The Exploit Is Public, the Ubuntu Patch Isn't

DepthFirst released working exploit code for a Linux kernel use-after-free that escapes a container to host root, and Ubuntu’s LTS kernels still lack the fix seven weeks after it landed upstream. watchTowr’s patch diff of F5’s actively exploited BIG-IP APM zero-day shows how little it takes to reach the overflow.

Vulnerabilities & Exploits

Public exploit for an unpatched Ubuntu container escape. CVE-2026-80521 (CVSS 7.8) is a use-after-free in the Linux kernel’s AF_UNIX socket garbage collector: a race lets the collector free linked sockets while leaving a dangling pointer that the next pass follows into freed memory. It was fixed upstream on 6 August (mainline 7.2, stable 7.1.10), but Ubuntu has not shipped patches for 26.04, 24.04 or 22.04 LTS, including the cloud-optimised AWS/Azure/GCP kernels. AF_UNIX is permitted by default in Docker and Kubernetes seccomp profiles, so the path is reachable with ordinary syscalls from inside a container; DepthFirst published a working exploit targeting Ubuntu 26.04 on 22 September. No confirmed in-the-wild exploitation, and it is not in KEV (The Hacker News).
F5 BIG-IP APM CVE-2026-94127 gets its root cause. watchTowr diffed the hotfixes and found the patch simply adds size checks on the OAuth Authorization header — an oversized header drives an unauthenticated heap overflow to RCE, and only deployments where APM acts as an OAuth authorization server are affected (watchTowr Labs). F5 confirmed exploitation in the wild in its 22 September advisory; CERT-SE has issued a Swedish-language alert calling it critical and unauthenticated (CERT-SE) and CERT-EU urges immediate action (CERT-EU 2026-013) (earlier coverage).
WordPress CVE-2026-87902 moves from scanning to code execution. Patchstack saw the first malicious requests at 17:44 UTC on 22 September — recon began under five hours after 7.1.2 shipped — and traffic has since risen tenfold, with a third stage that swaps pearcmd’s config-show for config-create to write attacker-controlled files to disk. RCE needs an active theme with a top-level directory named page-* plus a readable local .php file; the official PHP Docker image and default cPanel configs on PHP before 8.5 qualify (BleepingComputer) (earlier coverage).
Arista ships VCO patches and IoCs. CVE-2026-93952 affects VeloCloud Orchestrator On-Prem where Edge-to-VCO certificate authentication is configured; exploitation requires only the public portion of the Edge certificate and network access to the VCO web interface, no tenant or operator credentials. Hosted deployments on 5.2.3.16+/6.4.2.8+ are patched, with fixes pending for 6.1.3.7 and below and 7.0.0.2 and below. Arista advises blocking 142.93.149.77 and 104.248.126.159 and grepping nginx logs for the x-vc-opt header; the CISA KEV remediation date for federal agencies is Friday 25 September (BleepingComputer).
Check Point’s older VPN bug is now being exploited too. Alongside the Management Server zero-day CVE-2026-93616, CISA added CVE-2026-85102 (CVSS 9.8) — an improper certificate-validation flaw in Security Gateway and Spark patched on 9 September — to KEV, with Check Point saying it is “now observing exploitation attempts against Check Point Spark customers globally.” BOD 26-04 gave federal agencies three days for both (SecurityWeek) (earlier coverage).
Veeam Agent for Windows LPE exploited with a public PoC. Arctic Wolf reports active exploitation of CVE-2026-32996 (CVSS 7.3), a local privilege escalation to SYSTEM; the GitHub PoC demonstrates it by running whoami and writing the output to a file (The Hacker News).
cPanel CalDAV/CardDAV flaw gives any hosting account root. cPanel lists no prerequisite beyond having an account, which on a shared server means any paying customer — or anyone with a customer’s login. Fixed in 11.134.0.57 / 11.136.0.41 / 11.138.0.8 and WP Squared 11.138.1.11, with no workaround offered; a separate WP Toolkit bug lets a logged-in user modify other accounts’ databases. No exploitation reported (The Hacker News).
FortiOS 8.0.2 appears to carry silent fixes. Kevin Beaumont says Fortinet stealth-patched a range of vulnerabilities in the release without issuing CVEs or backporting them (Kevin Beaumont).

Offensive Tradecraft & Research

CERT Polska publishes the full MikroTrick chain. CVE-2026-67279, an SSH state-machine flaw, chains with CVE-2026-86060, argument injection into /nova/bin/login, for unauthenticated full admin takeover of RouterOS — no password, key, or completed authentication. The team identified the second bug within an hour of patch diffing and handed the vendor a working PoC; log artefacts are a failed login for user -2 followed by user ops added by ssh in the same session, seen on devices restricted to SSH keys and strong-crypto. Earliest public attack logs date to 2 September, a day before the fixes (7.25beta3, 7.24.2, 7.23.4, 6.49.21). LLM agents were used to monitor forum and Reddit reports during the research (CERT Polska) (earlier coverage).
Pre-auth RCE in the legacy tac_plus TACACS+ daemon. elttam details a format-string bug plus pre-shared-key recovery against the service that authenticates admins to network gear, with patches and configuration changes as mitigations (elttam).
Process parameter poisoning as an injection primitive. The technique writes into a target’s process initialization structures rather than calling the Windows APIs EDR products hook for injection, letting the payload land without touching the monitored call path (Dark Reading).
Managed PostgreSQL superuser guardrails can be walked around. Part two of a six-part series shows the security-hardening extensions that grant temporary superuser on managed Postgres are bypassable via function-resolution tricks and procedural-language abuse, restoring full superuser (Mehmet Ince).
Free-tier GitHub Codespaces as disposable attack infrastructure. Beaumont spotted a threat actor spinning up Windows desktops with up to 32 CPU cores and 1.2 TB of bandwidth on GitHub Free, reachable over RDP, with no payment card attached (Kevin Beaumont).

