33 results for “ART”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types1139 Articles504 Write-ups198 Papers189 Repos118 Threads51

More types6

Advisories33 Tools17 Talks13 Other10 Courses4 Videos2

🚨 Advisories “ART”Clear all

x.comadvisory🛡️ Security

dbugs (@ptdbugs) on X

CVE-2026-106173 is a critical (CVSS 9.4) unauthenticated arbitrary file write in FortiSIEM's phQueryMaster gRPC service on port 27918/TCP. The SendQueryResult method builds a path from the query-id parameter without validation, so "../" sequences escape the directory and a null byte drops the appended filename and extension. Overwriting /opt/charting/redishb.sh, which runs every 60 seconds, gives remote command execution. Horizon3.ai published the analysis and a PoC.

FortiSIEMgRPCRedis+1

CVE-2026-106173PT-2026-111783Horizon3.ai+4

Offensive Security, AppSec· Added 27 Oct 2026, published 26 Oct 2026

cisa.govadvisory🛡️ Security

CISA: Critical Vulnerabilities in PHP Require Immediate Patching

CISA alert on CVE-2026-109618 and CVE-2026-109619 ("php2shell"), unauthenticated remote code execution flaws affecting PHP installations serving web requests, including mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updated 23 October 2026 with a Sigma rule, partner advisories (NSA, NCSC-UK, ASD ACSC, NCSC-NL, NCSC-NZ, Cyber Centre) and guidance to inventory PHP, patch internet-facing systems first, and watch for PHP workers spawning shells. No in-the-wild exploitation had been observed.

PHPApachePHP-FPM+3

CVE-2026-109618CVE-2026-109619PHP2Shell+2

AppSec, Blue Team & Detection· Added 24 Oct 2026

x.comadvisory🛡️ Security

Xavier Rivera (@XavierRiveraX) on X

CVE-2026-115560 is a PHP code execution bug reported two days after the PHP2Shell emergency patches. The post says those releases do not fix it and no emergency fix is planned. Only apps that switch session.serialize_handler to php via ini_set() before session_start() are exposed. The mitigation is session.upload_progress.enabled=0, which also covers anyone who applied it for the 21 October advisory. The post gives no technical root-cause detail.

PHP

CVE-2026-115560PHP2Shell

AppSec· Added 25 Oct 2026, published 23 Oct 2026

enisa.europa.euadvisory🛡️ Security

ENISA Technical Advisory for Software Bill of Materials

ENISA Technical Advisory for Software Bill of Materials (October 2026, TLP:CLEAR) is non-mandatory guidance for organisations, especially SMEs, starting SBOM adoption. It covers SBOM data models (CycloneDX, SPDX), a mapping of BSI TR-03183-2 fields to CISA minimum elements, lifecycle and CI/CD integration, an SBOM threat model, and security recommendations. It supports Cyber Resilience Act obligations but is not a legal interpretation.

SBOMCycloneDXSPDX

ENISAEU Cyber Resilience ActBSI TR-03183+4

Supply Chain, GRC· Added 23 Oct 2026

snyk.ioadvisory🛡️ Security

PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now

Snyk's write-up of two critical unauthenticated PHP runtime RCEs, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state, cross-request use-after-free), both CVSS v4.0 9.2. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. It covers the disclosure timeline, affected SAPIs (mod_php most exposed), backports for 8.1 and older, and partial mitigations.

PHPApacheFrankenPHP+3

CVE-2026-109618CVE-2026-109619SNYK-UNMANAGED-PHP-21347795+2

AppSec· Published and added 22 Oct 2026

blog.railway.comadvisory🛡️ Security

Railway Security Disclosure

Railway's security disclosure of 21 October 2026 says an unauthorized third party may have accessed encrypted customer environment variables and decrypted some of them. Railway links it to a series of attacks on platform companies aimed at compromising AI inference providers, and has asked upstream providers to revoke keys. It tells all users to roll every environment variable, API key and registry credential, and it paused all deployments. The notice gives no technical details of the intrusion.

