ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Ubuntu”

646 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 288Exploit / PoC 114Malware 70Advisory 56Ransomware 30Industry 22Policy & legal 15AI tools & infra 12Data breach 12Threat actor 11Tools 9Research 6AI research 6AI industry 6
SeverityAllcritical 241high 138medium 184low 74info 28

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net Security · 3d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316CVE-2026-862182· 1 read

USN-8748-1: Linux kernel (NVIDIA) vulnerabilities

Ubuntu released USN-8748-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across networking, file system, and crypto subsystems.

Ubuntu issued security notice USN-8748-1 fixing several Linux kernel vulnerabilities affecting the NVIDIA Tegra memory controller driver, hardware crypto device drivers, and network drivers, among others. Affected subsystems include GFS2, OCFS2, and SMB file systems, B.A.T.M.A.N. meshing, Ceph, Netfilter, Open vSwitch, IPv4/IPv6, RxRPC, SCTP, and TIPC. An attacker could potentially exploit these flaws to compromise the system.

Ubuntu Security Notices · 6d agoAdvisoryCVE-2026-52914CVE-2026-52931CVE-2026-52955+8 CVEs

Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)

SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.

A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.

SANS Internet Storm Center · 6d agoMalware in the wild 2 sources1

USN-8742-1: Netty vulnerability

Ubuntu issues USN-8742-1 fixing a Netty DNS cache poisoning flaw caused by improper NS record bailiwick validation.

Ubuntu Security Notice USN-8742-1 addresses a vulnerability in the Netty framework in which NS records are incorrectly validated for bailiwick. An attacker could potentially exploit this to facilitate DNS cache poisoning attacks. Updated packages are available for supported Ubuntu releases.

Ubuntu Security Noticesupdated · 5h agofirst · 6d agoAdvisory 13 sources

USN-8738-1: FFmpeg vulnerabilities

Ubuntu's USN-8738-1 fixes multiple FFmpeg vulnerabilities allowing denial of service, arbitrary code execution, and sensitive information exposure.

Ubuntu Security Notice USN-8738-1 addresses several FFmpeg flaws. CVE-2026-66036 involves mishandled video frames in the hqdn3d filter, allowing denial of service or arbitrary code execution. CVE-2026-66038, found by Adrian Junge, leaks sensitive information via compressed video files, and CVE-2026-66039 allows denial of service or code execution through crafted audio files. Additional subtitle-file handling flaws were also fixed.

Ubuntu Security Noticesupdated · 7d agofirst · 8d agoAdvisory 2 sourcesCVE-2026-66036CVE-2026-66038CVE-2026-66039

USN-8736-1: Perl vulnerabilities

Ubuntu issued USN-8736-1 fixing two Perl regex flaws that could cause denial of service, code execution, or security-restriction bypass.

Ubuntu released a security notice addressing two Perl vulnerabilities in regular expression handling. CVE-2026-15534 involves mishandling of large inputs during regex matching, enabling out-of-bounds heap reads or writes that could lead to denial of service or arbitrary code execution. CVE-2026-19487 involves incorrect matching for regexes with alternative branches, allowing security restrictions to be bypassed. Users are advised to apply the updated packages.

Ubuntu Security Notices · 8d agoAdvisoryCVE-2026-15534CVE-2026-19487

USN-8735-1: HSQLDB vulnerability

Ubuntu released USN-8735-1 fixing an HSQLDB flaw that lets specially crafted database files overwrite arbitrary files.

Ubuntu Security Notice USN-8735-1 addresses a vulnerability in HSQLDB, which incorrectly handled specially crafted database files. An attacker could exploit the flaw to overwrite arbitrary files on affected systems; updated packages are available.

Ubuntu Security Notices · 8d agoAdvisory

USN-8734-1: PHP vulnerabilities

Ubuntu issued USN-8734-1 fixing three PHP denial-of-service flaws in SOAP, metaphone() and phar handling, including CVE-2026-7262 and CVE-2026-7568.

Ubuntu security notice USN-8734-1 addresses multiple PHP vulnerabilities. CVE-2026-7262 is a NULL pointer dereference in Apache map decoding in SOAP servers with a typemap configured; CVE-2026-7568 is a signed integer overflow in metaphone() causing an out-of-bounds read; and CVE-2026-7260 involves unbounded recursion from circular symbolic links in phar archives. All issues could allow remote attackers to cause denial-of-service conditions.

Ubuntu Security Notices · 9d agoAdvisoryCVE-2026-7262CVE-2026-7568CVE-2026-7260

USN-8733-1: Gzip vulnerabilities

Ubuntu issued USN-8733-1 fixing two Gzip flaws: insecure gzexe temp files allowing file overwrites, and a crafted-file DoS/info exposure bug.

USN-8733-1 updates Gzip in Ubuntu to fix CVE-2026-41991, where the gzexe utility created temporary files insecurely when mktemp was unavailable, letting a local attacker overwrite arbitrary files. It also fixes CVE-2026-41992, incorrect handling of certain compressed files that could expose sensitive information or crash Gzip in a denial of service. Both issues have local impact and are addressed via updated Ubuntu packages.

Ubuntu Security Notices · 9d agoAdvisoryCVE-2026-41991CVE-2026-41992

USN-8732-1: Minetest vulnerability

Ubuntu issued USN-8732-1 fixing a Minetest LuaJIT sandbox escape that let malicious mods execute arbitrary code on servers.

Ubuntu Security Notice USN-8732-1 addresses a flaw in Minetest where the Lua sandbox environment was not properly sanitized when using LuaJIT. A malicious mod could escape the sandbox, execute arbitrary code, and gain full file system access on the server. Administrators should update to the patched packages.

Ubuntu Security Notices · 9d agoAdvisory

USN-8731-1: MiniUPnPd vulnerability

Ubuntu issued USN-8731-1 fixing a MiniUPnPd integer underflow allowing remote DoS or information disclosure via malformed SOAPAction headers.

Ubuntu released USN-8731-1 to address an integer underflow vulnerability in MiniUPnPd's SOAPAction header parsing. A remote attacker could send a malformed SOAPAction header containing a single quote to trigger a denial of service or information disclosure. MiniUPnPd is a lightweight UPnP daemon widely deployed on routers and gateways.

Ubuntu Security Notices · 9d agoAdvisory1

PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

PostgreSQL fixed CVE-2026-6471 (CVSS 7.2), a 12-year-old logical decoding flaw letting replication-role accounts execute arbitrary code as the database OS user.

PostgreSQL patched CVE-2026-6471 (CVSS 7.2), a flaw present since logical decoding shipped in 9.4 (2014) that lets an account with the REPLICATION attribute run arbitrary code as the database server's OS user when wal_level is logical. Versions before 18.6, 17.11, 16.15, 15.19, and 14.24 are affected; exploitation requires such an account, which backup, CDC, and monitoring tooling routinely holds. The fix adds an output_plugin_libraries whitelist, so administrators using non-default plugins such as wal2json and decoderbufs must add them and reload configuration after updating. Cyera Research, whose write-up names the flaw PostGREShell, demonstrated escalating a replication user to superuser with persistence; no PoC or KEV entry existed as of September 4.

The Hacker News · 12d agoVulnerabilityCVE-2026-64711

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog · 12d agoThreat actor in the wild1