[CVE-2026-64600]

July 24, 2026

• RefluXFS (CVE-2026-64600): a nine-year-old XFS race condition gives local users root on default RHEL installs. The kernel filesystem flaw lets attackers overwrite protected files to escalate. BleepingComputer, The Hacker News. · Vulnerabilities & Exploits

in The Week AI Agents Started Doing the Hacking

July 23, 2026

• Qualys discloses local-root flaws in default Ubuntu. A snap-confine LPE (CVE-2026-8933, CVSS 7.8) grants root on default Ubuntu Desktop 24.04/25.10/26.04 installs (The Hacker News), alongside "RefluXFS" (CVE-2026-64600), a Linux kernel XFS local privilege escalation to root (Qualys). · Vulnerabilities & Exploits

in "Every Frontier Model Tried to Cheat": UK Safety Institute Puts Numbers Behind the OpenAI–Hugging Face Incident