linux news
10 stories
ClingSTUN Malware Turns IoT Devices Into Proxy Nodes
A recently discovered Linux backdoor, named ClingSTUN, has been observed actively compromising Internet of Things (IoT) devices. The malware reportedly exploits a significant number of known vulnerabilities, specifically 24 distinct flaws, to gain initial access to these devices. Once compromised, ClingSTUN employs a novel technique involving legitimate public STUN servers to obfuscate its…
New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses
A new variant of the Spectre-v2 CPU vulnerability, termed Branch Target Reuse (BTR), has been reported by researchers. This attack reportedly enables the leakage of sensitive memory from Linux systems, even those equipped with existing Spectre-v2 mitigations. The vulnerability is said to specifically target Just-In-Time (JIT) engines, which are commonly found in web browsers, various runtimes,…
Public Exploits Released for Linux Kernel Root Privilege Flaws
Working exploit code has been publicly released for four distinct vulnerabilities within the Linux kernel. These flaws reportedly allow a local user to escalate their privileges to administrative root access on affected systems. The availability of public exploits significantly lowers the bar for malicious actors to leverage these vulnerabilities, increasing the urgency for system…
ZDI-26-576: Linux Kernel XFRM Race Condition Local Privilege Escalation Vulnerability
A race condition vulnerability, identified as ZDI-26-576, has been reported in the Linux Kernel's XFRM (IPSec) subsystem. This flaw reportedly allows local attackers to escalate privileges on affected systems. The issue specifically involves improper locking mechanisms during operations on skb (socket buffer) objects within the XFRM component.
18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
A significant vulnerability has been identified and patched in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw, a use-after-free bug present for 18 years, could allow local users to escalate their privileges to root and potentially escape containerized environments. Researchers from Tencent are credited with discovering and demonstrating the…
Indian Cybersecurity Firm Uses Homegrown AI to Discover Three Security Flaws in Enterprise Linux
An Indian cybersecurity company has disclosed three previously unknown vulnerabilities in one of the most widely deployed identity components in enterprise Linux, and says all three were surfaced by an artificial intelligence model it built in-house for offensive security research.
Metasploit Adds Linux Fetch Multi Payload for Architecture Agnostic Exploits
The Metasploit Framework has introduced a new Linux Fetch Multi payload family, designed to simplify exploitation by automatically identifying and delivering the correct architecture-specific payload to a target Linux host. This enhancement means that users no longer need to manually determine a target's architecture when selecting a payload, as a single payload and handler can now serve…
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
A Linux kernel vulnerability, present for 15 years and now publicly disclosed as CVE-2026-43499, has been identified by Nebula Security. This flaw, dubbed GhostLock, allows any authenticated user on an unpatched system to escalate their privileges to root and to break out of containerized environments.
New Januscape Linux flaw allows VM escape on Intel, AMD devices
A newly disclosed vulnerability in the Linux kernel, named Januscape, allows an attacker to escape a virtual machine and execute code on the host system. The flaw, present for approximately 16 years before being patched in June 2026, stems from a use-after-free weakness within the shadow MMU emulation of KVM/x86, the virtualization technology for Intel and AMD processors.
Linux Kernel Vulnerability Allows VM Escape on Intel and AMD Systems
A critical vulnerability, present in the Linux kernel's KVM (Kernel-based Virtual Machine) hypervisor for 16 years, has been disclosed, potentially allowing attackers to escape virtual machine environments and execute code on the host system. The flaw, named Januscape, impacts systems utilizing processors from both Intel and AMD.