Microsoft is developing the Windows 11 27H2 update, focusing on core system stability, new wallpapers, and 64-bit speed via Intel APX register expansion.
Related Posts:
Windows 11 Cloud Rebuild Delivers Fresh System Recovery
Windows 11 Android Apps Return via Taskbar Search
Windows 11 Speed Test Tool Arrives as Native Utility
The post Windows 11 27H2 Update Brings Intel APX Boost appeared first on Daily CyberSecurity.
Microsoft is developing the Windows 11 27H2 update, focusing on core system stability, new wallpapers, and 64-bit speed via Intel APX register expansion.
Update Alpine Linux OpenSSH servers to OpenSSH 10.6p2 now to fix a critical password authentication bypass affecting passwordless accounts.
Related Posts:
JetBrains Patches 61 Flaws Across Hub, Datalore, YouTrack, and IntelliJ IDEA
ChatGPT Lockdown Mode Bypass Exposes Chat Data
Windows Paint RCE CVE-2026-83844 Affects Hundreds of Millions
The post OpenSSH Authentication Bypass on Alpine Linux Lets Attackers Log In Without a Password appeared first on Daily CyberSecurity.
Introduction
Incidents in virtual environments can begin with a software vulnerability, human error, a configuration weakness, or several of these factors at once. The investigation is rarely limited to the workload. Hypervisors, container runtimes, management consoles, monitoring platforms, identity systems, virtual networks, datastores, backups, and automation accounts all influence what an attacker can reach.
Kaspersky GERT recently investigated two more ransomware cases on ESXi and Proxmox e
Incidents in virtual environments can begin with a software vulnerability, human error, a configuration weakness, or several of these factors at once. The investigation is rarely limited to the workload. Hypervisors, container runtimes, management consoles, monitoring platforms, identity systems, virtual networks, datastores, backups, and automation accounts all influence what an attacker can reach.
Kaspersky GERT recently investigated two more ransomware cases on ESXi and Proxmox environments in which weak access controls, insufficient network separation, exposed administrative services, and poor management of privileged credentials contributed to the impact. A monitoring system that could reach the virtualization layer also exposed a reusable root credential. Once the attacker controlled that route, ordinary administrative access was enough to affect several hosts. No VM escape was required.
The incidents show why patching and secure configuration must be managed together. A fully patched hypervisor can still be compromised through a shared password, an overprivileged monitoring account, an open SSH path, or an administrator interface reachable from a general server network. NIST guidance places secure configuration baselines, restricted administrative access, current patches, and monitoring across all layers within the same set of sound security practices.
In this article, we’re going to describe both incidents with additional focus on common unsafe practices that were exploited, leading to compromise, as well as remediation tactics. We’ll also discuss the broader scope of threats targeting virtual environments for a better understanding of possible protection strategies.
The connected system defenders must protect
A business virtual environment is not just Hyper-V, VMware, or Docker but rather a connected stack. Management consoles, orchestration tools, monitoring platforms, and automation accounts sit above hypervisors and container engines. Registries, image stores, virtual switches, datastores, and backup systems connect the layers. Applications and business services run at the bottom, while much of the administrative power sits near the top.
The important boundaries extend beyond guest to host. They include workload to management plane, monitoring system to hypervisor, registry to deployment, administrator workstation to console, management plane to storage, and one virtual network segment to another. An attacker only needs one usable route. The possibility of compromise may lie in one stolen or insecurely placed administrator credential rather than in a complex escape exploit. In the GERT case, the compromise route passed through the monitoring platform and included a valid virtualization platform credential.
Case #1: From network monitoring to ESXi encryption
The investigation began with evidence of BlackNevas ransomware activity on a Windows system in a virtualized domain controller segment. UserAssist artifacts recorded execution of the AnyDesk RMM tool and GMER binaries. The environment also used PRTG Network Monitor to monitor its virtual infrastructure.
UserAssist artifacts
The available evidence showed that the PRTG deployment had broad access to the ESXi hosts and that the same root password was reused across several nodes. After obtaining access to the monitoring environment, the attacker used the ESXi credential to connect over SSH to the hosts that shared the same password. This design joined monitoring, credential storage, and direct administration into one attack path.
PRTG supports storing VMware credentials at the device or inherited group level. That feature is operationally useful, but a monitoring server becomes privileged infrastructure when it holds credentials that can administer the systems it observes. The security question is therefore not whether monitoring needs access, but whether the identity, privileges, storage method, and permitted network path are limited to the monitoring task.
