Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week

A reliable public PoC for a Linux kernel privilege-escalation flaw headlines the day, joined by a fresh batch of red-team tooling and a critical client-side SSH bug. Threat-intel churn continued with new ransomware brands, a Turla retool against Ukraine, and an FBI warning about Signal account takeovers.

Vulnerabilities & Exploits

• CVE-2026-46331 (“pedit COW”) — a Linux kernel privilege-escalation flaw in the net/sched act_pedit traffic-control subsystem (CVSS 7.8) — now has a public PoC (packet_edit_meme, by researcher Massimiliano Oldani). The bug is an out-of-bounds write from incorrect Copy-on-Write handling that lets an unprivileged local user poison the page cache and modify cached privileged binaries in memory to reach root, complicating on-disk detection. Patched kernels are shipping from Red Hat, Ubuntu, AlmaLinux and CloudLinux; defenders should watch for unusual tc/unshare use and restrict unprivileged user namespaces where feasible. (Daily Dark Web, Dark Web Informer)
• CVE-2026-55200 in libssh2 now has a public PoC. The critical flaw (CVSS 4.0 score 9.2) lets a malicious or compromised SSH server trigger memory corruption — and possibly code execution — on a connecting client with no credentials or interaction. It affects all releases up to and including 1.11.1; note this is a client-side library, so the exposure is anything that dials out over SSH using libssh2. (The Hacker News)

New Tools & Releases

• DriverScope — an automated BYOVD hunting pipeline that scans Windows .sys drivers for dangerous imports, extracts IOCTL dispatch surfaces (Capstone), runs Speakeasy emulation, and cross-references LOLDrivers, the Microsoft blocklist, KDU and VirusTotal to surface novel vulnerable-driver candidates, with a C++ comm-header generator for runtime validation and Claude-assisted triage. (GitHub, iPurpleTeam)
• GitRunner C2 — a write-up and PoC turning self-hosted GitLab Windows CI runners into a fully functional command-and-control channel using a legitimate, signed binary, plus the Sysmon/Wazuh telemetry needed to detect it — useful for both red and purple teams. (vrls.ws)
• NebulaPulsar — a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells with encrypted payload delivery. (GitHub)
• IkeAbuser — a wrapper that automates IPSec VPN gateway enumeration, fingerprinting, transform/ID brute-forcing, PSK hash extraction and offline cracking with hashcat. (GitHub)
• An uncensored 27B “offensive security” LLM is circulating, fine-tuned on ~2,541 real bug-bounty and CVE reports and pitched as generating ready-to-run Nuclei templates, CVE PoC scripts and webshell upload bypasses with “zero refusals” — notable as another data point in the trend of purpose-built offensive models. (0x0SojalSec)
• YARA-X 1.18.0 / 1.19.0 shipped with detection improvements and bugfixes. (SANS ISC)

Supply Chain

• Researchers uncovered two hijacked npm packages and a cluster of malicious Go packages that deploy a cross-platform Python infostealer on Windows, Linux and macOS. JFrog notes the attack avoids npm lifecycle scripts — instead abusing VS Code tasks — apparently to dodge npm v12’s hardening and evade common execution-path detections. (The Hacker News)

Threat Activity

• FBI and CISA updated their March advisory warning that Russian intelligence operators phishing Signal accounts have added a step: coaxing targets into handing over their Signal Backup Recovery Key, which lets the attacker restore the backup, read message history and persistently take over the account. (The Hacker News)
• Turla has added new malware, StockStay, to Russia’s espionage campaigns against Ukraine, per Google threat researchers. (The Record)
• 119 malicious extensions were found on the official Microsoft Edge Add-ons store. (blackorbird)
• vx-underground is publicly reverse-engineering the heavily Lua-obfuscated SmartLoader campaign back to working source, with de-obfuscated code posted in a gist — handy reference for analysts tracking the loader. (vx-underground)
• A native C++ Millenium RAT 4.x malware-as-a-service, distributed via social engineering and Telegram-based C2, has reportedly infected over 62,000 Windows endpoints in 2026. (CyberInsider)
• The legitimate DCloud Uni-App toolkit is being repurposed to mass-produce investment-scam templates, powering roughly 200,000 scam sites. (SecurityWeek)
• Ransomware churn: SafePay climbed from 22 to 59 victims quarter-over-quarter (+168%) — including German logistics firm Hellmold & Plank — and RALord (Nova) jumped to 60 (+329%); new leak-site brands SETTRA (“if there is access, there is a target”) and REDACT appeared, while Qilin and PLAY added several US victims. (Ido Cohen, Dark Web Informer)
• A weekly Europe threat brief tracks pro-Russian NoName057(16) DDoS against Luxembourg’s digitalisation ministry and national railway (CFL), plus active MuddyWater, VoidBlizzard and DPRK UNC1069 (fake-Teams ClickFix) C2 infrastructure and a wave of French data leaks. (FalconFeeds)

Data Breaches & Leaks

• Nearly one million passports and photo IDs from multiple countries sat on the public internet — no password, no encryption, accessible by guessing a short URL — and remained discoverable for months before takedown, per reporting flagged by NCSC-FI. (NCSC-FI / source)
• Japanese telecom KDDI disclosed a breach of an email system shared with five other ISPs, exposing up to 14.2 million email logins. (BleepingComputer)

AI & Model Security

• Coinbase reportedly dropped OpenAI and Anthropic for open-weight Chinese models from Zhipu (GLM 5.2) and DeepSeek, citing roughly 9x lower cost for equivalent output and competitive coding benchmarks — a notable signal on enterprise AI economics and the failure of export controls to slow Chinese model quality. (Ric_RTP via cyb3rops)
• 360 founder Zhou Hongyi unveiled two AI security tools to rival Anthropic’s Mythos, claiming one has already flagged 3,432 vulnerabilities, while framing offensive AI as a “cyber-nuclear” capability China must build its own deterrent against. (The Decoder)

Regional

• A resurgent Booking.com phishing campaign is targeting hotels and their customers in sequence, using two distinct phishing kits — one harvesting hotel-business credentials, the next harvesting customer banking data — over a three-stage infection chain. (Bridewell, via NCSC-FI)