Supply Chain & CI/CD

Your GitLab issue-by-email address is a non-expiring credential. Aikido found that the token embedded in the per-user incoming address is shared across every project the account can open, public or private, and never expires. Change the address suffix from -issue to -merge-request, put a target branch in the subject and attach a patch, and GitLab commits it to that branch as you — creating the branch if needed, including main — and will run CI as you if the patch edits .gitlab-ci.yml. GitLab does not verify the sender. Reach is capped by your role, and an attacker also needs the project path and numeric ID, both public for public projects (The Hacker News, Dark Reading).
Terraform providers used as a malware channel for the first time. Aikido flagged gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads) in HashiCorp’s registry plus two Go modules, delivering Go malware overlapping with the DPRK-linked Graphalgo campaign. Related npm packages take orders from an Ethereum Sepolia testnet contract, keep a second channel over Slack, and inflate download counts with GitHub Actions workers (The Hacker News) (earlier coverage).
MemTensor packages compromised on both npm and PyPI to deliver a Go implant dubbed sckit with Windows, Linux and macOS builds, per reports from Aikido, SafeDep, Socket and StepSecurity (The Hacker News).

AI-Enabled Threat Activity

CARBONATO wires an off-the-shelf agent framework into a Docker botnet. ThreatDown found an unauthenticated Docker registry exposed since May; one day of passive, read-only collection yielded 59 repositories, 234 image tags, 605 verified blobs and 4.3 GB of images spanning October 2024 to August 2026. The implant targets daemons exposed on port 2375, installs the MIT-licensed Hermes Agent unchanged, then overwrites its SOUL.md persona with a 39-line prompt telling it to take tasks over Telegram, persist and collect credentials — the same framework and persona file seen in the card-skimming operation reported this week (ThreatDown) (earlier coverage).
RemControl: an Android banking MaaS whose overlays were written by an AI assistant. Group-IB documents 30+ phishing overlay targets across Italy, France, Spain, Poland, Portugal, Canada and some GCC states, distributed through fake Play Store pages impersonating the TVTap IPTV app. The dropper blocks Play Protect via a local VPN service and generates a unique signing certificate per install; C2 is resolved through an encrypted Telegram dead-drop. The operator’s panel API documentation was exposed during analysis, and a complete AI assistant response was left verbatim in a live phishing page served to victims (Group-IB, BleepingComputer).
“Loopjacking” names the gap between what a human approved and what runs. The paper describes broken binding between approval and execution — representation mismatch at approval time, or state mutated after approval — and argues for verifying the approved action at execution and forbidding post-approval state changes (arXiv).
CERT-DK says AI bug hunters have produced a record year for patches (CERT.dk) — a trend watchTowr frames from the defender’s side in its F5 write-up, warning that LLM-generated “slop” payloads showing up in access logs are not evidence of exploitation.

Threat Activity

FBI confirms it is investigating the ShinyHunters claim. The group defaced FBIjobs.gov on Tuesday with its Pokémon mascot and posted a leak-site statement demanding the bureau retract a May public service announcement — issued after the Instructure attack — within a week or it will publish data on every agent and applicant. It supplied 5,000 sample agent records to 404 Media and other outlets, which confirmed their legitimacy; the special agent application portal remained offline Wednesday morning. The group claims 2–3 TB via a zero-day and denies swatting, sextortion and membership of The Com (The Record, SecurityWeek) (earlier coverage).
UTA0565 ran the Chrome-to-Windows chain as zero-days on 3–4 September. Volexity attributes attacks combining CVE-2026-85046 and CVE-2026-87491 in Chrome with Windows ALPC flaw CVE-2026-85880 — the BlueMoon exploit kit — delivered from fake sites imitating China Digital Times and the Center for American Progress in emails to Asian government entities. The payload, CLEANGULP, supports shell, process listing, file upload/download and beacon object file execution, and beacons to a domain typosquatting theconversation.com. Volexity assesses the kit is shared across multiple Chinese operators (The Hacker News).
ChainScript RAT rotates C2 through Polygon. Blackpoint APG documents ClickFix-style lures delivering a previously undocumented RAT under build names including ComponentTask33, UpdateDigital and OrchidViolet66, posing as Spotify, Zoom Workplace and Microsoft Teams (The Hacker News).
Google pulled a cluster of Chrome extensions that enrolled browsers into the Mellowtel scraping botnet, with Spur measuring the proxy node count falling from around 90,000 (Catalin Cimpanu).
Japan dismantles its first North Korean laptop farm. A joint international advisory ties the WaterPlum campaign to a global fake-employer scheme that infected more than 30,000 devices and stole $10.7 million in cryptocurrency (SecurityWeek) (earlier coverage).

New Tools & Releases

Analysis, YARA rules and IoCs for a DLL sideloading campaign disguised as HWMonitor — multi-stage in-memory obfuscation and encrypted payloads ending in the Blacksee Stealer, with ATT&CK mapping for hunting (GitHub).

Industry & Policy

Oxygen Forensics CEO arrested in the US for concealing the company’s Russian ownership while selling forensic software to the US government (Catalin Cimpanu).
Ryuk operator sentenced to 24 months plus three years of supervised release; the Armenian national extorted roughly $1.2 million from US victims (The Record, BleepingComputer).
Ireland’s DPC fined Google €403 million over how three features handled location data between May 2018 and February 2020, and ordered the processing brought into compliance within six months (The Hacker News).
ENISA published its Threat Landscape 2026 report (ENISA).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .