Critical

CISA alerts of active exploitation of three Linux kernel flaws

BleepingComputer

September 21, 2026 at 8:12 PM

Actively Exploited

Overview

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of three vulnerabilities in the Linux kernel, with one being classified as critical. These flaws could allow attackers to gain unauthorized access or control over affected systems, posing significant risks to organizations that rely on Linux-based infrastructure. Users and administrators of Linux systems are urged to take immediate action to protect their environments. The vulnerabilities affect various distributions of Linux, and failure to address them could lead to serious security breaches. As these exploits are currently active, it is crucial for those using Linux to stay informed and apply necessary updates promptly.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Linux kernel versions affected across various distributions, including Red Hat, Ubuntu, and others that implement the Linux kernel.
Action Required: Users should apply the latest security patches provided by their Linux distribution maintainers.
Timeline: Newly disclosed

Original Article Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical. [...]

Impact

Linux kernel versions affected across various distributions, including Red Hat, Ubuntu, and others that implement the Linux kernel.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should apply the latest security patches provided by their Linux distribution maintainers. It is recommended to check for updates and apply them immediately to mitigate the risks associated with these vulnerabilities.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Linux, Critical.

Read Original Article

Related Coverage

How AI Agents Can Trigger Runaway Costs for Enterprises

darkreading

A new concern has emerged regarding the use of AI agents, particularly in the context of unbounded consumption, which OWASP ranks as a significant risk for large language model (LLM) applications. This issue arises when AI systems operate without proper constraints, potentially leading to excessive resource usage and runaway costs for enterprises. Companies leveraging LLM technologies could face financial strain as these agents consume resources beyond expected limits, which could impact budgets and operational efficiency. It’s crucial for organizations to implement controls and monitor AI usage to mitigate these risks effectively. Understanding and addressing this issue is essential for businesses to avoid unexpected expenses and ensure sustainable AI deployment.

Sep 21, 2026

BigCommerce alerts merchants of data breach linked to Ribon apps

BleepingComputer

BigCommerce has informed several merchants about data breaches linked to third-party Ribon applications. Attackers gained access to credentials for these apps and exploited them to insert malicious scripts into online stores. This breach poses a significant risk to affected merchants, potentially compromising customer data and undermining the integrity of their online platforms. The incident raises concerns about the security of third-party integrations and emphasizes the need for merchants to review their app permissions and security practices. Merchants using Ribon applications should take immediate action to secure their accounts and monitor for unusual activity.

Sep 21, 2026

ShinyHunters Hacked Clop. Now What About Clop's Victims?

darkreading

ShinyHunters, a notorious hacking group, has reportedly defaced Clop’s Dark Web site and claims to have stolen data belonging to Clop's victims. This action raises concerns for organizations that previously paid ransoms to Clop, as they could face renewed extortion attempts. The stolen data could expose sensitive information, putting these companies at further risk. This incident highlights the ongoing cycle of ransomware attacks and the challenges organizations face in protecting their data after paying ransoms. As the situation develops, affected organizations will need to assess their security postures and prepare for potential follow-up attacks.

Sep 21, 2026

Cybercriminals Are Hiding New Malware in Torrents for Popular Films

darkreading

Recent reports indicate that cybercriminals are embedding malware into torrent files of popular films, targeting users in Africa, particularly in Kenya and Uganda. These malicious files are designed to compromise the devices of individuals who download them, putting their personal information and security at risk. The trend of hiding malware in torrents is concerning, as many users may not be aware of the dangers associated with downloading files from unofficial sources. This incident serves as a reminder for users to be cautious when downloading content online and to consider using security software to detect potential threats. As this method of distribution becomes more common, it raises serious questions about the safety of torrenting and the need for increased public awareness about cybersecurity risks.

Sep 21, 2026

WordPress Click2Shell flaw lets hackers execute PHP on the server

BleepingComputer

A new vulnerability called 'Click2Shell' has been identified in the Core component of WordPress, allowing attackers to execute PHP code on affected servers. This cross-site request forgery (CSRF) flaw poses a significant risk as it could enable unauthorized actions on behalf of users, potentially leading to full server compromise. Technical details and a proof-of-concept exploit have already been published, raising concerns about its exploitation. WordPress users, particularly those running outdated versions, should take this threat seriously. Implementing security updates as soon as they become available is crucial to protect against potential attacks.

Sep 21, 2026

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

The Hacker News

A recent cybersecurity advisory has revealed that North Korean hackers are behind the Contagious Interview campaign, which has compromised at least 30,000 devices across over 100 countries. These attackers primarily targeted web designers, engineers, and cryptocurrency specialists, managing to steal funds or account credentials from more than 7,000 cryptocurrency wallets. The total amount siphoned from these wallets amounts to approximately $10.71 million. This incident underscores the growing risk to individuals involved in the cryptocurrency space, highlighting the need for enhanced security measures among professionals in this field. Users must remain vigilant and adopt best practices to protect their digital assets from such sophisticated attacks.

Sep 21, 2026