{"metadata": {"vulnerability": "CVE-2026-92574", "count": 19, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-09-16T13:40:20.528Z", "date_only": false, "value": "2026-09-16T13:40:20.528Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-92574", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-16T13:47:48.664Z", "date_only": false, "value": "2026-09-16T13:47:48.664Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat", "record": "CVE-2026-92574", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-09-21T09:00:00Z", "date_only": false, "value": "2026-09-21T09:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-92574", "field": "containers.cna.datePublic"}, {"timestamp": "2026-09-21T09:00:00Z", "date_only": false, "value": "2026-09-21T09:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat", "record": "CVE-2026-92574", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-09-21T09:49:49.679Z", "date_only": false, "value": "2026-09-21T09:49:49.679Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-92574", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-21T10:13:56.063Z", "date_only": false, "value": "2026-09-21T10:13:56.063117Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/117308498552050605", "record": "CVE-2026-92574", "field": "creation_timestamp", "uuid": "959b7b5f-09da-42ea-bbb0-a4db1ad02fdc", "content": "There is a new vulnerability with elevated criticality in Red Hat Confidential Compute Attestation and other products (CVE-2026-92574) https://vuldb.com/vuln/408086", "url": "https://infosec.exchange/users/vuldb/statuses/117308498552050605"}, {"timestamp": "2026-09-21T10:17:17Z", "date_only": false, "value": "2026-09-21T10:17:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MHQ8-392F-7M6M", "record": "GHSA-MHQ8-392F-7M6M", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-21T10:17:17.360Z", "date_only": false, "value": "2026-09-21T10:17:17.360", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92574", "record": "FKIE_CVE-2026-92574", "field": "published"}, {"timestamp": "2026-09-21T10:42:40.353Z", "date_only": false, "value": "2026-09-21T10:42:40.353481Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ewjabhrbkl5rc", "record": "CVE-2026-92574", "field": "creation_timestamp", "uuid": "3c399111-d84d-4957-93c4-6922824dedd5", "content": "CVE-2026-92574 - Cri-o: cri-o checkpoint restore bypasses destination security context\nCVE ID : CVE-2026-92574\n \n Published : Sept. 21, 2026, 9:49 a.m. | 11\u00a0minutes ago\n \n Description : A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malic...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/ewjabhrbkl5rc"}, {"timestamp": "2026-09-21T12:32:36Z", "date_only": false, "value": "2026-09-21T12:32:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MHQ8-392F-7M6M", "record": "GHSA-MHQ8-392F-7M6M", "field": "published"}, {"timestamp": "2026-09-21T12:32:36Z", "date_only": false, "value": "2026-09-21T12:32:36Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MHQ8-392F-7M6M", "record": "GHSA-MHQ8-392F-7M6M", "field": "modified"}, {"timestamp": "2026-09-21T15:35:54.906Z", "date_only": false, "value": "2026-09-21T15:35:54.906351Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-92574", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-21T15:35:54.906Z", "date_only": false, "value": "2026-09-21T15:35:54.906351Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92574", "record": "FKIE_CVE-2026-92574", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-21T15:36:29.601Z", "date_only": false, "value": "2026-09-21T15:36:29.601Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-92574", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-21T16:01:32.888Z", "date_only": false, "value": "2026-09-21T16:01:32.888045Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/4a9aae7d3d8d22be0592bc020e91d67a", "record": "CVE-2026-92574", "field": "creation_timestamp", "uuid": "30da0027-e775-4010-ae12-1d7628aa94b3", "content": "This threat intelligence briefing covers critical vulnerabilities, active malware campaigns, and emerging AI security governance:\n\n**Vulnerabilities & Advisories:** IBM released advisory AV26-943 requiring immediate patches for multiple enterprise products. Two high-severity CVEs were disclosed: CVE-2026-16651 (a DoS flaw in Temporal\u2019s SQL parser) and CVE-2026-92574 (a CRI-O checkpoint restore bypass enabling Kubernetes privilege escalation).\n\n**Active Threats:** The TASK#STOMP PowerShell backdoor is harvesting documents, Wi-Fi credentials, clipboard data, and screenshots. A sophisticated npm malware campaign evaded script defenses by hijacking core runtime functions, exfiltrated data via Slack/Telegram, used an Ethereum testnet for resilient C2, and accumulated ~2M weekly downloads.\n\n**AI & Device Security:** Five Eyes/CISA guidance recommends restricting autonomous AI agents to low-risk, non-sensitive tasks, while Orchid Security introduced identity drift detection and application-level kill-switches to govern safe AI scaling. Additional insights cover a critical disk encryption bypass in Flock ALPR cameras and security best practices for Windows 11 kiosk deployments.\n\n**Recommendation:** Organizations should apply pending patches, monitor for newly disclosed IOCs, and enforce strict identity hygiene and access controls across software supply chains and AI workloads.", "url": "https://gist.github.com/ichintu/4a9aae7d3d8d22be0592bc020e91d67a"}, {"timestamp": "2026-10-01T11:15:09.832Z", "date_only": false, "value": "2026-10-01T11:15:09.832Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-92574", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-01T11:15:09.832Z", "date_only": false, "value": "2026-10-01T11:15:09.832Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / redhat", "record": "CVE-2026-92574", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-01T12:17:16.617Z", "date_only": false, "value": "2026-10-01T12:17:16.617", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92574", "record": "FKIE_CVE-2026-92574", "field": "lastModified"}, {"timestamp": "2026-10-21T04:20:12.193Z", "date_only": false, "value": "2026-10-21T04:20:12.193306Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hugovalters/statuses/117476976359814676", "record": "CVE-2026-92574", "field": "creation_timestamp", "uuid": "5d6344f5-94ca-49f9-bfd2-0e8fd58ac2fc", "content": "CVE-2026-92574 CRI-O checkpoint restore lets a malicious pod bypass destination security context, retaining capabilities and seccomp state for privilege escalation. CVSS 8.8. Patch under review, track it and restrict untrusted checkpoints now. https://www.valtersit.com/cve/CVE-2026-92574/", "url": "https://mastodon.social/users/hugovalters/statuses/117476976359814676"}]}