A new vulnerability in Linux, named 'Dirty Frag', has emerged, specifically affecting the xfrm-ESP and RxRPC modules. One of the flaws, identified as CVE-2026-43284, has already been patched in the Linux kernel, but the second flaw, CVE-2026-43500, remains unpatched. This situation poses a significant risk as attackers can exploit the unpatched vulnerability to gain root access to affected systems. The implications are serious, particularly for organizations using Linux systems that rely on these modules for secure networking. Users and system administrators are urged to apply the latest patches for the patched vulnerability and remain vigilant for updates regarding the unpatched issue.
Articles tagged "Exploit"
Found 577 articles
Trellix source code breach claimed by RansomHouse hackers
BleepingComputer
The RansomHouse hacking group has claimed responsibility for a breach of Trellix's source code repository, revealing a small set of images as proof of the attack. This incident raises concerns about the security of Trellix's products and the potential exposure of sensitive information. With the source code compromised, attackers could exploit vulnerabilities or develop attacks against Trellix's software. The breach not only affects Trellix but also poses risks to its users, who may be at increased risk of cyberattacks. As the situation develops, it is crucial for Trellix and its customers to take immediate steps to assess their security posture and mitigate any potential fallout from the breach.
Why Vulnerability Scanning Is Not Penetration Testing, And Why Cisos Should Care
Cyber Defense Magazine
The article discusses a common misconception in cybersecurity where organizations mistake vulnerability scanning for penetration testing. A survey by the SANS Institute found that over 60% of organizations confuse these two distinct practices. Vulnerability scanning involves identifying potential security weaknesses, while penetration testing simulates real-world attacks to exploit those vulnerabilities. This distinction is crucial for Chief Information Security Officers (CISOs) as reliance on scanning alone can leave organizations exposed to risks that a comprehensive penetration test would reveal. Understanding the difference can help improve security postures and better allocate resources to protect sensitive data.
Critical
Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major DistributionsThe Hacker News
Actively Exploited
A newly discovered vulnerability, named Dirty Frag, poses a significant local privilege escalation risk within the Linux kernel, affecting several major distributions. This flaw is considered a successor to another serious vulnerability known as Copy Fail (CVE-2026-31431), which has already seen active exploitation. Dirty Frag allows attackers to gain root access on systems running vulnerable kernel versions. The vulnerability was reported to Linux kernel maintainers, but as of now, it remains unpatched. Users of Linux distributions should be aware of this issue and take necessary precautions to secure their systems, especially since it has been linked to ongoing exploitation in the wild.
Actively Exploited
Ivanti customers are facing a new security challenge as attackers exploit a zero-day vulnerability in a popular mobile endpoint security product. This flaw allows unauthorized access to victim networks, making it a prime target for cybercriminals. The issue is particularly pressing as Ivanti's products are widely used in various organizations, raising concerns about the potential scale of the attacks. Companies relying on these security solutions are urged to take immediate action to safeguard their networks. The ongoing exploitation of this vulnerability highlights the need for vigilance in maintaining cybersecurity measures and prompt updates to security software.
Cisco's AI security researchers have discovered a vulnerability in vision-language models (VLMs) that could be exploited by attackers using subtle pixel-level changes in images. These small alterations can mislead the models into producing incorrect outputs without being noticeable to human observers. This poses significant risks for industries that rely on VLMs, such as autonomous vehicles and security systems, where accurate visual interpretation is crucial. The findings suggest that companies using these AI systems should review their security measures to prevent potential exploitation. As AI continues to integrate into various applications, understanding and mitigating such vulnerabilities becomes increasingly important.
Exploits and vulnerabilities in Q1 2026
Securelist
The report for Q1 2026 details a range of newly discovered vulnerabilities and exploits in various software and systems. Researchers have identified several Command and Control (C2) frameworks utilized in Advanced Persistent Threat (APT) attacks, which indicates a concerning trend in cybercrime tactics. This information is crucial for organizations to understand the evolving threat landscape and to take proactive measures to protect their networks. By keeping track of these vulnerabilities, companies can better defend against potential attacks that exploit these weaknesses. It’s essential for IT teams to stay updated on these findings to ensure their systems are secure.
