Linux
Curated coverage and analysis in this editorial area.
CVE-2025-68670: Pre-auth RCE Vulnerability Identified in xrdp Server Domain Field
A technical breakdown of CVE-2025-68670: A stack buffer overflow within xrdp's domain name processing logic enables unauthenticated re…
NGINX Rift: Critical CVE-2026-42945 Exploitation Detected In-the-Wild
The NGINX Rift vulnerability (CVE-2026-42945) has seen active exploitation since May 16, leveraging a long-dormant heap buffer overflo…
DirtyDecrypt: Linux Local Privilege Escalation Exploit Surfaces for Unpatched Systems
A proof-of-concept for 'DirtyDecrypt'—a local privilege escalation flaw in the Linux kernel's RXGK module—is now public. Organizations…
Fragnesia Flaw Enables Local Root via Linux Page Cache Corruption
CVE-2026-46300 allows local root escalation on Linux by corrupting read-only files in memory. With a public PoC available and patches…
Exim 'Dead.Letter' Vulnerability: Critical RCE Risk for GnuTLS-Based Builds
CVE-2026-45185 is a use-after-free vulnerability in the Exim SMTP BDAT parser that allows unauthenticated RCE on GnuTLS-compiled serve…
Dirty Frag LPE Chain: Deterministic Linux Root Access via Single Command
Dirty Frag exploits two Linux kernel vulnerabilities to achieve deterministic local privilege escalation to root. With a public PoC av…
Exim 'Dead.Letter' Vulnerability: Unauthenticated RCE Threatens GnuTLS-Based Mail Servers
A critical use-after-free vulnerability in Exim’s BDAT parser (CVE-2026-45185) allows for unauthenticated remote code execution on ser…
Dirty Frag: Linux Kernel Vulnerability Chain Exploited in the Wild for Root Access
Dirty Frag chains two Linux kernel flaws to achieve deterministic local privilege escalation. With a public PoC available and active e…
CVE-2026-31431: CISA Mandates Container Patch — Actively Exploited in the Wild
CISA has confirmed active exploitation of CVE-2026-31431, a critical Linux kernel vulnerability dubbed "Copy Fail." With a 732-byte Po…
BRICKSTORM: CISA and NSA Alert on Evolving Rust Backdoor Targeting vSphere
Cybersecurity agencies have updated their Malware Analysis Report for BRICKSTORM, a sophisticated ELF backdoor targeting VMware vSpher…
Linux ‘Copy Fail’ Under Active Attack: CISA Sets May 15 Patch Deadline
CISA has added CVE-2026-31431, known as 'Copy Fail,' to its KEV catalog following reports of active exploitation. The stealthy 732-byt…
Linux Copy Fail Risk: The Invisible 4-Byte Root Exploit
The Linux Copy Fail vulnerability allows root escalation in 4 bytes, corrupting only RAM. Discover the impact on Kubernetes and how to…