from affected installations.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-80994

ZDI-26-682: Linux Kernel IPv6 Neighbour Discovery Uninitialized Memory Information Disclosure Vulnerability

ZDI discloses an uninitialized-memory flaw in Linux kernel IPv6 neighbor discovery (CVE-2026-43040, CVSS 6.0) allowing information disclosure by already-privileged local attackers.

ZDI advisory ZDI-26-682 describes an uninitialized memory vulnerability in the Linux kernel's IPv6 Neighbour Discovery code, tracked as CVE-2026-43040 with a CVSS score of 6.0. Exploitation requires the attacker to already execute high-privileged code on the target, which severely limits practical impact to kernel memory information disclosure. No active exploitation is mentioned.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-430401

ZDI-26-696: Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability

ZDI-26-696: Linux Kernel NTFS3 journal heap-based buffer overflow (CVE-2026-72196, CVSS 8.8) enables local arbitrary code execution.

ZDI advisory ZDI-26-696 describes a heap-based buffer overflow in the Linux Kernel NTFS3 journal handling, tracked as CVE-2026-72196 with a CVSS score of 8.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to execute arbitrary code. No in-the-wild exploitation is mentioned.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-721961

ZDI-26-700: Linux Kernel QFQ Plus Scheduler Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses Linux Kernel QFQ Plus scheduler use-after-free (CVE-2026-22999, CVSS 7.8) enabling local privilege escalation on affected systems.

ZDI advisory ZDI-26-700 covers a use-after-free in the Linux Kernel QFQ Plus scheduler, tracked as CVE-2026-22999 with a CVSS score of 7.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to escalate privileges. No in-the-wild exploitation is mentioned.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-22999

ZDI-26-701: Linux Kernel TLS Protocol Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI discloses Linux Kernel TLS protocol out-of-bounds read (CVE-2026-64046) allowing high-privileged local attackers to disclose sensitive information, CVSS 6.7.

ZDI-26-701 covers an out-of-bounds read information disclosure vulnerability in the Linux Kernel TLS protocol implementation, tracked as CVE-2026-64046 with a CVSS rating of 6.7. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-640461

ZDI-26-689: Linux Kernel SCTP Subsystem Race Condition Information Disclosure Vulnerability

ZDI discloses Linux Kernel SCTP subsystem race condition (CVE-2026-46227) allowing low-privileged local attackers to disclose sensitive information, CVSS 6.4.

ZDI-26-689 describes a race condition information disclosure vulnerability in the Linux Kernel SCTP subsystem, assigned CVE-2026-46227 with a CVSS rating of 6.4. An attacker needs the ability to execute low-privileged code on the target system to exploit the flaw. The vulnerability exposes sensitive information from affected installations.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-46227

ZDI-26-690: Linux Kernel MCTP Routing Uninitialized Memory Information Disclosure Vulnerability

ZDI discloses Linux Kernel MCTP routing uninitialized memory flaw (CVE-2026-45930) letting high-privileged local attackers leak sensitive kernel information.

ZDI-26-690 describes an uninitialized memory information disclosure vulnerability in the Linux Kernel MCTP routing subsystem, tracked as CVE-2026-45930 with a CVSS rating of 6.0. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-45930

ZDI-26-692: Linux Kernel eMPIA USB Device Driver Race Condition Code Execution Vulnerability

ZDI-26-692: race condition in Linux kernel eMPIA USB driver (CVE-2026-31583) lets physically present attackers execute code without authentication; CVSS 7.1.

ZDI advisory ZDI-26-692 discloses a race condition in the Linux kernel's eMPIA USB device driver that allows physically present attackers to execute arbitrary code on affected installations. Authentication is not required, but physical access to the target system is necessary. ZDI assigned a CVSS rating of 7.1 and CVE-2026-31583.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-31583

ZDI-26-680: Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses a Linux kernel crypto subsystem use-after-free (CVE-2026-31719, CVSS 8.8) letting local low-privileged attackers escalate to root.

ZDI advisory ZDI-26-680 covers a use-after-free vulnerability in the Linux kernel crypto subsystem, tracked as CVE-2026-31719 with a CVSS score of 8.8. A local attacker who can already execute low-privileged code can exploit it to escalate privileges on affected installations. The advisory does not report any exploitation in the wild.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-31719

ZDI-26-685: Linux Kernel NFC NCI UART Driver Race Condition Local Privilege Escalation Vulnerability

ZDI discloses a race condition in the Linux kernel NFC NCI UART driver (CVE-2025-38416, CVSS 8.8) allowing local low-privileged attackers to escalate privileges.