Railway

Railway security incident October 2026

Threat Intel, DevSecOps· Added 22 Oct 2026, published 21 Oct 2026

blog.talosintelligence.comadvisory🛡️ Security

Two critical RCEs in PHP core

Cisco Talos advisory on "php2shell", two unauthenticated RCE flaws in PHP core, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), affecting every build since PHP 5.4. One flaw is an out-of-memory handling bug leaving request data partly initialized; the other reuses stale state after free. PHP 8.1 and older get no patch (about 50% of PHP systems). Includes ini-level mitigations and Snort SIDs 67359 and 67360. No exploitation seen as of 21 October 2026.

PHPWordPressCVSS

CVE-2026-109618CVE-2026-109619php2shell+2

AppSec, Blue Team & Detection· Published and added 21 Oct 2026

x.comadvisory🛡️ Security

JFrog Security (@JFrogSecurity) on X

JFrog Security Research warns that the LiteLLM 1.107.0 release on PyPI contains malicious code, as part of a supply-chain attack. It advises avoiding that version and investigating any environment where it was installed or executed. The post gives no technical detail, payload description or IOCs, and says a blog post will follow.

LiteLLMPyPIPython+1

Supply Chain· Added 23 Oct 2026, published 21 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CVE-2026-106931 is an OS command injection (CWE-78) in the statistics processing of EG Secure Solutions SiteGuard Server Edition, a host-based WAF. It can give root or SYSTEM command execution. The vendor and JVN confirm exploitation on 14 October 2026. The post lists fixed builds (Ver8.00 Update 5, Ver7.00 Update 6 on FreeBSD), the IIS exclusion, the workaround of disabling statistics, and a SOC trail starting with diagnostic preservation before patching.

SiteGuard Server EditionApache HTTP Servernginx+3

CVE-2026-106931CWE-78CISA KEV+5

Blue Team & Detection, AppSec· Added 21 Oct 2026, published 19 Oct 2026

x.comadvisory🛡️ Security

♫Why♥Not♪ (@Python_s_) on X

Alert summarizing XBOW's disclosure of a three-stage Chrome for Windows exploit chain: V8 Maglev memory corruption (CVE-2026-85045), Animated WebP decoder memory corruption (Chromium issue 548509153), then a Crashpad sandbox escape (CVE-2026-78952). Loading a crafted page was enough; no click or download needed. Human researchers working with GPT-5.6 Sol agents built it in six days, Google paid $250,000, all three bugs are fixed, and no in-the-wild exploitation is confirmed. It advises updating Chrome and restarting, and gives forensic triage pointers.

ChromeV8Crashpad+3

CVE-2026-85045CVE-2026-78952Chromium issue 548509153+2

Offensive Security, AI Security, Threat Intel· Added 15 Oct 2026, published 14 Oct 2026

rapid7.comadvisory🛡️ Security

Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

Rapid7 emergency-response analysis of CVE-2026-104935, a CVSS 8.6 authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure that allows unauthenticated remote command execution. It was exploited as a zero-day against a limited number of customers, added to CISA KEV on disclosure day, and Volexity observed it chained with a still-unpatched privilege escalation flaw. Part of the fix shipped in 25.1.3.0 in July 2026, with backports to other supported versions pending. Rapid7 advises emergency patching outside normal cycles and hunting for compromise using Volexity's IOCs, since Ivanti has no reliable ones.

Ivanti Connect SecureVPNCVSS

CVE-2026-104935CWE-290CISA KEV+3

Threat Intel, Blue Team & Detection· Published and added 13 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CyberForge's CVE of the Day #075 covers CVE-2026-108860, a critical (CVSS 9.1 v3.1 / 9.3 v4.0) authentication bypass in SciSharp BotSharp through 5.2.0. WebStarter ships a published default HMAC JWT signing secret (CWE-321), so anyone holding it can forge bearer tokens that impersonate known users, including administrators. The post sets out how to confirm the effective key and serving build, a six-step SOC investigation trail, and remediation by rotating the secret. No verified fixed release, KEV entry or EPSS data existed at cutoff, and the linked research is static-only.

BotSharpASP.NET CoreJWT+5

CVE-2026-108860CWE-321VulnCheck+2

AppSec, Identity & Access, Blue Team & Detection· Added 13 Oct 2026, published 12 Oct 2026

thehackernews.comadvisory🛡️ Security

Critical FortiMail Zero-Day Flaw (CVE-2026-104286)

CISA added CVE-2026-104286 (CVSS 9.8), a path traversal and NULL-byte handling flaw in Fortinet FortiMail, to its Known Exploited Vulnerabilities catalog after confirming active in-the-wild exploitation. The bug lets unauthenticated attackers write arbitrary files via crafted HTTP/HTTPS requests, affecting FortiMail 7.2 through 8.0.1; Fortinet published workarounds (disabling IBE, restricting management-interface access) ahead of patches and shared attacker IPs and modified/added files as IOCs. The article also lists several other actively exploited vendor flaws disclosed the same week (Check Point, Arista VeloCloud, F5 BIG-IP APM, Cisco Catalyst SD-WAN Manager, Citrix NetScaler).

FortiMailCISA KEVCVSS

CVE-2026-104286CVE-2026-85102CVE-2026-93616+9

Threat Intel, AppSec· Added 3 Oct 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-57860: ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined i

CVE-2026-57860 describes an arbitrary code execution flaw in ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI that automatically loads and executes MCP servers defined in a repository's .mcp.json on startup without user confirmation. A malicious repo can define mcpServers entries with arbitrary command/args (e.g. bash -c) that spawn under the invoking user's privileges the moment forge is run inside the cloned repo, giving attackers a reliable initial-access and persistence primitive against developers evaluating untrusted code. CVSS 4.0 8.4 HIGH, CWE-829 (inclusion of functionality from untrusted control sphere); a fix commit and VulnCheck advisory are linked.

Model Context Protocol

CVE-2026-57860CWE-829

AI Security· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-16584: Improper handling of an initialization failure in AWS API MCP Server from 0

CVE-2026-16584 affects AWS API MCP Server (awslabs.aws-api-mcp-server) versions 0.2.13 through 1.3.46: if the security policy enforcement data fails to initialize at server startup, the tool silently skips policy checks for the rest of the process's life, letting an agent execute AWS API operations the admin configured the policy to deny or gate. Underlying IAM permissions still apply and are unaffected, but the intended allow/deny gating layer is bypassed (CWE-455, improper handling of initialization failure). Fixed in 1.3.47.

Model Context ProtocolAWSAWS IAM+1

CVE-2026-16584GHSA-29w2-fq35-v728CWE-455

AI Security, Cloud & Infra· Added 26 Sep 2026

cisa.govadvisory🛡️ Security

Careful Adoption of Agentic SI Services | CISA

Joint guidance from CISA, the Australian Signals Directorate's ACSC and other international and US partners on adopting agentic AI systems. It covers the main security challenges and risks of agentic systems, with steps for designing, deploying and operating them safely. It also shows how to map agentic risk management onto existing cybersecurity frameworks and strengthen oversight. The page text calls them "agentic super intelligence (SI)" systems, but the URL says agentic AI services.

CISAAustralian Signals DirectorateASD's ACSC

AI Security, GRC· Added 26 Sep 2026

cisa.govadvisory🛡️ Security

CISA Adds Seven Known Exploited Vulnerabilities to Catalog | CISA

CISA added seven vulnerabilities to its Known Exploited Vulnerabilities Catalog on the basis of active exploitation. They are SQL injection in Sangoma Switchvox, HTTP request/response smuggling in Kludex Starlette, OS command injection in Kestra OSS, improper authentication in BerriAI LiteLLM and JFrog Artifactory, and SSRF plus OS command injection in SonicWall SMA1000 appliances. The alert restates BOD 26-04, which makes federal agencies prioritise rapid remediation of KEV CVEs on publicly exposed assets that grant total control after exploitation. It also requires agencies to check for prior compromise before patching.

