Linux

IPV6_FRAG_ESCAPE: The Linux Container Escape Your CVE Scanner May Miss

IPV6_FRAG_ESCAPE is a Linux kernel 6.12 privilege escalation with public PoC code, no CVE at disclosure time, and a practical path from container user to host root.

pedit COW & DirtyClone: Two New Linux Root Exploits That Bypass On-Disk Integrity Checks

CVE-2026-46331 and CVE-2026-43503 both corrupt the Linux page cache via network subsystems to grant root — bypassing file integrity tools like AIDE and Tripwire without touching files on disk.

Quasar Linux QLNX: A Developer Workstation RAT Built for Supply Chain Access

Trend Micro documented QLNX, a Linux RAT that combines credential harvesting, LD_PRELOAD persistence, PAM backdoors, and rootkit behavior. The real risk is not one infected host - it is the supply chain access behind it.

SSH-keysign-pwn: The Nine-Year Linux Kernel Flaw

CVE-2026-46333 (ssh-keysign-pwn) is a nine-year-old Linux kernel race condition that lets an unprivileged local user steal SSH host keys and dump /etc/shadow. Root command execution is also possible on specific configurations.

Dirty Frag & Copy Fail: Two New Linux Kernel Vulnerabilities Grant Root Privileges

Two new Linux kernel vulnerabilities — Dirty Frag (CVE-2026-43284/43500) and Copy Fail (CVE-2026-31431) — enable local privilege escalation to root on nearly all major distros. What users and admins need to know.

CrackArmor: Nine AppArmor Flaws That Let Attackers Own the Kernel

Qualys TRU disclosed nine confused deputy vulnerabilities in Linux AppArmor — exposing 12.6 million servers to root escalation, KASLR bypass, and container isolation collapse. Technical deep dive and detection guide.

The Linux Server Attack Surface You Didn't Install: Default Services That Open Your System

Every major Linux distro ships services you never asked for. From snapd to CUPS to rpcbind — a practical audit guide covering Ubuntu, Debian, RHEL, Rocky, Fedora, and openSUSE.

Linux Lateral Movement: Attack Techniques and How to Detect Them

A complete guide to Linux lateral movement — SSH pivoting, ssh-agent hijacking, credential harvesting, port forwarding, and NFS abuse. Includes auditd rules, Sigma, Wazuh, and Sentinel KQL detections.

Linux Privilege Escalation: Attack Techniques and How to Detect Them

A complete guide to Linux privilege escalation — SUID abuse, sudo misconfig, cron hijacking, capabilities, and kernel exploits. Includes auditd rules, Sigma, Wazuh, and Sentinel KQL detections.

Rapid Compromise Triage: First 10 Minutes on Linux and Windows

A practical workflow for the first 10 minutes after a suspected breach — commands with explanations for Linux and Windows triage, red flags, and when to escalate.

Cookie-Controlled PHP Webshells: A Stealthy Tradecraft in Linux Hosting Environments

Microsoft's Defender team uncovered a clever attacker technique: PHP webshells that stay completely dormant until activated by a secret HTTP cookie. Here's how it works — and how to catch it.