The threat actor gained root access to the ESXi environment and used the esxcli command to bypass the system restriction by disabling the execInstalledOnly policy to execute the encryption binary and also perform anti-forensic log deletion. Let’s look closely at the timeline of the initial host compromise.
ESXi (192.168.*.*) timeline
2025-10-18 Connection attempts from IP address 192.168.*.*.
2025-10-19 During an SSH session by root from IP 192.168.*.*, the file esx is uploaded to the system.
2025-10-19 User "root" attempts to execute the binary esx with the error "Execution of non-installed file prevented".
chmod 777 esx
./esx /log
2025-10-19 User "root" deactivates the execInstalledOnly option.
esxcli system settings advanced set -o
/User/execInstalledOnly -i 0
2025-10-19 User "root" executes the malware esx.
2025-10-19 New connection attempts from IP 192.168.*.*.
Now, at the same time, the following activities ensued on a different host with the same password for the root user:
ESXi (172.16.*.*) timeline
2025-10-19 SSH connection by user "root" from IP 172.16.*.*.
2025-10-19 User "root" executes the malware esx and clears the logs.
chmod a+x esx && chmod 777 esx
./esx /selftest
nohup ./esx /p /vmfs/ /depth 5 /log /wipe
./esx /depth 5 /log /wipe
Case #2: Credential notes impacting the whole Proxmox environment
GERT responded to a ransomware incident by The Gentlemen group, in which the threat actor gained access to Proxmox using information collected during the dwell time between initial access and visible impact. On a compromised system administrator workstation, the actor discovered administrative credentials and access details stored in notes in plain text. These records provided the information needed to log in to Proxmox using the root account.
The actor then activated the VNC web socket through the compromised root account, gaining extensive control over the Proxmox environment. This access was subsequently used to download and execute ransomware within the cluster, which resulted in the encryption of the entire virtual environment. Below are the log records showing the root account being used to access other hosts via a VNC web socket.
This incident is a clear example of the risks of storing privileged credentials in unsecured notes or other easily accessible files. Once the administrator workstation was compromised, the saved credentials allowed the actor to move from a single endpoint into the virtualization management layer. Because the credentials belonged to a highly privileged root account, one poor credential handling practice significantly increased the scope and impact of the attack. Privileged credentials should instead be stored in an approved password manager or privileged access management system, protected with multifactor authentication and rotated immediately if an administrator workstation is suspected of being compromised.
Why the misconfiguration caused broad impact
Both cases exhibited unsafe misconfiguration practices whose exploitation led to a bigger impact on the host system. Next, we will break down each misconfiguration to see how it enabled further compromise and what should be done to avoid it.
Monitoring inherited excessive privilege
In Case 1, the monitoring platform could do more than collect health and performance data. It held or could use credentials with enough privilege to reach ESXi directly. A compromise of the monitoring system therefore became a compromise of the management plane. Monitoring identities should be dedicated to the task and given only the permissions required by the deployed sensors.
Credential reuse
Password reuse converted one recovered secret into farm-wide access. System administration should use named identities through the central management plane. Each host should have unique credentials and proper password storage hygiene. Password strength alone does not limit the impact of theft, but where the credential can be used and where it is stored do.
Direct root access bypassed central control
Direct SSH access allowed the actor to authenticate as root, upload a binary, and change a security setting without first passing through vCenter role controls. Broadcom, the parent company of VMware, recommends managing vSphere through vCenter, disabling SSH during normal operation, and using Lockdown Mode where suitable. Required service accounts should be explicit exceptions rather than members of a broad administrator group.
Lack of enhanced security settings
The initial execution attempt was blocked by execInstalledOnly, but the attacker had enough privilege to disable this policy. Broadcom documents enforcement options that combine execInstalledOnly with UEFI Secure Boot and TPM-backed configuration protection. These controls must be enabled, tested, and monitored for change. A setting that can be silently disabled by the same credential used for daily administration provides limited resistance after account compromise.
Unsafe credential storage
Case 2 demonstrated the possibility of compromise lying in privileged credential exposure. The mitigation strategy involves not only securing the administrative credential storage but also general hardening practices of secret handling, such as privilege management and regular access audits.
