Threats Tagged 'linux'

Bulletin ID: 2026-046-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/18/2026 17:30 PM PDT Description: containerd is an open-source container runtime used by Kubernetes via the Container Runtime Interface (CRI) plugin. It underpins AWS managed container services including Amazon Elastic Kubernetes Service (Amazon EKS), Amazon Elastic Container Service (Amazon ECS), AWS Fargate, Bottlerocket, and Amazon Linux. AWS identified five issues in the containerd CRI plugin affecting versions 1.7 through 2.3. - CVE-2026-50195 (GHSA-cvxm-645q-p574) - CRI checkpoint import, local image tag poisoning - CVE-2026-53488 (GHSA-xhf5-7wjv-pqxp) - image-config LABEL -> host-root command exec - CVE-2026-53492 (GHSA-33vj-92qq-66hc) - CDI annotation smuggling during checkpoint restore - CVE-2026-53489 (GHSA-rgh6-rfwx-v388) - arbitrary host file read via symlink in checkpoint restore - CVE-2026-47262 (GHSA-jpcc-p29g-p8mq) - image-triggered runtime DoS Impacted versions: containerd 1.7, 2.0, 2.1, 2.2, 2.3 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Bulletin ID: 2026-045-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/15/2026 11:45 AM PDT Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. We identified CVE-2026-11931, where incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). Impacted versions: < 0.11.133 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Microsoft's FORGE Lab is advancing AI-native vulnerability research, discovering and helping remediate numerous vulnerabilities across Windows and open-source projects including the Linux kernel. Their work from May to September 2026 led to 140 CVEs assigned for Windows and 155 validated reports for open-source projects. The research highlights challenges beyond discovery, emphasizing the need for scalable validation and remediation processes to keep pace with AI-generated findings. Key lessons include shifting focus from capability to scale, optimizing reasoning economics, and coordinating validation and remediation efforts. This approach aims to sustain vulnerability research at scale by integrating automated validation tools and human coordination.

The Universal Library for Linux (uldaq) by Measurement Computing Corporation contains a stack-based buffer overflow vulnerability. No specific affected versions or patch information are provided. There is no evidence of known exploits in the wild.

ClingSTUN is a Linux backdoor malware that operates as a back-connect proxy using the STUN protocol. It sets up persistence on infected systems and exploits multiple vulnerabilities across various device vendors for initial access and self-propagation. The malware abuses legitimate public STUN servers to maintain NAT connectivity and avoid direct attacker infrastructure. It targets a wide range of vulnerabilities in devices from vendors such as Avtech, EnGenius, D-Link, and others, and supports multiple CPU architectures. ClingSTUN also kills competing malware processes and listens for specific packets to execute remote commands and propagate further.

A special build of the kernel packages for Red Hat Enterprise Linux for NVIDIA. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For detailed information on changes in this release, see the RHEL for NVIDIA Release Notes linked from the References section.

Microsoft has released general availability of Linux container support in Windows Subsystem for Linux (WSL), enabling users to build, run, and deploy Linux containers directly on Windows. This new feature includes a command-line tool (wslc.exe) and an API for programmatic container management. It integrates with Microsoft Defender for Endpoint for enhanced security monitoring and with Microsoft Intune for administrative control over container usage. Additional features such as container restart, file copying, health checks, and network commands are now supported. Docker Compose-style support is in development. This release is a feature enhancement rather than a security vulnerability.

Signal has released version 8.30, completing the rollout of its secure backups feature across all supported platforms including iOS and desktop apps. This feature allows users to create end-to-end encrypted backups of their chats, either hosted by Signal or stored locally on the device. The backups require a recovery key for decryption, and hosted backups include an additional rotating key for enhanced security. The update introduces local encrypted backups to iOS and desktop, aligns Android backups to a cross-platform format, and improves media storage efficiency. The backup system excludes disappearing messages set to vanish within 24 hours. The new iOS client also supports direct encrypted iPhone-to-iPhone transfers via Wi-Fi Aware. This release marks the completion of Signal's first phase of its backups project.

A new variant of the Spectre v2 speculative execution side-channel attack, called Branch Target Reuse (BTR), has been demonstrated to leak Linux root password hashes on Intel-based systems within minutes. This attack exploits stale branch predictor information when just-in-time (JIT) compiled code is replaced but the CPU still speculatively executes instructions based on old predictions. Researchers confirmed this vulnerability affects modern CPUs from Intel, AMD, and ARM. Fixes have been merged into the Linux kernel to address this issue.

Multiple vulnerabilities have been identified in the Image Scanner Driver for Linux provided by PFU Limited. Specific technical details and affected versions are not disclosed in the available information. No known exploits are reported in the wild at this time.