Linux
OpenSSH 'sshole' CVE-2026-123158: A Long Password Walks Past Authentication on Alpine and musl Systems
OpenSSH 10.6p2 ships an emergency workaround for a password-authentication bypass on musl-based, non-PAM builds such as Alpine Linux; a 257-byte-plus password can log in to accounts that have no password set.
CVE-2026-109518: APT Retry Logic Lets On-Path Attackers Swap a Verified Package and Run Code as Root
A flaw in APT's download retry and hard-link handling lets a network attacker replace a package after signature verification, yielding root code execution on Debian and Ubuntu. Patches are out.
Siemens SIMATIC IoT2050 CVE-2026-58115: Unauthenticated Node-RED Editor Exploited to Drop Linux Bots and Persistent Webshells
VulnCheck reports in-the-wild exploitation of CVSS 10.0 CVE-2026-58115, where Siemens SIMATIC IoT2050 Advanced gateways expose an unauthenticated Node-RED editor, since October 30.
Canonical LXD CVE-2026-112816: mTLS Certificate-Chain Flaw Lets Attackers Impersonate Any Trusted Client (CVSS 4.0 10.0)
Canonical patched a CVSS 4.0 10.0 improper certificate validation bug in the LXD HTTPS listener that lets an attacker authenticate as any trusted client via a crafted certificate chain; MicroCloud is affected too.
CVE-2026-98432: Linux Kernel IPv4 TCP Use-After-Free Rated CVSS 9.8, Reachable Before Application Authentication
A race in the Linux kernel's IPv4 TCP handshake path frees socket options while still in use, giving an unauthenticated remote peer a use-after-free against any listening TCP service. Fixed in stable kernels; distro status varies.
Two CVSS 9.0 Linux KSMBD RCE Flaws Hit a Public Mailing List Before Any Kernel Fix Existed
Trend Micro ZDI reports for two CVSS 9.0 KSMBD flaws, one pre-authentication, were mistakenly posted to the public Linux kernel list with no mainline fix and no CVE assigned.
Plex2Shell: Four-CVE Plex Media Server Chain Exploited Within a Day of PoC Release, Dropping XMRig and Proxy Malware
A public exploit chain for Plex Media Server (CVE-2026-96652, -96654, -96655, -96656) goes from SSRF to code execution; attackers began dropping XMRig and a proxy tool less than 24 hours after the PoC appeared.
PwnEscape (CVE-2026-99999): Linux Kernel Checksum Bug Lets KVM Guests Read and Corrupt Host Memory
PwnEscape, a Linux IPv4 checksum-validation flaw (CVE-2026-99999), lets a malicious guest leak host memory on KVM hosts using virtio-net/TAP networking; a leak was demonstrated against Vercel's production sandboxes.
DirtyAH6, TUNderflow, PPPoEject, DiagSpill: Four Public Linux Kernel Root Exploits Land in the Networking Stack
Researcher Asim Manizada published working local-root exploits for four Linux kernel networking-stack flaws, three reachable via unprivileged user namespaces, one via SCTP diag with no special privileges.
CVE-2026-72018: AI Agent Turns a 16-Byte Linux Kernel Zero-Write Into Local Root
XBOW's autonomous agent found and weaponized a missing bounds check in the Linux kernel's DIBS loopback driver (SMC-D), escalating a constrained out-of-bounds write to root via cred structure corruption.
TeamViewer Patches Five High-Severity Flaws, Including Remote Session Access Control Bypass to RCE
TeamViewer bulletin TV-2026-1010 fixes five high-severity client and host flaws, led by CVE-2026-92370, a remote-session access control bypass that can lead to code execution. Update to 15.82.
CVE-2026-89775: KVM/arm64 Nested-Virtualization Bug Gives Guests Read-Write Access to Host Kernel Memory
A type-truncation bug in KVM/arm64's stage-1 page-table walk lets a guest keep a writable mapping to a freed host kernel page, enabling guest-to-host escape on ARM64 hosts with nested virtualization enabled.
Branch Target Reuse: New Spectre v2 Variant Leaks Linux Root Password Hash Through the cBPF JIT
VUSec's Branch Target Reuse abuses stale indirect-branch predictions over freed JIT memory to leak a root password hash from Linux in 3-5 minutes; kernel fixes for CVE-2026-64507 and CVE-2026-64508 are merged.
CVE-2026-86708: ManageEngine Shipped a Live GCP Service-Account Key Inside Its Public Installer
CVE-2026-86708 (CVSS 10.0): Zoho's ManageEngine Applications Manager Linux installer shipped a hard-coded, over-privileged Google Cloud service-account key that anyone who downloaded the installer could extract and use to impersonate the account.
CISA Adds Three Linux Kernel Flaws to KEV: TLS Receive Path, ebtables SNAT, and AF_ALG Race Condition Under Active Exploitation
CISA added three Linux kernel CVEs to its Known Exploited Vulnerabilities catalog on evidence of in-the-wild exploitation — a CVSS 9.8 TLS receive-path flaw, an 8.8 ebtables SNAT out-of-bounds write, and a 7.8 AF_ALG race condition — with FCEB remediation due September 21.
CVE-2026-87886: Acronis Backup Plugin for cPanel and Plesk Exploited for Root on Shared Hosting
CVE-2026-87886 (CVSS 7.8) lets a low-privileged local user escalate to root on cPanel, WHM, Plesk, and DirectAdmin hosts via world-writable files left behind by Acronis's backup plugin — already exploited in targeted attacks and added to CISA KEV with a September 19 federal deadline.
PostGREShell (CVE-2026-6471): A 12-Year-Old PostgreSQL Flaw Turns Replication Access Into Root RCE
A missing-authorization bug in PostgreSQL logical decoding, present since version 9.4 in 2014, lets any account with REPLICATION privilege load an arbitrary library and execute code as the database server's OS user.
Fire Ant Expands From VMware Hypervisors to Cisco IOS XR Routers and TACACS Servers
China-nexus actor Fire Ant has moved beyond VMware ESXi hosts to implant Cisco IOS XR routers and TACACS+ authentication servers, using purpose-built tooling to hijack GRE tunnels, hide commands from admins, and intercept credentials at the network's control plane.
GPUThor: First Rowhammer Attack to Defeat ECC on NVIDIA Workstation GPUs
University of Toronto researchers show GPUThor beats NVIDIA's ECC mitigation for GDDR6 Rowhammer, closing the gap the GPUBreach disclosure left open for host root access.
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Fourteen npm packages disguised as calendar and streak utilities smuggle in RedC2 4.0, a commercial Linux implant whose LLM-driven operator console turns plain-English prompts into post-exploitation commands.