How to close this attack path
In this section, we share remediation advice on how to mitigate such attacks, and detect and prevent them from going further. We recommend the following actions:
Separate monitoring from administration. Create a dedicated monitoring identity for each platform and restrict it to the smallest set of objects and actions that the monitoring sensors require. Do not use ESXi root or another emergency account for routine polling. Prevent monitoring servers from starting interactive administrator sessions unless a separately approved support workflow requires it. The same principle applies beyond VMware.
Replace stored root passwords. Locate every copy of hypervisor, management, storage, and backup credentials in monitoring tools, scripts, scheduled tasks, connection managers, and service configurations. Replace static passwords with vault retrieval, brokered identities, or limited API tokens where the platform supports them. Record every retrieval and rotate the secret after emergency use or compromise.
Restrict direct host access. Route normal ESXi administration through vCenter and enable an appropriate Lockdown Mode after testing monitoring, backup, and recovery dependencies. Keep ESXi Shell and SSH stopped by default. When support work requires SSH, enable it for a defined period, restrict the source, and alert on service activation, root login, and changes to the exception list of users who are allowed to connect via SSH.
Use a specialized security solution. In our portfolio, Kaspersky Cloud Workload Security (KCWS) is perfectly suited to address virtual environment risks, offering a powerful combination of two products: Kaspersky Hybrid Cloud Security (KHCS) and Kaspersky Container Security (KCS). Kaspersky Hybrid Cloud Security is specifically built to secure virtualized infrastructures, private data centers, and hybrid clouds. A patented Light Agent architecture minimizes resource impact without compromising performance, while comprehensive infrastructure visualization through a unified console gives administrators complete visibility and control over the entire hybrid network. Kaspersky Container Security covers every stage of a containerized app’s lifecycle, from development to operation. Among other capabilities, the solution allows for detecting misconfigurations using a dedicated scanner for images, file systems, and repositories that contain IaC files (such as Terraform, CloudFormation, Azure ARM templates, Helm charts, and Dockerfiles).
Treat configuration changes as security events. Alert when execInstalledOnly, Secure Boot enforcement, Lockdown Mode, SSH, local accounts, exception users, firewall rules, or remote logging settings change. Baseline the expected state and test whether the security team can detect an unauthorized change. A secure configuration set once does not mean that the control remains active on the host.
Isolate the management network. Place hypervisor, monitoring, backup, storage, and cluster administration on restricted management networks. Permit only the exact source and destination services required. Administrative workstations should enter through hardened jump hosts with named identities and multifactor authentication.
Protect logs, backups, and recovery. Forward ESXi, vCenter, Proxmox monitoring, identity, and network logs to protected storage that a compromised administrator cannot erase. Backup platforms should use separate identities, restricted management paths, and recovery copies outside ordinary administrative reach.
Configuration checks for monitored virtualization
Below are recommended checks to run when enabling virtualization monitoring. The safest state depends on the platform and monitoring method, but each control should be tested.
Control area
Safer state
Verification
Monitoring identity
Dedicated service account or token with only required read and polling rights
Review assigned roles and test every sensor without root or global administrator access
Credential storage
No recoverable host root password on a monitoring or general-purpose server
Review tool configurations, scripts, scheduled tasks, and connection stores for embedded credentials, access tokens, or other secrets
Network path
Monitoring reaches only required polling services while administration uses a jump host
Test management ports from monitoring server, user segments and untrusted network segments
Direct host access
Lockdown Mode where suitable with SSH and ESXi Shell stopped by default
Attempt direct client API and SSH access to host using a routine account
Configuration integrity
Secure Boot and execInstalledOnly enforcement enabled where supported and tested
Change a test setting through the approved process and confirm an alert is generated
Evidence
Host, management, identity, monitoring, firewall, and PAM logs stored remotely
Generate successful and failed logins and verify source, account, host, time, and action
The wider attack surface
Closing the monitoring and credential routes does not secure the environment by itself. Virtualization also relies on isolation boundaries, trusted images, management APIs, virtual networks, storage, and backups. Each layer requires a different control and leaves evidence in a different place.
VM and container escapes
In a VM escape, code inside a guest reaches past the VM boundary and affects the host or another guest. The weakness may be in a virtual device, an integration feature, a hypercall interface, or another component that translates guest requests for the host. If the escape works, control of one VM may lead to control of the physical server and every workload on it. VMware CVE-2025-22224 showed this risk: an attacker with administrator rights inside a VM could execute code as the VMX process on the host, and Broadcom reported exploitation in the wild.