ZDI advisory ZDI-26-685 covers a race condition vulnerability in the Linux kernel's NFC NCI UART driver, tracked as CVE-2025-38416 with a CVSS score of 8.8. A local attacker with the ability to execute low-privileged code can exploit the race to escalate privileges on affected systems. Exposure is limited to systems where the NFC NCI UART driver is present, and no exploitation is reported.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2025-38416

ZDI-26-697: Linux Kernel NTFS3 Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI-26-697: Linux Kernel NTFS3 out-of-bounds read rated CVSS 7.3 lets local low-privileged attackers disclose sensitive information.

ZDI advisory ZDI-26-697 describes an out-of-bounds read in the Linux Kernel NTFS3 driver rated CVSS 7.3. An attacker must first be able to execute low-privileged code on the target system to exploit the flaw. Successful exploitation leads to sensitive information disclosure. No CVE identifier is listed in the advisory.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability 3 sources

ZDI-26-694: Linux Kernel Net Scheduler Clsact Qdisc Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-23413, a use-after-free in the Linux kernel net scheduler clsact qdisc allowing local privilege escalation, CVSS 8.2.

ZDI advisory ZDI-26-694 describes a use-after-free vulnerability in the Linux kernel's net scheduler clsact qdisc component. Successful exploitation allows local attackers to escalate privileges on affected installations, and ZDI assigned a CVSS score of 8.2. The flaw is tracked as CVE-2026-23413. The advisory notes an attacker must first obtain the ability to execute high-privileged code on the target system to exploit the vulnerability.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-234132

Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs

Microsoft issued emergency Windows 11 update KB5129195 to fix Patch Tuesday regressions and fully close the CVE-2026-62721 privilege escalation flaw.

Microsoft shipped out-of-band cumulative update KB5129195 for Windows 11 24H2 and 25H2 (builds 26100.9457 and 26200.9457) after the September 8 Patch Tuesday rollup, which addressed over 960 CVEs including two actively exploited flaws, broke Remote Desktop Services, Hyper-V Plan9 folder sharing, and USB audio. The emergency release also strengthens the incomplete fix for CVE-2026-62721, an elevation-of-privilege flaw in the Windows User-Mode Power Service that could let a local attacker gain SYSTEM privileges. Companion patches cover Windows 11 26H1, Windows 10, and Windows Server. Some USB Audio Class 1.0 and AMD Radeon graphics issues remain unresolved.

Cyber Security News07:45 UTC · 16h agoVulnerability in the wildCVE-2026-62721

Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones

Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.

Google's Chrome 153 Stable channel update (153.0.8010.47/.48 for Windows/macOS, 153.0.8010.47 for Linux) patches 42 vulnerabilities: three Critical, 27 High, ten Medium, and one Low. The Critical flaws are CVE-2026-91721 (use-after-free in Internals), CVE-2026-91749 (use-after-free in Workers), and CVE-2026-91726 (out-of-bounds read in WebGL). Google's bulletin states none of the patched issues are actively exploited, and detailed bug links remain restricted until most users receive the fixes. Bug bounty awards include $1,500 to Hafiizh for CVE-2026-91724 and $1,000 to Jihyeon Jeong of Seoul National University for CVE-2026-91728.

Cyber Security News03:01 UTC · 20h agoVulnerability CVE-2026-91721 CVE-2026-91749 CVE-2026-91726+27 CVEs1

Homebrew 7.0.0 is out, here’s what changed for security

Homebrew 7.0.0 closes eight security advisories, including a High sudo execution bug fixed in 6.0.12, and ships brew vulns vulnerability scanning.

Homebrew 7.0.0 closes eight security advisories rated one High, two Moderate, and five Low. The High flaw let unsigned cask removal metadata execute commands with sudo (fixed in 6.0.12), while the 7.0.0 Moderate closes a LaunchServices escape that let a malicious cask execute code outside the macOS install sandbox. The release ships brew vulns, which checks installed formulae against OSV.dev, extends build attestation verification to third-party tap bottles, and replaces Bubblewrap with Landlock sandboxing on Linux.

Help Net SecuritySep 15, 00:47 UTC · 1d agoVulnerability

CVE-2026-89775: Guest-to-Host Escape in KVM/arm64

Disclosed CVE-2026-89775 lets a guest VM escape to the host on KVM/arm64 systems with nested virtualization enabled.

Researcher Hyunwoo Kim disclosed CVE-2026-89775, a guest-to-host escape in KVM/arm64, after the embargo agreed with linux-distros maintainers expired. The root cause is a type truncation of the stage-1 walk level that makes a size computation return 0, the value meaning 'size unknown'. The VNCR pseudo-TLB invalidation path then interprets that 0 as a valid value on ARM64 hosts where nested virtualization is enabled.

oss-security16:04 UTC · 7h agoVulnerability CVE-2026-89775

Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix

JFrog disclosed CVE-2026-90894, a 7.8-rated local privilege escalation in Parallels Desktop for Mac, patched only in version 27, which Intel Macs cannot install.

JFrog researcher Yuval Moravchick disclosed CVE-2026-90894 (dubbed ParaShells, CVSS 7.8), a local privilege escalation in Parallels Desktop for Mac that lets non-admin users run code as root. The root-level prl_disp_service listens on a world-writable socket, and argument injection into a tar command via QProcess::splitCommand and the --use-compress-program option yields code execution as root, demonstrated on Parallels Desktop 26.4.0 build 57513 on Apple silicon. The fix appears in version 27.0.0, but Parallels Desktop 27 requires Apple silicon, leaving Intel Macs on the 26.x line with no build JFrog describes as fixed. No exploitation in the wild has been reported and Parallels has not published a statement.

The Hacker News13:14 UTC · 10h agoVulnerability 4 sources CVE-2026-90894

Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover

Two unauthenticated CVSS 9.8 code-injection and PHP object injection flaws in The Events Calendar plugin expose 200,000+ WordPress sites to RCE and takeover.

Defiant identified two critical vulnerabilities in The Events Calendar WordPress plugin, which has over 600,000 active installations. CVE-2026-78159, unauthenticated code injection during single-event HTML processing, was patched in version 6.17.3.1 on August 25; CVE-2026-78006, unauthenticated PHP object injection via event comments, was patched in 6.17.4.1 on September 10. Both independent chains lead to remote code execution and full site compromise. Roughly 240,000 sites run versions vulnerable to both flaws, and about 300,000 downloads between September 10 and 14 suggest half of installations may still lack the second fix.

SecurityWeek11:32 UTC · 12h agoVulnerability 3 sources CVE-2026-78159 CVE-2026-78006

Chrome, Firefox Updates Patch 115 Vulnerabilities

Google and Mozilla patch 115 vulnerabilities across Chrome 153 and Firefox 156, including three critical Chrome bugs; no exploitation reported.

Google's Chrome 153 (153.0.8010.47/.48 for Windows/macOS) fixes 42 flaws, including three critical: CVE-2026-91726, an out-of-bounds read in WebGL, and use-after-free bugs CVE-2026-91721 and CVE-2026-91749 in Internals and Workers. Mozilla's Firefox 156 resolves 73 vulnerabilities, including 29 high-severity use-after-free and privilege escalation issues, with related fixes in Thunderbird and Firefox ESR branches. Neither vendor reports any of the defects being exploited in the wild.

SecurityWeek10:28 UTC · 13h agoVulnerability CVE-2026-91726 CVE-2026-91721 CVE-2026-91749

Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities

Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.

Google released Chrome 153 (153.0.8010.47/48) for Windows, macOS, and Linux, patching 42 security vulnerabilities including three rated critical: CVE-2026-91726 (out-of-bounds read in WebGL), CVE-2026-91721 (use-after-free in Internals), and CVE-2026-91749 (use-after-free in Workers). Twenty-eight fixes are rated high severity, covering use-after-free, type confusion, race condition, integer overflow, and authorization flaws across components like V8, Skia, DOM, ServiceWorker, PDF, and Extensions. Google's bulletin indicates no vulnerabilities are currently being exploited in the wild, and external researchers earned rewards up to $1,500 for reported issues. Enterprises are advised to verify fleet-wide deployment via browser-management consoles and enable automatic updates.

GBHackers05:00 UTC · 18h agoVulnerability CVE-2026-91726 CVE-2026-91721 CVE-2026-91749+27 CVEs1

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security NewsSep 15, 13:52 UTC · 1d agoVulnerability

Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports

Telegram Desktop HTML export XSS (CVSS 8.2) let bot messages exfiltrate exported chats; fixed in 7.0.1 but old exports stay vulnerable.

ExPatch researchers found that Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 wrote bot inline-keyboard button text into HTML chat exports without escaping, allowing a bot to plant invisible JavaScript. When a user opened the export in a browser, the script could exfiltrate every message in that 1,000-message file, rewrite the displayed content, or fake a verification form. The flaw (rated CVSS 3.1 8.2) was fixed by commit 8457d13a in 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026), but pre-fix exports remain dangerous since updating the app does not fix old files. No CVE identifier or Telegram security advisory exists, and no exploitation in the wild is claimed.

The Hacker Newsupdated Sep 15, 09:47 UTC · 1d agofirst Sep 14, 17:58 UTC · 2d agoVulnerability 2 sources1