Search: “suse”

39 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 120 Exploit / PoC 41 Industry 18 Ransomware 14 Policy & legal 6 Malware 6 Phishing & fraud 3 AI tools & infra 3 Advisory 2 Tools 2 AI industry 2 Threat actor 1

SeverityAll critical 118 high 39 medium 37 low 16 info 8

PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

PostgreSQL fixed CVE-2026-6471 (CVSS 7.2), a 12-year-old logical decoding flaw letting replication-role accounts execute arbitrary code as the database OS user.

PostgreSQL patched CVE-2026-6471 (CVSS 7.2), a flaw present since logical decoding shipped in 9.4 (2014) that lets an account with the REPLICATION attribute run arbitrary code as the database server's OS user when wal_level is logical. Versions before 18.6, 17.11, 16.15, 15.19, and 14.24 are affected; exploitation requires such an account, which backup, CDC, and monitoring tooling routinely holds. The fix adds an output_plugin_libraries whitelist, so administrators using non-default plugins such as wal2json and decoderbufs must add them and reload configuration after updating. Cyera Research, whose write-up names the flaw PostGREShell, demonstrated escalating a replication user to superuser with persistence; no PoC or KEV entry existed as of September 4.

The Hacker NewsSep 4, 15:20 UTC · 12d agoVulnerability CVE-2026-64711

Researcher Says AI Helped Develop Linux Traffic

The Hacker NewsJul 28, 08:04 UTC · Jul 28, 2026Exploit / PoC in the wildCVE-2026-53264

Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431)

Help Net SecurityMay 11, 11:22 UTC · May 11, 2026Vulnerability in the wildCVE-2026-31431

New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions

The Hacker NewsMay 3, 06:13 UTC · May 3, 2026Vulnerability CVE-2026-31431 CVE-2022-0847

2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")

Linux kernel flaw CVE-2026-31431 ('Copy Fail', CVSS 7.8) allows unprivileged users to gain root via AF_ALG; a public PoC is out and most distros remain unpatched.

Disclosed on 29 April 2026, CVE-2026-31431 is a local privilege escalation in the Linux kernel's algif_aead module (AF_ALG crypto API), CVSS 7.8, stemming from a 2017 in-place optimisation. By chaining an AF_ALG socket operation with splice(), an unprivileged user can write 4 bytes into an arbitrary page-cache page, e.g. corrupting a setuid binary like /usr/bin/su to obtain a root shell. It affects virtually all kernels built since 2017, including Ubuntu 20.04-24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16; the mainline fix landed 1 April 2026 but no vendor packages were available as of 30 April. CERT-EU recommends the interim mitigation (disable algif_aead) and blocking AF_ALG via seccomp, prioritising Kubernetes nodes and CI/CD runners.

CERT-EU Advisoriesupdated Sep 7, 09:12 UTC · 9d agofirst Apr 29, 00:00 UTC · Apr 29, 2026Exploit / PoC 6 sources CVE-2026-31431

New Linux Flaws Enable Full Root Access via PAM and Udisks Across Major Distributions

The Hacker NewsJun 20, 03:52 UTC · Jun 20, 2025Exploit / PoC CVE-2025-6018 CVE-2025-6019 CVE-2025-6020

Ubuntu Linux for Windows 10 Released — Yes, You Read it Right

The Hacker NewsJul 15, 00:00 UTC · Jul 15, 2017Industry1

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.