A container escape can reach a similar result, but the starting point is different. Linux containers share the host kernel, so their isolation model differs from that of a VM. Namespaces limit what processes can see, cgroups control resource use, and capabilities split root privileges into smaller parts. A kernel or runtime bug can break this isolation. Copy Fail (CVE-2026-31431) is a good example of a kernel flaw. Code already running in a container could use a Linux AF_ALG crypto socket to change pages in the shared Linux kernel page cache. Because the host and other containers may read the same cached pages, the effect did not have to stay inside one container. The fix is a kernel update; Docker Engine 29.4.3 also tightened its default security profiles to reduce exposure on hosts that had not yet been patched.
Unsafe settings can also break the boundary. Privileged mode, excessive capabilities, writable host mounts, or access to the Docker socket may remove isolation without any software exploit. For instance, runc CVE-2024-21626 involved leaked file descriptors that could expose the host filesystem to a malicious image or container process.
This difference changes the investigation. A VM can often be treated like a separate computer with its own kernel, memory, and disk. A container is a group of host processes placed inside namespaces. If investigators collect only the container filesystem, they may leave the most useful process, socket, and control-plane evidence on the host.
Images and templates
A compromised golden VM image or container base image can spread through normal automation. Common weaknesses include unofficial public images, mutable tags, overprivileged build tokens, recoverable secrets in older layers, and stale templates that restore vulnerable software or forgotten accounts. Scanning might help, but it does not establish who built the artifact or whether the exact image tested and approved was the one ultimately deployed to production. Use controlled builders, provenance records, signature checks, and planned rebuilds from trusted sources.
Management tools and APIs
A stolen vCenter identity, exposed Docker API, overpowered Portainer role, or compromised backup console may give an attacker an easier route than an escape exploit. Portainer advisory GHSA-7fw3-x4r2-g7wc showed how a proxy validated one bind-mount representation but missed an equivalent API form, allowing an authenticated non-administrator with container creation privileges to reach host paths. The runtime performed a valid request after authorization had already failed in the management layer.
Administrative file-copy operations also deserve attention. Docker fixed archive and mount-handling flaws in CVE-2026-41567, CVE-2026-41568, and CVE-2026-42306. These cases required particular conditions and operator or API activity. They are a reminder to patch the daemon and record who initiated copy operations, which container was involved, the source and destination paths, and the result.
Virtual networks, storage, and backups
East-west traffic between virtual workloads may stay inside one host and bypass a physical sensor. Management, migration, storage, and workload traffic should use separate zones with filtering between them. Snapshot and memory files may contain credentials, while weak datastore permissions can expose whole virtual disks. Backup systems need broad access to recover services, which also makes them valuable to an attacker who wants to delete recovery points or reach several hosts.
Attack surface examples by layer
To sum up, the described attack vectors might be mitigated as follows:
Attack surface
Initial access
Possible impact
Primary control
Credentials and configuration
Password recovered from monitoring or an overprivileged account
Direct control of several hypervisor nodes
Unique vaulted credentials, segmented access, and configuration monitoring
VM escape
Administrative access or code execution privileges inside a guest plus a hypervisor flaw
Host process or neighboring workload compromise
Patch the hypervisor and reduce risky virtual devices and guest privilege
Malicious container affecting kernel or runtime
Code in a container or a malicious image
Host filesystem, kernel, or shared cache impact
Patch kernel and runtime, and remove privileged settings
Images and templates
Compromised build input registry or golden image
Repeated deployment of the compromise
Immutable digests, controlled builds, provenance, and verification
Management API
Stolen identity exposing endpoint or authorization gap
Fleet-wide administrative actions
MFA, least privilege, network restrictions, and complete API validation
Networks, storage, and backups
Flat network or broad datastore and access through backups
Lateral movement, data theft, encryption, and recovery loss
Segmentation, least privilege, protected backups, and traffic monitoring
Conclusion
GERT cases that we presented in this article did not require an attacker to break the VM boundary. The attack path was created by an overprivileged monitoring relationship, an insecure password storage approach, a recoverable and reused root credential, broad management-network reachability, and direct SSH administration. Each element was legitimate on its own, but together they allowed one compromise to reach virtualization hosts and their workloads.
Misconfiguration should therefore receive the same operational attention as vulnerability management. Teams need to know where privileged credentials exist, which systems can use them, which network paths make them effective, and which logs will show their use. Escape flaws, unsafe images, API weaknesses, virtual network exposure, and attacks on storage or backups remain serious, but closing the known administrative route should come first.
A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. [...]
A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. [...]