Sangoma SwitchvoxStarletteKestra+3

CVE-2026-9586CVE-2026-48710CVE-2026-49869+8

AppSec, GRC· Added 26 Sep 2026

ccb.belgium.beadvisory🛡️ Security

Warning: Vulnerability in Starlette framework and related frameworks like FastAPI exposes millions of servers to authentication bypass, Patch Immediately! | CCB Belgium

Belgian CCB advisory on CVE-2026-48710 ("BadHost", CVSS 6.5), an authentication bypass in Starlette versions before 1.0.1. The Host header was not validated when request.url was rebuilt, so request.url.path could differ from the routed path. Middleware and endpoints that enforce access control on request.url could therefore be bypassed. The flaw affects FastAPI, LiteLLM, vLLM, MCP servers and other Python LLM infrastructure, and may expose stored third-party credentials. The advisory recommends upgrading to 1.0.1 or later and increasing monitoring, and links to the badhost.org scanner and to the GitHub, OSTIF, X41 D-Sec and Ars Technica write-ups.

StarletteFastAPILiteLLM+3

CVE-2026-48710BadHostCCB+3

AppSec, AI Security· Added 26 Sep 2026

wiz.ioadvisory🛡️ Security

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Wiz Research documents active in-the-wild exploitation of three JFrog Artifactory vulnerabilities: CVE-2026-42018 (exposes an internal anonymous-user JWT via POST /access/api/v1/aws/token/), CVE-2026-42016 (token scope validation flaw allowing that JWT to be escalated to admin via POST /access/api/v1/tokens), and CVE-2026-82329 (unauthenticated admin access via POST /access/api/v1/registry/join, added to CISA KEV). Attackers chained the first two to create persistent admin accounts, deploy malicious Groovy plugins for RCE, and drop Rust-based C2 backdoors, while CVE-2026-82329 was exploited independently for configuration exfiltration, cluster join-key theft, and credential/SSH-key persistence. The post includes exact request sequences, detection signatures, affected/fixed version ranges, and remediation guidance.

JFrog ArtifactoryRust

CVE-2026-42016CVE-2026-42018CVE-2026-82329+1

AppSec, Threat Intel, Blue Team & Detection· Published and added 10 Sep 2026

soliditylang.orgadvisory🛡️ Security

Misordered Named Parameters in require with Custom Errors Bug

The Solidity team discloses a bug (reported by Cantina Security via the Ethereum Foundation bug bounty) where the IR-based (--via-ir) code generator pushed named custom-error arguments in call-site order instead of declaration order before ABI-encoding, corrupting revert data for require(condition, ErrorName({...})) calls with reordered named parameters. Introduced in Solidity 0.8.26 and fixed in 0.8.37, the bug produces silently swapped or type-confused values in decoded revert data with no compiler warning, and can cause misaligned encoding in multi-slot-argument cases that either reverts with undecodable data or produces a plausible-but-wrong payload - a real concern for standards like ERC-3668 (CCIP Read) that treat revert data as part of the contract interface. Severity was rated "very low" since the affected transaction is already reverting and there is no attacker-controlled exploitation path, but audits of via-ir contracts using named custom-error arguments should check for it.

SolidityEthereum

Cantina SecurityEthereum FoundationERC-3668+1

Blockchain· Added 29 Sep 2026, published 10 Sep 2026

rapid7.comadvisory🛡️ Security

Patch Tuesday - September 2026

Rapid7's September 2026 Patch Tuesday analysis: Microsoft published 974 own-product CVEs (723 in Windows), 999 in total with non-Microsoft fixes, the most it has ever published in one day. Two zero-days are exploited in the wild: CVE-2026-85880 (Windows ALPC elevation of privilege to SYSTEM via out-of-bounds write; not patched on Server 2025 or Windows 11) and CVE-2026-81963 (Windows Update Stack elevation of privilege via improper link resolution). It also flags Microsoft's missing Edge advisory for the exploited Chromium V8 zero-day CVE-2026-85046, lists upcoming end-of-support dates for Windows 11 24H2, Server 2012/2012 R2, Office 2021 and Exchange 2016/2019, and includes per-product CVE tables with exploitation-likelihood ratings. Only the first part of the page was available, so the later tables are not covered.

