A vulnerability in the Linux kernel io_uring subsystem was fixed to prevent leaving list poison values in the ->hash_node field. The issue occurs because io_uring_cmd_del_cancelable() uses hlist_del(), which leaves LIST_POISON1/2 markers behind. These poisoned pointers can cause a general protection fault and potential kernel memory corruption when requests are recycled without proper reinitialization. The flaw could lead to a kernel crash due to wild memory access.
A vulnerability in the Linux kernel's io_uring subsystem causes a kernel task to spin indefinitely on a stuck overflow list, preventing it from being killed. This occurs when the completion queue (CQ) ring appears full due to CQE overflow conditions, especially with mixed CQE entries or manipulated CQ head pointers. The issue is fixed in certain Linux kernel commits.
A vulnerability in the Linux kernel's io_uring/io-wq subsystem causes a thread exit to hang when processing certain bounded work, such as opening a FIFO without a writer. This occurs because the signal intended to wake workers is lost if the worker has not started the work by the time the signal is sent, causing the thread to hang indefinitely in do_exit(). The issue affects Linux kernel version 5.12 and has been fixed in later commits.
CVE-2026-99227 is a high-severity vulnerability in the Linux kernel's io_uring subsystem related to cancellation reference counting. The flaw allows repeated failed cancellation attempts to wrap a 31-bit reference counter to zero, potentially enabling a request to be completed twice. The issue is fixed by making cancellation attempts idempotent through atomic operations that prevent reference wraparound.
CVE-2026-99226 is a use-after-free vulnerability in the Linux kernel's key management subsystem. It arises from a race condition during named keyring lookup where the owner account pointer can be dereferenced after being freed, leading to a potential read of freed memory. The flaw occurs because the lookup reads the owner UID under a lock that does not protect the lifetime of the key_user structure, allowing concurrent ownership changes to free the old user while it is still being accessed.
CVE-2026-99225 is a vulnerability in the Linux kernel's keyring authorization process. It involves a NULL pointer dereference in the function search_process_keyrings_rcu() due to improper validation and handling of the authorization payload during keyring searches. This flaw can cause a kernel oops (crash) when a descendant process dereferences a cleared payload pointer. The issue is fixed by ensuring the payload is non-NULL before validation and search operations.
CVE-2026-99224 is a high-severity vulnerability in the Linux kernel affecting key description handling. The flaw arises because the key type's name is not properly protected during formatting in keyctl_describe_key(), leading to a use-after-free scenario when a module providing the key type is unloaded concurrently. This can cause a kernel page fault due to accessing freed memory. The issue is fixed by holding the key semaphore during formatting to prevent concurrent retirement of the key type module.
CVE-2026-99223 is a vulnerability in the Linux kernel's key management subsystem where keyring indexes leak kernel address information. This flaw allows an unprivileged user to predict the order of keys in a keyring and recover the kernel image address, potentially undermining Kernel Address Space Layout Randomization (KASLR). The issue has been fixed by removing kernel addresses from the index and using non-address-dependent identifiers with SipHash-based hashing.
A vulnerability in the Linux kernel keys subsystem allowed a race condition where the read method check could be performed on a key type that was being removed, potentially leading to reading freed module memory. This was due to the check occurring outside a semaphore-protected critical section. The issue was fixed by moving the method check inside the critical section, preventing use-after-free scenarios during module unload.
A vulnerability in the Linux kernel's trusted_keys subsystem causes the function trusted_tpm_unseal() to continue processing after a TPM unseal failure, potentially allowing key instantiation to succeed incorrectly. This happens because the error from the unseal operation is overwritten by a subsequent call to pcrlock(), masking the failure. The issue has been fixed by returning immediately upon unseal failure to preserve the original error.
A vulnerability in the Linux kernel asymmetric_keys subsystem allowed unprivileged users to trigger a NULL pointer dereference via trust keys without IDs. This flaw occurs because the PKCS#8 parser leaves the asym_key_ids payload empty, but the kernel code unconditionally dereferences this slot when applying key restrictions. This can cause a kernel panic due to a general protection fault. The issue has been fixed by rejecting asymmetric restriction keys that lack key IDs, as PKCS#8 private keys cannot serve as valid trust anchors.
A vulnerability in the Linux kernel's ftrace subsystem was fixed by initializing the variables 'modname' and 'offset' in the print_rec() function. Previously, if kallsyms_lookup() failed during module load or unload, 'modname' could hold garbage data, leading to a general protection fault when dereferenced. This fault could be triggered by reading available_filter_functions while a module is loading or unloading.
CVE-2026-99218 is a high-severity vulnerability in the Linux kernel affecting version 2.6.27. It involves improper handling of parked threads during coredump processing, where the kernel fails to hold an RCU (Read-Copy-Update) reference while releasing parked threads. This can lead to use-after-free conditions when wake_up_process() is called without proper synchronization, potentially causing memory corruption or kernel crashes. The issue has been fixed in several subsequent commits.
A vulnerability in the Linux kernel's fork implementation could cause a deadlock and system-wide fork blocking when a fork fails while another thread closes a BPF link file descriptor. The issue arises from improper cleanup of file references in failed forks, leading to a deadlock involving the scx_fork_rwsem lock. This has been fixed by reordering cleanup operations to release the child's files after sched_cancel_fork() drops the lock, preventing exit_files() from running on failed forks prematurely.
The npm package @nuxzofficial/baileys contains malicious code that can fully compromise any computer on which it is installed or running. This compromise potentially allows an attacker full control over the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, simply removing the package may not eliminate all malicious software. All secrets and keys stored on the compromised computer should be rotated immediately from a separate, secure device.
The nuxzofficial package on npm contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
TheLeaf Threat Observatory operates honeypot sensors that mimic common internet services such as WordPress, Tomcat, phpMyAdmin, SMTP, Telnet, and RDP to capture unsolicited traffic and automated probing attempts. These sensors collect data on login attempts, credential guessing, and exploitation probes, publishing categorized observations with a delay. The project aims to provide real-world insight into automated scanning and attack techniques without enabling actual exploitation or access. It serves as an educational and research tool rather than a direct threat or vulnerability.
A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.
Critical9.2KEVEPSS 82%Check Point ResearchCVE-2026-111497
This report summarizes multiple significant cyber threats and incidents disclosed in early November 2026. Major breaches include a $6.3 billion cryptocurrency theft from Binance via compromised internal infrastructure, a malicious JavaScript attack on Polymarket's platform, and data breaches affecting Japan Airlines and the Florida Department of Education. The report also highlights the use of AI by threat actors such as the GOLD OGRE ransomware group and North Korean cyber operators to enhance attack capabilities. Several critical vulnerabilities are noted, including CVE-2026-111497 (HTTP2Shell) affecting Brotli decompression, a critical Linux kernel TCP networking flaw (CVE-2026-98432), and a Drupal Commerce Core access control vulnerability (CVE-2026-118539). Cisco patched a high-severity SSL VPN crash vulnerability (CVE-2026-76418) that was exploited in the wild. Additional threat intelligence includes malware campaigns and advanced persistent threat activity targeting various sectors globally.
A malicious file identified by the SHA-256 hash 58c8e25de53f0b4c9afee286556cc8d70d7a7f4900689ab09454640af01aa7cd was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and was seen originating from infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.