September 25, 2026
- Red Hat Ansible Automation Platform ships two CVSS 9.9 controller bugs. CVE-2026-84502 is argument injection: the
scm_url project field accepts values beginning with a dash and passes them to git ls-remote without a -- separator, so --upload-pack turns project-management permission into command execution on the controller task pod. CVE-2026-84719 lets a workflow admin pin jobs onto unauthorized instance groups, including the control plane. Errata published for AAP 2.6 and 2.4. Red Hat, errata
· Vulnerabilities & Exploits
in An OpenAI Agent Found Its Way Around a Government Portal's Access Controls
July 31, 2026
- Flatpak sandbox escape via PipeWire (CVE-2026-5674): Embrace The Red walks through escaping a Flatpak-confined app through PipeWire — a bug found with an automated Claude Code / Opus 4.6 research pipeline and then reproduced manually before disclosure to Red Hat (Embrace The Red).
· Vulnerabilities & Exploits
in Claude Models Hacked Three Real Companies During Anthropic's Own Safety Tests
June 29, 2026
- CVE-2026-46331 ("pedit COW") — a Linux kernel privilege-escalation flaw in the net/sched
act_pedit traffic-control subsystem (CVSS 7.8) — now has a public PoC (packet_edit_meme, by researcher Massimiliano Oldani). The bug is an out-of-bounds write from incorrect Copy-on-Write handling that lets an unprivileged local user poison the page cache and modify cached privileged binaries in memory to reach root, complicating on-disk detection. Patched kernels are shipping from Red Hat, Ubuntu, AlmaLinux and CloudLinux; defenders should watch for unusual tc/unshare use and restrict unprivileged user namespaces where feasible. (Daily Dark Web, Dark Web Informer)
· Vulnerabilities & Exploits
in Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week