60
60
60
60
Containers on fire: from container escapes to supply chain attacks
60
60
60
60
60
60
60
60
60
60
60
60
Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE
60
60
60
60
Microsoft February 2021 Patch Tuesday fixes 56 bugs, including an actively exploited Windows zero
60
The skb that wasn't freed - the Fragnesia primitive via Open vSwitch
Doyensec details CVE-2026-90049 in Open vSwitch, enabling deterministic Linux kernel local privilege escalation on default major distribution installs.
Doyensec reports that the Open vSwitch datapath strips the SKBFL_SHARED_FRAG flag from packets it is still forwarding, allowing an in-place decrypt to write attacker-chosen bytes into root-owned page cache — a Dirty COW-class primitive that re-opens the Fragnesia bug family. The issues are tracked as CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977, and were reported to the kernel security team with fixes coordinated alongside OVS maintainers. A deterministic local privilege escalation works on default installs of Arch, Fedora, Debian, Amazon Linux, and RHEL where unprivileged user namespaces and openvswitch auto-loading are enabled; the fix landed in mainline and shipped in stable on 09/04/2026. The write technique builds on the earlier Fragnesia and Dirty Frag bugs, including CVE-2026-43284 and CVE-2026-43500.
62
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0
60
60
60
Week in review: Microsoft patches 5 actively exploited 0-days, recently fixed Chrome vulnerability exploited
60
60
Microsoft Fixes 149 Flaws in Huge April Patch Release, Zero
60
March 2024 Patch Tuesday: Microsoft fixes critical bugs in Windows Hyper-V
60
60
Microsoft Patch Tuesday Fixes New Windows Zero
60
60
60
60
60
September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows
Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.
Microsoft's September 2026 Patch Tuesday includes 964 Microsoft vulnerabilities requiring customer action, a record attributed to AI-assisted bug discovery, plus 174 third-party/open-source and 23 Chromium/Edge CVEs. Two zero-days are exploited in the wild: CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape and privilege escalation, and CVE-2026-81963, a Windows Update Stack escalation to SYSTEM. CVE-2026-69730, an unauthenticated Windows DNS RCE, is not yet exploited but Microsoft expects exploitation, and roughly 20 bugs could be wormable. Separately, SAP issued a critical CVSS 10.0 fix for the EPP component used in S/4HANA and NetWeaver.
84
60
60
⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
60
Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for months
60