Actively Exploited
Cybersecurity researchers have identified three malicious packages on the Python Package Index (PyPI) that are distributing a new type of malware called ZiChatBot. These packages are designed to deliver harmful files while masquerading as legitimate software. Both Windows and Linux systems are at risk, as the malware can operate on both platforms. This incident raises concerns about the security of open-source repositories, where malicious actors can exploit the trust users place in these resources. Developers and users of Python packages should be vigilant and verify the authenticity of packages before installation to avoid falling victim to such attacks.
Actively Exploited
Cofense has reported a notable rise in phishing campaigns that exploit the Vercel platform. Vercel, a popular service for frontend developers that allows for easy deployment of web applications, has been misused by attackers to create deceptive sites aimed at tricking users into providing sensitive information. This uptick in abuse is significant enough to raise alarms among cybersecurity experts, as it could affect a wide range of organizations using Vercel for their web projects. Companies relying on this platform need to be vigilant and enhance their security measures to protect against these phishing attacks. Users should also be cautious about unsolicited communications that may lead to fraudulent websites.
Actively Exploited
Palo Alto Networks has announced a patch for a zero-day vulnerability, identified as CVE-2026-0300, that affects the Captive Portal service in its PAN-OS software. This vulnerability impacts both PA and VM series firewalls, allowing attackers to exploit the system and potentially gain unauthorized access. The existence of this zero-day exploit means that it is currently being used in the wild, putting users at risk. Companies using these firewalls should prioritize applying the upcoming patch to safeguard their networks. This incident underscores the need for organizations to stay vigilant and maintain their systems updated to protect against emerging threats.
The UC Berkeley Center for Long-Term Cybersecurity (CLTC) is stepping up to assist schools, local governments, and non-profits in improving their cybersecurity defenses. With cyberattacks on the rise, these organizations often lack the resources to protect themselves effectively. CLTC provides a range of tools and support aimed at bridging this cybersecurity gap, ensuring that under-resourced entities can better safeguard sensitive information and infrastructure. This initiative is crucial as smaller organizations are often targeted by cybercriminals who exploit their vulnerabilities. By equipping these groups with the necessary resources, CLTC aims to strengthen the overall security posture of communities that might otherwise be left vulnerable.
Actively Exploited
A critical vulnerability in the Weaver E-cology platform has been identified, allowing remote code execution (RCE) that could expose sensitive enterprise workflows and data. This flaw poses a significant risk to organizations using the software, as attackers can exploit it to gain unauthorized access to critical systems and information. The vulnerability is currently being actively exploited, which raises immediate concerns for businesses that rely on Weaver E-cology for their operations. Security experts are urging affected users to take swift action to mitigate the risks associated with this flaw. The situation underscores the need for organizations to remain vigilant and proactive in addressing security vulnerabilities.
Actively Exploited
Hackers have been exploiting a significant vulnerability in Weaver E-cology, a platform used by various organizations in China for managing workflows and documents. According to threat intelligence firm Vega, these attacks have been targeting institutions that rely on this software for their internal business processes. The situation raises concerns for affected organizations, as successful exploitation could lead to unauthorized access to sensitive information and disruption of critical operations. As this vulnerability is actively being used by attackers, it is crucial for users of Weaver E-cology to take immediate action to protect their systems. Organizations should remain vigilant and consider reviewing their security protocols to mitigate potential risks.
NCSC Warns of an AI-Fuelled “Vulnerability Patch Wave”
Infosecurity Magazine
The UK's National Cyber Security Centre (NCSC) is warning organizations to brace for a wave of new software updates driven by advancements in artificial intelligence. This surge in updates is expected as developers respond to newly discovered vulnerabilities that AI tools can help identify more efficiently. The NCSC emphasizes that businesses and institutions need to ensure their systems are up-to-date to protect against potential security threats that exploit these vulnerabilities. With the growing reliance on software across various sectors, timely patching becomes crucial to maintain cybersecurity. Organizations are encouraged to review their update policies and prepare for increased patch management activities in the coming months.
Actively Exploited
A significant security vulnerability, dubbed 'Copy Fail', has been discovered in Linux systems that could potentially impact every major Linux distribution released since 2017. The flaw has been actively exploited, raising alarms among cybersecurity researchers. Some experts have criticized the way the vulnerability was disclosed, particularly noting that the AI-generated report from Theori lacked clarity and helpful details. This situation underscores the importance of clear communication in security disclosures, especially when dealing with vulnerabilities that affect a wide range of users and systems. As attackers may leverage this flaw, it’s crucial for system administrators and users to stay informed and prepared for potential exploits.