From Exposed Firewall to Active Directory: Inside a 25-Server Root Compromise Chain
Security researchers at Dream say an attacker combined two PHP2Shell firewall bugs with a Linux kernel privilege-escalation flaw to seize root on 25 systems across four countries, including...
CISA Gives Agencies Until Halloween to Patch a Linux Kernel Flaw Already Under Attack
CISA has added a high-severity Linux kernel flaw, tracked as CVE-2026-46300, to its Known Exploited Vulnerabilities catalog after confirming active attacks, giving federal agencies an October 31 deadline....
Unpatched Linux KSMBD Flaws Exposed Before Fixes Were Ready
Technical details for several unresolved Linux-related vulnerabilities were posted publicly before fixes were broadly available. Two CVSS 9.0 KSMBD flaws could enable remote code execution, although exposure depends...
PwnEscape: Linux Kernel Bug Lets Rogue VMs Reach Into the Host
A Linux kernel flaw dubbed PwnEscape (CVE-2026-99999) lets an attacker-controlled virtual machine leak host memory through a checksum-handling bug in the networking stack, with researchers demonstrating a path...
Debian’s Massive 1,313-CVE Kernel Update: What Administrators Actually Need to Know
Debian's DSA-6528-1 advisory bundles fixes for 1,313 CVEs into a single kernel update for Trixie, addressing privilege escalation, denial-of-service, and information-leak risks. The headline number is less alarming...
Zapscape Flaw Lets a Rogue Cloud Virtual Machine Seize Root on Its Host Server
A Linux kernel vulnerability nicknamed Zapscape and tracked as CVE-2026-64561 allows a malicious KVM guest running nested virtualization to escape its virtual machine entirely and take root control...
RefluXFS: A Nine-Year-Old Race Condition in Linux’s XFS Filesystem Opens a Silent Road to Root
Qualys researchers have disclosed RefluXFS (CVE-2026-64600), a race condition in the Linux kernel's XFS copy-on-write path that lets a local, unprivileged user seize root access while leaving no...
New “Bad Epoll” Linux Zero-Day Lets Local Users Root Servers and Android Devices
A newly disclosed Linux kernel flaw dubbed “Bad Epoll” (CVE-2026-46242) lets a local, unprivileged user escalate to root on Linux servers, desktops, and Android devices via a use-after-free...