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]
Postman AI plugin hijacking sparks controversy after the desktop app silently modifies Codex and Claude Code configs to favor its own tools.
Related Posts:
Apple AI Budget Cuts Target Internal Model Usage
OpenAI Unveils ChatGPT Images 2.6 with Animated GIF Support
ChatGPT Search Volume Reaches 20 Percent of Google
The post Postman AI Plugin Hijacking Sparks Developer Outcry appeared first on Daily CyberSecurity.
An upcoming OpenAI cyber model found 1,724 Linux kernel vulnerabilities and built 948 local root exploits to help maintainers patch critical bugs.
Related Posts:
Linux 7.4 Merge Window Sets Record with AI Patches
OpenBSD 8.0 Release Introduces Kernel Hardening and Day-One Errata
GNOME OS Preview Brings GNOME 51.1 to the Public
The post OpenAI Cyber Model Uncovers 1,724 Linux Kernel Vulnerabilities and Builds 948 Root Exploits appeared first on Daily CyberSecurity.
Install the Citrix security vulnerabilities update to patch critical Citrix security vulnerabilities affecting XenServer hypervisors and Scout gateways.
Related Posts:
Cisco Patches High-Severity Remote Code Execution in UCS Central Alongside ISE and Unified CM Flaws
Attackers Exploit Critical GPUStack Authentication Bypass in the Wild to Run Reverse Shells
Control Web Panel Patches Ten Flaws Allowing Unauthenticated Root Code Execution
The post Citrix Security Vulnerabilities: Patch 9.8 CVSS
Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.
The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet a
Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.
The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President (AS2650). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period.
The proxy tracking company Synthientsaid on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into “free” mobile and desktop applications. Infatica’s founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in Arizona and Illinois in 2016.
Synthient’s depiction of the outgoing proxy traffic from the dedicated White House network (AS2650). Click to enlarge.
There are dozens of residential proxy providers with varying degrees of legitimacy, many of them based in China or Russia. But at a minimum, they all make it simple for customers to rent someone else’s internet address as a way to anonymize their web traffic or spoof their true location. From a website’s perspective, the traffic from a proxy network user appears to originate from the rented IP address, not from the proxy service customer.
Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight.
Incredibly, Infatica was not the only proxy service that reportedly has been reselling access to White House internet addresses: Layer3 Intel said it found 28 separate residential proxy services were able to exit through this network.
“This is public access,” the Layer3 Intel team wrote. “Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services.”
The White House did not immediately respond to a request for comment.
As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover and other cybercrime activity, advertising fraud, and mass content scraping for AI projects.
They can also introduce serious security risks. In late 2025, it was discovered that cybercriminals were mass exploiting a widespread vulnerability in these services that allowed them to probe each proxy endpoint’s local network for vulnerable systems to infect with malware. In January 2026, dozens of proxy services were forced to patch their networks after Synthient Founder Ben Brundage showed how cybercriminals were abusing a vulnerability in these residential proxy services to seize control over devices inside the local networks of unsuspecting users.
“Some of these resellers sell bandwidth for as low as 60 cents a Gigabyte, that means for less than a dollar you can gain access into some of the most confidential and trusted networks,” Brundage told KrebsOnSecurity. “The reseller ecosystem further enables this with any criminal able to buy access while skipping KYC [Know Your Customer] processes.”
All too often, these proxy services are beaconing out from employee devices brought into the workplace. App developers can embed software development kits (SDKs) provided by the residential proxy networks to monetize their software, allowing them to receive a small amount of money on each installation.
As risky as residential proxies can be for unsuspecting end users, they are all too commonly found on government and corporate networks. In a webinar in January 2026, the proxy tracking service Spur found residential proxies in nearly 300 government owned and operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance. In a blog post earlier this year, the security firm Infoblox said it discovered that fully 65% of its customer base was querying one or more residential proxy related domains.
Puppet Server RCE CVE-2026-115731 (CVSS 9.4) now has a public proof-of-concept exploit. Update OpenVox and Puppet Enterprise to patched versions.
Related Posts:
Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code
Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder
The post PoC Exploit and Technical Details Published for Puppet Server
The Linux 7.4 merge window reached a record 19,671 commits as Linus Torvalds highlighted early AI patches and major hardware support.
Related Posts:
OpenBSD 8.0 Release Introduces Kernel Hardening and Day-One Errata
GNOME OS Preview Brings GNOME 51.1 to the Public
Linux Assisted-by Tag Dropped for AI Patches
The post Linux 7.4 Merge Window Sets Record with AI Patches appeared first on Daily CyberSecurity.
Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root without a login or any user action. The patches are still in testing, so many servers stay open for now.
Canonical’s security team says the flaw sits in how the Linux kernel sets up IPv4 TCP connections, and it affects kernel versions 4.4 and later. The fixed builds are 5.15.0-203.213 for Jammy (22
Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root without a login or any user action. The patches are still in testing, so many servers stay open for now.
Canonical’s security team says the flaw sits in how the Linux kernel sets up IPv4 TCP connections, and it affects kernel versions 4.4 and later. The fixed builds are 5.15.0-203.213 for Jammy (22.04), 6.8.0-149.149 for Noble (24.04), and 7.0.0-43.43 for Resolute (26.04). Stonking (26.10) is already fixed in 7.3.0-10.10, and Trusty (14.04) is not affected. Fixes for Xenial, Bionic and Focal are still pending.
Release
Package
Patch status
Fixed kernel version
Trusty (14.04)
linux
Not affected
Not applicable
Xenial (16.04)
linux
Fix pending
Not yet released
Bionic (18.04)
linux
Fix pending
Not yet released
Focal (20.04)
linux
Fix pending
Not yet released
Jammy (22.04 LTS)
linux
Fix available in -proposed
5.15.0-203.213
Noble (24.04 LTS)
linux
Fix available in -proposed
6.8.0-149.149
Resolute (26.04 LTS)
linux
Fix available in -proposed
7.0.0-43.43
Stonking (26.10)
linux
Fixed
7.3.0-10.10
Canonical runs tests on more than 2,000 certified servers and devices before it moves a kernel to the updates pocket. Teams that run their own acceptance tests can install the early builds today, as described in Canonical’s new SRU strategy for faster CVE fixes.
Ubuntu’s CVE-2026-98432 tracker rates the bug 9.8, which is Critical. Its own blog post calls the same score “High,” so readers may see both labels. The record was published on October 15, 2026.
The bug is a use-after-free. In plain terms, the kernel keeps using a piece of memory after it has already let go of it. One CPU frees the IP options of a new connection. Another CPU, handling a repeated SYN packet, still reads them while building a reply. The upstream fix delays that free with kfree_rcu(), so readers finish first.
Anthropic’s Frontier Red Team shared its research on October 27, 2026. It says an unreleased Claude model wrote a working exploit after one first prompt. The exploit targets Linux servers with a multipath TCP (MPTCP) listener.
It works in two stages. First, it makes the kernel send back extra bytes that may hold a kernel pointer, which defeats KASLR, a defense that hides where kernel code sits. Second, it overwrites a callback pointer so the kernel runs a payload and ends in a shell command as root.
A lost race only fails the handshake and does not crash the machine, so the attacker can retry. In the test, the leak took 48 minutes, and the shell took five more.
Researcher Marcus Hutchins says his team has seen what looks like threat actors scanning the whole internet for affected systems. In a post on X, he reports that residential proxies and Russia-based VPN servers began probing port 443 with MPTCP connections as of November 2.
Normal scanners do not use MPTCP by default, so he strongly suspects this activity targets CVE-2026-98432. His scan on October 30 found about 2,102,043 servers reachable over MPTCP on port 443.
A deeper TLS scan found about 762,774. He says a valid HTTP request is not needed, so the true exposure is likely closer to 2.1 million. These counts show exposure only and do not prove the kernels are unpatched.
There is no public remote code execution exploit yet. Several denial-of-service proofs-of-concept do exist, and they give attackers a starting point.
Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore…
Some people assumed MPTCP listeners were rare. Hutchins points out that Debian and several other kernels enable MPTCP by default. Go 1.24 and later also bind MPTCP sockets when the kernel allows it, so tools built on Go, such as Caddy, create the needed listener.
Ubuntu emphasizes that the flaw itself is not tied to MPTCP, and the MPTCP link comes only from the Anthropic exploit. Ubuntu’s security team says updates are the only proper fix. Hutchins adds that setting net.mptcp.enabled=0 does not close sockets that are already open, so those apps must restart. You can list MPTCP listeners with sudo ss -Mlnp.
For Admins
Run uname -r and compare the result with the fixed versions above. Ubuntu’s guide to enabling the -proposed pocket explains how to pull in the new kernel, and a reboot is needed afterward. Packages in -proposed are not chosen for upgrade by default, so you must name the pocket when you install.