WindowsMicrosoft EdgeChrome+3

CVE-2026-85880CVE-2026-81963CVE-2026-85046+35

Blue Team & Detection, Offensive Security· Added 7 Oct 2026, published 8 Sep 2026

orca.securityadvisory🛡️ Security

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites

CVE-2026-32475 (CVSS 9.0) is an unauthenticated arbitrary file upload leading to RCE in Elementor Pro's Forms module (versions up to 4.2.1), caused by the extension-blocklist check and the file-move step running in two separate loops with different empty-file handling, letting a two-part file submission bypass the blocklist and drop a PHP webshell into the public wp-content/uploads/elementor/forms/ directory. The post also flags related WordPress core CVE-2026-65640 (CVSS 8.8, fixed in 7.0.4), an Author-level RCE via malicious PostScript upload requiring Imagick and Ghostscript. Fix: upgrade Elementor Pro to 4.2.2+ and WordPress core to 7.0.4, and audit the uploads/elementor/forms directory for planted PHP files.

WordPressPHPOrca Security+1

CVE-2026-32475CVE-2026-65640arbitrary file upload+1

AppSec· Added 3 Sep 2026, published 20 Aug 2026

orca.securityadvisory🛡️ Security

Orca Security: Zoom Zero-Click RCE Flaws Allow Any Meeting Attendee to Compromise All Participants

Orca Security details four Zoom vulnerabilities in the cross-platform annotation engine (libannotate.so): CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize from unchecked 32-bit character counts, and CVE-2026-53415, a use-after-free in auto-shape metadata handling giving a write-what-where primitive, both enabling zero-click RCE against every meeting participant via crafted annotation messages during screen sharing. Also disclosed are CVE-2026-53414 (heap over-read/DoS) and CVE-2026-53416 (path traversal in the Windows VDI client). The write-up notes a working exploit chain built in under 24 hours with fewer than 20 AI-model prompts, platform-specific exploitation details (macOS ARM64 ASLR bypass, Android heap spraying/vtable corruption), and that E2EE meetings bypass Zoom's server-side message filtering.

Orca SecurityAndroidmacOS+2

CVE-2026-53413CVE-2026-53414CVE-2026-53415+1

AppSec, Offensive Security· Published and added 12 Aug 2026

aws.amazon.comadvisory🛡️ Security

CVE-2026-18394 - Incorrect authorization in Strands Agents Tools http_request tool

AWS bulletin for CVE-2026-18394, an incorrect authorization flaw in the http_request tool of the open-source strands-agents-tools package used with the Strands Agents SDK. The tool exposed an LLM-controllable proxies parameter that let attacker-controlled web content (via indirect prompt injection) redirect requests through an actor's proxy while the hostname allowlist check still passed, disclosing HTTP_REQUEST_TOKEN_CONFIG-bound credentials in cleartext Authorization headers on the first hop. Fixed in version 0.8.2; AWS recommends upgrading and rotating any credentials configured on affected versions.

AWSStrands AgentsLLM

CVE-2026-18394

AI Security, AppSec· Added 6 Aug 2026

endorlabs.comadvisory🛡️ Security

NPM Malware Compromises keyv and cacheable with 500M+ Weekly Downloads and Spreads to Hundreds of Packages | Blog | Endor Labs

Endor Labs' active-tracking advisory on an npm supply-chain worm that compromised keyv, flat-cache, and file-entry-cache (500M+ combined weekly downloads) via the jaredwray/Cacheable GitHub Actions OIDC trusted-publishing pipeline, injecting a preinstall hook (setup.mjs) that fetches a legitimate Bun binary to run an obfuscated ~727KB stage-2 payload (Math_Symbol.js/math_init.js) stealing AWS, npm, GitHub, and Vault tokens. The stolen tokens were used to self-propagate the same payload to 384+ packages and 1,136+ versions across unrelated maintainer accounts, including scopes belonging to companies like ServiceTitan, Qlik, and Picsart. The post includes IOCs (file hashes), affected package/version lists, and mitigation guidance (lockfile/CI log checks, --ignore-scripts).

