Threats Tagged 'linux'

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about active exploitation of three Linux kernel vulnerabilities, including one rated critical. Specific technical details and affected versions have not been provided. No confirmed exploits in the wild are documented beyond this advisory.

Three Linux kernel vulnerabilities have been identified and added to CISA's Known Exploited Vulnerabilities catalog. These flaws allow local attackers to cause denial-of-service conditions, memory disclosure, or unauthorized memory modification. The vulnerabilities involve issues in the TLS receive path, AF_ALG socket handling, and bridge Netfilter ebtables SNAT target. Federal agencies are urged to patch these vulnerabilities promptly.

Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild. [...]

A $1 million bug bounty challenge by Vercel uncovered multiple vulnerabilities in the Linux kernel's networking stack used in their Firecracker-based microVM sandbox environment. The challenge generated 1,285 reports over two weeks, identifying one critical and several high- and medium-severity issues. Notably, two independent Linux kernel flaws were found: one causing memory leaks and another causing deterministic host crashes. These vulnerabilities have broad implications for cloud providers using similar Linux kernel isolation techniques. No customer data was accessed during the challenge. Fixes are under private review with CVEs pending. Vercel automated report triage using AI to handle the high volume of submissions and improved their sandbox security based on findings.

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. [...]

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530) * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the NVIDIA for RHEL 10 Release Notes linked from the References section.

An intrusion was investigated that began with exploitation of CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp RMM software. The threat actor obtained unauthorized technician access and deployed two previously undocumented malware samples: TaskWeaver and Djinn Stealer. TaskWeaver is a heavily obfuscated Node.js loader that establishes encrypted communications and delivers additional payloads. Djinn Stealer targets credentials across Windows, macOS, and Linux systems, collecting authentication data for cloud platforms, source control, package registries, AI development assistants, browsers, SSH keys, and cryptocurrency wallets. The attacker leveraged legitimate RMM capabilities to transfer files and execute commands across managed systems. Stolen AI assistant tokens provided extensive access to repositories, databases, and cloud accounts. The intrusion demonstrated how a single authentication bypass in trusted management infrastructure can enable widespread credential theft and p...

Published: 2026-09-09 Reference: GHSA-p7v4-vr35-mj6f Description Severity A security vulnerability GHSA-p7v4-vr35-mj6f (CVE assignment pending) in containerd's CRI implementation allows a container restored from an untrusted checkpoint through the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI image, CRIU restores process credentials, Linux capabilities, no_new_privs , and seccomp state directly from checkpoint data rather than enforcing the destination CRI ContainerConfig . An attacker who can run a container with a crafted checkpoint image can execute processes as the root user with full capabilities and no enforced seccomp filters despite restrictive security policies requested by the orchestrator. Additionally, containerd's CRI status reporting reflects the requested configuration rather than the actual restored process state, masking the privilege discrepancy from orchestrators. GKE clusters are not vulnerable by default. GKE node images do not include the criu tool. Implicit container restore is not supported without criu installed on the node. Standard container creation operations in GKE Standard and GKE Autopilot remain unaffected. GKE Autopilot clusters do not support custom runtime configuration and are not impacted. Additionally, Pod snapshots in GKE do not exercise the vulnerable implicit restore codepath. In updated containerd versions (2.3.4 and later, or 2.2.7 and later), implicit restore is disabled by default through the enable_experimental_restore_via_create configuration option. Version 2.4 of containerd will remove this codepath completely in favor of the explicit Pod-level restore API (KEP-5823). Warning: Administrators can manually re-enable the feature in containerd (2.3.4 and later, or 2.2.7 and later) by setting the enable_experimental_restore_via_create configuration option. However, doing so leaves this vulnerability present because containerd cannot enforce destination security policy while it restores the criu process. What should I do? Because GKE does not include the criu binary on default node images, no immediate cluster upgrades or configuration changes are required for default workloads. If you install custom runtime software or node tools on your nodes that include the criu binary, consider taking the following actions as appropriate for your environment: Re-create existing restored containers: Stop, delete, and re-create any running containers that were restored from untrusted checkpoints. Disable experimental restore (containerd 2.3.4 and later, or 2.2.7 and later): If operating nodes with containerd (2.3.4 and later, or 2.2.7 and later) and custom criu installations, ensure the enable_experimental_restore_via_create configuration option remains set to false in your containerd node configuration. Audit containerd logs: If criu is installed, inspect node logs for implicit restore log entries containing search strings such as "Found checkpoint of container" , "Prepared for restore" , or "Restored container successfully" . Monitor deprecation warnings for containerd: Look for the following deprecation warning event: io.containerd.deprecation/cri-create-container-checkpoint-restore . Restrict Pod creation permissions: Ensure Kubernetes RBAC restricts Pod creation permissions ( create pods ) strictly to trusted users and service accounts. Enforce trusted image registries: Ensure that the values for the Pod's image: field reference verified image repositories. Prepare for KEP-5823: Update operational procedures to rely on explicit Pod-level Checkpoint or Restore APIs after they are available in future Kubernetes releases. Medium

A Linux rootkit has been identified targeting F5 BIG-IP APM devices. This rootkit intercepts PHP file loading processes and injects a fileless web shell directly into memory, which allows it to avoid writing malicious code to disk. This technique complicates detection and forensic analysis. The rootkit specifically affects F5 BIG-IP APM environments and leverages in-memory injection to maintain persistence and stealth.

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.