For hosts that cannot update yet, Ubuntu’s tracker lists an nftables rule that drops incoming IPv4 TCP packets carrying IP options. It reduces risk but does not fully prevent exploitation, and it breaks any connection that relies on IP options.
Ubuntu 20.04 LTS and older need Ubuntu Pro. Focal and Bionic fall under Expanded Security Maintenance, while Xenial and Trusty need the Legacy add-on. Ubuntu Pro is free for up to five machines.
Ubuntu has published fixes for CVE-2026-98432, a critical Linux kernel flaw in IPv4 TCP connection handling. It carries a CVSS 3.1 score of 9.8 and can lead to remote code execution. The fixes for Ubuntu 22.04 LTS and newer are in the -proposed pocket, so they are not yet in the default updates channel. Critical […]
The post Ubuntu Releases Security Fixes for Critical Linux Kernel Vulnerability Allowing Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Securi
Ubuntu has published fixes for CVE-2026-98432, a critical Linux kernel flaw in IPv4 TCP connection handling. It carries a CVSS 3.1 score of 9.8 and can lead to remote code execution. The fixes for Ubuntu 22.04 LTS and newer are in the -proposed pocket, so they are not yet in the default updates channel. Critical […]
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.
A report from the Google Threat Intelligence Group (GTIG) said Google has severed ties with Videostrong Technology Co., a TV box manufacturer in China that GTIG and other industry experts concluded was responsible for including malware that enrolled more than 1.3 million set-top boxes in a botnet dubbed “XCPE” (named after one of the malware’s core code components).
The global distribution of XCPE botnet infections. Image: Google Threat Intelligence Group.
The report said the XCPE botnet loaded the user’s device with software that makes their Internet address available for resale by multiple “residential proxy” services, which allow customers to rent Internet addresses as a way to anonymize their web traffic or spoof their true location. As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover activity, advertising fraud, and mass content scraping for AI projects.
“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” the GTIG post reads, noting that Google took legal action to take down the domains and servers Videostrong used to control the botnet and install additional malware. “A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users. Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors.”
The report notes that while TV boxes made up the the majority of the botnet, the same XCPE malware was found in other Android-based IoT products, including telehealth devices, karaoke machines, and even digital signage systems.
Google said it requires all Android device makers to pass compatibility and security tests to ensure their products don’t harm users, but that Videostrong nevertheless found a way to load their malicious software immediately after a user boots up one of these devices for the first time (Google says it has since addressed that weakness).
The GTIG report calls out a number of residential proxy providers whose software development kits were routinely downloaded by devices infected by the XCPE botnet. Those include AppSalt, also known as Honeygain, which was developed by the Vilnius, Lithuania-based Oxylabs. In October 2026, Oxylabs and Honeygain were reorganized as independent platforms under an umbrella entity called Source, which received $130 million in funding from private equity firm Warburg Pincus that reportedly valued the business at $3.6 billion.
Another provider linked to the botnet was NetNut, a once sprawling residential proxy company operated by the publicly-traded Israeli company Alarum Technologies. In July 2026, the FBI worked with industry partners to seize hundreds of domains associated with NetNut, saying the company was responsible for operating a separate botnet called Popa that enslaved TV boxes as residential proxies. Other proxy providers named in the GTIG report include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.
Google’s announcement credits a number of industry partners, including Synthient, a startup that tracks proxy providers. In January 2026, Synthient published research into the rapid spread of the Kimwolf botnet, which at the time was hammering networks worldwide with record-smashing DDoS attacks. Synthient documented how Kimwolf infected millions of Android set-top boxes virtually overnight, using a widespread vulnerability in these residential proxy services to compromise other Android-based devices inside the local networks of unsuspecting TV box users.
Synthient’s research caused dozens of residential proxy providers to patch their networks, which helped to fragment the Kimwolf botnet into much smaller pieces that made its incessant and disruptive DDoS attacks far easier for network operators to manage. It also attracted the attention of the Motion Picture Association (MPA), a trade group representing the major Hollywood studios, which partnered with Synthient to purchase and tear apart a number of popular Android TV set-top boxes — including some that were being infected by Kimwolf and other IoT botnets.
In a report published today, Synthient examined a popular, pre-infected TV box sold under the brand MECOOL by a publicly traded company in China called Skyworth Technology, concluding that MECOOL also bundled the malware from Videostrong Technology Co. and likewise installed AppSalt/Honeygain and other proxy components.
The MECOOL storefront and marketing. Image: Synthient.com.
Synthient founder Ben Brundage told KrebsOnSecurity that Videostrong’s malware also distributed software for the proxy service Grass. In our November 2025 story, “Is Your Android TV Streaming Box Part of a Botnet?” we quoted a researcher from Censys who found the popular Superbox TV streaming device bundled Grass’s residential proxy software. We also quoted the Grass founder, who denied any affiliation with the TV box maker.
That November 2025 story noted that Superbox and similar Android TV set-top boxes gain new customers primarily by engaging influencers on Tiktok and other social networks who praise the product’s ability to offer hundreds of (pirated) pay TV streaming services for a one-time fee.
Likewise, Synthient’s report observes that the MECOOL set-top boxes exploded in popularity after the product was mentioned in 2023 by the Youtube channel Linus Tech Tips, which has an audience of nearly 17 million subscribers [Linus Tech Tips said in a statement shared with Synthient that it has since updated the video to explicitly frame the product as a scam and have removed all associated affiliate links].
The popular Youtube channel Linus Tech Tips discussing MECOOL TV streaming boxes.
The GTIG report estimates the XCPE botnet takedown should sever access to at least 10 million additional compromised devices, noting that the various proxy and ad fraud affiliates of Videostrong “each have diversified distribution channels for their modules beyond XCPE.”
Synthient’s Brundage echoed that conclusion, calling the 1.3 million number “highly conservative.”
“The scale of affected devices is likely way higher,” he said. “This is probably the largest operation against backdoored TV boxes that we’ve seen.”
Update, Nov. 5, 11:07 a.m. ET: In a statement shared post-publication, Oxylabs said that while its system is built so that a device can’t be used as a proxy exit node unless they receive a signal that it has consented, the developer faked these signals.
“We have been conducting regular audits of the applications provided by our partners,” the statement reads. “However, following this incident, we will improve the application and application’s build fingerprinting logic to better detect cases where the SDK is running on an unapproved build of an originally authorized application.”
The statement said Oxylabs has no record of any company called Videostrong Technology Co., but it did find between is suppliers the domain “com.abc[.]nexus,” mentioned in the GTIG report as an external malware loader.
“As soon as we saw that, we suspended the relationship and sent them a formal legal inquiry,” the statement reads. “This supplier accounts for less than 1% of our IP address pool. We had a signed contract with them, they assured our QA team that users had given consent, and we saw the consent flow ourselves.”
OpenAI announced that ChatGPT Codex usage limits will merge under a shared token quota across Plus, Pro, and Business plans starting December 2026.
Related Posts:
ChatGPT Violence Restrictions Tighten with Teen Safeguards
AI Training Preference Standard Added to Robots.txt
Google Project Suncatcher Achieves Orbital AI Inference
The post ChatGPT Codex Usage Limits Merged Across Plans appeared first on Daily CyberSecurity.
Microsoft reveals how North Korean threat actors use tools like ARTEX. See how AI-enabled North Korean threat actors speed up cyber operations.
Related Posts:
Binance Hack Investigation Traces Historic $6.3B Breach
Polymarket Supply Chain Attack Drains Trader Wallets
Binance Hot Wallet Breach Prompts Multibillion-Dollar Inquiry
The post North Korean Threat Actors Accelerate Cyber Operations With Artificial Intelligence appeared first on Daily CyberSecurity.
Details and a Linux kernel vulnerability PoC exploit are public for CVE-2026-31419. Patch this high-severity flaw to prevent local privilege escalation.
Related Posts:
Critical MediaTek Vulnerabilities Patched in Chipsets
Critical FreePBX Vulnerabilities Patched in User Manager
Apache Wicket Fixes 19 Vulnerabilities in 8.20.0, 9.25.0 and 10.12.0
The post Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability appeared first on Daily CyberSecurity.
Details and a Linux kernel vulnerability PoC exploit are public for CVE-2026-31419. Patch this high-severity flaw to prevent local privilege escalation.
Apply the latest update to fix critical FreePBX vulnerabilities, including a 9.3 CVSS authentication bypass and privilege escalation in User Manager.
Related Posts:
Critical MediaTek Vulnerabilities Patched in Chipsets
Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability
Apache Wicket Fixes 19 Vulnerabilities in 8.20.0, 9.25.0 and 10.12.0
The post Critical FreePBX Vulnerabilities Patched in User Manager appeared first on Daily CyberSecurity.
Entrar