npmBunGitHub Actions+3

keyvcacheableflat-cache+15

Supply Chain, Threat Intel· Added 3 Sep 2026, published 4 Aug 2026

aikido.devadvisory🛡️ Security

Keyv and friends compromised in active Shai-Hulud supply chain attack

Aikido Security reports that Keyv and several related npm packages were compromised as part of the ongoing Shai-Hulud supply-chain attack, in which malicious versions were published to npm to spread a self-replicating worm across the ecosystem. The write-up details the affected packages and versions and the worm's propagation mechanism via compromised maintainer credentials and postinstall scripts.

npmNode.jsKeyv

Shai-Hulud

Supply Chain· Added 3 Sep 2026, published 4 Aug 2026

socket.devadvisory🛡️ Security

Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics

Socket details a compromise of @injectivelabs/sdk-ts version 1.20.21 (a popular Injective Labs TypeScript SDK with ~50,000 weekly downloads), in which the fromMnemonic and fromHex key-derivation functions were hooked with a trackKeyDerivation call that base64-encodes and exfiltrates wallet private keys and mnemonic phrases to a lookalike Injective public infrastructure endpoint. The attacker gained access via a legitimate maintainer's GitHub account, published the malicious version, and simultaneously pushed version 1.20.21 to 17 other @injectivelabs-scoped packages pinned to the compromised SDK, amplifying blast radius to transitive dependents. The compromise was detected and reverted within roughly an hour by the account owner, but the malicious release artifacts remained downloadable on npm and GitHub at time of writing.

npmTypeScriptSocket

@injectivelabs/sdk-tsInjective LabstrackKeyDerivation

Supply Chain· Added 21 Sep 2026, published 9 Jul 2026

radar.offseq.comadvisory🛡️ Security

CVE-2026-49257: CWE-306: Missing Authentication for Critical Function in startreedata mcp-pinot - Live Threat Intelligence - Threat Radar | OffSeq.com

test summary

Python

CVE-2026-49257

AI Security· Added 26 Sep 2026, published 18 Jun 2026

orca.securityadvisory🛡️ Security

Orca Security: Critical Unauthenticated RCE in Kopia Backup via SSH ProxyCommand Injection

Orca Security breaks down CVE-2026-45695 (CVSS 9.8), an unauthenticated RCE in the Kopia backup tool's HTTP server, affecting versions 0.22.3 and earlier. The flaw stems from Kopia's /api/v1/repo/exists endpoint splitting SFTP storage configuration fields on literal spaces without a proper tokenizer or quote handling, letting an attacker inject `-oProxyCommand=<cmd>` into the SSH command line when the server runs with --without-password and SFTP/external-SSH enabled — achieving code execution via a single crafted HTTP request. Fix is Kopia 0.23.0, which blocks starting with --insecure/--without-password on non-loopback interfaces; researcher Daniele Berardinelli reported it, tracked as GHSA-2q4c-3mrw-63c3.

KopiaSSHOpenSSH+1

CVE-2026-45695GHSA-2q4c-3mrw-63c3Daniele Berardinelli

AppSec· Published and added 26 May 2026

wiz.ioadvisory🛡️ Security

Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP | Wiz Blog

Wiz analyzes Fragnesia, a Linux kernel local privilege escalation in the XFRM ESP-in-TCP subsystem and a new variant of the Dirty Frag family, introduced as a side effect of a Dirty Frag patch. File-backed pages spliced into a TCP receive queue before the socket switches to espintcp ULP mode are decrypted in place, so AES-GCM keystream manipulation gives deterministic single-byte page-cache writes. The PoC uses user and network namespaces for CAP_NET_ADMIN, installs an ESP security association via NETLINK_XFRM, and overwrites /usr/bin/su in page cache to get a root shell. Ubuntu's AppArmor restrictions on unprivileged user namespaces partially mitigate it, and the post recommends vendor patches and disabling the vulnerable modules.

Linux kernelLinuxUbuntu

FragnesiaDirty FragHyunwoo Kim+7

Offensive Security, Cloud & Infra· Added 5 Sep 2026, published 13 May 2026

Showing 30 of 33